TWI801855B - System and method of application control based on root node - Google Patents

Abstract

A system of application control based on a root node includes a check unit; and hierarchical nodes including a root node and a first layer node, in which the root node is the parent node of the first layer node. The check unit is used to check whether the root node is a specified application control unit. If so, the first layer node will be executed.

Description

Root node-based application program control system and method

The present invention relates to the technical field of application program control, in particular to a root node-based application program control system and method.

With the development of informatization, a large number of application programs (APP) have appeared. Multiple applications can be provided by the same vendor. Even different applications, especially multiple applications provided by the same vendor, may have similar functions. In order to adapt to technological development or business needs, it is often necessary to upgrade or replace the application program. For example, the release frequency of a new version of the application program may be greater than once per week. When an error occurs in the released new version of the application or the business fails, the user-side application needs to return to the specified version of the application in an emergency to meet the basic needs of the user.

Existing application programs usually limit the computer devices that can legally use it to prevent the application program from being copied to other computer devices that are not legally authorized. To achieve this goal, there is currently a protection mechanism for binding hardware information. In this mechanism, once the application is started, it will first read and verify the hardware information in the computer device where it is installed, such as the CPU code, hard disk serial number, etc., and only allow the computer to The device executes it normally. Although this mechanism can connect the application program with the normal The legitimate computer devices that execute it are bound together, but due to the lack of dynamic changes in hardware information, it is easy to be cracked.

In addition, with the popularity of the Internet, connections to the Internet are usually established in enterprises to obtain various applications. However, various information or application programs retrieved from the Internet may also receive malicious programs. Once the malicious program enters the information processing device, it will destroy the software or steal the information therein, causing great harm to the information security in the enterprise.

On the other hand, for enterprises, while enjoying the convenience of the Internet, they should also eliminate the threats of these possible malicious programs as much as possible. Restrictions related to the implementation of applications have traditionally been implemented using blacklist controls. Because there are too many programs in the world, the blacklist control method is no longer suitable for use.

Furthermore, recently, hackers often use the original programs on the machine as attack programs instead of using programs written by hackers themselves. This will cause a problem. For example, the built-in programs on Windows are programs that are often used by users, but they are also favorite programs for hackers; so, whether these built-in programs can be set as application control is also a big problem problem lies in.

In view of the above shortcomings, the present invention provides a novel application program control method to solve the above shortcomings.

The purpose of the present invention is to provide a root node-based application program control system and method.

The application program control method based on the root node of the present invention can greatly reduce the time cost of detection and improve the detection efficiency of information security.

The application program control system based on the root node of the present invention includes: a checking unit; and a hierarchical node including a root node and a first-level node, wherein the root node is the parent node of the first-level node. The checking unit is used to check whether the root node is a designated application program control unit, and if so, execute the first layer node.

Wherein the root node checked by the checking unit is not the specified application program control unit, then the execution of the first layer node is prohibited.

The hierarchical node further includes a second-level node, and the first-level node is the second parent node of the second-level node. The checking unit checks whether the first layer node is the specified application program control unit, and if so, executes the second layer node; if not, prohibits the execution of the second layer node.

Wherein the hierarchical node includes a root node and nodes of N layers, the checking unit checks whether the parent nodes of the N layers are all the specified application control unit.

The root node-based application program control method of the present invention includes: providing a check unit; providing a hierarchical node, including a root node and a first-level node, wherein the root node is the parent node of the first-level node; and , check whether the root node is a specified application program control unit, if so, execute the first-level node, otherwise prohibit the execution of the first-level node.

102,404,420:Explorer

104, 108, 206, 210, 410, 412, 414, 418, 424, 430: Microsoft PowerShell

106: DOS Command

202, 406, 408, 426: Microsoft Word

204: VB macro program

208: Hacker program

300: check unit

302: root node

304: first layer node

306:Second layer node

308: The third layer node

310: Layer N node

402,416,422,428: Cmd

[Fig. 1] shows a schematic diagram of the application control unit of the present invention executing Microsoft PowerShell.

[Picture 2] shows a schematic diagram of hacker macros and hacker programs executing Microsoft PowerShell.

[Figure 3] shows a schematic diagram of hierarchical nodes of the application program control system of the present invention.

[Figure 4] A schematic diagram showing the behavior of normal users and hackers.

Herein, the present invention will be described in detail with respect to specific embodiments of the invention and its viewpoints. Such descriptions are for explaining the structure or step flow of the present invention, and are for illustration rather than limiting the patent scope of the present invention. Therefore, except for the specific embodiments and preferred embodiments in the description, the present invention can also be widely implemented in other different embodiments. Illustrate the reality of the present invention below by specific specific embodiment Embodiments, those skilled in the art can easily understand the effectiveness and advantages of the present invention from the content disclosed in this specification. Moreover, the present invention can also be used and implemented through other specific embodiments, and various details described in this specification can also be applied based on different needs, and various modifications or changes can be made without departing from the spirit of the present invention.

The present invention proposes a root node-based application program control method, in which the parent process (Parent Process) and the parent node are designated as the application program control unit to prevent hackers from using the white list program controlled by the application program (such as on Windows) The built-in program, PowerShell.Exe) is used as an attack tool. In computing, a parent journey is one that has created one or more child journeys. Checking the parent process can prohibit the program implanted by the hacker from executing the original white list program on the local machine (information processing device, computer). The application program control system of the present invention may include a hierarchical node, a multi-layer structure or a tree structure composed of multi-layer nodes, wherein the top layer of the structure contains a node, the bottom node is the program to be executed, and its layer There is no limit to the number. The upper and lower nodes are the relationship between the parent trip (parent node) and the child trip (child node). In execution, each parent node needs to check whether it is a designated application program control unit or other non-designated execution programs.

The present invention uses a white list as a control solution to replace the traditional black list control method. In terms of actual operation, we can use the user's behavior to judge whether the programs to be executed are normal programs or hacker programs. If the program is in normal use, it is the white list controlled by the application, otherwise it is the black list.

)。 The first figure depicts a schematic diagram of the application control unit of the present invention executing Microsoft PowerShell. For example, the application control unit in this embodiment is Explorer 102 , which is the parent node (parent process) of Microsoft PowerShell 104 . In this example, the parent is Explorer.Exe, so just check the parent. As parent node Explorer 102 can execute Microsoft PowerShell 104 . Microsoft PowerShell 104 is a whitelisted file or program executable by a computer. PowerShell is a task automation and configuration management framework developed by Microsoft Corporation. It consists of a command-line interface shell-related script language built with .NET Framework and .NET Core. As an example, the above-mentioned parent node Explorer 102 is an application program control unit designated by a designated unit of the server (IT end). Of course, in terms of execution, the parent node Explorer 102 is determined to be the specified application program control unit after being checked by the checking unit (not shown) of the server (IT side), so the Microsoft PowerShell 104 can be executed. Under normal behavior, Microsoft PowerShell 104 is marked as whitelisted (the tick symbol in the figure

).

Referring to the first figure, in another example, the application control unit is DOS Command 106, which is the parent node (parent process) of Microsoft PowerShell 108. In this example, the parent is DOS.Exe, but just check the parent. With parent node DOS Command 106 Microsoft PowerShell 108 can be executed. The parent node DOS Command 106 is also the application program control unit specified by the specified unit of this machine. Similarly, in terms of execution, the parent node DOS Command 106 is also determined to be the specified application program control unit after being checked by the checking unit, and can execute Microsoft PowerShell 108 . Under normal behavior, Microsoft PowerShell 108 is marked as whitelisted. In Microsoft PowerShell, administrative tasks are usually performed by cmdlets (command-lets: Cmd.exe), which are specialized .NET classes that perform specific actions. Cmdlets can be assembled into scripts, executables (typically stand-alone applications), or instantiated through regular .NET classes (or WMI/COM objects). via access Data in various data stores are executed by Microsoft PowerShell, such as File Explorer or Registry.

The second figure depicts a hacker macro, a schematic diagram of a hacker program executing Microsoft PowerShell. In the second figure, Microsoft Word 202 and Visual Basic (VB) macro program (virus) 204 are parent-child nodes, and the VB macro program 204 is executed by Microsoft Word 202 program. A macro is an abstraction that replaces certain text patterns according to a series of predefined rules. This pattern substitution is done automatically by the interpreter or compiler when it encounters a macro. VB macro program 204 and Microsoft PowerShell 206 are parent and child nodes, and VB macro program 204 is prohibited from executing Microsoft PowerShell 206 . Because Microsoft Word 202 and VB macro program 204 are not the specified application program control units of the present invention, they cannot execute Microsoft PowerShell 206 . That is to say, in terms of execution, after the parent node Microsoft Word 202 and VB macro program 204 are checked by the checking unit, it is determined that they are not designated application program control units, so they are prohibited from executing Microsoft PowerShell 206 . Under the hacking behavior, Microsoft PowerShell 206 is marked as a blacklist (the prohibition symbol in the figure), and it is prohibited to execute in this machine, and it can be further deleted.

In the second figure, hacker program 208 and Microsoft PowerShell 210 are parent and child nodes. That is, the Microsoft PowerShell 210 is used as the attack object of the hacker program 208 . During execution, after the hacker program 208 is inspected by the checking unit, it is determined that it is not a specified application program control unit, so the execution of the Microsoft PowerShell 210 is prohibited. Under the hacking behavior, Microsoft PowerShell 210 will be marked as a blacklist, and it is forbidden to execute in this machine, and it can be deleted further.

Referring to the third figure, it shows the hierarchical nodes of the application program control system of the present invention schematic diagram. The application program control system of the present invention may include a multi-layer structure or a tree structure composed of a plurality of nodes, and the number of layers is not limited. In this embodiment, N layers are taken as an example. The application program control system includes a node (uppermost layer) 302 , a first layer node 304 , a second layer node 306 , a third layer node 308 . . . an Nth layer node 310 . The root node 302 is the parent node of the first layer node 304, the first layer node 304 is the parent node of the second layer node 306, the second layer node 306 is the parent node of the third layer node 308, and the parent-child node relationship of other generations So on and so forth. The Nth layer node 310 is the program executed at the bottom layer. During execution, it is necessary to check the parent nodes of the N layer (generation), including the root node 302, the first layer node 304, the second layer node 306, the third layer node 308.... and the (N-1) layer node , all need to be inspected by the inspection unit 300 . If the result of the check is determined, the root node 302, the first layer node 304, the second layer node 306, the third layer node 308.... and the (N-1)th layer node are all designated application program control units (X .Exe), the program of the node 310 at the Nth layer can be executed. For example, the parent of the node 310 at level N is PowerShell.Exe, the grandparent is Dos.Exe, the great-grandfather is Explorer.Exe...the root node (X.Exe), and the parent node of the Nth generation needs to be checked. It can be seen from this that all generations of his ancestors may be included in the control, not only the parents and ancestors, but the parents of different layers need to be checked. Under normal behavior, the executed N-th layer nodes 310 are marked as whitelisted. If the check results, as long as one (or more) of the root node 302, the first layer node 304, the second layer node 306, the third layer node 308... and the (N-1) layer node is not specified The application program control unit is prohibited from executing the program of the node 310 in the Nth layer. Under the hacking behavior, the executed Nth layer node 310 is marked as a blacklist, which is prohibited from being executed in the local machine, and can be further deleted. It can be seen from this that the hacking program may be arranged (hidden) in a certain layer (or layers) of hierarchical nodes.

Refer to the fourth figure, which shows a schematic diagram of the usage behavior of normal users and hackers. In this embodiment, each example uses Microsoft PowerShell as an example of the executed program. However, What you need to know is that Microsoft PowerShell is just an example, and any other program can also be used as an example. In the first example, Cmd 402 is the parent node of Microsoft PowerShell 410 . Because Cmd 402 is the designated application program control unit, Microsoft PowerShell 410 can be executed. Under normal behavior, Microsoft PowerShell 410 is marked as whitelisted. In the second example, Explorer 404 is the parent node of Microsoft PowerShell 412 . Since the Explorer 404 is the designated application control unit, the Microsoft PowerShell 412 can be executed. Under normal behavior, Microsoft PowerShell 412 is marked as whitelisted. In other words, the execution of Microsoft PowerShell 410, 412 by Cmd (command-lets: Cmd.exe) 402 or Explorer 404 is under normal behavior, so Microsoft PowerShell 410, 412 is a whitelist for application control. Generally speaking, analyze the parent node A to execute the child node B (that is, the parent node of B is A) to judge the same B; because the parent node A is different, it becomes a different application control. For example, the same Microsoft PowerShell mentioned above, because the parent node Cmd or Explorer is different, its application control will be different.

As shown in the fourth figure, in the third example, Microsoft Word 202 is the parent node of Microsoft PowerShell 414 . Because Microsoft Word 202 is not a designated application control unit, Microsoft PowerShell 414 is prohibited in this machine. Under the hacking behavior, Microsoft PowerShell 414 is marked as a blacklist, and it is forbidden to execute in this machine, and it can be deleted further.

Referring to the fourth figure, in the fourth example, this example is a case of misjudgment. Microsoft Word 408 is the parent node of Cmd 416. Cmd 416 is the parent node of Microsoft PowerShell 418 . Among them, Microsoft Word 408 is not the application program control unit specified by the specified unit, and Cmd 416 is the application program control unit specified by the specified unit. As mentioned above, in terms of execution, each layer of parent nodes needs to check Check if it is the specified application control unit. In this example, because the checking unit only checks the parent node at the level of Cmd 416, but does not check the parent node (root node) at the level of Microsoft Word 408, thus causing a misjudgment. Because Microsoft Word 408 is not a designated application program control unit, it may still affect the execution of Microsoft PowerShell 418 in the second layer below, so Microsoft PowerShell 418 should be prohibited from being executed in the local machine. However, because the parent node of Microsoft Word 408 is not checked, Microsoft PowerShell 418 is marked as a white list, which will make hackers affect the local machine and cause a crisis in information security. It can thus be explained that in this case, each layer of parent node needs to check whether it is a specified application program control unit, so as to avoid the occurrence of the above-mentioned misjudgment.

Continuing to refer to the fourth figure, in the fifth example, Explorer 420 is the parent node of Cmd 422 . Cmd 422 is the parent node of Microsoft PowerShell 424 . Among them, Explorer 420 is the application program control unit specified by the specified unit, and Cmd 422 is also the application program control unit specified by the specified unit. In this example, the parent is DOS.Exe and the grandparent is Explorer.Exe, so check 2 generations. In execution, each parent node needs to check whether it is the specified application control unit. In this example, the checking unit first checks the parent node at the level of Cmd 422 , and then checks the parent node at the level of Explorer 420 (root node). Since the detected Cmd 422 and the Explorer 420 are designated application control units, the Cmd 422 can execute the Microsoft PowerShell 424 . Under normal behavior, Microsoft PowerShell 424 is marked as whitelisted. To sum up the above, Microsoft PowerShell is executed by Explorer\Cmd or Explorer. In normal behavior, Microsoft PowerShell is a whitelist controlled by the application.

With reference to the fourth figure, in the sixth example, Microsoft Word 426 is one of Cmd 428 parent node. Cmd 428 is the parent node of Microsoft PowerShell 430 . Among them, Microsoft Word 426 is not the application program control unit specified by the specified unit, and Cmd 428 is the application program control unit specified by the specified unit. In this example, the checking unit first checks the parent node of the level of Cmd 428, and then checks the parent node of the level of Microsoft Word 426 (root node). Since it is detected that Microsoft Word 426 is not a designated application program control unit, it will affect the execution of the Microsoft PowerShell 430 in the lower two layers, so Microsoft PowerShell 430 is prohibited from being executed in the local machine. Microsoft PowerShell 430 is marked as blacklisted. Therefore, it is necessary for Microsoft PowerShell 430 to check the earlier grandparent Microsoft Word 426.

Compared with the conventional blacklist control method, the present invention proposes a root node-based application program control method, using a specified application program control unit to determine the executable white list, which greatly improves the detection efficiency of information security. promote.

Without departing from the scope of this paper, changes can be made to the above-mentioned root node-based application program control method and its control method. It is therefore to be noted that all matter contained in the above description and shown in the accompanying drawings shall be interpreted in an illustrative rather than a restrictive sense. The scope of the following patent application is intended to cover all the general and specific features described herein, as well as all statements in the scope of the root node-based application program control method and its control method of the present invention, which can be said to be implemented in language in between.

300: check unit

302: root node

304: first layer node

306:Second layer node

308: The third layer node

310: Layer N node

Claims (10)

A root node-based application program control system, including: a server end, including a check unit and a designation unit; and a hierarchical node configured on an information processing device, including a node and a first-level node, Wherein the root node is the parent node of the first layer node; wherein the specified unit on the server side is used to designate the root node as an application program control unit, and the checking unit on the server side is used to Check whether the root node is the application control unit specified by the specified unit, and if so, execute the first layer node on the information processing device. In the root node-based application control system described in Claim 1, wherein the root node checked by the inspection unit is not the specified application control unit, the execution of the first layer node is prohibited. In the root node-based application control system as described in claim 1 or 2, the hierarchical node further includes a second-level node, and the first-level node is a second parent node of the second-level node. The application control system based on the root node as described in claim 3, wherein the checking unit checks whether the first-level node is the designated application control unit, and if so, executes the second-level node; if not, Then the execution of the second layer node is prohibited. The application control system based on the root node as described in claim 1, wherein the layer The formula node includes the root node and nodes of N layers, and the checking unit checks whether the parent nodes of the N layers are all the specified application program control units. A root node-based application program control method, including: providing a checking unit and a specifying unit on the server side; providing a hierarchical node of an information processing device, including a node and a first-level node, wherein the The root node is the parent node of the first-level node; and the specifying unit on the server side is used to designate the root node as an application program control unit, and the checking unit on the server side checks whether the root node is If the application program control unit specified by the specifying unit is yes, execute the first-level node on the information processing device; otherwise, prohibit the execution of the first-level node on the information processing device. The root node-based application program control method as described in Claim 6, wherein the hierarchical node further includes a second-level node, and the first-level node is a second parent node of the second-level node. The root node-based application control method as described in claim 7, wherein the checking unit checks whether the first-level node is the designated application control unit, and if so, executes the second-level node. The root node-based application control method as described in Claim 8, wherein the first-level node checked by the checking unit is not the specified application control unit, and the execution of the second-level node is prohibited. The application control method based on the root node as described in claim 6, wherein the hierarchical node includes the root node and N layers of nodes, and the checking unit checks whether the parent nodes of the N layers are all the specified applications program control unit.

Images