CN105138366A - Recognition software silent installation method and device - Google Patents
Recognition software silent installation method and device Download PDFInfo
- Publication number
- CN105138366A CN105138366A CN201510524452.4A CN201510524452A CN105138366A CN 105138366 A CN105138366 A CN 105138366A CN 201510524452 A CN201510524452 A CN 201510524452A CN 105138366 A CN105138366 A CN 105138366A
- Authority
- CN
- China
- Prior art keywords
- software
- information
- installation kit
- silence
- mourning
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Landscapes
- Stored Programmes (AREA)
Abstract
The invention provides a recognition software silent installation method and device. One or more pieces of process behavior information in the recognized installation package process running period are obtained, and if the obtained process behavior information meets preset conditions, it is determined that the installation package process executes silent installation. The method and device can recognize silently installed software. By means of the method and device, prompt information of the software executing silent installation can also be presented to users so that the users can clearly know the software installed in a silent installation mode. Furthermore, the method and device also can assist the users in uninstalling the software to reduce the probability that user computers are damaged.
Description
Technical field
The present invention relates to areas of information technology, particularly relate to a kind of technology of installing of mourning in silence of identification software.
Background technology
Current, most of software can make prompting to user in installation process, such as, show to user the process that software is installed by graphic user interface.User also can by the installation procedure selecting the exit button in graphic user interface to stop software.
But some softwares (such as bundled software) do not make any prompting to user in installation process.The mounting means of this software can be called as " installation of mourning in silence ".User usually cannot be understood these softwares installed of mourning in silence and when be, by what mode installed in a computer.Further, user easily produces dislike mood to this software installed of mourning in silence.Even, some softwares installed of mourning in silence may work the mischief to the computing machine of user.
According to the dbase of the problem software recorded, prior art judges whether a software has problems usually, such as, judge whether a software belongs to bundled software according to the dbase of the bundled software recorded.The problem of prior art is, for emerging problem software, owing to not yet recording its dbase, prior art successfully cannot identify it in the very first time.Therefore, the technology of existing identification problem software has certain hysteresis quality, and it cannot identify emerging problem software at short notice.The present invention identifies according to the process behavior information of installation kit process the software performing and mourn in silence and install.As long as the process behavior information of installation kit process meets predetermined condition, then this installation kit process can be determined that execution is mourned in silence installation.Therefore, whether the dbase of the software installed of no matter mourning in silence is recorded, and the present invention all can successfully identify its installation kit process.
Namely the installation kit process of installing of mourning in silence usually directly can be regarded as and belonged to suspicious process.Even, because the installation kit process of most of bundled software performs installation of mourning in silence, therefore, namely the software corresponding to process that performing mourns in silence installs can directly be regarded as usually belongs to bundled software.In addition, the present invention can also carry out other identifying processings (such as identifying according to black/white list) to performing the installation kit process of installing of mourning in silence, to determine whether this installation kit process has problems more accurately, such as, determine whether this software corresponding to installation kit process belongs to bundled software more accurately.
Summary of the invention
The object of this invention is to provide a kind of method and apparatus installed of mourning in silence of identification software.
According to an aspect of the present invention, provide a kind of method of installing of mourning in silence of identification software, wherein, the method comprises:
-identify installation kit process;
-obtain one or more process behavior information of described installation kit process run duration;
If-described process behavior information meets predetermined condition, determine that described installation kit process performs installation of mourning in silence;
Wherein, described predetermined condition comprises:
-described process behavior packets of information installs behavioural information containing software;
-described process behavior information does not comprise user interface and calls behavioural information.
According to another aspect of the present invention, additionally provide a kind of device installed of mourning in silence of identification software, wherein, this device comprises:
-for identifying the device of installation kit process;
-for obtaining the device of one or more process behavior information of described installation kit process run duration;
If-meet predetermined condition for described process behavior information, determine that described installation kit process performs the device of mourning in silence and installing;
Wherein, described predetermined condition comprises:
-described process behavior packets of information installs behavioural information containing software;
-described process behavior information does not comprise user interface and calls behavioural information.
Compared with prior art, the present invention obtains one or more process behavior information of the installation kit process run duration identified, and if the process behavior information obtained meets predetermined condition, then determines that installation kit process performs installation of mourning in silence.The present invention can identify the software of mourning in silence and installing.The present invention can also present this software to user and perform the information of mourning in silence and installing, and is well understood to by software that mounting means of mourning in silence is installed to make user.Further, the present invention can also assisted user unload this software with reduce its to subscriber computer produce harm possibility.
Accompanying drawing explanation
By reading the detailed description done non-limiting example done with reference to the following drawings, other features, objects and advantages of the present invention will become more obvious:
Fig. 1 illustrates a kind of according to an embodiment of the invention method flow diagram installed of mourning in silence of identification software;
Fig. 2 illustrates a kind of according to an embodiment of the invention device schematic diagram installed of mourning in silence of identification software.
In accompanying drawing, same or analogous Reference numeral represents same or analogous parts.
Embodiment
Before in further detail exemplary embodiment being discussed, it should be mentioned that some exemplary embodiments are described as the process or method described as process flow diagram.Although operations is described as the process of order by process flow diagram, many operations wherein can be implemented concurrently, concomitantly or simultaneously.In addition, the order of operations can be rearranged.Described process can be terminated when its operations are completed, but can also have the additional step do not comprised in the accompanying drawings.Described process can correspond to method, function, code, subroutine, subroutine etc.
Within a context alleged " computer equipment ", also referred to as " computer ", refer to the intelligent electronic device that can be performed the predetermined process such as numerical evaluation and/or logical calculated process by operation preset program or instruction, it can comprise processor and storer, the programmed instruction that prestores in memory is performed to perform predetermined process process by processor, or perform predetermined process process by the hardware such as ASIC, FPGA, DSP, or combined by said two devices and realize.Computer equipment includes but not limited to server, PC, notebook computer, panel computer, smart mobile phone etc.
Described computer equipment such as comprises subscriber equipment and the network equipment.Wherein, described subscriber equipment includes but not limited to PC, notebook computer etc.; The described network equipment includes but not limited to the server group that single network server, multiple webserver form or the cloud be made up of a large amount of computing machine or the webserver based on cloud computing (CloudComputing), wherein, cloud computing is the one of Distributed Calculation, the super virtual machine be made up of a group loosely-coupled computing machine collection.Wherein, described computer equipment isolated operation can realize the present invention, also accessible network by realizing the present invention with the interactive operation of other computer equipments in network.Wherein, the network residing for described computer equipment includes but not limited to internet, wide area network, Metropolitan Area Network (MAN), LAN (Local Area Network), VPN etc.
It should be noted that; described subscriber equipment, the network equipment and network etc. are only citing; other computer equipments that are existing or that may occur from now on or network, as being applicable to the present invention, within also should being included in scope, and are contained in this with way of reference.
The method (some of them are illustrated by process flow diagram) discussed herein can be implemented by hardware, software, firmware, middleware, microcode, hardware description language or its combination in any.When implementing by software, firmware, middleware or microcode, program code or code segment in order to implement necessary task can be stored in machine or computer-readable medium (such as storage medium).(one or more) processor can implement necessary task.
Concrete structure disclosed herein and function detail are only representational, and are the objects for describing exemplary embodiment of the present invention.But the present invention can carry out specific implementation by many replacement forms, and should not be construed as only being limited to the embodiments set forth herein.
Should be understood that, although may have been used term " first ", " second " etc. here to describe unit, these unit should not limit by these terms.These terms are used to be only used to a unit and another unit to distinguish.For example, when not deviating from the scope of exemplary embodiment, first module can be called as second unit, and second unit can be called as first module similarly.Here used term "and/or" comprise one of them or more any and all combinations of listed associated item.
Here used term is only used to describe specific embodiment and be not intended to limit exemplary embodiment.Unless context refers else clearly, otherwise singulative used here " ", " one " are also intended to comprise plural number.It is to be further understood that, the existence of the feature that term used here " comprises " and/or " comprising " specifies to state, integer, step, operation, unit and/or assembly, and do not get rid of and there is or add other features one or more, integer, step, operation, unit, assembly and/or its combination.
Also it should be mentioned that and to replace in implementation at some, the function/action mentioned can according to being different from occurring in sequence of indicating in accompanying drawing.For example, depend on involved function/action, in fact the two width figure in succession illustrated can perform simultaneously or sometimes can perform according to contrary order substantially.
Below in conjunction with accompanying drawing, the present invention is described in further detail.
The present invention can be realized by subscriber equipment.Particularly, subscriber equipment identification installation kit process; Subsequently, subscriber equipment obtains one or more process behavior information of this installation kit process run duration; Then, if the process behavior information obtained meets predetermined condition, subscriber equipment determines that this installation kit process performs installation of mourning in silence, wherein, described predetermined condition comprises: process behavior packets of information installs behavioural information containing software, and process behavior information does not comprise user interface and calls behavioural information.
Preferably, the solution of the present invention can by install and the application program run in subscriber equipment realizes.Further, the solution of the present invention can be in the application integrated as a functional module.
Those skilled in the art will be understood that the present invention program at least can carry out at following 2 kinds of time points:
1) the present invention program can start to carry out at the run duration of process.
At this, at the run duration of process, subscriber equipment such as can monitor the process creation behavioural information of this process in real time, to identify whether this process belongs to installation kit process.Subsequently, subscriber equipment can obtain one or more process behavior information of identified installation kit process run duration.Then, if the process behavior information obtained meets predetermined condition, subscriber equipment can determine that corresponding installation kit process performs installation of mourning in silence.
Wherein, process behavior information includes but not limited to the information of the various behavior for representing process.
2) the present invention program can the random time after process terminates start to carry out.
At this, at the run duration of process, all or part of behavior record of this process can be such as one or more process behavior information of this process by subscriber equipment.Subsequently, the random time after process terminates, one or more process behavior information of the installation kit process run duration that subscriber equipment is recorded before can being obtained by the mode read.Subsequently, if the process behavior information obtained meets predetermined condition, subscriber equipment can determine that corresponding installation kit process performs installation of mourning in silence.
Fig. 1 illustrates method flow diagram according to an embodiment of the invention, and it specifically illustrates a kind of process of installing of mourning in silence of identification software.As shown in Figure 1, in step sl, subscriber equipment identification installation kit process; In step s 2, subscriber equipment obtains one or more process behavior information of this installation kit process run duration; In step s3, if the process behavior information obtained meets predetermined condition, subscriber equipment determines that this installation kit process performs installation of mourning in silence, wherein, described predetermined condition comprises: process behavior packets of information installs behavioural information containing software, and process behavior information does not comprise user interface and calls behavioural information.
Particularly, in step sl, subscriber equipment identification installation kit process.
At this, subscriber equipment determines whether one or more process belongs to installation kit process.The described installation kit process software meant corresponding to it is the process of installation kit software.
Subscriber equipment at least can by following 2 kinds of mode identification installation kit processes:
1) header information that whether subscriber equipment can comprise transplantable perform bulk (PortableExecutable, PE) file by the software corresponding to detection procedure determines whether this process belongs to installation kit process.
At this, if the software package corresponding to process is containing the header information of PE file, then this process belongs to installation kit process.If the software corresponding to process does not comprise the header information of PE file, then this process does not belong to installation kit process.
2) suffix name that whether subscriber equipment can be the PE files such as exe, com by the file suffixes name of the software corresponding to query procedure determines whether this process belongs to installation kit process.
At this, if the file suffixes of the software corresponding to process is called the suffix name of any one PE file, then this process belongs to installation kit process.If the suffix name of the file suffixes name of the software corresponding to process any one PE file non-, then this process does not belong to installation kit process.
For the process not belonging to installation kit process, subscriber equipment does not then carry out subsequent processing steps to this process.
Those skilled in the art will be understood that step S1 at least can carry out at following 2 kinds of time points:
1) step S1 can carry out at the run duration of process.
Preferably, subscriber equipment can create behavioural information, to identify installation kit process by monitoring process.
At this, process creation behavioural information includes but not limited to the various information for representing the behavior that process is created.Process creation behavioural information belongs to a kind of process behavior information.Process creation behavioural information such as process creation terminates the operation information with Registry Modifications.
At this, subscriber equipment such as can be included in and drive layer to carry out driving the driving monitoring unit of monitoring and the progress recognizing unit in application layer identification installation kit process.Monitoring unit is driven to monitor and the behavior of record the process, and by recorded process creation behavioural information upthrow to process recognition unit.After acquisition process creation behavioural information, progress recognizing unit according to process creation behavioural information, can obtain the software corresponding to this process.Such as, the store path of the software corresponding to this process is comprised in process creation behavioural information.Then, progress recognizing unit can identify the software corresponding to this process according to the mode of any one identification installation kit process aforementioned, to determine whether this process belongs to installation kit process.
2) step S1 can the random time after process terminates carry out.
At this, at the run duration of process, subscriber equipment such as can be monitored all or part of behavior of this process and record the process behavior information of this process.Subsequently, the random time after process terminates, subscriber equipment according to the process behavior information of recorded process, can obtain the software corresponding to this process.Such as, the store path of the software corresponding to this process is comprised in process behavior information.Then, subscriber equipment can identify the software corresponding to process according to the mode of any one identification installation kit process aforementioned, to determine whether this process belongs to installation kit process.
In step s 2, subscriber equipment obtains one or more process behavior information of this installation kit process run duration.
At this, if step S1 carries out at the run duration of process, subscriber equipment can the various actions of monitoring process to obtain the process behavior information of this process.
Alternately, if step S1 carries out after process terminates, subscriber equipment can obtain process behavior information recorded before this by the mode read in step s 2.Such as, the process behavior information of process run duration can be kept in a file of local disk by subscriber equipment.In step s 2, subscriber equipment can obtain the process behavior information of process by reading this file.
In step s3, if the process behavior information obtained meets predetermined condition, subscriber equipment determines that this installation kit process performs installation of mourning in silence.
Wherein, described predetermined condition comprises following 2:
1) described predetermined condition comprises process behavior packets of information containing software installation behavioural information.
Wherein, software installation behavior packets of information is drawn together but is not limited to the information of the various expression behavior relevant to the installation of software.
Subscriber equipment can install behavioural information according to predetermined one or more software, analyzes the process behavior information of installation kit process, to determine that whether comprising software in process behavior information installs behavioural information.If the process behavior packets of information of installation kit process installs behavioural information containing software, then subscriber equipment can determine that this installation kit process performs installation behavior.
Preferably, described software is installed behavior packets of information and is drawn together Registry Modifications behavioural information.
Wherein, described Registry Modifications behavioural information includes but not limited to the information of various expression to the behavior that registration table is modified.
Described Registry Modifications behavioural information includes but not limited to following any one:
I) startup item act of revision information.
At this, startup item act of revision information includes but not limited to the behavioural information that various expression is modified to startup item in registration table.
Ii) item act of revision information is unloaded.
At this, startup item act of revision information includes but not limited to that various expression is to the behavioural information unloading item in registration table and modify.
Iii) service entry act of revision information.
At this, startup item act of revision information includes but not limited to the behavioural information that various expression is modified to service entry in registration table.
Iv) plan target act of revision information.
At this, startup item act of revision information includes but not limited to that various expression is to the behavioural information of planning task items in registration table and modifying.
2) described predetermined condition comprises process behavior information and does not comprise user interface and call behavioural information.
At this, user interface is called behavioural information and is included but not limited to the information of various expression to the behavior of calling of user interface.Described user interface such as graphic user interface, Command Line Interface etc.
At this, process is carried out alternately with user by invoke user interface usually, to point out the various information relevant with this process to user.Such as, installation kit process shows installation process by invoke user interface to user usually.
Subscriber equipment can call behavioural information according to predetermined user interface, analyzes the process behavior information of installation kit process, to determine that whether comprising user interface in process behavior information calls behavioural information.If the process behavior information of process does not comprise user interface call behavioural information, then subscriber equipment can determine that this installation kit process is the process of mourning in silence.Also namely, user cannot understand the implementation of this installation kit process.
In sum, the process behavior packets of information of installation kit process installs behavioural information containing software---represent that this installation kit process performs installation behavior.And the process behavior information of installation kit process does not comprise user interface calls behavioural information---represent that this installation kit process is the process of mourning in silence.When process behavior information meets this two predetermined conditions, subscriber equipment can determine that this installation kit process performs installation of mourning in silence.Also namely, subscriber equipment can determine that this software corresponding to installation kit process is the software installed of mourning in silence.
At this, installation kit process needs to carry out alternately, such as, showing the process of installation to user with user by invoke user interface usually.Therefore, owing to not coming to carry out alternately with user by invoke user interface, namely the installation kit process that performing mourns in silence installs can directly be regarded as usually belongs to suspicious process.Even, because the installation kit process of most of bundled software performs installation of mourning in silence, therefore, namely the software corresponding to installation kit process that performing mourns in silence installs can directly be regarded as usually belongs to bundled software.
In addition, subscriber equipment can also carry out other identifying processings (such as identifying according to black/white list) to performing the installation kit process of installing of mourning in silence, to determine whether this installation kit process has problems more accurately, such as, determine whether this software corresponding to installation kit process belongs to bundled software more accurately.
Preferably, subscriber equipment can also identify the software corresponding to installation kit process.Subsequently, subscriber equipment can also present to user the information that this software performs installation of mourning in silence.
Wherein, subscriber equipment can extract the process identity information of process from process behavior information.The title of described process identity information such as process, the installation path etc. of process.Subsequently, subscriber equipment can according to described process identity information, the corresponding relation of query procedure identification information and dbase, to determine the dbase corresponding to installation kit process.Wherein, the corresponding relation of process identity information and dbase can be kept at subscriber equipment this locality, also can be kept in the webserver.
At this, the information that subscriber equipment such as can present to user " indicating risk---XX software has just been arranged in your computer ", knows this " XX software " mounted fact to make user.
More preferably, subscriber equipment carries out after installation kit process terminates the step of the identification of software.
Subscriber equipment can identify the software corresponding to installation kit process after installation kit process terminates, and presents to user the information that this software performs installation of mourning in silence.At this, subscriber equipment does not disturb or tackles installation kit process, but identifies software after it terminates and present information to user.This processing mode to installation kit process avoids in prior art carries out tackling to installation kit process the problem that the system fault that may cause even collapses.
According to a preferred exemplary, subscriber equipment can also be bundled software according to black/white list identification software.
At this, described blacklist means wherein to comprise the catalogue of the dbase of the one or more softwares belonging to bundled software.Described blacklist such as can comprise some and pass through the dbase belonging to the software of bundled software confirmed.
Described white list means wherein to comprise the catalogue of the dbase of the one or more softwares not belonging to bundled software.Described white list such as can comprise the dbase of the well-known software of some renowned companies.Although these well-known softwares are also installed by the mode of installing of mourning in silence, but these well-known softwares are not bundled software.
Subscriber equipment according to the dbase of identified software, can inquire about aforementioned blacklist, to determine whether this software belongs to bundled software.If the dbase of the software identified is present in this blacklist, then this software belongs to bundled software.If the dbase of the software identified is not present in this blacklist, then this software can be identified as and not belong to bundled software.
Or subscriber equipment according to the dbase of identified software, can inquire about aforementioned white list, to determine whether this software belongs to bundled software.If the dbase of the software identified is present in this white list, then this software does not belong to bundled software.If the dbase of the software identified is not present in this white list, then this software can be identified as and belong to bundled software.
At this, as long as determine that an installation kit process performs installation of mourning in silence, and the software corresponding to this installation kit process is identified as bundled software according to black/white list by subscriber equipment, and the present invention can assert that this software belongs to bundled software, no matter and this software whether with another Software Bundling install.
Further, subscriber equipment can also determine by other means to perform mourn in silence the software corresponding to installation kit process installed whether with another Software Bundling install.
Such as, subscriber equipment can be determined to perform in a period of time before the installation kit process operation of mourning in silence and installing, and whether had the operation of other installation kit processes.For clearly demonstrating, at this, being called installation kit process B by performing the installation kit process of installing of mourning in silence, other installation kit processes run in a period of time before this installation kit process B runs are called installation kit process A.
Subscriber equipment such as can extract the process identity information of installation kit process A from the process behavior information of the installation kit process A recorded before this.Subsequently, subscriber equipment can according to the process identity information of the process identity information of installation kit process A and installation kit process B, and inquiry bundle relation table, to determine whether installation kit process A and installation kit process B has bundle relation.Wherein, multiple process identity information each other with the installation kit process of bundle relation is preserved in described bundle relation table.Such as, record installation kit process A and installation kit process B has bundle relation in described bundle relation table, then subscriber equipment can be determined to perform the installation kit process B that mourns in silence and install and another installation kit process A and installs with bundling.
According to another preferred exemplary, subscriber equipment according to the feedback of user to information, can also unload this software.
At this, the information that subscriber equipment presents such as can comprise the interactive button of " unloading suspect software ".When user selects this interactive button, subscriber equipment such as can run the Uninstaller of this software to unload this software.
Fig. 2 illustrates an apparatus in accordance with one embodiment of the invention schematic diagram, and it specifically illustrates a kind of device installed of mourning in silence of identification software, is also recognition device 10.As shown in Figure 2, recognition device 10 is installed in subscriber equipment, and specifically comprises device 11-13.
Device 11 identifies installation kit process (for ease of distinguishing, below device 11 being called installation kit progress recognizing device 11); Device 12 obtains one or more process behavior information (for ease of distinguishing, below device 12 being called behavioural information obtaining means 12) of this installation kit process run duration; If the process behavior information obtained meets predetermined condition, device 13 determines that this installation kit process performs installation of mourning in silence, wherein, described predetermined condition comprises: process behavior packets of information installs behavioural information containing software, and process behavior information do not comprise user interface call behavioural information (for ease of distinguish, below device 13 is called mourn in silence install determining device 13).
Particularly, installation kit progress recognizing device 11 identifies installation kit process.
At this, installation kit progress recognizing device 11 determines whether one or more process belongs to installation kit process.The described installation kit process software meant corresponding to it is the process of installation kit software.
Installation kit progress recognizing device 11 at least can by following 2 kinds of mode identification installation kit processes:
1) header information that whether installation kit progress recognizing device 11 can comprise transplantable perform bulk (PortableExecutable, PE) file by the software corresponding to detection procedure determines whether this process belongs to installation kit process.
At this, if the software package corresponding to process is containing the header information of PE file, then this process belongs to installation kit process.If the software corresponding to process does not comprise the header information of PE file, then this process does not belong to installation kit process.
2) suffix name that whether installation kit progress recognizing device 11 can be the PE files such as exe, com by the file suffixes name of the software corresponding to query procedure determines whether this process belongs to installation kit process.
At this, if the file suffixes of the software corresponding to process is called the suffix name of any one PE file, then this process belongs to installation kit process.If the suffix name of the file suffixes name of the software corresponding to process any one PE file non-, then this process does not belong to installation kit process.
For the process not belonging to installation kit process, recognition device 10 does not perform subsequent operation to this process.
Those skilled in the art will be understood that installation kit progress recognizing device 11 at least can in following 2 kinds of time point executable operations:
1) installation kit progress recognizing device 11 can in the run duration executable operations of process.
Preferably, installation kit progress recognizing device 11 can create behavioural information, to identify installation kit process by monitoring process.
At this, process creation behavioural information includes but not limited to the various information for representing the behavior that process is created.Process creation behavioural information belongs to a kind of process behavior information.Process creation behavioural information such as process creation terminates the operation information with Registry Modifications.
At this, installation kit progress recognizing device 11 such as can be included in and drive layer to carry out driving the driving monitoring unit of monitoring and the progress recognizing unit in application layer identification installation kit process.Monitoring unit is driven to monitor and the behavior of record the process, and by recorded process creation behavioural information upthrow to process recognition unit.After acquisition process creation behavioural information, progress recognizing unit according to process creation behavioural information, can obtain the software corresponding to this process.Such as, the store path of the software corresponding to this process is comprised in process creation behavioural information.Then, progress recognizing unit can identify the software corresponding to this process according to the mode of any one identification installation kit process aforementioned, to determine whether this process belongs to installation kit process.
2) installation kit progress recognizing device 11 can random time executable operations after process terminates.
At this, at the run duration of process, other specific devices in recognition device 10 or recognition device 10 such as can be monitored all or part of behavior of this process and record the process behavior information of this process.Subsequently, the random time after process terminates, installation kit progress recognizing device 11 according to the process behavior information of recorded process, can obtain the software corresponding to this process.Such as, the store path of the software corresponding to this process is comprised in process behavior information.Then, installation kit progress recognizing device 11 can identify the software corresponding to process according to the mode of any one identification installation kit process aforementioned, to determine whether this process belongs to installation kit process.
Subsequently, behavioural information obtaining means 12 obtains one or more process behavior information of this installation kit process run duration.
At this, if installation kit progress recognizing device 11 is in the run duration executable operations of process, behavioural information obtaining means 12 can the various actions of monitoring process to obtain the process behavior information of this process.
Alternately, if installation kit progress recognizing device 11 executable operations after process terminates, behavioural information obtaining means 12 can obtain the process behavior information that other specific devices in recognition device 10 before this or recognition device 10 record by the mode read.Such as, the process behavior information of process run duration can be kept in a file of local disk by other specific devices in recognition device 10 or recognition device 10.Subsequently, behavioural information obtaining means 12 can obtain the process behavior information of process by reading this file.
Subsequently, if the process behavior information obtained meets predetermined condition, installation determining device 13 of mourning in silence determines that this installation kit process performs installation of mourning in silence.
Wherein, described predetermined condition comprises following 2:
1) described predetermined condition comprises process behavior packets of information containing software installation behavioural information.
Wherein, software installation behavior packets of information is drawn together but is not limited to the information of the various expression behavior relevant to the installation of software.
Installation determining device 13 of mourning in silence can install behavioural information according to predetermined one or more software, analyzes the process behavior information of installation kit process, to determine that whether comprising software in process behavior information installs behavioural information.If the process behavior packets of information of installation kit process installs behavioural information containing software, then installation determining device 13 of mourning in silence can determine that this installation kit process performs installation behavior.
Preferably, described software is installed behavior packets of information and is drawn together Registry Modifications behavioural information.
Wherein, described Registry Modifications behavioural information includes but not limited to the information of various expression to the behavior that registration table is modified.
Described Registry Modifications behavioural information includes but not limited to following any one:
I) startup item act of revision information.
At this, startup item act of revision information includes but not limited to the behavioural information that various expression is modified to startup item in registration table.
Ii) item act of revision information is unloaded.
At this, startup item act of revision information includes but not limited to that various expression is to the behavioural information unloading item in registration table and modify.
Iii) service entry act of revision information.
At this, startup item act of revision information includes but not limited to the behavioural information that various expression is modified to service entry in registration table.
Iv) plan target act of revision information.
At this, startup item act of revision information includes but not limited to that various expression is to the behavioural information of planning task items in registration table and modifying.
2) described predetermined condition comprises process behavior information and does not comprise user interface and call behavioural information.
At this, user interface is called behavioural information and is included but not limited to the information of various expression to the behavior of calling of user interface.Described user interface such as graphic user interface, Command Line Interface etc.
At this, process is carried out alternately with user by invoke user interface usually, to point out the various information relevant with this process to user.Such as, installation kit process shows installation process by invoke user interface to user usually.
Installation determining device 13 of mourning in silence can call behavioural information according to predetermined user interface, analyzes the process behavior information of installation kit process, to determine that whether comprising user interface in process behavior information calls behavioural information.If the process behavior information of process does not comprise user interface call behavioural information, then installation determining device 13 of mourning in silence can determine that this installation kit process is the process of mourning in silence.Also namely, user cannot understand the implementation of this installation kit process.
In sum, the process behavior packets of information of installation kit process installs behavioural information containing software---represent that this installation kit process performs installation behavior.And the process behavior information of installation kit process does not comprise user interface calls behavioural information---represent that this installation kit process is the process of mourning in silence.When process behavior information meets this two predetermined conditions, installation determining device 13 of mourning in silence can determine that this installation kit process performs installation of mourning in silence.Also namely, mourn in silence and determining device 13 is installed can determines that this software corresponding to installation kit process is the software installed of mourning in silence.
At this, installation kit process needs to carry out alternately, such as, showing the process of installation to user with user by invoke user interface usually.Therefore, owing to not coming to carry out alternately with user by invoke user interface, namely the installation kit process that performing mourns in silence installs can directly be regarded as usually belongs to suspicious process.Even, because the installation kit process of most of bundled software performs installation of mourning in silence, therefore, namely the software corresponding to installation kit process that performing mourns in silence installs can directly be regarded as usually belongs to bundled software.
In addition, recognition device 10 can also perform other identifying operations (such as identifying according to black/white list) to performing the installation kit process of installing of mourning in silence, to determine whether this installation kit process has problems more accurately, such as, determine whether this software corresponding to installation kit process belongs to bundled software more accurately.
Preferably, recognition device 10 can also comprise software recognition device and information presents device (all not shown in Fig. 2).Wherein, software recognition device can identify the software corresponding to installation kit process.Subsequently, information presents device and can present to user the information that this software performs installation of mourning in silence.
Wherein, software recognition device can extract the process identity information of process from process behavior information.The title of described process identity information such as process, the installation path etc. of process.Subsequently, software recognition device can according to described process identity information, the corresponding relation of query procedure identification information and dbase, to determine the dbase corresponding to installation kit process.Wherein, the corresponding relation of process identity information and dbase can be kept at subscriber equipment this locality, also can be kept in the webserver.
At this, information presents device such as can present " indicating risk---XX software has just been arranged in your computer " information to user, knows this " XX software " mounted fact to make user.
More preferably, the operate in installation kit process of software recognition device to the identification of software terminates rear execution.
Software recognition device can identify the software corresponding to installation kit process after installation kit process terminates.Then, information presents device and can present to user the information that this software performs installation of mourning in silence.At this, software recognition device and information present device and do not disturb or tackle installation kit process, but to be performed software by software recognition device after it terminates and identify and present device by information and present information to user.This processing mode to installation kit process avoids in prior art carries out tackling to installation kit process the problem that the system fault that may cause even collapses.
According to a preferred exemplary, software recognition device can also be bundled software according to black/white list identification software.
At this, described blacklist means wherein to comprise the catalogue of the dbase of the one or more softwares belonging to bundled software.Described blacklist such as can comprise some and pass through the dbase belonging to the software of bundled software confirmed.
Described white list means wherein to comprise the catalogue of the dbase of the one or more softwares not belonging to bundled software.Described white list such as can comprise the dbase of the well-known software of some renowned companies.Although these well-known softwares are also installed by the mode of installing of mourning in silence, but these well-known softwares are not bundled software.
Software recognition device according to the dbase of identified software, can inquire about aforementioned blacklist, to determine whether this software belongs to bundled software.If the dbase of the software identified is present in this blacklist, then this software belongs to bundled software.If the dbase of the software identified is not present in this blacklist, then this software can be identified as and not belong to bundled software.
Or software recognition device according to the dbase of identified software, can inquire about aforementioned white list, to determine whether this software belongs to bundled software.If the dbase of the software identified is present in this white list, then this software does not belong to bundled software.If the dbase of the software identified is not present in this white list, then this software can be identified as and belong to bundled software.
At this, as long as determine that an installation kit process performs installation of mourning in silence, and the software corresponding to this installation kit process is identified as bundled software according to black/white list by software recognition device, the present invention can assert that this software belongs to bundled software, no matter and this software whether with another Software Bundling install.
Further, other specific devices in recognition device 10 or recognition device 10 can also determine by other means to perform mourn in silence the software corresponding to installation kit process installed whether with another Software Bundling install.
Such as, other specific devices in recognition device 10 or recognition device 10 can determine to perform mourn in silence the installation kit process of installing run before a period of time in, whether have the operation of other installation kit processes.For clearly demonstrating, at this, being called installation kit process B by performing the installation kit process of installing of mourning in silence, other installation kit processes run in a period of time before this installation kit process B runs are called installation kit process A.
Other specific devices in recognition device 10 or recognition device 10 such as can extract the process identity information of installation kit process A from the process behavior information of the installation kit process A recorded before this.Subsequently, other specific devices in recognition device 10 or recognition device 10 can according to the process identity information of the process identity information of installation kit process A and installation kit process B, inquiry bundle relation table, to determine whether installation kit process A and installation kit process B has bundle relation.Wherein, multiple process identity information each other with the installation kit process of bundle relation is preserved in described bundle relation table.Such as, record installation kit process A in described bundle relation table and installation kit process B has bundle relation, then other specific devices in recognition device 10 or recognition device 10 can be determined to perform the installation kit process B that mourns in silence and install and another installation kit process A and install with bundling.
According to another preferred exemplary, recognition device 10 can also comprise software discharge mechanism (not shown in Fig. 2).Software discharge mechanism according to the feedback of user to information, can unload this software.
At this, the information in recognition device 10 presents the interactive button that information that device presents such as can comprise " unloading suspect software ".When user selects this interactive button, software discharge mechanism such as can run the Uninstaller of this software to unload this software.
It should be noted that the present invention can be implemented in the assembly of software and/or software restraint, such as, each device of the present invention can adopt special IC (ASIC) or any other similar hardware device to realize.In one embodiment, software program of the present invention can perform to realize step mentioned above or function by processor.Similarly, software program of the present invention (comprising relevant data structure) can be stored in computer readable recording medium storing program for performing, such as, and RAM storer, magnetic or CD-ROM driver or flexible plastic disc and similar devices.In addition, steps more of the present invention or function can adopt hardware to realize, such as, as coordinating with processor thus performing the circuit of each step or function.
To those skilled in the art, obviously the invention is not restricted to the details of above-mentioned one exemplary embodiment, and when not deviating from spirit of the present invention or essential characteristic, the present invention can be realized in other specific forms.Therefore, no matter from which point, all should embodiment be regarded as exemplary, and be nonrestrictive, scope of the present invention is limited by claims instead of above-mentioned explanation, and all changes be therefore intended in the implication of the equivalency by dropping on claim and scope are included in the present invention.Any Reference numeral in claim should be considered as the claim involved by limiting.In addition, obviously " comprising " one word do not get rid of other unit or step, odd number does not get rid of plural number.Multiple unit of stating in system claims or device also can be realized by software or hardware by a unit or device.First, second word such as grade is used for representing title, and does not represent any specific order.
Claims (16)
1. a method of installing of mourning in silence for identification software, wherein, the method comprises:
-identify installation kit process;
-obtain one or more process behavior information of described installation kit process run duration;
If-described process behavior information meets predetermined condition, determine that described installation kit process performs installation of mourning in silence;
Wherein, described predetermined condition comprises:
-described process behavior packets of information installs behavioural information containing software;
-described process behavior information does not comprise user interface and calls behavioural information.
2. method according to claim 1, wherein, the step of described identification installation kit process specifically comprises:
-monitoring process creates behavioural information, to identify installation kit process.
3. method according to claim 1 and 2, wherein, described software is installed behavior packets of information and is drawn together Registry Modifications behavioural information.
4. method according to claim 3, wherein, described Registry Modifications behavioural information comprises following any one:
-startup item act of revision information;
-unloading item act of revision information;
-service entry act of revision information;
-plan target act of revision information.
5. method according to any one of claim 1 to 4, wherein, the method also comprises:
-identify software corresponding to described installation kit process;
-present described software to user to perform the information of mourning in silence and installing.
6. method according to claim 5, wherein, the step of the described identification to described software is carried out after described installation kit process terminates.
7. the method according to claim 5 or 6, wherein, the step of the described identification to described software also comprises:
-according to the identification of black/white list, software is bundled software.
8. method according to claim 5, wherein, the method also comprises:
-according to the feedback of described user to described information, unload described software.
9. the device installed of mourning in silence of identification software, wherein, this device comprises:
-for identifying the device of installation kit process;
-for obtaining the device of one or more process behavior information of described installation kit process run duration;
If-meet predetermined condition for described process behavior information, determine that described installation kit process performs the device of mourning in silence and installing;
Wherein, described predetermined condition comprises:
-described process behavior packets of information installs behavioural information containing software;
-described process behavior information does not comprise user interface and calls behavioural information.
10. device according to claim 9, wherein, the device of described identification installation kit process specifically for:
-monitoring process creates behavioural information, to identify installation kit process.
11. devices according to claim 9 or 10, wherein, described software is installed behavior packets of information and is drawn together Registry Modifications behavioural information.
12. devices according to claim 11, wherein, described Registry Modifications behavioural information comprises following any one:
-startup item act of revision information;
-unloading item act of revision information;
-service entry act of revision information;
-plan target act of revision information.
13. devices according to any one of claim 9 to 12, wherein, this device also comprises:
-for identifying the device of the software corresponding to described installation kit process;
-perform the device of information of mourning in silence and installing for presenting described software to user.
14. devices according to claim 13, wherein, the described installation kit process that operates in of the described identification to described software terminates rear execution.
15. devices according to claim 13 or 14, wherein, the device of the described identification to described software also for:
-according to the identification of black/white list, software is bundled software.
16. devices according to claim 13, wherein, this device also comprises:
-for according to the feedback of described user to described information, unload the device of described software.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510524452.4A CN105138366A (en) | 2015-08-24 | 2015-08-24 | Recognition software silent installation method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510524452.4A CN105138366A (en) | 2015-08-24 | 2015-08-24 | Recognition software silent installation method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN105138366A true CN105138366A (en) | 2015-12-09 |
Family
ID=54723723
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510524452.4A Pending CN105138366A (en) | 2015-08-24 | 2015-08-24 | Recognition software silent installation method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN105138366A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106201634A (en) * | 2016-07-28 | 2016-12-07 | 北京小米移动软件有限公司 | Software installation method and device |
| WO2017206253A1 (en) * | 2016-05-31 | 2017-12-07 | 宇龙计算机通信科技(深圳)有限公司 | Application program management method and mobile terminal |
| WO2017206309A1 (en) * | 2016-05-31 | 2017-12-07 | 宇龙计算机通信科技(深圳)有限公司 | Processing method for silent installation of applications, and mobile terminal |
| CN108055582A (en) * | 2017-12-14 | 2018-05-18 | 深圳市雷鸟信息科技有限公司 | Using installation method and smart television |
| CN111639332A (en) * | 2020-05-11 | 2020-09-08 | 珠海豹趣科技有限公司 | Software installation method and device, electronic equipment and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20050268112A1 (en) * | 2004-05-28 | 2005-12-01 | Microsoft Corporation | Managing spyware and unwanted software through auto-start extensibility points |
| CN102779255A (en) * | 2012-07-16 | 2012-11-14 | 腾讯科技（深圳）有限公司 | Method and device for judging malicious program |
| CN103235913A (en) * | 2013-04-03 | 2013-08-07 | 北京奇虎科技有限公司 | System, equipment and method used for identifying and intercepting bundled software |
| CN104376263A (en) * | 2014-12-09 | 2015-02-25 | 北京奇虎科技有限公司 | Application behavior intercepting method and application behavior intercepting device |
-
2015
- 2015-08-24 CN CN201510524452.4A patent/CN105138366A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20050268112A1 (en) * | 2004-05-28 | 2005-12-01 | Microsoft Corporation | Managing spyware and unwanted software through auto-start extensibility points |
| CN102779255A (en) * | 2012-07-16 | 2012-11-14 | 腾讯科技（深圳）有限公司 | Method and device for judging malicious program |
| CN103235913A (en) * | 2013-04-03 | 2013-08-07 | 北京奇虎科技有限公司 | System, equipment and method used for identifying and intercepting bundled software |
| CN104376263A (en) * | 2014-12-09 | 2015-02-25 | 北京奇虎科技有限公司 | Application behavior intercepting method and application behavior intercepting device |
Non-Patent Citations (1)
| Title |
|---|
| 梁海华: "《InstallShield 6.x安装程序设计与制作》", 31 January 2002 * |
Cited By (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2017206253A1 (en) * | 2016-05-31 | 2017-12-07 | 宇龙计算机通信科技(深圳)有限公司 | Application program management method and mobile terminal |
| WO2017206309A1 (en) * | 2016-05-31 | 2017-12-07 | 宇龙计算机通信科技(深圳)有限公司 | Processing method for silent installation of applications, and mobile terminal |
| CN107450938A (en) * | 2016-05-31 | 2017-12-08 | 宇龙计算机通信科技(深圳)有限公司 | A kind of application management method and mobile terminal |
| CN106201634A (en) * | 2016-07-28 | 2016-12-07 | 北京小米移动软件有限公司 | Software installation method and device |
| CN108055582A (en) * | 2017-12-14 | 2018-05-18 | 深圳市雷鸟信息科技有限公司 | Using installation method and smart television |
| CN111639332A (en) * | 2020-05-11 | 2020-09-08 | 珠海豹趣科技有限公司 | Software installation method and device, electronic equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9117079B1 (en) | Multiple application versions in a single virtual machine | |
| CN105138366A (en) | Recognition software silent installation method and device | |
| CN104375856A (en) | Application updating method and device | |
| US9747449B2 (en) | Method and device for preventing application in an operating system from being uninstalled | |
| CN102520975B (en) | Intelligent updating method of external equipment driver, device and system | |
| EP4055477A1 (en) | Just-in-time containers | |
| CN113127050B (en) | Application resource packaging process monitoring method, device, equipment and medium | |
| CN105354498A (en) | Operation method of registry, related device and equipment | |
| CN114462044A (en) | UEFI (unified extensible firmware interface) firmware vulnerability static detection method and device based on taint analysis | |
| CN108090352B (en) | Detection system and detection method | |
| CN111459609B (en) | Virtual machine safety protection method and device and electronic equipment | |
| CN112783568A (en) | Initialization method, device, equipment and storage medium of application program | |
| CN109472540B (en) | Service processing method and device | |
| US9632897B2 (en) | Monitoring components in a service framework | |
| CN113760306A (en) | Method and device for installing software, electronic equipment and storage medium | |
| CN103440453A (en) | Method for detecting operation environment of browser, client, server and system | |
| CN114282212A (en) | Rogue software identification method and device, electronic equipment and storage medium | |
| CN102446253B (en) | Webpage trojan detection method and system | |
| CN113761306A (en) | Vehicle-end data processing method and device | |
| CN109388770B (en) | Web page generation method and device | |
| WO2009097241A1 (en) | A method and system for assessing deployment and un-deployment of software installations | |
| CN105843644B (en) | Application program installation method and device and electronic equipment | |
| CN111797016B (en) | Application program testing method, device, storage medium and device | |
| CN109634636B (en) | Application processing method, device, equipment and medium | |
| US8904002B2 (en) | Reducing overhead in component interactions |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| TA01 | Transfer of patent application right |
Effective date of registration: 20181225 Address after: 100000 Room 708, 7th Floor, Building 10, No. 30, Shixing Street, Shijingshan District, Beijing Applicant after: Beijing Xiaoxiong Bowang Technology Co., Ltd. Address before: 100085 Baidu Building, 10 Shangdi Tenth Street, Haidian District, Beijing Applicant before: BEIJING BAIDU NETCOM SCIENCE AND TECHNOLOGY Co.,Ltd. |
|
| TA01 | Transfer of patent application right | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20151209 |
|
| RJ01 | Rejection of invention patent application after publication |