WO2020132876A1 - Operation detection method and system, and electronic device - Google Patents

Abstract

An operation detection method, comprising: S1, obtaining an execution subject executing a specific operation; S2, determining, according to a first permission set, whether the execution subject has the permission to execute the specific operation; S3, obtaining the operation state of the execution subject and a corresponding second permission set; S4, determining, according to the second permission set, whether the execution subject has the permission to execute the specific operation, if yes, executing operation S5, and if not, processing the execution subject; S5, obtaining a task comprising the specific operation, the task corresponding to an operation process; S6, determining whether the operation process satisfies a preset operation process, and if not, processing the execution subject; S7, obtaining an instruction execution sequence corresponding to at least one operation in the task; and S8, determining whether the instruction execution sequence matches a preset instruction execution sequence, and if not, processing the execution subject. Also provided are an operation detection system and an electronic device.

Description

Operation detection method, system and electronic equipment Technical field

The present disclosure belongs to the field of network security, and specifically relates to an operation detection method, system and electronic equipment.

Background technique

With the development of computer networks, network security has received increasing attention from the industry. For the case where the computer network is attacked by hackers, people hope that this attack can be discovered during the attack or before the result of the harm occurs, in order to avoid the violation to the greatest extent. There are a variety of network security methods used in the prior art, such as "malware detection", "attack discovery", "malicious behavior detection", etc. Although these technologies can provide security protection, with the improvement of attack methods , Can no longer meet the growing demand for network security.

Summary of the invention

An aspect of the present disclosure provides an operation detection method, including: S1, before performing a specific operation, obtaining an execution subject performing the specific operation; S2, judging whether the execution subject has performed the specific operation according to the first set of permissions If not, execute operation S3; S3, obtain the operation state of the execution subject, and obtain the corresponding second permission set according to the operation state of the execution subject; S4, determine the execution subject according to the second permission set Whether it has the authority to perform the specific operation, if yes, perform operation S5, and if not, process the execution subject; S5, obtain a task including the specific operation, the task corresponds to an operation flow to perform at least one operation S6, judging whether the operation flow satisfies the preset operation flow, if yes, performing operation S7; if not, processing the execution body; S7, obtaining the instruction execution sequence corresponding to at least one operation in the task; S8, judging Whether the instruction execution sequence matches the preset instruction execution sequence, and if not, the execution body is processed.

Optionally, in step S6, determining whether the operation flow satisfies the preset operation flow includes: obtaining at least one operation corresponding to the operation flow; determining whether each operation in the at least one operation is consistent with the preset The corresponding operations in the operation flow are consistent.

Optionally, the judging whether each operation in the at least one operation is consistent with the corresponding operation in the preset operation flow includes: judging whether the execution subject of each operation in the at least one operation is consistent with the preset operation The execution body of the operation corresponding to the process is consistent.

Optionally, before the step S1, it further includes: S0, creating a first permission set, where the first permission set includes operation permissions of at least one execution subject in any operation state.

Optionally, before the step S1, the method further includes: S0', creating at least one second permission set, wherein each second permission set corresponds to an operation state of an execution subject, and each of the The second set of rights includes the operation rights of the corresponding execution subject in the corresponding operation state.

Optionally, the at least one second permission set is stored at the remote end, and in step S3, acquiring the corresponding second permission set according to the operating state of the execution subject includes: sending a request to the remote end, the request includes The execution subject information and its operation status; obtaining a second permission set sent by the remote end, where the second permission set is returned by the remote end in response to the request.

Optionally, in step S3, acquiring the operation state of the execution subject includes at least: determining the operation state of the execution subject according to the calling mode of the execution subject, where the execution subject is directly called by the user, It is determined that the operation state of the execution body is the first operation state, and when the execution body is called by another execution body, it is determined that the operation state of the execution body is the second operation state.

Optionally, in step S8, determining whether the instruction execution sequence matches a preset instruction execution sequence includes: obtaining function call information in the instruction execution sequence, where the function call information includes function call times and/or functions Call sequence; determine whether the function call information in the instruction execution sequence matches the function call information in the preset instruction execution sequence.

Optionally, in step S7, acquiring the instruction execution sequence corresponding to at least one operation in the task includes: acquiring the instruction execution sequence corresponding to at least one operation in the task from the stack memory.

Another aspect of the present disclosure provides an operation detection system, including: a first acquisition module for acquiring an execution subject performing a specific operation before performing a specific operation; a first determination module for determining based on a first set of permissions Whether the execution subject has the authority to perform the specific operation, if not, the second acquisition module is executed; the second acquisition module is used to acquire the operation state of the execution subject, and obtain the corresponding according to the operation state of the execution subject A second set of permissions; a second judgment module, used to determine whether the execution subject has the permission to perform the specific operation according to the second set of permissions, if so, execute the third acquisition module, and if not, perform the execution on the subject Processing; the third obtaining module is used to obtain the task including the specific operation, and the task corresponds to an operation flow for performing at least one operation; the third judgment module is used to judge whether the operation flow satisfies the preset operation flow, if yes , The fourth acquisition module is executed, if not, the execution body is processed; the fourth acquisition module is used to acquire the instruction execution sequence corresponding to at least one operation in the task; the fourth judgment module is used to determine the instruction execution sequence and Whether the preset instruction execution sequence matches, and if not, the execution body is processed.

Optionally, in the third determining module, determining whether the operation flow satisfies the preset operation flow includes: acquiring at least one operation corresponding to the operation flow; determining whether each operation in the at least one operation is different from the operation The corresponding operations in the preset operation flow are consistent.

Optionally, the third determination module determines whether each operation in the at least one operation is consistent with the corresponding operation in the preset operation flow, including: determining whether the execution subject of each operation in the at least one operation is It is assumed that the execution body of the operation corresponding to the operation flow is consistent.

Optionally, the operation detection system further includes: a first creation module, configured to create a first set of permissions, the first set of permissions includes operation permissions of at least one execution subject in any operation state.

Optionally, the operation detection system further includes: a second creation module for creating at least one second permission set, wherein each second permission set corresponds to an operating state of an execution subject, and each The second permission set includes the operation permission of the corresponding execution subject in the corresponding operation state.

Optionally, at least one second permission set is stored at the remote end, and the second acquiring module acquiring the corresponding second permission set according to the operating state of the execution subject includes: sending a request to the remote end, the request including the Execution subject information and its operation status; obtaining a second permission set sent by the remote end, where the second permission set is returned by the remote end in response to the request.

Optionally, the second acquiring module acquiring the operation state of the execution subject includes at least: determining the operation state of the execution subject according to the calling mode of the execution subject, where the execution subject is directly called by the user, It is determined that the operation state of the execution body is the first operation state, and when the execution body is called by another execution body, it is determined that the operation state of the execution body is the second operation state.

Optionally, the fourth judgment module judges whether the instruction execution sequence matches the preset instruction execution sequence, including: obtaining function call information in the instruction execution sequence, and the function call information includes the number of function calls and/or function call sequence; Whether the function call information in the sequence matches the function call information in the preset instruction execution sequence.

Optionally, the fourth acquiring module acquiring the instruction execution sequence corresponding to at least one operation in the task includes: acquiring the instruction execution sequence corresponding to at least one operation in the task from the stack memory.

Another aspect of the present disclosure provides an electronic device, including: a processor: a memory, storing computer-executable instructions, which when executed by the processor, causes the processor to execute: S1, Before performing a specific operation, obtain an execution subject performing the specific operation; S2, determine whether the executing subject has the authority to perform the specific operation according to the first set of permissions, if not, perform operation S3; S3, obtain the execution The operating state of the subject, and obtain the corresponding second permission set according to the operating state of the executing subject; S4, judging whether the executing subject has the permission to perform the specific operation according to the second permission set, and if so, performing operation S5, if No, the execution body is processed; S5, a task including the specific operation is acquired, the task corresponds to an operation flow for performing at least one operation; S6, whether the operation flow satisfies the preset operation flow is determined, and if so, Then perform operation S7; if not, process the execution body; S7, obtain the instruction execution sequence corresponding to at least one operation in the task; S8, determine whether the instruction execution sequence matches the preset instruction execution sequence, if not, then Execute the subject for processing.

Optionally, when the processor executes step S6, determining whether the operation flow satisfies the preset operation flow includes: acquiring at least one operation corresponding to the operation flow; determining whether each operation in the at least one operation is The corresponding operations in the preset operation flow are consistent.

Optionally, the processor determining whether each operation in the at least one operation is consistent with a corresponding operation in the preset operation flow includes: determining whether an execution subject of each operation in the at least one operation is consistent with the preset operation The execution body of the operation corresponding to the process is consistent.

Optionally, before executing the step S1, the processor further executes: S0, creating a first permission set, where the first permission set includes operation permissions of at least one execution subject in any operation state.

Optionally, before executing the step S1, the processor further executes: S0' to create at least one second permission set, where each second permission set corresponds to an operation state of an execution subject, and each Each of the second permission sets includes operation permissions of the corresponding execution subject in the corresponding operation state.

Optionally, at least one second permission set is stored at the remote end, and when the processor executes the step S3, acquiring the corresponding second permission set according to the operating state of the execution subject includes: sending a request to the remote end, The request includes the execution subject information and its operation status; obtaining a second permission set sent by the remote end, where the second permission set is returned by the remote end in response to the request.

Optionally, when the processor executes the step S3, acquiring the operation state of the execution body includes at least: determining the operation state of the execution body according to the calling mode of the execution body, wherein the execution body is When directly called by a user, it is determined that the operation state of the execution body is the first operation state, and when the execution body is called by another execution body, the operation state of the execution body is determined to be the second operation state.

Optionally, when executing step S8, the processor determines whether the instruction execution sequence matches the preset instruction execution sequence, including: acquiring function call information in the instruction execution sequence, and the function call information includes function call times and/or function call order ; Determine whether the function call information in the instruction execution sequence matches the function call information in the preset instruction execution sequence.

Optionally, when the processor executes step S7, acquiring the instruction execution sequence corresponding to at least one operation in the task includes: acquiring the instruction execution sequence corresponding to at least one operation in the task from the stack memory.

Another aspect of the present disclosure provides a computer-readable medium storing computer-executable instructions, which when executed are used to implement the method as described in any one of the above.

Another aspect of the present disclosure provides a computer program, the computer program including computer-executable instructions, which when executed are used to implement the method according to any one of the above.

BRIEF DESCRIPTION

FIG. 1 schematically shows a flowchart of an operation detection method according to an embodiment of the present disclosure.

FIG. 2 schematically shows a legal operation flowchart of “remotely launching Shell program cmd.exe” in an embodiment of the present disclosure.

FIG. 3 schematically shows an illegal operation flowchart of “remotely launching Shell program cmd.exe” in an embodiment of the present disclosure.

FIG. 4 schematically shows a block diagram of an operation detection system according to an embodiment of the present disclosure.

FIG. 5 schematically shows a block diagram of an electronic device according to another embodiment of the present disclosure.

detailed description

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. However, it should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present disclosure. In addition, in the following description, descriptions of well-known structures and techniques are omitted to avoid unnecessarily obscuring the concepts of the present disclosure.

The terminology used herein is for describing specific embodiments only, and is not intended to limit the present disclosure. The words "a", "an" and "the" as used herein should also include the meaning of "plurality" and "various types" unless the context clearly indicates otherwise. In addition, the terms "comprising", "including", etc. used herein indicate the existence of the described features, steps, operations and/or components, but do not exclude the presence or addition of one or more other features, steps, operations or components .

All terms (including technical and scientific terms) used herein have the meaning commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly stereotypical manner.

Some block diagrams and/or flowcharts are shown in the drawings. It should be understood that some of the blocks in the block diagrams and/or flowcharts or combinations thereof may be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, special-purpose computer, or other programmable data processing device, so that when executed by the processor, these instructions can be created to implement the functions described in these block diagrams and/or flowcharts / Operated device.

Therefore, the technology of the present disclosure may be implemented in the form of hardware and/or software (including firmware, microcode, etc.). In addition, the technology of the present disclosure may take the form of a computer program product on a computer-readable medium storing instructions, which may be used by or in conjunction with an instruction execution system. In the context of this disclosure, a computer-readable medium may be any medium that can contain, store, transfer, propagate, or transfer instructions. For example, computer-readable media may include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, devices, or propagation media. Specific examples of computer-readable media include: magnetic storage devices, such as magnetic tape or hard disk (HDD); optical storage devices, such as compact disk (CD-ROM); memory, such as random access memory (RAM) or flash memory; and/or wired /Wireless communication link.

FIG. 1 schematically shows a flowchart of an operation detection method according to an embodiment of the present disclosure.

Specifically, as shown in FIG. 1, the operation detection method of the embodiment of the present disclosure includes the following operations:

S101. Before performing a specific operation, obtain an execution subject performing the specific operation.

In order to complete tasks in the operating system, various operations are performed, and these operations often involve services, programs, files, and data in the system. "Specific operations" in this disclosure refer to some sensitive operations that may cause dangerous consequences, including but not limited to executable file loading, memory operations, file operations, network access, port monitoring, registry key operations, sensitive windows Message sending, etc.

The present disclosure monitors the above-mentioned specific operations in real time in the operating system, and there may be multiple monitoring methods. For example, "hooking" technology can be used. "hooking" is a security monitoring method commonly used in the field of computer security. It can hook some application programming interfaces (APIs). When the system performs specific operations, It will enter the HOOK processing flow; for example, you can use various types of function filter drivers provided by the operating system, such as: file filter driver, network filter driver, etc., you can monitor specific operations involving the corresponding file, network, etc.

The “execution subject performing this specific operation” mentioned in this disclosure includes but is not limited to the operating system itself, applications installed on the operating system, and the like. Before executing the specific operation, the execution subject will obtain the information of the execution subject through the above monitoring means, including but not limited to the name of the execution subject, creation time, location index, etc.

S102: Determine whether the execution subject has the authority to perform the specific operation according to the first authority set. If yes, release the specific operation, and if not, perform operation S103.

Due to the large number of current applications, the Windows 10 platform has 35 million applications, the IOS platform has 2.1 million applications, and the Android platform has 2.6 million applications. The operations involved in these applications are countless. The specific operations of each application are determined by means of a blacklist or whitelist, which requires huge resources to collect the specific operations and legality of each application.

In view of the foregoing considerations of the present disclosure, before performing the above operation S101, a first permission set is created, which is called a "minimum behavior permission set", and the set includes operation permissions of at least one execution subject in any operation state. Among them, the operation state of the execution subject in the present disclosure refers to the state that the execution subject is in when performing the specific operation, for example, the execution subject is a winword program, which can open a word document at runtime, if the winword program is actively run by the user , Then its operating state is active running state, if the winword program is run by other program calls, then its operating state is passive running state. Taking the winword program as an example, if the opened word document will be displayed in the form of a window, then its operating state is the window state. If the opened word document will only run in the background and not display, then its operating state is Non-windowed state. The first permission set in the present disclosure only relates to the operation permission of the execution subject in "any operation state", and the operation permission in the "different operation state" will be described later.

The first set of permissions provided by the present disclosure includes at least the operating permissions of the execution subject in any operating state:

· The operation mode of non-specific applications is non-automatic operation

Explanation: General applications cannot be run automatically, and can only be executed manually by the user. Specific programs that need to be run automatically are processed by the program's exclusive set of actions;

·The application can only operate files created directly and/or indirectly by itself

Explanation: The application can only operate (read, write, open, delete, etc.) files created by itself or directly or indirectly created by the same installation package with itself;

·The application has only read-only permission to the operating system files;

·Applications cannot operate on non-system files other than files created directly and/or indirectly

Explanation: The application cannot operate (read, write, open, delete, etc.) any non-system files other than the files created directly and/or indirectly by itself;

· The application does not allow access to internal and external networks and intra-network device nodes

· During non-user operations, the application does not allow cross-process operations on other processes;

·The operating system itself and application programs are not allowed to directly operate the disk without going through the file system;

· During non-user operation, the operating system and application programs are not allowed to download or execute another program, and the driver cannot be loaded;

· During non-user operations, the operating system and applications are not allowed to read and write user private data

Explanation: User private data includes but is not limited to documents, photos, etc.;

·When the user operates, only the default editing program corresponding to the data can operate the document of the corresponding data type

Explanation: The default editing program is subject to the registration in the operating system registry, for example, the word document only allows winword program or WPS operation;

·When the user operates, the corresponding behavior subject only has the authority to operate on a single object

Explanation: For example, if the user calls the winword program to open the word document A, the winword program will have the operation authority for A, but the user does not display the actively opened word document B, and the winword program does not have the operation authority;

· The operating system and application programs do not have the permission to add accounts during non-user operations;

· During non-user operations, the operating system and applications do not have permission to write key registry entries

Explanation: The key registry entries include but are not limited to the browser homepage, self-starting items, default program settings for various types of files, system startup settings, etc.;

· During non-user operations, the operating system itself and applications do not have the authority to call system function programs

Explanation: System function programs include, but are not limited to, shell programs, registry editors, scheduled tasks, and disk file registry permission change programs;

· During non-user operations, the operating system and applications do not have the authority to create and execute script files.

Through the setting of the first permission set, it is possible to effectively determine whether most of the executive bodies have the authority to perform the specific operation, without establishing a blacklist or whitelist for each executive body and the corresponding specific operation, thereby saving system overhead . In this operation, if the specific operation performed by the executor meets the first permission set, the specific operation is released and the specific operation is executed. If the specific operation performed by the executor does not comply with the first permission set, Then, operation S103 is performed to further determine it.

S103: Acquire the operation state of the execution subject, and acquire the corresponding second permission set according to the operation state of the execution subject.

The operation state of the execution subject has been explained in the above operation S102, and will not be repeated here. In addition, the first permission set set in the above operation S102 can filter any risky operation. However, for some special applications, they will exceed the permissions restricted by the first permission set during normal operation, such as: security software, which has the operation of detecting whether the system-wide executable files are infected by viruses, but is limited by The limitation of the first permission set cannot operate other applications. Therefore, if only the first permission set of the present disclosure is used for the determination, some special applications such as security software will generate "false positives". For the above situation, the present disclosure needs to further determine the execution subject that does not satisfy the first permission set, thereby introducing the second permission set of the present disclosure.

In view of the above considerations, before performing the above operation S101, the disclosure will also create more than one second permission set, where each second permission set corresponds to an operating state of an execution subject, and each second permission set Including the operation authority of the corresponding execution subject in the corresponding operation state.

For example, for the winword program, the second set of permissions provides:

· When the user actively executes the winword program, he has the authority to operate the corresponding object, that is: When the user actively opens the word document A through the winword program, the winword program has the operation authority of the word document A. (Note: Double-click the word document, and the operating system calls the winword program to open it; and double-clicking the winword program and then opening the document through the menu or drag operation are all actions triggered by user operations, and are regarded as "active running status")

· When the non-user actively executes the winword program (passive running state), he does not have the authority to operate the word document.

· When the user actively executes the winword program, it does not have the authority to operate the non-corresponding object, that is: when opening the word document A, the winword program only has the single authority to operate A, and does not have the authority to operate B, C and other word documents or non- Word document permissions.

It can be seen from the above example that the second permission set specifies the different permissions of the winword program under the two operating states of "active running state" and "passive running state".

In operation S103 of the present disclosure, different operation states of the execution subject may be determined in different ways.

According to an embodiment of the present disclosure, the operating state of the executive body can be determined according to the calling mode of the executive body, where the executive body is directly called by the user, and the operating state of the executive body is determined to be the active running state. When other executive bodies are called, it is determined that the operating state of the executive body is a passive running state.

According to another embodiment of the present disclosure, the operation state of the execution subject can be determined according to the operation mode of the execution subject on the execution object. For example, the winword program is used as an example. If the opened word document is displayed in the form of a window, Then its operation state is window state. If the opened word document will only run in the background and not display, then its operation state is non-window state.

The above-mentioned embodiments are merely examples for explaining different operating states of the execution body, and the operating states are not limited to the above two embodiments. In addition, the operation state acquired in operation S103 is not limited to one operation state, and multiple operation states to which it belongs can also be acquired for the same execution body at the same time (for example, the winword program that can be acquired simultaneously is the active execution state and the window state) For subsequent determination.

It should also be noted that each second permission set corresponds to at least one operating state of an execution subject, so the number of second permission sets is extremely large. Therefore, the present disclosure may store the created second permission set at the remote end (eg, server side, cloud, etc.), and when the client implements the present disclosure, the client sends a request to the remote end, the request includes the execution subject information and its operation status, The remote end responds to the request, retrieves the corresponding second permission set according to the execution subject information and its operation status, and sends it to the client. Furthermore, after obtaining the second permission set, the client may locally cache the execution subject information and the operation state of the second permission set. When the client needs to obtain the second permission set again, it can first query from the local cache, and if it does not exist, then send a request to the remote end. In another embodiment of the present disclosure, when the client installs the application program (or other execution agent), it obtains the second permission set of various operating states corresponding to the application program (or other execution agent) from the remote end And save it locally. In this way, when the second permission set is subsequently acquired, it can be directly called from the local.

S104: Determine whether the execution subject has the authority to perform the specific operation according to the second permission set. If yes, perform operation S105; if not, process the execution subject.

It has been described above that the second permission set includes the operation permission of the corresponding execution subject in the corresponding operation state, so it is easy to understand the determination process in operation S104, and details are not described here. However, it should be emphasized that the present disclosure makes authority determination from the operational status of the executive body, and is no longer limited to "application behavior, application functions and types", and can more accurately determine the "over-right behavior" of the executive body. .

Taking the above security software as an example, since it will detect whether the executable file of the entire system is infected by a virus during normal operation, it needs to have a function of automatic security detection without user intervention, and generally requires connection when performing security detection In the virus signature database in the cloud, these functions obviously have exceeded the permissions specified in the first permission set. Therefore, it must not be able to pass the judgment of the first authority set. In this case, the second authority set is required to further judge it. In any operating state of the security software, its corresponding second permission set specifies that it has the permission of “can be run automatically and can be connected to the network without user operation”, so it can pass the determination of the second permission set. It can be seen from the above example that the setting of the second permission set can avoid the "false positive" of the first permission set to some specific execution subjects.

In addition, the present disclosure sets the second permission set on the one hand, it not only prevents the "false positives" of the first permission set, but also strengthens the division of permissions on the execution subject, so that the execution subject can be protected from the first permission The set of "false positives" affects its normal function, and can restrict it from other specific operations with security threats. Taking Xshell as an example, it is mostly used to remotely manage servers, but there are backdoors in multiple versions of it, and users will secretly upload user server accounts and passwords when using it. When Xshell is determined by the first permission set of the present disclosure, since the first permission set specifies "the application is not allowed to access the internal and external networks and device nodes in the network", it does not meet the determination of the first permission set. For the second permission set of the present disclosure, it can determine different network connection permissions according to the type of application program, so that different application programs can accurately connect to a certain type or a certain network or networks. For example, printers, cameras, etc. can only be connected to a fixed IP address; applications for intranet communication can only be connected to the intranet; server management tools such as xshell can only connect to the network connected by the user for this operation; applications can only use specific Network protocol to connect to the network, etc. Taking Xshell as an example again, its second set of permissions in various operating states is:

· In the dual state of the user's active execution and with the interactive window, he has the right to communicate with the specified network address (actively connected server IP or domain name) for network communication

·Non-user active execution, or no window is not allowed for network communication

·Do not communicate with the network address unrelated to the server address pointed to by this user operation

When Xshell is determined based on the above second permission set, it does not allow Xshell to access the network other than the network to which the user is connected in this operation, and cuts off the network path for uploading the user's server account and password to avoid security threats.

It can be seen from the above example that after the first permission set is "intercepted", it is determined by the second permission set. It is "released" for normal functions such as the remote management server, and illegally connected to other networks Carry out "interception" to achieve more precise permission control.

When the executor does not meet the specified second permission set in the corresponding operation state, it can be fully determined that the executor or the corresponding specific operation has a security threat, that is, the executor is intercepted to interrupt the specific operating.

However, when the executor satisfies the specified second permission set in the corresponding operation state (it has been determined in operation S102 that the executor does not satisfy the first permission set), it can be determined that the result of the determination by the first permission set exists The possibility of "false positives" requires further judgment in the future.

S105. Obtain a task including a specific operation, and the task corresponds to an operation flow for performing at least one operation.

In the operating system, the "task" is the smallest unit that realizes the corresponding function. Each task includes one or more operations (including specific operations) that are executed in sequence. Performing these operations in a fixed order to complete the task is the task. Operating procedures.

In operation S105, the acquired task may specifically include: one or more operations included in the task, the execution order of the one or more operations, and the execution object of each operation (for example, opening a word document through a winword program, the word document is For the implementation object). Through the above information, it can be determined whether the operation flow of the task is legal.

S106. Determine whether the operation flow satisfies the preset operation flow. If yes, perform operation S7. If no, perform processing on the execution body.

This disclosure determines whether the operation flow of a task is legal by determining whether it conforms to a preset operation flow. Each task should have a set of legal operation flow in order to realize the corresponding function, which is the preset operation flow mentioned in this disclosure . The following uses "remote start Shell program cmd.exe" as an example to explain the legal operation flow and the illegal operation flow of the present disclosure.

FIG. 2 illustrates a legal operation flowchart of “remotely launching Shell program cmd.exe” in an embodiment of the present disclosure. As shown in FIG. 2, a task generated by the normal remote control machine A is “start the Shell program cmd.exe on the target server B”, and the operation process performed by the task is:

S201, start the Telnet.exe program on the normal remote control machine A;

S202, on the normal remote control machine A, a request to establish a remote connection with the target server B is sent through the Telnet.exe program;

S203, receiving a remote connection request sent by the normal remote control machine A through tlntsvr.exe on the target server B;

S204, on the target server B, start tlntsess.exe through tlntsvr.exe to establish a connection with the normal remote control machine A;

S205, sending a command to start the shell program cmd.exe on the normal remote control machine A;

S206, the above instruction is received on the target server B through tlntsess.exe;

S207, start the shell program cmd.exe through tlntsess.exe on the target server B.

FIG. 3 illustrates an illegal operation flowchart of “remotely launching Shell program cmd.exe” in an embodiment of the present disclosure. As shown in FIG. 3, a task generated by the hacker remote control machine A is “starting the Shell program cmd.exe on the target server B”, and the operation process performed by the task is:

S301, on the hacker remote control machine A, send a data packet to the target server B through the ms17-010 vulnerability (this vulnerability is actually used by the ransomware virus Wannacry) (the data packet is specially constructed and contains the ransomware virus) Attack code);

S302, on the target server B, due to the existence of the ms17-010 vulnerability, the attack code of the ransomware virus in the data packet is executed;

S303, on the target server B, the attacker's virus attack code injects the command to start the shell into spoolsv.exe;

S304. On the target server B, start the shell program cmd.exe through spoolsv.exe.

It can be seen from FIGS. 2 to 3 of the present disclosure that the two same tasks and the functions achieved are to start the shell program cmd.exe, but the operation flow performed by them is different.

But the legal operation flow is: "System-specific remote management service program: tlntsvr.exe, tlntsess.exe" jointly completed the execution of the task, tlntsvr.exe accepts the connection for identity authentication, and then starts tlntsess.exe to accept user commands, Finally start cmd.exe.

The illegal operation process is: start cmd.exe through "printer management service program: spoolsv.exe".

Obviously, in operation S106 of the present disclosure, by determining whether the operation flow of the task is legal is by determining whether it conforms to the preset operation flow, it can be determined whether the task to which the specific operation belongs is legal. Specifically, when determining the operation flow, the present disclosure first obtains the operation corresponding to the operation flow, and then needs to determine whether each operation is consistent with the corresponding operation in the preset operation flow.

Taking Figures 2 to 3 as examples, the illegal operation process includes "start spoolsv.exe" and "spoolsv.exe start Shell program cmd.exe"; the corresponding legal operation process is "tlntsvr.exe start tlntsess.exe", "Tlntsess.exe starts Shell program cmd.exe". Although both have the operation of "start Shell program cmd.exe", the link "tlntsvr.exe start tlntsess.exe" is missing, and "spoolsv.exe start cmd.exe" is also the same as tlntsess.exe in the preset task flow Starting the Shell program cmd.exe is inconsistent, so the task operation flow shown in Figure 3 does not conform to the preset operation flow and is therefore illegal.

In addition, if the malicious attack code does not choose to inject spoolsv.exe but starts and injects into tlntsess.exe, and then executes the operation of starting the shell program cmd.exe, can it be determined that this operation is legal? Still can't, because tlntsess.exe in the default legal process must be started by tlntsvr.exe to be legal, not any other service or program.

Therefore, in operation S106 of the present disclosure, it is also necessary to determine whether the execution body of each operation is consistent with the execution body of the operation corresponding to the preset operation flow. If they are not consistent, the entire operation flow is considered illegal.

In order to more accurately determine whether the operation process is legal, you can also add the step of "determine whether the execution object of each operation" is legal, its principle and "determine whether the execution subject of each operation is the execution subject of the operation corresponding to the preset operation flow The same, so I won’t repeat them here.

Through operation S106 of the present disclosure, it is possible to accurately screen the execution subject and the specific operation of "not passed the judgment of the first authority set" but "passed the judgment of the second authority set" to determine that it is a "false positive" Still "there is indeed a security threat." Therefore, when it is determined that the operation flow does not satisfy the preset operation flow, the execution subject or its corresponding specific operation may be fully deemed to have a security threat, that is, the execution subject is intercepted to interrupt the specific operation to be performed; When the operation flow satisfies the preset operation flow, it can be fully determined that there is a "false positive" phenomenon in operation S102, and the execution subject and the corresponding specific operation are "released" so that the execution subject performs the specific operation.

However, based on the examples in Figure 2 and Figure 3, if the hacker's remote attack is completed, first control tlntsvr.exe, and then call tlntsess.exe through tlntsvr.exe, and then control tlntsess.exe to start the shell, thereby bypassing the above operation S106 To determine the operation flow. Therefore, the present disclosure further introduces operations S107 to S108.

S107: Obtain an instruction execution sequence corresponding to at least one operation in the task.

The “task” in operation S107 of the present disclosure is a task including a specific operation mentioned earlier in the present disclosure. The present disclosure obtains at least one operation from the task (the operation may be a specific operation or other operations in the task), and obtains an instruction execution sequence corresponding to the execution of the operation. Specifically, the instruction execution sequence of the present disclosure is obtained from the stack memory in the operating system (the stack memory is automatically allocated, used, and recycled by the operating system, and cannot be controlled by the user).

S108. Determine whether the instruction execution sequence matches the preset instruction execution sequence, and if not, process the execution body.

The preset instruction execution sequence in operation S108 of the present disclosure refers to a legal instruction execution sequence. The instruction execution sequence acquired from the stack memory and the preset instruction execution sequence are matched to determine whether the instruction execution sequence acquired from the stack memory is legal, and then determine whether the corresponding operation is legal. Specifically, in the matching process, one embodiment of the present disclosure is to obtain the function call information in the instruction execution sequence. The function call information includes the number of function calls (if a function is called 0 times, it means that the function is not Call) and/or function call sequence to determine whether the function call information in the instruction execution sequence matches the function call information in the preset instruction execution sequence. If the match is successful, the specific operation performed by the execution subject is released, otherwise, the specific operation performed by the execution subject is intercepted.

Table 1 schematically shows the legal instruction execution sequence of “remote start Shell program cmd.exe” in the embodiment of the present disclosure:

Table 1

It should be noted that the order in which the instruction execution sequence is stored in the stack memory is opposite to the order in which it is executed. For convenience of description, Table 1 is described from the top to the bottom of the execution order. The following describes the instruction execution sequence 1 and instructions in Table 1 Execute sequence 2 to explain some of the key instructions, as shown in Table 2:

Table 2

As can be seen from Table 1 and Table 2, when the (legal) operation is executed, the instruction execution sequence is clear. Each call is from tlntsvr and tlntsess itself or the system API call. From the execution sequence of each layer of the call stack, you can clearly see each key link in each service or program, the start of key tasks, the upper and lower The connection of the relationship and the context of the process.

However, for the same completed task "remote start Shell program cmd.exe", hackers attacked the system remotely after gaining system control of the server, called tlntsess.exe through tlntsvr.exe, and then controlled tlntsess.exe to start the Shell program cmd.exe, as shown in Table 3, Table 3 schematically shows an illegal instruction execution sequence of "remote start Shell program cmd.exe" in the embodiment of the present disclosure:

tlntsvr.exe instruction execution sequence when starting tlntsess.exeThree	tlntsess.exe command execution sequence when starting cmd.exe 4
ntdll! RtlInitializeExceptionChain	ntdll! RtlInitializeExceptionChain
ntdll! RtlInitializeExceptionChain	ntdll! RtlInitializeExceptionChain
kernel32! BaseThreadInitThunk	kernel32! BaseThreadInitThunk
0x70ce1163	0x730711b0
kernel32! CreateProcessW	kernel32! CreateProcessW

table 3

It can be clearly seen by comparing Table 1 and Table 3 that the "remote start Shell program cmd.exe" shown in Table 1 needs to be "tlntsvr.exe start tlntsess.exe", "tlntsess.exe start cmd.exe" two Operations. The "remote start Shell program cmd.exe" shown in Table 3, in order to simulate the normal task process to complete the task "remote start Shell program cmd.exe", also need to perform "tlntsvr.exe start tlntsess.exe" , "Tlntsess.exe start cmd.exe" two operations, the operation process is consistent. But by analyzing the instruction execution sequence in the stack memory, the two are completely different, and there is not even any similarities. It can also be seen from Table 3 that the illegal instruction execution sequence is directly started by a separate thread, and then the corresponding program is started from a non-system code space address, from which it is impossible to see the instructions that should occur when normal operation occurs And the calling sequence, the illegal and abnormal are clearly arguable.

Referring again to the legal instruction execution sequence 1 shown in Table 1, one of the instructions is "kernel32! CreateProcessW", which means: "The function "CreateProcessW" in the dynamic link library "kernel32.dll" is called Once, and the function of calling this function is to “start a specified program.” Therefore, when determining whether the instruction execution sequence matches the preset instruction execution sequence, the present disclosure can be matched by the function call information in the respective sequence, Including whether the functions with different functions have been called, the number of calls and the order of calls.

It can be seen from operations S107-S108 of the embodiment of the present disclosure that after the operation flow of the task passes the determination of S106, the legality of the instruction execution sequence of the task is further determined. When the instruction execution sequence passes the determination, the initial The execution subject and its specific operation in S101 are legal, and then it is released; otherwise, the execution subject and its specific operation are intercepted. Therefore, S107 ~ S108 further ensure the safety of operation. FIG. 4 schematically shows a block diagram of an operation detection system according to an embodiment of the present disclosure.

As shown in FIG. 4, the operation detection system 400 includes a first acquisition module 410, a first judgment module 420, a second acquisition module 430, a second judgment module 440, a third acquisition module 450, a third judgment module 460, and a fourth acquisition Module 470 and fourth judgment module 480. The operation detection system 400 may perform the method described above with reference to FIG. 1 to implement detection of specific operations.

Specifically, the first obtaining module 410 is used to obtain the executing subject performing the specific operation before performing the specific operation; the first determining module 420 is used to determine whether the executing subject has the right to perform the specific operation according to the first set of permissions, If not, the second obtaining module 430 is executed; the second obtaining module 430 is used to obtain the operating state of the executing subject, and obtains the corresponding second permission set according to the operating state of the executing subject; Two sets of permissions determine whether the execution subject has the permission to perform the specific operation. If yes, the third acquisition module 450 is executed; if not, the execution subject is processed; the third acquisition module 450 is used to acquire the task including the specific operation , The task corresponds to an operation flow for performing at least one operation; the third determination module is used to determine whether the operation flow satisfies the preset operation flow, if yes, execute the fourth acquisition module, and if not, perform on the execution subject Processing; the fourth obtaining module is used to obtain the instruction execution sequence corresponding to at least one operation in the task; the fourth judging module is used to judge whether the instruction execution sequence matches the preset instruction execution sequence, and if not, the execution body is processed .

It can be understood that the first acquisition module 410, the first judgment module 420, the second acquisition module 430, the second judgment module 440, the third acquisition module 450, the third judgment module 460, the fourth acquisition module 470, and the fourth judgment The module 480 may be combined and implemented in one module, or any one of the modules may be split into multiple modules. Alternatively, at least part of functions of one or more of these modules may be combined with at least part of functions of other modules and implemented in one module. According to an embodiment of the present invention, the first acquisition module 410, the first judgment module 420, the second acquisition module 430, the second judgment module 440, the third acquisition module 450, the third judgment module 460, the fourth acquisition module 470 and the third At least one of the four judgment modules 480 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on chip, a system on a substrate, a system on a package, a dedicated An integrated circuit (ASIC) may be implemented in any other reasonable manner such as hardware or firmware that integrates or encapsulates the circuit, or an appropriate combination of software, hardware, and firmware. Alternatively, the first acquisition module 410, the first judgment module 420, the second acquisition module 430, the second judgment module 440, the third acquisition module 450, the third judgment module 460, the fourth acquisition module 470 and the fourth judgment module 480 At least one of can be at least partially implemented as a computer program module, and when the program is run by a computer, the function of the corresponding module can be performed.

FIG. 5 schematically shows a block diagram of an electronic device according to another embodiment of the present disclosure.

As shown in FIG. 5, the electronic device 500 includes a processor 510 and a computer-readable storage medium 520. The electronic device 500 may perform the method described above with reference to FIG. 1 to implement detection of specific operations.

Specifically, the processor 510 may include, for example, a general-purpose microprocessor, an instruction set processor and/or related chipsets, and/or a dedicated microprocessor (for example, an application specific integrated circuit (ASIC)), and so on. The processor 510 may also include on-board memory for caching purposes. The processor 510 may be a single processing unit or a plurality of processing units for performing different actions of the method flow according to the embodiment of the present disclosure described with reference to FIG. 1.

The computer-readable storage medium 520 may be, for example, any medium capable of containing, storing, transmitting, transmitting, or transmitting instructions. For example, readable storage media may include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, devices, or propagation media. Specific examples of readable storage media include: magnetic storage devices such as magnetic tapes or hard disks (HDD); optical storage devices such as compact disks (CD-ROM); memories such as random access memory (RAM) or flash memory; and/or wired /Wireless communication link.

The computer-readable storage medium 520 may include a computer program 521, which may include code/computer-executable instructions, which when executed by the processor 510, cause the processor 510 to perform, for example, the method flow described above in connection with FIG. 1 and Any deformation.

The computer program 521 may be configured to have computer program code including, for example, computer program modules. For example, in an example embodiment, the code in the computer program 521 may include one or more program modules, for example, including 521A, module 521B,... It should be noted that the division mode and number of modules are not fixed, and those skilled in the art may use appropriate program modules or program module combinations according to actual situations. When these program module combinations are executed by the processor 510, the processor 510 may be For example, the method flow described above in connection with FIGS. 2 to 3D and any variations thereof are performed.

According to an embodiment of the present invention, at least one of the first acquisition module 410, the first judgment module 420, the second acquisition module 430, the second judgment module 440, the third acquisition module 450, and the third judgment module 460 may be implemented as a reference The computer program module described in FIG. 5, when executed by the processor 510, can implement the corresponding operations described above.

Those skilled in the art may understand that the features described in the various embodiments and/or claims of the present disclosure may be combined or combined in various ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, the features recited in the various embodiments and/or claims of the present disclosure may be combined and/or combined in various ways without departing from the spirit and teachings of the present disclosure. All of these combinations and/or combinations fall within the scope of this disclosure.

Although the present disclosure has been shown and described with reference to specific exemplary embodiments of the present disclosure, those skilled in the art should understand that without departing from the spirit and scope of the present disclosure as defined by the appended claims and their equivalents, Various changes in form and details are made to the present disclosure. Therefore, the scope of the present disclosure should not be limited to the above-described embodiments, but should be determined not only by the appended claims but also by the equivalents of the appended claims.

Claims (28)

1. An operation detection method, including:

   S1, before performing a specific operation, obtain an execution subject performing the specific operation;

   S2, judging whether the execution subject has the authority to perform the specific operation according to the first authority set, and if not, performing operation S3;

   S3. Obtain the operation state of the execution subject, and obtain the corresponding second permission set according to the operation state of the execution subject;

   S4: Determine whether the execution subject has the authority to perform the specific operation according to the second permission set, if yes, perform operation S5, and if not, process the execution subject;

   S5. Obtain a task including the specific operation, and the task corresponds to an operation flow for performing at least one operation;

   S6. Determine whether the operation flow satisfies the preset operation flow. If yes, perform operation S7; if not, process the execution body;

   S7, obtaining an instruction execution sequence corresponding to at least one operation in the task;

   S8: Determine whether the instruction execution sequence matches the preset instruction execution sequence, and if not, process the execution subject.
2. The operation detection method according to claim 1, wherein in step S6, determining whether the operation flow satisfies a preset operation flow includes:

   Acquiring at least one operation corresponding to the operation flow;

   Judging whether each operation in the at least one operation is consistent with the corresponding operation in the preset operation flow.
3. The operation detection method according to claim 2, wherein the judging whether each operation in the at least one operation is consistent with a corresponding operation in the preset operation flow includes:

   It is determined whether the execution subject of each operation in the at least one operation is consistent with the execution subject of the operation corresponding to the preset operation flow.
4. The operation detection method according to any one of claims 1-3, wherein before the step S1, further comprising:

   S0. Create a first permission set, where the first permission set includes operation permissions of at least one execution subject in any operation state.
5. The operation detection method according to any one of claims 1-4, wherein before the step S1, further comprising:

   S0', creating at least one second permission set, where each second permission set corresponds to an operation state of an execution subject, and each second permission set includes the corresponding execution subject in the corresponding operation state Operation authority.
6. The operation detection method according to claim 5, wherein the at least one second permission set is stored at the remote end, and in step S3, obtaining the corresponding second permission set according to the operation state of the execution subject includes:

   Send a request to the far end, the request includes the execution subject information and its operation status;

   Acquire a second permission set sent by the remote end, where the second permission set is returned by the remote end in response to the request.
7. The operation detection method according to any one of claims 1 to 6, wherein in step S3, obtaining the operation state of the execution subject includes at least:

   The operation state of the execution body is determined according to the calling method of the execution body, wherein when the execution body is directly called by the user, it is determined that the operation state of the execution body is the first operation state, and when the execution body is When called by another execution subject, it is determined that the operation state of the execution subject is the second operation state.
8. The operation detection method according to claim 1, wherein in step S8, determining whether the instruction execution sequence matches a preset instruction execution sequence includes:

   Acquiring function call information in the instruction execution sequence, the function call information including the number of function calls and/or the order of function calls;

   It is determined whether the function call information in the instruction execution sequence matches the function call information in the preset instruction execution sequence.
9. The operation detection method according to any one of claims 1-7, wherein in step S7, obtaining an instruction execution sequence corresponding to at least one operation in the task includes:

   Obtain the instruction execution sequence corresponding to at least one operation in the task from the stack memory.
10. An operation detection system, including:

    The first obtaining module is used to obtain an execution subject performing the specific operation before performing the specific operation;

    The first judgment module is used to judge whether the execution subject has the authority to perform the specific operation according to the first authority set; if not, execute the second acquisition module;

    A second obtaining module, configured to obtain the operation state of the execution subject, and obtain the corresponding second permission set according to the operation state of the execution subject;

    The second judgment module is used to judge whether the execution subject has the authority to perform the specific operation according to the second permission set, if yes, execute the third acquisition module, and if not, process the execution subject;

    A third acquiring module, configured to acquire a task including the specific operation, and the task corresponds to an operation process for performing at least one operation;

    A third judgment module, used to judge whether the operation flow satisfies the preset operation flow, if yes, execute the fourth acquisition module, if not, process the execution subject;

    A fourth obtaining module, configured to obtain an instruction execution sequence corresponding to at least one operation in the task;

    The fourth judgment module is used for judging whether the instruction execution sequence matches the preset instruction execution sequence, and if not, processing the execution subject.
11. The operation detection system according to claim 10, wherein, in the third determination module, determining whether the operation flow satisfies a preset operation flow includes:

    Acquiring at least one operation corresponding to the operation flow;

    Judging whether each operation in the at least one operation is consistent with the corresponding operation in the preset operation flow.
12. The operation detection system according to claim 11, wherein the third determination module determines whether each operation in the at least one operation is consistent with a corresponding operation in the preset operation flow, including:

    It is determined whether the execution subject of each operation in the at least one operation is consistent with the execution subject of the operation corresponding to the preset operation flow.
13. The operation detection system according to any one of claims 10-12, further comprising:

    The first creation module is used to create a first permission set, where the first permission set includes at least one operating subject's operating permission in any operating state.
14. The operation detection system according to any one of claims 9-13, further comprising:

    A second creation module, configured to create at least one second permission set, wherein each second permission set corresponds to an operation state of an execution subject, and each second permission set includes a corresponding execution subject in a corresponding Operation authority in operation state.
15. The operation detection system according to claim 14, wherein the at least one second permission set is stored at a remote end, and the second obtaining module obtains the corresponding second permission set according to the operating state of the execution subject, including:

    Send a request to the far end, the request includes the execution subject information and its operation status;

    Acquire a second permission set sent by the remote end, where the second permission set is returned by the remote end in response to the request.
16. The operation detection system according to any one of claims 10-15, wherein the second acquisition module acquiring the operation state of the execution subject includes at least:

    The operation state of the execution body is determined according to the calling method of the execution body, wherein when the execution body is directly called by the user, it is determined that the operation state of the execution body is the first operation state, and when the execution body is When called by another execution subject, it is determined that the operation state of the execution subject is the second operation state.
17. The operation detection system according to claim 10, wherein the fourth determination module determines whether the instruction execution sequence matches a preset instruction execution sequence, including:

    Acquiring function call information in the instruction execution sequence, the function call information including the number of function calls and/or the order of function calls;

    It is determined whether the function call information in the instruction execution sequence matches the function call information in the preset instruction execution sequence.
18. The operation detection system according to any one of claims 10-17, wherein the fourth acquisition module acquiring the instruction execution sequence corresponding to at least one operation in the task includes:

    Obtain the instruction execution sequence corresponding to at least one operation in the task from the stack memory.
19. An electronic device, including:

    processor:

    The memory stores computer-executable instructions, which when executed by the processor, causes the processor to execute:

    S1, before performing a specific operation, obtain an execution subject performing the specific operation;

    S2, judging whether the execution subject has the authority to perform the specific operation according to the first authority set, and if not, performing operation S3;

    S3. Obtain the operation state of the execution subject, and obtain the corresponding second permission set according to the operation state of the execution subject;

    S4: Determine whether the execution subject has the authority to perform the specific operation according to the second permission set, if yes, perform operation S5, and if not, process the execution subject;

    S5. Obtain a task including the specific operation, and the task corresponds to an operation flow for performing at least one operation;

    S6, judging whether the operation flow satisfies the preset operation flow, if yes, performing operation S7; if not, processing the execution body;

    S7, obtaining an instruction execution sequence corresponding to at least one operation in the task;

    S8: Determine whether the instruction execution sequence matches the preset instruction execution sequence, and if not, process the execution subject.
20. The electronic device according to claim 19, wherein when the processor executes step S6, determining whether the operation flow satisfies a preset operation flow includes:

    Acquiring at least one operation corresponding to the operation flow;

    Judging whether each operation in the at least one operation is consistent with the corresponding operation in the preset operation flow.
21. The electronic device according to claim 20, wherein the processor determining whether each operation in the at least one operation is consistent with a corresponding operation in the preset operation flow includes:

    It is determined whether the execution subject of each operation in the at least one operation is consistent with the execution subject of the operation corresponding to the preset operation flow.
22. The electronic device according to any one of claims 19-21, wherein, before executing the step S1, the processor further executes:

    S0. Create a first permission set, where the first permission set includes operation permissions of at least one execution subject in an arbitrary operation state.
23. The electronic device according to any one of claims 19-22, wherein before performing the step S1, the processor further executes:

    S0', creating at least one second permission set, where each second permission set corresponds to an operation state of an execution subject, and each second permission set includes the corresponding execution subject in the corresponding operation state Operation authority.
24. The electronic device according to claim 23, wherein the at least one second permission set is stored at the remote end, and when the processor executes the step S3, the corresponding second permission is obtained according to the operating state of the execution subject Collection, including:

    Send a request to the far end, the request includes the execution subject information and its operation status;

    Acquire a second permission set sent by the remote end, where the second permission set is returned by the remote end in response to the request.
25. The electronic device according to any one of claims 19-24, wherein when the processor executes the step S3, acquiring the operation state of the execution subject includes at least:

    The operation state of the execution body is determined according to the calling method of the execution body, wherein when the execution body is directly called by the user, it is determined that the operation state of the execution body is the first operation state, and when the execution body is When called by another execution subject, it is determined that the operation state of the execution subject is the second operation state.
26. The electronic device according to claim 19, wherein when the processor executes step S8, determining whether the instruction execution sequence matches a preset instruction execution sequence includes:

    Acquiring function call information in the instruction execution sequence, the function call information including the number of function calls and/or the order of function calls;

    It is determined whether the function call information in the instruction execution sequence matches the function call information in the preset instruction execution sequence.
27. The electronic device according to any one of claims 19 to 26, wherein when the processor executes step S7, acquiring the instruction execution sequence corresponding to at least one operation in the task includes:

    Obtain the instruction execution sequence corresponding to at least one operation in the task from the stack memory.
28. A computer-readable medium storing computer-executable instructions, which when executed are used to implement the method according to any one of claims 1-9.

Images