A method and apparatus for handling a risky operation

Abstract

The application discloses a method and device for processing risk operations, and relates to the field of computers, and aims to realize management and control processing with high accuracy and without affecting the efficiency of users, so as to balance information security and user experience. The method comprises the following steps: obtaining a stack frame for recording the operation process of a process on a target object by performing IO on the target object; extracting a first feature of the stack frame content; if a second feature matching the first feature exists in a feature set recording the features of the stack frame contents of different risk operations, performing a processing operation on the process, and the processing operation is used for processing the risk operation indicated by the second feature.

Description

Technical Field

[0001] This application relates to the field of computers, and more particularly to a method and apparatus for handling risky operations. Background Technology

[0002] With the development of IT digitalization, many important assets are stored in the form of files on various terminal devices. Due to the "editable" and "transferable across different information media" characteristics of files, protecting the information security of important assets is extremely challenging. Therefore, deploying reliable and efficient control technologies at the endpoint for preventative information security protection can reduce information security risks.

[0003] Currently, the industry has proposed numerous endpoint control technologies, such as antivirus software, storage encryption, network management, and port control. Among these technologies, some are based on sample analysis, resulting in low accuracy due to fuzzy estimation; others provide general media management with overly coarse-grained protection. Both low analysis accuracy and overly coarse-grained protection can easily lead to misjudgments, impacting user efficiency. Summary of the Invention

[0004] This application provides a method and apparatus for handling risky operations, achieving high accuracy in control and processing without affecting the efficiency of users, thus balancing information security and user experience.

[0005] Firstly, a method for handling risky operations is provided. This method may include: obtaining a stack frame recording the process's operation on the target object by accessing the input / output (I / O) of the target object; extracting a first feature from the stack frame content; and if a second feature matching the first feature exists in the feature set, performing a processing operation on the process to handle the risky operation indicated by the second feature. The feature set records the features of the stack frame content for different risky operations.

[0006] The solution provided in this application allows for the determination of a process's risky operation on a target object when the extracted stack trace features match the second feature in the feature set that records the characteristics of stack frames containing different risky operations. This enables the execution of the corresponding processing operation to address the risky operation indicated by the second feature. Since the stack trace accurately records the process's operations on the target object, reflecting the actual process, the extracted stack frame features accurately indicate the process's actual operations. By accurately configuring the stack frame features for different risky operations, highly accurate risky operation judgment and control can be achieved. The high accuracy of this control process significantly reduces the probability of misjudgments, thus avoiding impacts on system user efficiency and effectively balancing information security and user experience.

[0007] One possible implementation involves performing processing operations on the process, including labeling the process's stack frame with tagging information associated with the second feature. This tagging information describes the risky operation indicated by the second feature. Implementing IO records with more detailed semantic information allows downstream systems to perform more accurate behavior recognition and control.

[0008] Another possible implementation is that the second feature indicates data outgoing operations and performs processing operations on the process, including blocking the process's I / O, which effectively ensures information security.

[0009] Another possible implementation, as described above, involves performing processing operations on the process, including sending the annotated stack frames to the driver framework layer for decision-making. Since the callbacks registered by the driver are insufficient to understand the behavior represented by IO, annotating the stack frames allows the driver framework layer to utilize the annotation information for more precise control.

[0010] Another possible implementation, as described above, involves performing processing operations on the process, further including sending the annotated stack frame to the analysis system or other devices for decision-making. This helps the analysis system or other devices achieve comprehensive and multi-faceted information security protection.

[0011] Another possible implementation is that the driver framework layer can be driven by a minifilter file.

[0012] Another possible implementation is that the aforementioned marking information may include: the identifier of the risk operation indicated by the second feature, and / or the operation content of the risk operation indicated by the second feature.

[0013] Another possible implementation is that the above operations include one or more of the following: the reason for triggering the process to operate on the target object, or whether the process I / O has semantics related to other processes.

[0014] Another possible implementation, the method provided in this application, may further include: extracting a third feature of the stack frame according to a learning strategy; and reporting the third feature. The learning strategy is used to indicate the content and data structure of the extracted features. By learning, stack features are extracted and further stored in the database to update the feature set, thereby improving the accuracy of the solution in this application.

[0015] Another possible implementation, the method provided in this application, may further include: taking over the I / O of the target object operated by the aforementioned process to achieve stack backtracking, thereby achieving precise control of the solution in this application.

[0016] Another possible implementation involves taking over the I / O operations of the target object within the aforementioned process. This includes: injecting a dynamic link library (DLL) into the process; and configuring hooks for target functions in the operating system. The target functions are operating system functions related to risky operations. I / O control is achieved by configuring these hook functions.

[0017] Another possible implementation, the method provided in this application may also include: reporting the results of the above processing operations.

[0018] Another possible implementation involves the target object mentioned above, including a file, with the corresponding I / O being file I / O.

[0019] Another possible implementation is that the target object is the network, and the corresponding IO is network IO.

[0020] Secondly, an apparatus for handling risky operations is provided, which may include: an acquisition unit, an extraction unit, and a processing unit. Wherein:

[0021] The acquisition unit is used to acquire a stack frame that records the process's operation on the target object through the process's I / O operation on the target object.

[0022] The extraction unit is used to extract the first feature of the stack frame content.

[0023] The processing unit is configured to, if a second feature in the feature set matches the first feature, perform a processing operation on the improved process. This processing operation is used to handle the risky operation indicated by the second feature. The feature set records the features of the stack frame contents of different risky operations.

[0024] The solution provided in this application allows for the determination of a process's risky operation on a target object when the extracted stack trace features match the second feature in the feature set that records the characteristics of stack frames containing different risky operations. This enables the execution of the corresponding processing operation to address the risky operation indicated by the second feature. Since the stack trace accurately records the process's operations on the target object, reflecting the actual process, the extracted stack frame features accurately indicate the process's actual operations. By accurately configuring the stack frame features for different risky operations, highly accurate risky operation judgment and control can be achieved. The high accuracy of this control process significantly reduces the probability of misjudgments, thus avoiding impacts on system user efficiency and effectively balancing information security and user experience.

[0025] One possible implementation involves the processing unit specifically annotating the process's stack frame with tagging information associated with the second feature. This tagging information describes the risky operation indicated by the second feature. Implementing IO records with more detailed semantic information allows downstream systems to perform more accurate behavior recognition and control.

[0026] Another possible implementation is that the second feature indicates the data outgoing operation, and the above processing unit is specifically used to: block the I / O of the process, which well ensures information security.

[0027] In another possible implementation, the aforementioned processing unit is further used to send the annotated stack frame to the driver framework layer for decision-making. Since the callbacks registered by the driver are insufficient to understand the behavior represented by IO, annotating the stack frame allows the driver framework layer to use the annotation information for more precise control.

[0028] In another possible implementation, the aforementioned processing unit is further used to send the annotated stack frame to the analysis system or other devices for decision-making. This helps the analysis system or other devices achieve comprehensive and multi-faceted information security protection.

[0029] Another possible implementation is that the driver framework layer can be driven by a minifilter file.

[0030] Another possible implementation is that the aforementioned marking information may include: the identifier of the risk operation indicated by the second feature, and / or the operation content of the risk operation indicated by the second feature.

[0031] Another possible implementation is that the above operations include one or more of the following: the reason for triggering the process to operate on the target object, or whether the process I / O has semantics related to other processes.

[0032] In another possible implementation, the extraction unit is further configured to: extract the third feature of the stack frame according to the learning strategy. The processing unit is further configured to: report the third feature. The learning strategy is used to indicate the content and data structure of the extracted features. By learning, stack features are extracted and further stored in the database to update the feature set, thereby improving the accuracy of the proposed solution.

[0033] In another possible implementation, the aforementioned acquisition unit is also used to: take over the I / O of the target object operated by the aforementioned process, in order to achieve stack backtracking and thus achieve precise control of the solution in this application.

[0034] Another possible implementation involves using the acquisition unit to: inject a DLL into the process; and configure hooks for target functions in the operating system. These target functions are operating system functions related to risky operations. Control over I / O is achieved by configuring hook functions.

[0035] In another possible implementation, the processing unit is also used to report the results of the above processing operations.

[0036] It should be understood that the apparatus for handling risk operations provided in the second aspect above is used to implement the method for handling risk operations described in the first aspect above or any possible implementation method. The specific implementation can refer to the first aspect above or any possible implementation method, and will not be repeated here.

[0037] Thirdly, a computing device is provided, comprising a processor and a memory. The processor is configured to execute instructions stored in the memory, causing the computing device to perform operational steps as described in the first aspect or any possible implementation thereof.

[0038] Fourthly, a computer-readable storage medium is provided, comprising: computer software instructions; when the computer software instructions are executed in a processor, causing the processor to perform operational steps of the method as described in the first aspect or any of the possible implementations above.

[0039] Fifthly, a computer program product is provided that, when run on a computer, causes the computer to perform the operational steps of the method as described in the first aspect or any of the possible implementations above.

[0040] In a sixth aspect, a chip is provided, comprising: a processor and a power supply circuit; wherein the power supply circuit is used to supply power to the processor; and the processor is used to perform operational steps of the method in the first aspect or any possible implementation thereof.

[0041] The technical effects of any of the design methods in aspects three through six can be found in the technical effects of different implementation methods in aspect one, and will not be repeated here.

[0042] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods. Attached Figure Description

[0043] Figure 1 A schematic diagram of the architecture of a computer system provided in this application embodiment;

[0044] Figure 2 This is a schematic diagram of the structure of a computing device provided in an embodiment of this application;

[0045] Figure 3 A flowchart illustrating a method for handling risky operations provided in an embodiment of this application;

[0046] Figure 4This is a schematic diagram illustrating the I / O relationship between a target process and an operating system, provided as an embodiment of this application.

[0047] Figure 5 A flowchart illustrating another method for handling risky operations provided in this application embodiment;

[0048] Figure 6 This application provides a schematic diagram illustrating a process by which a computing device takes over the I / O of a target process.

[0049] Figure 7 A flowchart illustrating a control scenario for an embodiment of this application;

[0050] Figure 8 A flowchart illustrating a solution from this application in a learning scenario, provided as an embodiment of this application;

[0051] Figure 9 This is a schematic diagram of an application scenario provided by an embodiment of this application;

[0052] Figure 10 This is a schematic diagram of a device for handling risky operations provided in an embodiment of this application. Detailed Implementation

[0053] In the description of this application, unless otherwise stated, " / " indicates that the objects before and after are in an "or" relationship. For example, A / B can mean A or B. "And / or" in this application is merely a description of the relationship between the related objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. A and B can be singular or plural.

[0054] In the description of this application, unless otherwise stated, "multiple" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0055] Furthermore, to facilitate a clear description of the technical solutions in the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first" and "second" do not limit the quantity or execution order, and the terms "first" and "second" are not necessarily different.

[0056] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of terms such as "exemplary" or "for example" is intended to present the relevant concepts in a specific manner to facilitate understanding.

[0057] It is understood that the term "embodiment" used throughout the specification means that a specific feature, structure, or characteristic related to an embodiment is included in at least one embodiment of this application. Therefore, various embodiments throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in multiple embodiments. It is understood that in the various embodiments of this application, the sequence number of each process does not imply the order of execution; the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0058] It is understood that some optional features in the embodiments of this application can be implemented independently in certain scenarios without relying on other features, such as the current solution on which they are based, to solve the corresponding technical problems and achieve the corresponding effects. Alternatively, they can be combined with other features as needed in certain scenarios. Correspondingly, the apparatus given in the embodiments of this application can also implement these features or functions, which will not be elaborated here.

[0059] In this application, unless otherwise specified, the same or similar parts between the various embodiments can be referred to each other. In the various embodiments of this application, unless otherwise specified or logically conflicting, the terminology and / or descriptions between different embodiments are consistent and can be mutually referenced. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships. The following descriptions of the embodiments of this application do not constitute a limitation on the scope of protection of this application.

[0060] For ease of understanding, the main terms used in this application are explained below.

[0061] A program is a static set of instructions. A program can contain program code, data, and a process control block (PCB) structure.

[0062] A process is a dynamically executing instance of a program. It is a dynamic set of instructions running in the system. The process is the basic unit for resource allocation in the system and is fundamental to the operating system structure.

[0063] Data loss prevention (DLP) is a strategy that uses technical means to prevent designated data or information assets of an enterprise from being leaked out of the enterprise in a manner that violates security policy regulations.

[0064] Currently, in scenarios involving end-user file protection, the industry typically employs one or more technologies in combination, such as antivirus software, content detection, storage encryption, network management, port control, and artificial intelligence (AI), to achieve predetermined information security protection goals.

[0065] Antivirus software solutions identify virus file characteristics and delete or isolate the virus's environment before it runs. However, this approach only prevents virus attacks and cannot prevent human-caused information leaks, resulting in low accuracy in control.

[0066] Content detection solutions configure a sample library of important assets (such as content fingerprints or images), and identify and label important files or data by referring to this sample library. However, using file content as the reference for identification and control cannot accurately distinguish between normal and risky operations on files, which can easily lead to misjudgments and affect the normal usage efficiency of the system.

[0067] Storage encryption schemes encrypt target storage media at the file or other granular level, ensuring that target files can only be decrypted under authorized conditions. This approach provides general management of storage media, but its coarse-grained protection fails to accurately distinguish between normal and risky operations on files within the target storage media itself, easily leading to misjudgments and impacting system user efficiency.

[0068] Network control solutions monitor and manage network egress points based on traffic or other rules. However, overly coarse-grained protection cannot accurately identify risky operations.

[0069] Port control schemes restrict the use of external storage or communication devices based on processes or data. However, excessively coarse-grained protection fails to accurately identify risky operations.

[0070] AI solutions refer to using AI as an engine to optimize strategies, anomaly detection, or samples, and to improve the accuracy of control measures in conjunction with other control measures.

[0071] For example, a management and control scheme that combines storage encryption and port control is a device management technology that achieves information security protection through general management of storage media. However, this scheme provides overly coarse-grained protection, significantly impacting the efficiency of other user services.

[0072] For example, a control solution combining antivirus software, content detection, network management, and AI is a sample analysis-based control technology. This sample analysis is generally a fuzzy estimate, and its accuracy is often insufficient to meet the needs of information security professionals, easily leading to erroneous events. This not only affects the efficiency of all parties involved but also usually requires manual verification, making it difficult to automate post-incident processing.

[0073] Based on this, this application provides a method for handling risky operations. By taking over the I / O of a process operating on a target object, performing stack frame backtracking, obtaining stack frames that record the process's operation on the target object, and extracting features. When the features of the extracted stack frame content match the feature set used to record the stack frame content of different risky operations, it is determined that the process has performed a risky operation on the target object, and corresponding processing operations are performed on the process to handle the risky operation. Since the stack accurately records the process's operation on the target object, reflecting the actual operation process, the extracted stack frame features can accurately indicate the process's actual operation. As long as the stack frame features of different risky operations are configured accurately, highly accurate risky operation judgment and control processing can be achieved. Because the control process of this solution has high accuracy, it can greatly reduce the probability of control misjudgment, thus avoiding impacting the efficiency of system users and effectively balancing information security and user experience.

[0074] The method for handling risky operations provided in this application can be applied to... Figure 1 An example of a computer system. (e.g.) Figure 1 As shown, the computer system includes a terminal device 101, a storage subsystem 102, and a background database 103.

[0075] The storage subsystem 102 stores data. The terminal device 101 is used to access the data in the storage subsystem 102. For example, the terminal device 101 can be used to access data in the storage subsystem. Information security protection programs (such as the solution provided in this application, which can be deployed in the terminal device 101 as an application) can be deployed in the terminal device 101 to achieve information security protection for the storage subsystem 102. The background database 103 provides data support for the terminal device 101.

[0076] For example, terminal device 101 can be an edge device running an operating system (OS). This operating system can be... Or other operating systems. For example, the terminal device can be a personal computer (PC), mobile phone, tablet computer, embedded device, or other form, which is not limited in the embodiments of this application.

[0077] The storage subsystem 102 can be a storage platform built on one or more servers, which can be physical servers, cloud servers, or other types of servers. The storage subsystem 102 can be deployed centrally, in a cluster, or using other deployment methods. This application embodiment does not limit these methods. For example, the storage subsystem 102 can be an internal backend server for an enterprise.

[0078] The backend database 103 can be deployed separately, or integrated into the storage subsystem 102, or into the terminal device 101. This application embodiment does not limit this.

[0079] certainly, Figure 1 The illustrated computer system's size and contents can be configured according to actual needs. Figure 1 The illustrations are for illustrative purposes only and do not constitute specific limitations.

[0080] The following is combined with Figure 2 ,by Figure 1 The terminal device 101 shown is a computing device, and the internal structure of the device is illustrated by example.

[0081] Please refer to Figure 2 This is a schematic diagram of a computing device provided in this application. This computing device can... Figure 2 The diagram illustrates terminal device 101 in a computer system.

[0082] like Figure 2 As shown, the computing device may include a processor 2010, a bus 2020, a memory 2030, and a communication interface 2040. The processor 2010, memory 2030, and communication interface 2040 are connected via the bus 2020.

[0083] It should be understood that in this embodiment, the processor 2010 may be a central processing unit (CPU), but it may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0084] The processor 2010 may also be a GPU, NPU, microprocessor, ASIC, or one or more integrated circuits used to control the execution of programs according to the present application.

[0085] The communication interface 2040 is used to enable communication between the computing device and external devices or components.

[0086] Bus 2020 is used to transfer information between the aforementioned components (such as processor 2010 and memory 2030). In addition to the data bus, bus 2020 may also include power buses, control buses, and status signal buses. However, for clarity, all buses are labeled as bus 2020 in the diagram. Bus 2020 can be a peripheral component interconnect express (PCIe) bus, or an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cachecoherent interconnect for accelerators (CCIX), etc. It is worth noting that... Figure 2 Taking a computing device comprising one processor 2010 and one memory 2030 as an example, the processor 2010 and memory 2030 are used to indicate a type of device or equipment. In a specific embodiment, the number of each type of device or equipment can be determined according to business requirements.

[0087] The memory 2030 can be a pool of volatile memory or a pool of non-volatile memory, or it can include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0088] For example, the processor 2010 can perform the following functions by running or executing software programs and / or modules stored in the memory 2030:

[0089] By performing I / O operations on the target object, the process's stack frame is obtained. The stack frame records the process's operations on the target object. A first feature is extracted from the stack frame content. If a second feature matching the first feature exists in the feature set, a processing operation is performed on the process. The processing operation addresses the risky operation indicated by the second feature. The feature set records the characteristics of the stack frame content for different risky operations.

[0090] The method for handling risk operations provided in this application will be described in detail below with reference to the accompanying drawings.

[0091] This application provides a method for handling risky operations. This method can be executed by a computing device, an application deployed on the computing device, or other means. The following embodiments of this application describe execution via a computing device as an example and do not constitute a specific limitation on the executing entity. The computing device manages the target device by executing the scheme of this application to achieve information security protection for the target device. The target device can be the computing device or other devices, and is not limited thereto.

[0092] In the scheme of this application, the computing device performs the same operation on different processes. In the following embodiments, a process is used as an example to describe the process by which the computing device processes the operation of the process. Other examples will not be described in detail.

[0093] like Figure 3 As shown, the method for handling risky operations provided in this application embodiment may include:

[0094] S301. The computing device obtains the stack frame of the process by operating the I / O of the target object through the process.

[0095] This process refers to a process running on the target device managed by the computing device.

[0096] In one possible implementation, all processes in the target device can be managed to achieve comprehensive information security protection for the target device, and the process can be any process running in the target device.

[0097] In another possible implementation, high-risk processes are configured according to actual needs, and these processes are monitored and managed to achieve information security protection for the target device. Accordingly, the process described in S301 can be any monitored process running on the target device.

[0098] In this context, process operation on target object I / O refers to the process of interaction between a process and a target object in the operating system (OS).

[0099] Furthermore, the target object mentioned above refers to the subject that the process operates on, and the specific content of this subject can be configured according to actual needs. For example, the target object may include: a file, or a network.

[0100] For example, if the target object is a file, the above I / O can be file I / O. Or, if the target object is a network, the above I / O can be network I / O. Of course, the target object can also be other types of entities, and the above I / O corresponds to the type of the target object.

[0101] Specifically, stack frames are used to record the process's operations on the target object.

[0102] For example, a stack frame can be a memory region allocated on the stack during a function call to store all information about the current function. Whenever a function is called, the operating system allocates a new stack frame for that function; when the function finishes execution, the corresponding stack frame is destroyed. Of course, the stack frame described in this application can also be anything other than a stack frame; anything used to record the process's operations on the target object can be understood as a stack frame as described in this application. It should be understood that obtaining the process's stack frame in S301 can mean obtaining the content recorded in the process's stack frame.

[0103] For example, the stack frame can record the module name, offset, module order, and jump relationship of the I / O stack.

[0104] Specifically, the solution provided in this application can be injected into the target process to be managed (i.e. the process processed in the solution of this application) in the form of a plugin, so as to take over the process's operation of the target object's IO, perform stack frame backtracking, and thus realize the S301 process.

[0105] For example, Figure 4 This illustrates the I / O relationship between the target process and the operating system. For example... Figure 4 As shown in (a) above, the I / O relationship between the target process and the operating system is illustrated; as Figure 4 As shown in (b) in the figure, the I / O relationship between the target process and the operating system is illustrated after the solution of this application is injected into the target process in the form of a plug-in, which realizes that the plug-in captures and takes over the I / O of the target process.

[0106] S302, The computing device extracts the first feature of the stack frame content.

[0107] Specifically, since the content recorded in the stack frame indicates the process's operation on the target object, the first feature of the extracted stack frame content is to describe the process's operation on the target object in the form of features.

[0108] In one possible implementation, the content of the stack frame is in the form of code, and the first feature is extracted from the content of the stack frame by an analyzer, debugger, disassembler, or other means.

[0109] In another possible implementation, the position of the feature in the frame stack is pre-configured, and the content at the configured position is extracted in S302 as the first feature.

[0110] Of course, the method for extracting the first feature can be configured according to actual needs, and this application embodiment does not limit this.

[0111] Furthermore, the features in the feature set indicate the content and format of the effective features or other information, and the first feature of the stack frame content can be extracted according to the content of the features in the feature set.

[0112] The feature set records the characteristics of the stack frame content for different risky operations. A risky operation refers to an operation that poses a risk to information security protection. The content of risky operations can be configured according to actual needs; this application embodiment does not limit this.

[0113] For example, if the target object is a file, the risky operation can be configured as an outbound operation, a cache operation, or one or more other operations.

[0114] In one possible implementation, a corresponding background feature library is configured for the computing device to synchronize feature sets with it. Accordingly, the computing device can obtain the feature set from the background feature library. After the feature set recorded in the background feature library is updated, the background feature library synchronizes the feature set with the computing device. The feature combinations recorded in the background feature library can be updated through deep learning and / or manual configuration, or other methods.

[0115] In another possible implementation, the computing device internally records the feature set, which can be updated by the computing device itself through deep learning and / or manual configuration, or other means.

[0116] S303. The computing device compares the first feature with the features in the feature set.

[0117] In S303, the computing device compares the first feature extracted in S302 with each feature in the latest feature set to determine whether a feature in the feature set matches the first feature. Here, mutually matching features refer to features that indicate the same process operation content. The definition of matching can be configured according to actual needs; this embodiment does not limit this.

[0118] For example, two completely identical features are defined as two mutually matching features.

[0119] Alternatively, for example, two features whose distance is less than or equal to a threshold are defined as mutually matching features. This distance can be similarity, semantic distance, or other parameters, which are not limited in this embodiment.

[0120] Furthermore, if it is determined in S303 that there is no feature in the feature set that matches the first feature, then the operation performed by the target process on the target object can be determined to be a safe operation, and the current process can be terminated. If it is determined in S303 that there is a second feature in the feature set that matches the first feature, then the operation performed by the target process on the target object is determined to be the same operation as the risky operation indicated by the second feature, and therefore also a risky operation, and the operation in S304 is further executed.

[0121] S304. If a second feature that matches the first feature exists in the feature set, the computing device performs a processing operation on the process, which is used to handle the risk operation indicated by the second feature.

[0122] Specifically, this processing operation is used to handle the risky operation indicated by the second feature, which can be understood as corresponding to or related to the second feature. This processing operation can avoid or resolve the risky operation indicated by the second feature, or it can facilitate other devices or systems to avoid or resolve the risky operation indicated by the second feature.

[0123] For example, the computing device can record the processing operations corresponding to different features to support the implementation of S304. The correspondence between features and processing operations can be synchronized to the computing device by other devices for recording, or it can be directly configured inside the computing device by the administrator, or it can be learned and recorded by the computing device itself. This application embodiment does not limit this.

[0124] Furthermore, different handling procedures can be adopted for different risk operations, and this application does not specifically limit the content of the handling procedures. The following describes the content of centralized handling procedures through examples:

[0125] Processing operation 1: Mark the stack frame of the process.

[0126] Specifically, the stack frames of the process are labeled with marking information, which describes the risky operation indicated by the second feature. The correspondence between the feature and the marking information can be recorded by other devices synchronizing to the computing device, or it can be directly configured within the computing device by the administrator, or it can be learned and recorded within the computing device itself. This application embodiment does not limit this. For example, the correspondence between the marking information and the second feature can be included in the aforementioned feature set, and is not limited thereto.

[0127] For example, the tagging information may include: the identifier of the risky operation indicated by the second feature, and / or the operation content of the risky operation indicated by the second feature.

[0128] One of the risk operation identifiers is used to uniquely identify the operation. It can be a string or other form. This application embodiment does not limit this, as long as it is uniquely identifiable in the entire system.

[0129] The content of a risk operation indicates the specific details of the risk operation, and the content of the risk operation can be configured according to actual needs without limitation. For example, the operation content of a risk operation may include one or more of the following: the reason for triggering the target process to operate on the target object, or whether the target process's I / O has semantics related to other processes.

[0130] For example, assuming the target object is a file, the reason that triggers the target process to operate on the target object could be: whether the user manually opened the file or the program opened the file spontaneously.

[0131] Accordingly, the specific implementation of S304 corresponding to processing operation 1 can be: marking the stack frame of the target process with the marking information associated with the second feature, which is used to describe the risky operation indicated by the second feature.

[0132] In another possible implementation, processing operation 1 can also be replaced by labeling the process or the process's I / O. The content of the label can be referred to the above content and will not be repeated here.

[0133] Operation 2: Block I / O.

[0134] For outbound operations, the corresponding processing operation can be to block I / O and prevent the file from being sent out.

[0135] Accordingly, the specific implementation of S304 corresponding to processing operation 2 can be: blocking the target process's I / O to the target object.

[0136] Operation 3: Send the labeled stack frame to the driver framework layer for decision-making.

[0137] Since the callbacks registered by the driver framework layer are insufficient to understand the behavior of IO representatives, processing operation 3, based on the above processing operation 1, utilizes the tagging information to help the driver framework layer achieve more precise control. The process by which the driver framework layer makes decisions based on the tagging information is not limited in the provided embodiments.

[0138] Furthermore, the driving framework layer can be selected according to actual needs, and this embodiment does not limit this. For example, if the target object is a file, the driving framework layer can be a minifilter file driver, and the annotated stack frame can be sent to the minifilter for secondary decision-making via ioctl.

[0139] Processing operation 4: Send the labeled stack frame to other systems or devices for information security analysis and protection.

[0140] It should be understood that the processing operations corresponding to the features can be configured according to actual needs. The processing operations exemplified above are for illustrative purposes only. In practical applications, one or more processing operations can be selected and combined as the processing operations in the actual application. Different processing operations can be configured for different risk operations. The relationship between processing operations and the stack frame features of risk operations, or the relationship between processing operations and the tagging information of risk operations, can be managed. The corresponding processing operation can be determined based on the tagging information.

[0141] The solution provided in this application allows for the determination of a process's risky operation on a target object when the extracted stack trace features match the second feature in the feature set that records the characteristics of stack frames containing different risky operations. This enables the execution of the corresponding processing operation to address the risky operation indicated by the second feature. Since the stack trace accurately records the process's operations on the target object, reflecting the actual process, the extracted stack frame features accurately indicate the process's actual operations. By accurately configuring the stack frame features for different risky operations, highly accurate risky operation judgment and control can be achieved. The high accuracy of this control process significantly reduces the probability of misjudgments, thus avoiding impacts on system user efficiency and effectively balancing information security and user experience.

[0142] In scenarios where the target object is a file, the solution proposed in this application can achieve secure file operations and secure file transfer.

[0143] Furthermore, such as Figure 5 As shown, the method for handling risky operations provided in this application embodiment may further include operation S305, which reports the processing result and / or matching result to the server backend, whereby the server backend records or further processes the data to achieve secure data transfer.

[0144] S305, Calculate the results reported by the computing device.

[0145] Specifically, the computing device can report the results of the processing operation in S304 and / or the comparison and matching results in S303. The content of the risk-handling operation is transmitted to upstream and downstream processes via the reporting method in S305.

[0146] Furthermore, the following example illustrates the process by which the computing device takes over the I / O of the target process as described in S301. This process can be entered into... Figure 6 As shown, it includes the following steps:

[0147] S601. Inject the DLL into the target process.

[0148] Specifically, S601 can be implemented using DLL injection technology. This application embodiment does not limit the specific content of the DLL injection technology. For example, the DLL injection technology can be remote thread injection technology.

[0149] S602, Configure hooks for target functions in the operating system.

[0150] The objective function is a function related to the operating system and risky operations, also known as a critical function. The objective function can be selected and configured according to actual needs; this application does not limit this selection.

[0151] For example, when the target object is a file, the target function in the Windows system may include the application programming interface (API) illustrated in Table 1.

[0152] Table 1

[0153] CreateFileA CreateFileW CreateFile2 OpenFile _lopen _lcreat NtCreateFile ZwCreateFile NtOpenFile ZwOpenFile fopen _wfopen _fsopen _wfsopen

[0154] Specifically, S602 can be implemented using hook technology. For example, the hook technology can be the MIT-licensed open-source version of detours or other hook technologies. This application embodiment does not limit the hook technology used to implement S602.

[0155] API hooking technology is used to manage calls to these target functions. When these functions are called, the hook function is activated. Within the hook function, stack frame backtracking can be performed to obtain the current process's call history.

[0156] S603, The computing device obtains the I / O of the target process to be distributed.

[0157] Because the hook function performs stack frame backtracking to obtain the current process's call, the I / O of the target process's operation on the target object is distributed to the computing device. Then, the above S601 to S603 processes can be executed to handle risky operations and achieve information security protection.

[0158] Furthermore, the solution provided in this application embodiment, after taking over the I / O of the target process, in Figure 3 Based on the illustrated methods for handling risk operations (control scenarios), such as Figure 5 As shown, it also includes processes S306 and S307, which are processes that learn and update the feature set to enhance the program's capabilities and supplement itself with more stack frame feature data. This process can be called the learning scenario.

[0159] S306. According to the learning strategy, the computing device extracts the third feature of the stack frame.

[0160] The learning strategy is used to indicate the content and data structure of the extracted features. The learning strategy can be pre-configured or synchronously distributed by a background model library managed by the computing device. This application does not limit the method by which the computing device obtains the learning strategy.

[0161] Specifically, in S306, the computing device extracts features from the stack frame content of the target process as a third feature, according to the content and data structure indicated by the learning strategy. The specific techniques for feature extraction can be found in the description of S302 above, and will not be repeated here.

[0162] S307, The computing device reports the third feature.

[0163] Specifically, the purpose of the computing device reporting the third feature is to synchronize the third feature to the feature set.

[0164] In one possible implementation, the feature set is distributed and synchronized from the background feature library to the computing device. In S307, the computing device reports the third feature to the background feature library, which reviews and stores it in the library and synchronizes it to the computing device.

[0165] In another possible implementation, the feature set is directly configured in the computing device. In S307, the computing device can report the third feature to its own storage device and record the third feature in the feature set.

[0166] Optionally, the system corresponding to this application's solution can be configured with a control mode and a learning mode. In control mode, the processes in control scenarios S301 to S304 are executed; in learning mode, the processes in learning scenarios S306 and S307 are executed. The mode can be switched by the user of the computing device, or by the administrator of the system to which the computing device belongs. This mode switching can be manual, automatically at a preset time, or implemented using other strategies; this application's embodiments do not limit this.

[0167] The following specific examples illustrate the solution of this application. In these examples, the target object is a file, and the purpose of information security protection is to identify users' outgoing file operations and execute corresponding measures. The solution provided in this application is deployed on a terminal, and a server-side backend is configured on the terminal, including a backend stack frame feature library, a backend analysis library, and a backend learning model library. The solution of this application is illustrated as a distribution system in the following examples.

[0168] Example 1: Control Scenario

[0169] Figure 7This illustrates the process of the proposed solution in a control scenario. For example... Figure 7 As shown, the distribution system of this application is injected into the target process as a plugin. The server-side backend synchronizes the feature set with the analysis system through a backend stack frame feature library. When the analysis system is in "control mode," it automatically takes over the target process's I / O, performs stack frame backtracking, and obtains the stack frame content of the target process. Then, according to the feature set pre-distributed by the server, it analyzes and extracts the features of the stack frame content from the target process's stack frames. For example, based on the nature of the program distribution version, the module name, offset, module order, and jumps of its I / O stack are used as feature conditions to analyze and extract the features of the stack content from the target process's stack frames.

[0170] The extracted features are compared with features in the feature set. If an extracted feature matches a feature 'a' in the feature set, the target process's I / O can be interpreted as the same operation as feature 'a'. The target process's stack frame is then annotated accordingly (marking the information corresponding to feature 'a'), and processing is performed based on the annotation. This processing can refer to the process described in S304 above. For example, an ioctl call can be sent to a minifilter (the filtering driver framework) for secondary decision-making. Alternatively, the annotation information can be used to directly block the current I / O. Finally, the processing result is reported to the backend analysis library for risk management.

[0171] Example 2: Learning Scenario

[0172] This scenario is used to enhance the program's capabilities by supplementing it with more stack feature data. Figure 8 This illustrates the workflow of the proposed solution in a learning scenario. For example... Figure 8 As shown, the distribution system of this application is injected into the target process as a plugin. The server-side backend synchronously learns the model (used to indicate the content and data structure for feature extraction) from the analysis system through a backend learning model library. For example, based on the nature of the program release version, the module name, offset, module order, and jumps of its IO stack are used as the learning model. When in "learning mode", the distribution system automatically takes over the target's IO, performs stack frame backtracking, and obtains the stack frame content of the target process. Then, combined with the learning model, it extracts the key stack features of the target process, extracts the original semantics of IO into a binary format of (stack features, tag information), and uses it as the learning result. This learning result is then reported to the backend for further verification and storage in the backend analysis library in the server-side backend. After storage, it can be used in management scenarios.

[0173] Example 3:

[0174] The aforementioned Examples 1 and 2 demonstrate the implementation of an independent distribution detection system using the solution provided in this application. In Example 3, the tagging information can be used to integrate the system into other complete systems or solutions (analysis systems outside this system) to build a larger information security database and construct a security protection system from multiple perspectives.

[0175] Figure 9 This illustrates the application scenario of the proposed solution. For example... Figure 9 As shown, the distribution system of this application is injected into the target process as a plugin. The server-side backend synchronizes the feature set with the analysis system through the backend stack frame feature library. When the analysis system is in "control mode", it automatically takes over the target process's I / O, performs stack frame backtracking, and obtains the stack frame content of the target process. Then, according to the feature set pre-distributed by the server, it analyzes and extracts the features of the stack content from the target process's stack frame. The extracted features are compared with the features in the feature set. When the extracted feature matches a feature b in the feature set, the target process's I / O can be interpreted as the same operation as feature b, and the target process's stack frame can be marked accordingly (marking the tag information corresponding to feature b). The marking result is then transmitted to the analysis system outside this system. Finally, the matching result is reported to the backend analysis library for risk management.

[0176] The foregoing mainly describes the solution provided in this application. Accordingly, this application also provides an apparatus for handling risky operations, which is used to execute the solution in the above method embodiments.

[0177] In some embodiments, the apparatus for handling risky operations includes hardware structures and / or software modules corresponding to the execution of each function in order to achieve the above-described functions. Those skilled in the art will readily recognize that, based on the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein, this application can be implemented in hardware or a combination of hardware and computer software. Whether a function is executed in hardware or by computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0178] This application embodiment can divide the device for handling risky operations into functional modules according to the above method embodiment. For example, each function can be divided into a separate functional module, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or as a software functional module. It should be noted that the module division in this application embodiment is illustrative and only represents one logical functional division. In actual implementation, there may be other division methods.

[0179] On one hand, embodiments of this application provide an apparatus 100 for handling risky operations, which is used to implement the functions of the computing device in the above-described method embodiments. For example... Figure 10 As shown, the apparatus 100 for handling risky operations may include an acquisition unit 1001, an extraction unit 1002, and a processing unit 1003.

[0180] The acquisition unit 1001 is used to perform Figure 3 or Figure 5 The illustrated method shows the operation of S301. The extraction unit 1002 is used to perform... Figure 3 or Figure 5 The illustrated method involves the operation of S302, or... Figure 5 The schematic diagram illustrates the operation of S306. Processing unit 1003 is used to execute... Figure 3 or Figure 5 The illustrated method includes operations S303 and / or S304, or... Figure 5 The operation of S305, S306 or S307 is illustrated.

[0181] Furthermore, embodiments of this application provide a computer system, including a storage subsystem and an analysis and management system. The storage subsystem is used to store data, and the analysis and management system is used to perform the aforementioned operations. Figure 3 or Figure 5 The method is illustrated.

[0182] Furthermore, embodiments of this application also provide a computer program product containing instructions. The computer program product may be a software or program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to perform some or all of the operational steps of the method in the above method embodiments.

[0183] Furthermore, embodiments of this application also provide a computer-readable storage medium. The computer-readable storage medium can be any available medium capable of being stored by a computing device, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to perform some or all of the operational steps of the method in the above-described method embodiments.

[0184] Furthermore, embodiments of this application also provide a chip, including a processor and a power supply circuit. The power supply circuit supplies power to the processor; the processor executes some or all of the operational steps of the method described in the method embodiments.

[0185] The method steps in this embodiment can be implemented in hardware or by a processor executing software instructions. The software instructions can consist of corresponding software modules, which can be stored in RAM, flash memory, ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, portable hard disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor, enabling the processor to read information from and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and storage medium can reside in an ASIC. Alternatively, the ASIC can reside in a computing device. Of course, the processor and storage medium can also exist as discrete components in the computing device.

[0186] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially in the form of a computer program product. The computer program product includes one or more computer programs or instructions. When the computer program or instructions are loaded and executed on a computer, the processes or functions described in the embodiments of this application are performed entirely or partially. The computer can be a general-purpose computer, a special-purpose computer, a computer network, a network device, a user equipment, or other programmable device. The computer program or instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another. For example, the computer program or instructions can be transferred from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium, such as a floppy disk, hard disk, or magnetic tape; it can also be an optical medium, such as a digital video disc (DVD); or it can be a semiconductor medium, such as a solid-state drive (SSD). The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for handling risky operations, characterized in that, The method includes: By manipulating the input / output I / O of the target object through process operations, the stack frame of the process is obtained, and the stack frame is used to record the process of the process operating on the target object; Extract the first feature of the stack frame content; If a second feature that matches the first feature exists in the feature set, a processing operation is performed on the process. The processing operation is used to handle the risky operation indicated by the second feature. The feature set records the features of the stack frame contents of different risky operations.

2. The method according to claim 1, characterized in that, The processing operation performed on the process includes: The stack frame is labeled with tagging information associated with the second feature, and the tagging information is used to describe the risky operation indicated by the second feature.

3. The method according to claim 1 or 2, characterized in that, The second feature indicates an outgoing data operation, and the processing operation performed on the process includes: blocking the I / O.

4. The method according to claim 2, characterized in that, The process processing operation further includes sending the annotated stack frame to the driver framework layer or analysis system for decision-making.

5. The method according to claim 2, characterized in that, The marking information includes: The identifier of the risk operation indicated by the second feature, and / or the operation content of the risk operation indicated by the second feature.

6. The method according to claim 5, characterized in that, The operation content includes one or more of the following: the reason for triggering the process to operate on the target object, or whether the process I / O has semantics related to other processes.

7. The method according to any one of claims 1-6, characterized in that, The method further includes: According to the learning strategy, the third feature of the stack frame is extracted; the learning strategy is used to indicate the content and data structure of the extracted features. The third feature mentioned above shall be reported.

8. The method according to any one of claims 1-7, characterized in that, The method further includes: Inject the dynamic link library (DLL) into the process; Configure hooks for target functions in the operating system, where the target functions are functions of the operating system related to risky operations.

9. The method according to any one of claims 1-8, characterized in that, Report the results of the aforementioned processing operations.

10. The method according to any one of claims 1-9, characterized in that, The target object includes: a file, or a network.

11. An apparatus for handling risky operations, characterized in that, The device includes: The acquisition unit is used to acquire the stack frame of the process by means of the input / output I / O of the process operating the target object, and the stack frame is used to record the process of the process operating the target object; Extraction unit, used to extract the first feature of the stack frame; The processing unit is configured to perform a processing operation on the process if a second feature matching the first feature exists in the feature set, wherein the processing operation is used to process the risky operation indicated by the second feature; the feature set records the features of the stack frame contents of different risky operations.

12. A computing device, characterized in that, The computing device includes a processor and a memory; The processor is configured to execute instructions stored in the memory to cause the computing device to perform the operational steps of the method as described in any one of claims 1 to 10.

13. A computer program product, characterized in that, The instruction includes instructions that, when executed by a computing device, cause the computing device to perform the operational steps of the method as described in any one of claims 1 to 10.

14. A computer-readable storage medium, characterized in that, It includes computer program instructions, which, when executed by a computing device, cause the computing device to perform the operational steps of the method as described in any one of claims 1 to 10.

Images