CN114003912A - Lasso program identification method and device, computer equipment and storage medium - Google Patents

Lasso program identification method and device, computer equipment and storage medium Download PDF

Info

Publication number
CN114003912A
CN114003912A CN202111355996.4A CN202111355996A CN114003912A CN 114003912 A CN114003912 A CN 114003912A CN 202111355996 A CN202111355996 A CN 202111355996A CN 114003912 A CN114003912 A CN 114003912A
Authority
CN
China
Prior art keywords
identifier
file
identification
background
program
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202111355996.4A
Other languages
Chinese (zh)
Inventor
刘鹏
徐翰隆
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Antiy Technology Group Co Ltd
Original Assignee
Antiy Technology Group Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Antiy Technology Group Co Ltd filed Critical Antiy Technology Group Co Ltd
Priority to CN202111355996.4A priority Critical patent/CN114003912A/en
Publication of CN114003912A publication Critical patent/CN114003912A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/54—Interprogram communication

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Storage Device Security (AREA)

Abstract

The application provides a lasso program identification method and device, computer equipment and a storage medium, relates to the technical field of network security, and is used for accurately identifying a lasso program. The method mainly comprises the following steps: acquiring a first process identifier of current operation of a user and a first file identifier of current operation; acquiring a second process identifier of the background modified document and a second file identifier modified by the background; matching the first process identification with the second process identification, wherein the first file identification is matched with the second file identification; and if the matching is not successful, determining that the program corresponding to the second process identifier is a lasso program.

Description

Lasso program identification method and device, computer equipment and storage medium
Technical Field
The present application relates to the field of network security technologies, and in particular, to a lasso program identification method, an apparatus, a computer device, and a storage medium.
Background
With the continuous upgrading of the lasso program technology, increasingly lasso events cause the encryption and the destruction of documents of a large number of users, the traditional lasso program defense mechanism is more and more easy to bypass, according to the analysis of the traditional lasso, the lasso virus adopts a background mode to carry out disk retrieval, after a specified suffix file is found, the file of the type is encrypted, and then the encrypted content is rewritten into a disk.
For example, a lemonaster reads a document into a memory to delete the document, encrypts the content in the memory and writes the encrypted content into a newly created document, and similar to the encryption mode and the file deletion behavior, the traditional lemonade mechanism is difficult to judge whether the behavior is a user operation or a malicious lemonade.
Disclosure of Invention
The embodiment of the application provides a lasso program identification method and device, computer equipment and a storage medium, which are used for accurately identifying a lasso program.
The embodiment of the invention provides a lasso program identification method, which comprises the following steps:
acquiring a first process identifier of current operation of a user and a first file identifier of current operation; acquiring a second process identifier for background modification of the document and a second file identifier modified by the background;
matching the first process identification with the second process identification, wherein the first file identification is matched with the second file identification;
and if the matching is not successful, determining that the program corresponding to the second process identifier is a lasso program.
The embodiment of the invention provides a lasso program identification device, which comprises:
the acquisition module is used for acquiring a first process identifier of the current operation of a user and a first file identifier of the current operation; acquiring a second process identifier for background modification of the document and a second file identifier modified by the background;
the matching module is used for matching the first process identifier with the second process identifier, and the first file identifier is matched with the second file identifier;
and the determining module is used for determining that the program corresponding to the second process identifier is a lasso program if the matching is unsuccessful.
A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, the processor implementing the aforementioned lasso program identification method when executing the computer program.
A computer-readable storage medium, which stores a computer program that, when executed by a processor, implements the aforementioned lasso program identification method.
The invention provides a method, a device, computer equipment and a storage medium for identifying a Lesox program, which comprises the steps of firstly obtaining a first process identifier currently operated by a user and a first file identifier currently operated by the user; acquiring a second process identifier for background modification of the document and a second file identifier modified by the background; then matching a first process identification with the second process identification, wherein the first file identification is matched with the second file identification; and if the matching is not successful, determining that the program corresponding to the second process identifier is a lasso program. The method and the device analyze the current operation behavior of the user by acquiring the current operation of the user, and can accurately judge whether the modification of the document is the user behavior or the lasso behavior by the current operation of the user when the document is modified (modified or deleted) in the background, thereby effectively improving the defense capability and the accuracy of judging the lasso program.
Drawings
FIG. 1 is a flow chart of a Lexus program identification method provided by the present application;
FIG. 2 is a flow chart of another Lesog program identification method provided herein;
FIG. 3 is a schematic structural diagram of a Lesog program identification apparatus provided in the present application;
fig. 4 is a schematic diagram of a computer device provided in the present application.
Detailed Description
In order to better understand the technical solutions described above, the technical solutions of the embodiments of the present application are described in detail below with reference to the drawings and the specific embodiments, and it should be understood that the specific features of the embodiments and the embodiments of the present application are detailed descriptions of the technical solutions of the embodiments of the present application, and are not limitations of the technical solutions of the present application, and the technical features of the embodiments and the embodiments of the present application may be combined with each other without conflict.
Referring to fig. 1, a method for identifying a lasso program according to an embodiment of the present invention includes steps S101 to S104:
step S101, acquiring a first process identifier of current operation of a user and a first file identifier of current operation; and acquiring a second process identifier for performing background modification on the document and a second file identifier modified by the background.
The first file identifier is used for uniquely identifying the first file, the second file identifier is used for uniquely identifying the second file, and the types of the first file and the second file may be a document file, a table file, a picture file, a video file, and the like. The first process identifier uniquely identifies the first process, and the second process identifier uniquely identifies the second process, where the first process may be the same as or different from the second process, and the first process and the second process are specific programs executed in a computer, and the programs may be a Word program, an Excel program, a mailbox program, a game program, and the like, and the specific programs represented by the processes are not limited in this embodiment.
It should be noted that, in this embodiment, the backstage modified document may specifically be a backstage deleted document, a backstage encrypted file, or a backstage edited document, and the like, and this embodiment is not particularly limited. In an optional embodiment provided by the present invention, if the second process identifier for deleting or editing the document in the background and the second file identifier modified in the background are obtained, the file corresponding to the second file identifier needs to be backed up first, so that the file modified or edited by the lasso program is restored after the program corresponding to the second process identifier is determined to be the lasso program in the subsequent steps, and the file loss is avoided.
In an optional embodiment provided by the present invention, a first process identifier currently operated by a user and a first file identifier currently operated by the user are obtained; before acquiring a second process identifier for modifying the document in the background and a second file identifier modified by the background, a first thread and a second thread need to be created, the first thread and the second thread work in parallel, then the first process identifier currently operated by a user and the first file identifier currently operated by the user are acquired through the first thread, and the second process identifier for modifying the document in the background and the second file identifier modified by the background are acquired through the second thread.
And S102, matching the first process identification with the second process identification, and matching the first file identification with the second file identification.
Specifically, a first process identifier is matched with a second process identifier, and if the two process identifiers are the same, it can be determined that the first process identifier and the second process identifier are successfully matched; and matching the first file identifier with the second file identifier, and if the two file identifiers are the same, determining that the first file identifier and the second file identifier are successfully matched.
In this embodiment, the first process identifier and the second process identifier are matched by creating communication between the first thread and the second thread, and the first file identifier and the second file identifier are matched.
And step S103, if the matching is not successful, determining that the program corresponding to the second process identifier is a lasso program.
In this embodiment, if the first process identifier is not matched with the second process identifier, and the first file identifier is not matched with the second file identifier, it is indicated that the current program operating on the first file and the second file is two different programs, and the current file operated by the user and the background modified file are also two different files, that is, the background modification operation and the ongoing operation behavior of the user are different, and at this time, it is determined that the program corresponding to the second process identifier is a lasso program.
And step S104, if the matching is successful, determining that the program corresponding to the second process identifier is a normal program.
In this embodiment, if the first process identifier is matched with the second process identifier, and the first file identifier is matched with the second file identifier, it indicates that the currently operated programs for the first file and the second file are consistent, and the currently operated file and the background modified file are also consistent, that is, the background modification operation is the operation behavior of the user, and at this time, it is determined that the program corresponding to the second process identifier is a normal program.
Further, if the first process identifier is successfully matched with the second process identifier, and the first file identifier is not matched with the second file identifier; or, if the first process identifier is not matched with the second process identifier and the first file identifier is successfully matched with the second file identifier, it is further determined whether the program corresponding to the second program identifier is a lasso program.
Specifically, if the first process identifier is successfully matched with the second process identifier and the first file identifier is unsuccessfully matched with the second file identifier, querying whether a preset virus library stores a program corresponding to the second process identifier, wherein the preset virus library stores programs corresponding to different process identifiers respectively; and if the program corresponding to the second process identifier is stored in the preset virus library, determining that the program corresponding to the second process identifier is a lasso program.
Specifically, if the first process identifier is not matched with the second process identifier and the first file identifier is successfully matched with the second file identifier, whether a file corresponding to the second file identifier exists in a preset virus file library is inquired, and if the file corresponding to the second file identifier exists in the preset virus library, the second identifier file is a virus file, and a program corresponding to the second process identifier is a normal program; if the file corresponding to the second file identifier does not exist in the preset virus library, the second identifier file is a normal file, and whether a program corresponding to the second process identifier is stored in the preset virus library or not needs to be further inquired, and if the program corresponding to the second process identifier is stored in the preset virus library, the program corresponding to the second process identifier is determined to be a lasso program.
In this embodiment, a thread pool is created through a parallel mode library, and one thread is responsible for sensing a handle of an operation window of a current user, and acquiring detailed information of a current operation process (for example, a first process identifier of the current operation of the user and a first file identifier of the current operation) through the handle; one thread is responsible for acquiring background document modification behaviors, when the acquired document is modified, a second process identification of the background modified document and a second file identification modified by the background are recorded, the first process identification is matched with the second process identification, the first file identification is matched with the second file identification, when the matching is successful, the user operation behaviors are performed, when the matching is failed, the lasso behaviors are performed, namely, a program corresponding to the second identification is a lasso program.
The embodiment of the invention provides a lasso program identification method, which comprises the steps of firstly obtaining a first process identification currently operated by a user and a first file identification currently operated by the user; acquiring a second process identifier for background modification of the document and a second file identifier modified by the background; then matching a first process identification with the second process identification, wherein the first file identification is matched with the second file identification; if the matching is not successful, determining that the program corresponding to the second process identifier is a lasso program; and if the matching is successful, determining that the program corresponding to the second process identifier is a normal program. The method and the device analyze the current operation behavior of the user by acquiring the current operation of the user, and can accurately judge whether the modification of the document is the user behavior or the lasso behavior through the current operation of the user when the document is modified (edited, modified or deleted) in the background, thereby effectively improving the defense capability and the accuracy of judging the lasso program.
Referring to fig. 2, another method for identifying a lasso program according to an embodiment of the present invention specifically includes steps S201 to S206:
step S201, detecting whether a second process identifier for performing background modification on the document and a second file identifier modified in the background can be obtained through a second thread.
The first file identifier is used for uniquely identifying the first file, the second file identifier is used for uniquely identifying the second file, and the types of the first file and the second file may be a document file, a table file, a picture file, a video file, and the like. The first process identifier uniquely identifies the first process, and the second process identifier uniquely identifies the second process, where the first process may be the same as or different from the second process, and the first process and the second process are specific programs executed in a computer, and the programs may be a Word program, an Excel program, a mailbox program, a game program, and the like, and the specific programs represented by the processes are not limited in this embodiment.
The background modified document in this embodiment may specifically be a background deleted document, a background encrypted document, or a background edited document, and the like, and this embodiment is not particularly limited.
Step S202, if the second process identification of the document to be modified in the background and the second file identification modified in the background can be obtained through the second thread, the first process identification currently operated by the user and the first file identification currently operated by the user are obtained through the first thread.
Step S203, creating communication between the first thread and the second thread.
Step S204, through the communication between the created first thread and the created second thread, the first process identification is matched with the second process identification, and the first file identification is matched with the second file identification.
And step S205, if the matching is not successful, determining that the program corresponding to the second process identifier is a lasso program.
And step S206, if the matching is successful, determining that the program corresponding to the second process identifier is a normal program.
The embodiment of the invention provides a method for identifying a Lessox program, which is used for detecting whether a second process identifier for performing background modification on a document and a second file identifier modified by a background can be acquired through a second thread, and acquiring a first process identifier currently operated by a user and a first file identifier currently operated by the user through a first thread if the second process identifier for performing background modification on the document and the second file identifier modified by the background can be acquired through the second thread, so that the data volume acquired through the first thread can be reduced, and system resources are saved. And finally, determining whether the program corresponding to the second thread identifier is a lasso program according to a matching result. The method and the device analyze the current operation behavior of the user by acquiring the current operation of the user, and can accurately judge whether the modification of the document is the user behavior or the lasso behavior through the current operation of the user when the document is modified (edited, modified or deleted) in the background, thereby effectively improving the defense capability and the accuracy of judging the lasso program.
It should be understood that, the sequence numbers of the steps in the foregoing embodiments do not imply an execution sequence, and the execution sequence of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.
In an embodiment, a lasso program identification apparatus is provided, and the lasso program identification apparatus corresponds to the lasso program identification methods in the above embodiments one to one. As shown in fig. 3, the functional modules of the lasso program identification apparatus are described in detail as follows:
an obtaining module 31, configured to obtain a first process identifier of a current operation of a user and a first file identifier of the current operation; acquiring a second process identifier of the background modified document and a second file identifier modified by the background;
a matching module 32, configured to match the first process identifier with the second process identifier, where the first file identifier is matched with the second file identifier;
and a determining module 33, configured to determine that the program corresponding to the second process identifier is a lasso program if the matching is unsuccessful.
In an optional embodiment, the apparatus further comprises: a creation module 34;
the creating module 34 is configured to create a first thread and a second thread, where the first thread and the second thread work in parallel;
the obtaining module 31 is configured to obtain, through the first thread, a first process identifier of a current operation of a user and a first file identifier of the current operation;
the obtaining module 31 is configured to obtain, through the second thread, a second process identifier of the background modified document and a second file identifier modified in the background.
In an optional embodiment, the apparatus further comprises: a query module 35;
the query module 35 is configured to query whether a preset virus library stores programs corresponding to the second process identifier, where the preset virus library stores programs corresponding to different process identifiers respectively, if the first process identifier is successfully matched with the second process identifier, and the first file identifier is unsuccessfully matched with the second file identifier;
the determining module 33 is further configured to determine that the program corresponding to the second process identifier is a lasso program if the program corresponding to the second process identifier is stored in the preset virus library.
In an optional embodiment, the matching module 32 is configured to match the first process identifier with the second process identifier by creating a communication between the first thread and the second thread, and the first file identifier is matched with the second file identifier.
In an optional embodiment, the obtaining module 31 is specifically configured to:
detecting whether a second process identifier for performing background modification on the document and a second file identifier modified by the background can be acquired through the second thread;
and if the second process identification of the document to be modified in the background and the second file identification modified in the background can be obtained through the second thread, the first process identification currently operated by the user and the first file identification currently operated by the user are obtained through the first thread.
In an alternative embodiment, the creating module 34 is configured to create a communication between the first thread and the second thread;
correspondingly, the matching module 32 is configured to match the first process identifier with the second process identifier, and match the first file identifier with the second file identifier.
In an optional embodiment, the background modification document comprises a background deletion document, a background encryption file or a background editing document, and the apparatus further comprises a backup module;
and the backup module is used for backing up the file corresponding to the second file identifier.
For the specific limitation of the lasso program identification means, reference may be made to the above limitation on the lasso program identification method, which is not described herein again. The various modules in the above-described apparatus may be implemented in whole or in part by software, hardware, and combinations thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.
In one embodiment, a computer device is provided, which may be a server, the internal structure of which may be as shown in fig. 4. The computer device includes a processor, a memory, a network interface, and a database connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a lasso program identification method.
In one embodiment, a computer device is provided, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor implementing the following steps when executing the computer program:
acquiring a first process identifier of current operation of a user and a first file identifier of current operation; acquiring a second process identifier for background modification of the document and a second file identifier modified by the background;
matching the first process identification with the second process identification, wherein the first file identification is matched with the second file identification;
and if the matching is not successful, determining that the program corresponding to the second process identifier is a lasso program.
In one embodiment, a computer-readable storage medium is provided, having a computer program stored thereon, which when executed by a processor, performs the steps of:
acquiring a first process identifier of current operation of a user and a first file identifier of current operation; acquiring a second process identifier for background modification of the document and a second file identifier modified by the background;
matching the first process identification with the second process identification, wherein the first file identification is matched with the second file identification;
and if the matching is not successful, determining that the program corresponding to the second process identifier is a lasso program.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
It will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-mentioned division of the functional units and modules is illustrated, and in practical applications, the above-mentioned function distribution may be performed by different functional units and modules according to needs, that is, the internal structure of the apparatus is divided into different functional units or modules to perform all or part of the above-mentioned functions.
The above examples are only intended to illustrate the technical solution of the present invention, but not to limit it; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; such modifications and substitutions do not substantially depart from the spirit and scope of the embodiments of the present invention, and are intended to be included within the scope of the present invention.

Claims (10)

1. A lasso program identification method, characterized in that the method comprises:
acquiring a first process identifier of current operation of a user and a first file identifier of current operation; acquiring a second process identifier for background modification of the document and a second file identifier modified by the background;
matching the first process identification with the second process identification, wherein the first file identification is matched with the second file identification;
and if the matching is not successful, determining that the program corresponding to the second process identifier is a lasso program.
2. The method of claim 1, further comprising:
creating a first thread and a second thread, the first thread working in parallel with the second thread;
the acquiring a first process identifier of a current operation of a user and a first file identifier of the current operation includes:
acquiring a first process identifier of the current operation of a user and a first file identifier of the current operation through the first thread;
the obtaining of the second process identifier of the modified document and the modified second file identifier includes:
and acquiring a second process identifier for performing background modification on the document and a second file identifier modified in the background through the second thread.
3. The method of claim 1, further comprising:
if the first process identifier is successfully matched with the second process identifier and the first file identifier is unsuccessfully matched with the second file identifier, inquiring whether a program corresponding to the second process identifier is stored in a preset virus library, wherein the preset virus library stores programs corresponding to different process identifiers respectively;
and if the program corresponding to the second process identifier is stored in the preset virus library, determining that the program corresponding to the second process identifier is a lasso program.
4. The method according to any of claims 2-3, wherein said matching the first process identifier with the second process identifier, and the matching the first file identifier with the second file identifier, comprises:
and matching the first process identification with the second process identification by establishing communication between the first thread and the second thread, wherein the first file identification is matched with the second file identification.
5. The method according to claim 2, wherein the first process identifier currently operated by the user and the first file identifier currently operated by the user are obtained; acquiring a second process identifier for performing background modification on the document and a second file identifier modified by the background, wherein the second process identifier comprises:
detecting whether a second process identifier for performing background modification on the document and a second file identifier modified by the background can be acquired through the second thread;
and if the second process identification of the document to be modified in the background and the second file identification modified in the background can be obtained through the second thread, the first process identification currently operated by the user and the first file identification currently operated by the user are obtained through the first thread.
6. The method according to claim 5, wherein after the second process identifier of the background-modified document and the second file identifier of the background-modified document are obtained by the second thread, and then the second process identifier of the background-modified document and the second file identifier of the background-modified document are obtained by the second thread, the method further comprises:
creating a communication between the first thread and the second thread;
and matching the first process identification with the second process identification, wherein the first file identification is matched with the second file identification.
7. The method of claim 1, wherein the background modification document comprises a background deletion document, a background encryption file, or a background editing document, and wherein the method further comprises:
and backing up the file corresponding to the second file identifier.
8. A lasso program identification apparatus, characterized in that said apparatus comprises:
the acquisition module is used for acquiring a first process identifier of the current operation of a user and a first file identifier of the current operation; acquiring a second process identifier of the background modified document and a second file identifier modified by the background;
the matching module is used for matching the first process identifier with the second process identifier, and the first file identifier is matched with the second file identifier;
and the determining module is used for determining that the program corresponding to the second process identifier is a lasso program if the matching is unsuccessful.
9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that the processor implements the lasso program identification method according to any of claims 1 to 7 when executing the computer program.
10. A computer-readable storage medium, in which a computer program is stored which, when being executed by a processor, carries out the lasso program identification method according to any one of claims 1 to 7.
CN202111355996.4A 2021-11-16 2021-11-16 Lasso program identification method and device, computer equipment and storage medium Pending CN114003912A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111355996.4A CN114003912A (en) 2021-11-16 2021-11-16 Lasso program identification method and device, computer equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111355996.4A CN114003912A (en) 2021-11-16 2021-11-16 Lasso program identification method and device, computer equipment and storage medium

Publications (1)

Publication Number Publication Date
CN114003912A true CN114003912A (en) 2022-02-01

Family

ID=79929193

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111355996.4A Pending CN114003912A (en) 2021-11-16 2021-11-16 Lasso program identification method and device, computer equipment and storage medium

Country Status (1)

Country Link
CN (1) CN114003912A (en)

Similar Documents

Publication Publication Date Title
CN110209652B (en) Data table migration method, device, computer equipment and storage medium
CN109446068B (en) Interface test method, device, computer equipment and storage medium
US11574290B2 (en) Data processing method and apparatus, computer device, and storage medium
RU2565109C2 (en) Method and apparatus for recovering backup database
CN111723056B (en) Small file processing method, device, equipment and storage medium
US20120296878A1 (en) File set consistency verification system, file set consistency verification method, and file set consistency verification program
CN112579202B (en) Method, device, equipment and storage medium for editing server program of Windows system
CN113835713B (en) Source code packet downloading method, device, computer equipment and storage medium
CN112632375B (en) Session information processing method, server and storage medium
CN114416121A (en) Firmware burning method and device, burning equipment and firmware burning system
CN108446224B (en) Performance analysis method of application program on mobile terminal and storage medium
CN114417335A (en) Malicious file detection method and device, electronic equipment and storage medium
CN108133026B (en) Multi-data processing method, system and storage medium
CN108664255B (en) Software upgrading method and device
CN108459927B (en) Data backup method and device and server
Li et al. Digital forensics and analysis for Android devices
CN114003912A (en) Lasso program identification method and device, computer equipment and storage medium
CN111339054A (en) Storage system hierarchical management method, device, equipment and storage medium
CN111367869A (en) Mirror image file processing method and device, storage medium and electronic equipment
CN111290747A (en) Method, system, equipment and medium for creating function hook
CN109002710B (en) Detection method, detection device and computer readable storage medium
CN115277677A (en) Batch archive hooking method and device, computer equipment and storage medium
CN115421699A (en) Class inheritance relationship analysis method and device, computer equipment and storage medium
CN104268231A (en) File access method, device and intelligent file system
CN110460585B (en) Equipment identity identification method and device, computer equipment and storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination