WO2012025026A1

WO2012025026A1 - Method and system for scanning plug-in

Info

Publication number: WO2012025026A1
Application number: PCT/CN2011/078522
Authority: WO
Inventors: 谭晓光; 陈卓; 董琼康; 陈旭东
Original assignee: 腾讯科技（深圳）有限公司
Priority date: 2010-08-24
Filing date: 2011-08-17
Publication date: 2012-03-01
Also published as: CN102375735B; BR112012026735A2; BR112012026735B1; CN102375735A

Abstract

Disclosed is a method for scanning a plug-in, comprising: reading pre-stored information about a known plug-in, and determining, on the basis of the information of the known plug-in, the detection position and detection property of the plug-in; detecting at the detection position whether the detection property exists; and outputting the detection result thereof. Also disclosed is a corresponding system for scanning a plug-in. By way of pre-stored information about a known plug-in, the method and system are able to find a known plug-in in a targeted way by carrying out a scan according to the information of the known plug-in, thus improving the scan speed and accuracy.

Description

Plug-in scanning method and system

Technical field

The present invention relates to the field of computer technologies, and in particular, to a plug-in scanning method and system. Background of the invention

Nowadays, with the popularity of computer networks, the convenience of people's work and life has been greatly improved. In the process of installing some programs, accessing the network through a browser, etc., in order to implement some specific functions, it is often necessary to install plug-ins. The development of plug-ins has increased or improved the original functionality of the program and has been used more and more widely.

However, plug-ins are also maliciously used by some software developers, such as installing the plug-in in the background without the user's knowledge and collecting the user's privacy, or popping up an advertisement page, modifying the browser's home page, and the like, which is detrimental to the user's interests. Therefore, the detection and cleaning of plug-ins has become an indispensable function in system security software. Through plug-in detection, the user can know the installation status of the current computer plug-ins, which are installed by the user himself, and which are installed without the user's knowledge. Therefore, how to accurately detect the plug-ins on the user's computer is particularly important.

In the current system security software on the market, the function of plug-in detection is generally implemented. After the user clicks the operation button of the scanning plug-in, the plug-in scanning module of the software traverses the registry entries that may be related to the plug-in, and finds the global existence of the plug-in. The unique identifier (CLSID), and then obtain the plugin's file path through the CLSID to complete the plugin detection process.

Since the plug-in technology is now more and more perfect, it can be used by the earliest registration as a windows plug-in. It can also be developed without registering as a windows plug-in, and the latter may not write the registry at all. The prior art is incapable of detecting the plug-in that does not write the registry. The plug-in detected by the prior art scheme may be inaccurate, and may even be missed or misdetected. Therefore, the disadvantage of the prior art solution is that the accuracy of the detection is not high, and the recognition rate is low. Very low, has not adapted to the current development of plug-in detection technology. Summary of the invention

Embodiments of the present invention provide a plug-in scanning method and system

The technical solution of the embodiment of the present invention is implemented as follows:

A plug-in scanning method, the method comprising:

Reading the pre-stored known plug-in information, and determining the detection location and detection attribute of the plug-in according to the known plug-in information;

Detecting whether the detection attribute exists in the detection position;

Output test results.

A plug-in scanning system, the system comprising:

a storage module, configured to save known plug-in information;

An analysis module, connected to the storage module, configured to read known plug-in information from the storage module, and determine a detection location and a detection attribute of the plug-in according to the known plug-in information, and the detection location and the detection attribute Send to the detection module.

The detecting module is connected to the analyzing module, and receives the detecting position and the detecting attribute sent by the analyzing module, and detects whether the detecting attribute exists in the detecting position; and sends the detection result to the interaction module.

The interaction module is connected to the detection module, and receives and outputs the detection result sent by the detection module.

The plug-in scanning method and system can scan the known plug-in information by pre-storing the known plug-in information, so that the known plug-in can be retrieved in a targeted manner, and the scanning speed and accuracy can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a flowchart of a method for scanning a plug-in according to an embodiment of the present invention;

2 is a schematic structural diagram of a plug-in scanning system according to an embodiment of the present invention;

3 is a schematic structural diagram of a detection module according to an embodiment of the present invention;

4 is a schematic structural diagram of a plug-in scanning system according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a plug-in scanning system according to an embodiment of the present invention; FIG.

FIG. 6 is a schematic structural diagram of a plug-in scanning system according to an embodiment of the present invention. Mode for carrying out the invention

The present invention will be further described in detail below with reference to the accompanying drawings.

The invention mainly proposes a method for combining detection detection plug-ins based on known plug-in information, and adopts multiple detection methods such as file detection, process detection, registry detection and service detection to perform combined detection. Thereby greatly improving the accuracy and recognition rate of the plug-in detection.

Specifically, as shown in FIG. 1 , the method for scanning a plug-in according to an embodiment of the present invention includes the following steps: Step 101: Read pre-stored known plug-in information, and determine a detection location and a detection attribute of the plug-in according to the known plug-in information. .

The plug-in information is known as plug-in related information obtained by analyzing the plug-in that has been found in advance. After the plugin is installed, it will leave traces in the computer system. The location of these traces is the location of the plugin, which can be a file path, a registry path, a process, a service, a memory, etc.; the specific feature file left by the plugin in the corresponding location Information such as feature registry entries, feature processes, feature services, and feature codes in memory are plug-in properties. Through these pre-stored known plug-in information, the specific location that needs to be detected during subsequent plug-in detection, that is, the detection location, and the content to be detected, that is, the detection attribute, can be determined. Step 102: Detect whether the detection attribute exists in the detection position.

That is, whether the signature file exists in the file path to be detected, whether the feature registry key exists in the registry path, whether the feature process exists in the process, whether the feature service exists in the service, whether the feature code exists in the memory, or the like is detected.

For example, the information about a known plug-in stored in the known plug-in information is ScanFile (%system%\test.exe). In step 101, it can be determined that the detected location of the known plug-in is the system directory, and the detection attribute is Is a file named test.exe. At this point, in this step, the detection function can be determined according to the ScanFile keyword (for different detection positions, there are different detection functions, which can be defined in advance, for example, in the known plug-in information, the ScanFile keyword corresponds to the file scanning function, In the detection file; if the plugin also performs registry writing, you can also define the ScanReg keyword, corresponding to the registry scan function, used to detect the registry, etc.), after determining the detection function, put %system%\test.exe As the search path parameter is passed to the determined detection function, the detection function returns the detection result, and the plug-in attribute of the corresponding detection position can be detected.

Step 103: Output the detection result.

The plug-in detection result of step 102 is outputted by a screen display, an audible prompt, or the like. For example, if a plug-in is detected, the detected plug-in is displayed; if it is not detected, it is not displayed or the plug-in is not detected. In addition, in this step, the evaluation of the detected plug-in can be further output. The evaluation information is the user's opinion on the plug-in, and may be a comprehensive evaluation, a bad evaluation, a middle evaluation, or the like, or a voting result of all the users participating in the evaluation, or a combination of the above two methods. The evaluation may be pre-stored, for example, the previously stored known plug-in information, or may be obtained in real time through the network, preferably obtained in real time through the network, to obtain a true and timely evaluation. By displaying the rating, it can be used as a reference for users who do not understand the plugin.

In the above embodiment, the information of the plug-in information is included in the plug-in information, and at this time, To read the information of multiple or all plug-ins at the same time to initiate detection, you can also read the known plug-in information one by one, detect a plug-in, get the test results and then read the next known plug-in information, until all plug-ins are detected. . When the detection result is output, it is also possible to output one by one or to output multiple or all at the same time.

The plurality of plug-in attribute information, such as a feature file name, a feature file size, a file content, and the like, may be saved in the known plug-in information, so that more detection attributes can be determined in the step 110, and multiple detection attributes are adopted. The detection, for example, by the detection attribute of the file size, can avoid the detection of false positives with the same file name but not the plug-in file. Similarly, in the known plug-in information, a plurality of plug-in location information, such as a file path, a registry path, a process, a service, a memory, and the like, are saved, that is, the detected location and the detected attribute determined in step 101 may be one or may be Multiple, so in step 102, the plug-in can be accurately detected through multiple detection paths and multiple detection methods to avoid missed detection and false detection.

Further, based on the above embodiment, in the detection result interface outputted in step 103, an option to delete the detected plug-in may be provided, and the plug-in is deleted when receiving the instruction to delete the plug-in. For example, after detecting the plug-in, in the interface for outputting the detection result, a button of "delete" is provided immediately after the detected plug-in, and if the user clicks the button, an instruction to delete the plug-in is issued, and after receiving the instruction, The plugin is removed; thus, it is convenient for the user to operate, so that the user can determine which plugins are unnecessary plugins. Further, after the step 103, the scan status may also be stored, where the scan status records the plug-in that has not been deleted by the user at the end of the scan, and the next time the detection position and the detection attribute are determined according to the known plug-in information, Ignore the plug-ins that are not deleted by the user, which can improve the detection speed and save system resources.

In the above embodiment, the step of upgrading and updating the known plug-in information may be further included in the above-mentioned embodiment, so that a new plug-in is generated on the network. Plugin. Also, read the pre-stored known Plug-in information, in addition to reading from local storage, can also be read directly from the network server, so you do not need to update the local known plug-in information.

In addition, in the above-mentioned plug-in scanning method embodiment, the traditional plug-in scanning method may also be combined, that is, in addition to the above steps, the global unique identifier (CLSID) of the existing plug-in may be found by traversing the registry key that may be related to the plug-in. ), then get the plugin's file path through CLSID, and help detect plugins that are not defined in the known plugin information.

The present invention also provides an embodiment of a plug-in scanning system. As shown in FIG. 2, the present invention includes a storage module 201, an analysis module 202, a detection module 203, and an interaction module 204.

a storage module 201, configured to save known plug-in information;

The analysis module 202 is connected to the storage module 201, and is configured to read the known plug-in information from the storage module 201, and determine the detection position and the detection attribute of the plug-in according to the known plug-in information, and the detection location is And the detection attribute is sent to the detection module 203.

The detecting module 203 is connected to the analyzing module 202, and receives the detecting position and the detecting attribute sent by the analyzing module 202, and detects whether the detecting attribute exists in the detecting position; and sends the detection result to the interaction module 204.

The interaction module 204 is connected to the detection module 203, and receives and outputs the detection result sent by the detection module 203.

The detection module 203 is as shown in FIG. 3 and includes:

The file detecting unit 301, according to the detection location and the detection attribute, detecting whether a feature file exists in the file path to be detected; sending the detection result to the interaction module 204;

The registry detecting unit 302 detects, according to the detected location and the detection attribute, whether a feature registry entry exists in the registry path that needs to be detected; and sends the detection result to the interaction module 204;

The process detecting unit 303 is configured to detect according to the detected location and the detection attribute. Detecting whether there is a feature process in the process; sending the detection result to the interaction module 204; the service detection unit 304, according to the detection location and the detection attribute, detecting whether a feature service exists in the service to be detected; sending the detection result to The interaction module 204: the memory detecting unit 305 detects, according to the detection location and the detection attribute, whether a feature code exists in the memory that needs to be detected; and sends the detection result to the interaction module 204.

For example, the information about a known plug-in stored in the known plug-in information stored by the storage module 201 is ScanFile (%system%\test.exe). After the analysis module 202 reads the information, the detection of the known plug-in can be determined. The location is the system directory, and the detection attribute is a file named test.exe. The analysis module 202 sends the detection location and the detection attribute to the detection module 203. The detection module 203 can determine the detection function according to the ScanFile keyword (for different detection positions, there are different detection functions, which can be defined in advance, for example, known plug-in information. In the ScanFile keyword, the file scan function is used to detect the file; if the plugin also performs the registry write, the ScanReg keyword can also be defined, corresponding to the registry scan function, used to detect the registry, etc., different detections After the detection function is determined, that is, after the detection function is determined, the file detection unit 301 is determined in this example, and thus the file detection unit 301 is %system%\test. The exe is detected as a search path parameter, and the detection result is returned to the interaction module 204.

For the case where the information of the plug-in information is included in the plug-in information, the analysis module 202 may read the information of the plurality of plug-ins and send the information to the detecting module 203 for detection, or may read the information of the known plug-ins one by one. The detecting module 203 detects the plug-in by the detecting module 203, and after receiving the detection result and sending the result to the interaction module 204, the analyzing module 202 reads the next known plug-in information until all the plug-ins are detected.

The interaction module 204 outputs the detection result sent by the detection module 203 by means of screen display, voice prompt, and the like. For example, if a plugin is detected, the detected plugin is displayed; if it is not detected, it is not displayed or the plugin is not detected. You can also lose one by one when outputting test results. Output multiple or all test results at the same time.

As another embodiment, the plug-in scanning system of the present invention, as shown in FIG. 4, may further include a search module 205, connected to the detecting module 203 and the interaction module 204, for detecting results according to the detecting module 203 (such as detecting The plug-in is obtained, and the evaluation of the plug-in is obtained from the web server, and sent to the interaction module 204 for output display.

As another embodiment, the plug-in scanning system of the present invention, as shown in FIG. 5, may further include a processing module 206, and is connected to the interaction module 204. After receiving the delete plug-in command sent by the interaction module 204, the corresponding plug-in is deleted.

The interaction module 204 further provides an option to delete the detected plug-in on the output detection result interface. For example, after detecting the plug-in, in the interface for outputting the detection result, providing a "delete" after the detected plug-in is followed. Button, if the user clicks the button, the delete plugin command is issued.

Further, the processing module 206 is further configured to store a scan status, where the scan status records a plug-in that is not deleted by the user at the end of the scan, and the processing module 205 is further connected to the storage module 201, and saves the scan status record to the Storage module 201;

The next time the analysis module 202 performs the determination of the detection position and the detection attribute according to the known plug-in information, the analysis may be performed according to the scan status, thereby ignoring the plug-in that is not deleted by the user, thereby improving the detection speed and saving the system. Resources.

As another embodiment, the plug-in scanning system of the present invention, as shown in FIG. 6, may further include an upgrade module 207, connected to the storage module 201, for reading the latest known plug-in information from the network server, for the storage. The known plug-in information saved by module 201 is upgraded.

The plug-in scanning method and system can scan the known plug-in information by pre-storing the known plug-in information, so that the known plug-in can be retrieved in a targeted manner, and the scanning speed and accuracy can be improved. And the detailed description is not to be construed as limiting the scope of the invention. It should be noted that a number of variations and modifications may be made by those skilled in the art without departing from the spirit and scope of the invention. Therefore, the scope of the invention should be determined by the appended claims.

Claims

Claim

A plug-in scanning method, characterized in that the method comprises:

Detecting whether the detection attribute exists in the detection position;

Output test results.

The method of scanning a plug-in according to claim 1, wherein the detecting location comprises:

A combination of file paths, registry paths, processes, services, one of memory, or any combination of any of the following.

The method of scanning the plug-in according to claim 2, wherein the detecting the presence or absence of the detecting attribute at the detecting position comprises:

Detect whether there is a signature file in the file path to be detected, whether there is a feature registry entry in the registry path, whether a feature process exists in the process, whether a feature service exists in the service, whether one of the feature codes exists in the memory, or any A variety of combinations.

The method of scanning a plug-in according to claim 1, wherein the method further comprises: after outputting the detection result, if the result is that the plug-in is detected, searching for the evaluation of the detected plug-in, and displaying the evaluation .

The method of scanning a plug-in according to claim 1, further comprising: providing an option to delete the detected plug-in at an interface of the output detection result, and deleting the instruction when the plug-in is deleted Plugin.

The method of scanning a plug-in according to claim 5, wherein the method further comprises: storing a scan status, wherein the scan status records a plug-in that is not deleted by the user at the end of the scan; The reading the pre-stored known plug-in information, and determining the detection location and the detection attribute of the plug-in according to the known plug-in information, ignoring the plug-in that is not deleted by the user according to the scan state.

7. The method of scanning a plug-in according to claim 1, wherein the method further comprises:

Updating the pre-saved known plug-in information; keeping the pre-saved known plug-in information up-to-date.

8. A plug-in scanning system, characterized in that the system comprises:

a storage module, configured to save known plug-in information;

The plug-in scanning system according to claim 8, wherein the detecting module comprises:

The file detecting unit detects, according to the detection location and the detection attribute, whether a feature file exists in the file path to be detected; sends the detection result to the interaction module; and the registry detecting unit, according to the detection position and the detection attribute, Detecting whether a feature registry entry exists in a registry path that needs to be detected; sending the detection result to the interaction module;

a process detection unit, according to the detection location and the detection attribute, in the process that needs to be detected Detecting whether there is a feature process; sending the detection result to the interaction module; the service detection unit, detecting, according to the detection location and the detection attribute, whether a feature service exists in the service to be detected; sending the detection result to the interaction Module

The memory detecting unit detects, according to the detected position and the detection attribute, whether a feature code exists in the memory that needs to be detected; and sends the detection result to the interaction module.

10. The plug-in scanning system of claim 8, wherein the system further comprises:

The search module is respectively connected to the detection module and the interaction module, and is configured to obtain an evaluation of the plug-in from the network server according to the detection result of the detection module, and send the evaluation to the interaction module for output display.

11. The plug-in scanning system of claim 8, wherein the system further comprises:

The processing module is connected to the interaction module, and after receiving the delete plug-in command sent by the interaction module, deleting the corresponding plug-in;

The interaction module further provides an option to delete the detected plug-in on the output detection result interface, and when the user clicks the button, issues a delete plug-in instruction.

The plug-in scanning system according to claim 11, wherein the processing module is further connected to the storage module to save a scan status record to the storage module; and the scan status records the end of the scan a plugin that has not been deleted by the user;

The analysis module further ignores the plug-in that is not deleted by the user according to the scan state record when the detection position and the detection attribute are determined according to the known plug-in information.

13. The plug-in scanning system of claim 8, wherein the system further comprises:

An upgrade module, connected to the storage module, for reading the latest known plug from the web server Information, upgrade the known plug-in information saved by the storage module.