WO2014015753A1 - Method and apparatus for intercepting or cleaning-up plugins - Google Patents

Method and apparatus for intercepting or cleaning-up plugins Download PDF

Info

Publication number
WO2014015753A1
WO2014015753A1 PCT/CN2013/079482 CN2013079482W WO2014015753A1 WO 2014015753 A1 WO2014015753 A1 WO 2014015753A1 CN 2013079482 W CN2013079482 W CN 2013079482W WO 2014015753 A1 WO2014015753 A1 WO 2014015753A1
Authority
WO
WIPO (PCT)
Prior art keywords
plugin
performance
empirical data
data
meets
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2013/079482
Other languages
French (fr)
Inventor
Weijie Li
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Priority to BR112014017310A priority Critical patent/BR112014017310A8/en
Publication of WO2014015753A1 publication Critical patent/WO2014015753A1/en
Priority to US14/607,044 priority patent/US9531734B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/445—Program loading or initiating
    • G06F9/44521—Dynamic linking or loading; Link editing at or after load time, e.g. Java class loading
    • G06F9/44526—Plug-ins; Add-ons
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
    • G06F11/3409—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment for performance assessment
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
    • G06F2201/865—Monitoring of software

Definitions

  • the present invention relates to plugin detection technologies, and more particularly to a method and apparatus for intercepting or cleaning-up plugins.
  • plugin interception or cleanup is generally based on the malicious acts or reputations of the plugins.
  • malicious plugin like Adware or Spyware monitors the internet activities of user terminals, and sends the recorded data to a remote monitoring center for the purposes of advertising or stealing game or bank account passwords, which causes severe adverse effects on user terminals.
  • plugins are not malicious, have some useful functions, but may consume large amount of resources at the user terminal when they are running. Such plugins are usually not blocked or cleaned-up by security software, and are not easily found by the user terminal.
  • the present invention aims to provide a method for intercepting or cleaning-up plugins to ensure a more complete interception and cleanup of the plugins, and enhances the stability of the system.
  • a method for intercepting or cleaning-up a plugin comprising: obtaining performance attributes of a plugin; determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
  • the method further comprises monitoring activity of the plugin in a user terminal, wherein the activity is selected from a group comprising installing, loading, and running of the plugin; identifying the plugin based on the monitored activity; and obtaining performance attributes of the plugin when the plugin is identified.
  • the method further comprises, after identifying the plugin based on the monitored activity, evaluating performance attributes of the plugin when the plugin is not identified; determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
  • the method further comprises, prior to obtaining performance attributes of the plugin, obtaining empirical data of the plugin, wherein the empirical data comprises plugin importance data, plugin performance data, and/or end user review data; and determining whether the plugin meets the performance criterion based on the empirical data.
  • the empirical data obtained through plugin testing, backend collection, and/or web crawling backend collection comprises frontend collection and end user review
  • frontend collection comprises hook mode and notification mode
  • plug testing comprises testing the plugin in an automatic module to obtain information on the plugin's CPU usage, load time and/or memory usage
  • hook mode comprises using a hook to obtain a start time and an end time for loading the plugin, a start time and an end time for running the plugin, and information on the plug's CPU usage and/or memory usage while the plugin is loading and running
  • reception mode comprises a client directly notifying starting and ending of loading and running of the plugin
  • end user review comprises collecting reviews of end users on the performance of the plugin
  • web crawling comprises crawling search engine data and/or website review data to evaluate the performance of the plugin
  • the empirical data is stored in a remote cloud database or a local database.
  • determining if the plugin meets the performance criterion based on the performance attributes and empirical data comprises: matching the performance attributes with empirical data stored on a cloud database; obtaining a preset determination result after a successful match, and determining whether the plugin meets the performance criterion based on the preset determination result.
  • an apparatus for intercepting or cleaning-up a plugin comprising: a performance acquisition module for obtaining performance attributes of a plugin; a first performance determination module for determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and a plugin processing module for intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
  • the apparatus further comprises a plugin monitoring module for monitoring activity of the plugin in a user terminal, wherein the activity is selected from a group comprising installing, loading, and running of the plugin; identifying the plugin based on the monitored activity; and obtaining performance attributes of the plugin when the plugin is identified.
  • a plugin monitoring module for monitoring activity of the plugin in a user terminal, wherein the activity is selected from a group comprising installing, loading, and running of the plugin; identifying the plugin based on the monitored activity; and obtaining performance attributes of the plugin when the plugin is identified.
  • the apparatus further comprises a performance evaluation module for, after identifying the plugin based on the monitored activity, evaluating performance attributes of the plugin when the plugin is not identified; wherein the first performance determination module is configured for determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and the plugin processing module is configured for intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
  • a performance evaluation module for, after identifying the plugin based on the monitored activity, evaluating performance attributes of the plugin when the plugin is not identified; wherein the first performance determination module is configured for determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and the plugin processing module is configured for intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
  • the apparatus further comprises an empirical data acquisition module for obtaining empirical data of the plugin, wherein the empirical data comprises plugin importance data, plugin performance data, and/or end user review data; and a second performance determination module for determining whether the plugin meets a performance criterion based on the empirical data.
  • the empirical data comprises plugin importance data, plugin performance data, and/or end user review data
  • a second performance determination module for determining whether the plugin meets a performance criterion based on the empirical data.
  • the empirical data obtained through plugin testing, backend collection, and/or web crawling wherein backend collection comprises frontend collection and end user review, frontend collection comprises hook mode and notification mode, plug testing comprises testing the plugin in an automatic module to obtain information on the plugin's CPU usage, load time and/or memory usage; hook mode comprises using a hook to obtain a start time and an end time for loading the plugin, a start time and an end time for running the plugin, and information on the plug's CPU usage and/or memory usage while the plugin is loading and running; reception mode comprises a client directly notifying starting and ending of loading and running of the plugin; end user review comprises collecting reviews of end users on the performance of the plugin; web crawling comprises crawling search engine data and/or website review data to evaluate the performance of the plugin; and the empirical data is stored in a remote cloud database or a local database.
  • the first performance determination module is further configured for: matching the performance attributes with empirical data stored on a cloud database; obtaining a preset determination result after a successful match, and determining whether the plugin meets the performance criterion based on the preset determination result.
  • the performance attributes of a plugin can be evaluated to determine whether the plugin meets a preset performance criterion, and the plugin can then be processed according to the result of the determination.
  • the embodiments of the present invention are primarily directed to evaluate and process plugins that are being installed, loaded, or running: if the plugin does meet the performance criterion, it will be intercepted if being installed, and cleaned-up if being loaded or running.
  • Figure 1 is an exemplary flowchart for a method for intercepting or cleaning-up plugins in accordance with an embodiment of the present invention.
  • Figure 2 is an exemplary flowchart for a method for intercepting or cleaning-up plugins in accordance with another embodiment of the present invention.
  • Figure 3 is an exemplary flowchart for a method for intercepting or cleaning-up plugins in accordance with yet another embodiment of the present invention.
  • Figure 4 is an exemplary flowchart for acquiring empirical data in accordance with an embodiment of the present invention.
  • Figure 5 is an exemplary schematic diagram for relevant components for acquiring empirical data in accordance with an embodiment of the present invention.
  • FIG. 6 is an exemplary flowchart for processing a plugin being installed in accordance with an embodiment of the present invention.
  • Figure 7 is an exemplary schematic diagram for an interface for intercepting a plugin being installed in accordance with an embodiment of the present invention.
  • Figure 8 is an exemplary flowchart for processing a plugin being loaded in accordance with an embodiment of the present invention.
  • Figure 9 is an exemplary schematic diagram for relevant components for processing a plugin being loaded in accordance with an embodiment of the present invention.
  • Figure 10 is an exemplary flowchart for processing a running plugin in accordance with an embodiment of the present invention.
  • Figure 11 is an exemplary schematic diagram for relevant components for processing a running plugin in accordance with an embodiment of the present invention.
  • Figure 12 is an exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with an embodiment of the present invention.
  • Figure 13 is an exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with another embodiment of the present invention.
  • Figure 14 is an exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with yet another embodiment of the present invention.
  • Figure 15 is another exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with an embodiment of the present invention.
  • Plugins are common in computer software, and are supported by many types of software. For example, text editor software Ultra Edit and software development tool Visual Studio both support plugins. There are also plugins for browsers, which comes in different forms, such as browser helper object (BHO), ActiveX, Url SearchHook, and ToolBar.
  • BHO browser helper object
  • ActiveX ActiveX
  • Url SearchHook Url SearchHook
  • ToolBar ToolBar
  • BHO Browser Helper Objects
  • BHOs are applets that automatically run whenever an Internet browser (such as IE) starts.
  • a BHO file is installed into the user terminal systems by some other software.
  • Adware with downloading capability may install a BHO file to track the various advertisements while the user terminal surfs the web.
  • BHO usually makes it easier for user terminals to browse the Internet or use various accessory functions, but some BHOs are Adware or Spyware as which monitor the online behavior of user terminals and transmit recorded data to the creator of the BHO.
  • BHO may also create conflicts with other programs that are running, and causes various display and running-time errors that may prevents the normal browsing.
  • ActiveX plugins also known as OLE controls or OCX controls, are software components or objects that can be inserted into a webpage or other applications. Typical software needs to be separately downloaded by a user terminal before being installed, while ActiveX plugins will be automatically downloaded by the browser when the user navigates to a particular webpage, and the user will be prompted to install them. ActiveX plug-ins must be downloaded first, authenticated, and eventually confirmed by the user terminal before they can be installed. A webpage embedded with ActiveX scripts may become very slow, or may even freeze the browser.
  • Url SearchHook when a user terminal enters a non-standard Web address in the address bar, such as English characters or Chinese characters, that cannot be successfully interpreted by the address bar, the browser will automatically open a page containing the search result where the string entered by the user is used as the search term, which may help the user to find the needed contents.
  • Url SearchHook object is the plugin that completes such search, usually developed by a third-party company or individual, and installed on the browser as a plugin to help the user to better use the Internet. For example, if the user terminal enters "mobile phone" in the address bar, the search results for "mobile phone" will directly appear. Some companies or individuals may modify a browser's Url SearchHook without the knowledge of the user terminal in order to direct traffic to a particular website or for other commercial purposes.
  • Toolbar usually refers to accessory tools loaded in a browser, located below the standard browser toolbar. In Internet Explorer, one can right click the blank space in the toolbar to check the installed toolbars, and to display or hide the installed toolbars by making the corresponding selections.
  • the plugins in accordance with embodiments of the present invention are programs written accordance to certain standard application programming interfaces. For example, after being installed, browser plugins can be called directly by the browser.
  • the plugin can also be a component for certain software features, which can facilitate or impede the user's use of the software.
  • Performance refers to the specification parameters of a computer, such as speed, which is an important indicator of computer performance.
  • the performance of a computer can typically be evaluated by the CPU usage and the time it takes to complete a task. Inception refers to stopping the installation or loading of a plugin. Clean-up refers to the removal of the plugin from the computer.
  • WinHIPS Windows-NT-family Host Intrusion Prevention System
  • WinHIPS is a kernel driver which uses techniques such as filtering and system call hooking to implement intelligence interception and safeguard computer systems.
  • a method for intercepting or cleaning-up a plugin comprising:
  • Step 11 obtaining performance attributes of a plugin
  • Step 12 determining whether the plugin meets a performance criterion based on the performance attributes and empirical data. If the plugin does not meet the performance criterion, proceed to Step 13; if the plugin meets the performance criterion, proceed to Step 14. Step 13: intercepting or cleaning-up the plugin; Step 14: no action taken.
  • the performance attributes of a plugin can be evaluated to determine whether the plugin meets a preset performance criterion, and the plugin can then be processed according to the result of the determination.
  • This embodiment of the present invention is primarily directed to evaluating and processing plugins that are being installed, loaded, or running: if the plugin does meet the performance criterion, it will be intercepted if being installed, and cleaned-up if being loaded or running; if the plugin meets the performance criterion, no action is taken.
  • the method further comprises, prior to the above method,
  • Step 10 monitoring activity of the plugin in a user terminal, wherein the activity is selected from a group comprising installing, loading, and running of the plugin; identifying the plugin based on the monitored activity; if the plugin is identified, proceeds to step 11; if the plug is not identified, proceeds to step 15.
  • Step 15 evaluating performance attributes of the plugin when the plugin is not identified
  • Step 16 determining whether the plugin meets a performance criterion based on the performance attributes and empirical data. If the plugin does not meet the performance criterion, proceed to Step 13; if the plugin meets the performance criterion, proceed to Step 14.
  • the method further comprises, prior to Step 10:
  • Step 8 obtaining empirical data of the plugin, wherein the empirical data comprises plugin importance data, plugin performance data, and/or end user review data;
  • Step 9 determining whether the plugin meets a performance criterion based on the empirical data.
  • the empirical data can be obtained through plugin testing, backend collection, and/or web crawling
  • backend collection comprises frontend collection and end user review
  • frontend collection comprises hook mode and notification mode
  • the empirical data is stored in a remote cloud database or a local database.
  • the cloud database is located at the server and can be used to store empirical data, and can communicate with the client over the network.
  • the local database is located locally at the client and can be used to store empirical data.
  • plug testing comprises testing the plugin in an automatic module to obtain information on the plugin' s CPU usage, load time and/or memory usage.
  • Frontend collection can be implemented through a client, and includes hook mode and notification mode.
  • Hook mode using a hook to obtain a start time and an end time for loading the plugin, a start time and an end time for running the plugin, and information on the plug's CPU usage and/or memory usage while the plugin is loading and running;
  • Reception mode a client directly notifying starting and ending of loading and running of the plugin.
  • Frontend collection includes collection hardware and software environment to further evaluate performance data.
  • End user review includes collecting reviews of end users on the performance of the plugin, which can be placed in the plugin cleanup module of security software, or plugin monitoring modules, or any other places.
  • Web crawling includes crawling search engine data and/or website review data to evaluate the performance of the plugin.
  • one factor that should be considered is the necessity of the plugin.
  • plugins like the Flash are highly necessary, and should be loaded even if its performance is poorer than other plugins, and the performance attributes of such plugins should be directly set as meeting the criterion.
  • the factors to be considered regarding whether or not a plugin meets the performance criterion include but are not limited to plugins necessity or importance data, end user plugin performance review data; plugin performance testing data, frontend collected performance data, and relevant performance data on the Internet. For example, a plugin with long loading time, poor end user review and not particularly important can be set as not meeting the performance criterion.
  • the method for intercepting or cleaning-up a plugin can be implemented in a client and a server, and the client can include a performance acquisition module 201, an evalution/determination module 202 and a plugin processing module 203.
  • the method can also be implemented in a plugin signature database 206 and a local empirical database 205.
  • the server can include backend module 207.
  • the method can also be implemented in cloud empirical data database 204 as shown in Figure 5.
  • the performance acquisition module 201, evaluation/determination module 202 and plugin processing module 203 generally can be one or several independent installation files based on the needs, and whose functionalities can be implemented as either Dynamic Link Library (DLL) or Label Information Base (LIB).
  • DLL Dynamic Link Library
  • LIB Label Information Base
  • the evaluating and processing of a plugin being installed at the user terminal will be described in reference to Figure 6.
  • the process includes:
  • Step 101 monitoring the installation of a plugin at a user terminal
  • Step 102 obtaining the performance attributes of the plugin
  • Step 103 matching the performance attributes with empirical data stored on a cloud database; obtaining a preset determination result after a successful match, and determining whether the plugin meets the performance criterion based on the preset determination result. If the plugin does not meet the performance criterion, proceed to Step 104; if the plugin meets the performance criterion, proceed to Step 105.
  • Step 104 intercepting or cleaning-up the plug- in.
  • Step 105 no action taken.
  • the plugin monitoring module 201 monitors various activities at the user terminal, such as addition, deletion, or modification of entries in the registry, files, and services.
  • the plugin monitoring module 201 generally runs in the driver layer.
  • the plugin signature database 206 can record identifying characteristics of plugins, such as those written to specific locations of the registry, which can be used to identify the plugin.
  • the plugin monitoring module 201 can catch such activity, and compares such activity with plugin signature database 206 to identify the plugin and obtain other information on the plugin. As a result, it can be confirmed that the monitored activity is the installation of the specific plugin.
  • the plugin monitoring module 201 then sends information regarding the plugin, such as the identification (ID) of the plugin, to the evaluation/determination module 202.
  • the evaluation/ determination module 202 is mainly used to obtain performance attributes of the plugin.
  • the evaluation/determination module 202 can visit cloud empirical database 204 or local empirical database 205 to obtain performance attributes of the plugin.
  • the evaluation/determination module 202 visits cloud empirical database 204 first to obtain performance attributes of the plugin from the server, then determines whether the plugin meets the performance criterion or directly obtains a preset result on whether the plugin meets the performance criterion. The result can be pre-obtained by backend module 207.
  • the local empirical database 205 is a backup when there is no network connection, or when the network connection is poor and the cloud empirical database 204 cannot be connected.
  • the present result on whether the plugin meets the performance criterion can be located on the server, and be updated when data on the server data is being updated.
  • the present result can also be located at the client, and be updated through replacement of the relevant files.
  • Whether the plugin meets the performance criterion is determined not only based on the loading time of the plugin, or any other individual data, but can also be based on a variety of factors, such as combining the loading time with end user review.
  • Plugin can be installed as regular software, such as through a plugin installation package, or can be installed while other software is being installed.
  • the plugin can be intercepted by the plugin processing module 203 as shown in Figure 7.
  • the interception user interface can be a popup window shown in Figure 7. If the plugin meets the performance criterion, no action will be taken.
  • the evaluation and processing of plugin being loaded at the user terminal will be described in reference to Figures 8 and 9.
  • the process includes:
  • Step 401 monitoring the loading of a plugin at a user terminal
  • Step 402 obtaining the performance attributes of the plugin
  • Step 403 matching the performance attributes with empirical data stored on a cloud database; obtaining a preset determination result after a successful match, and determining whether the plugin meets the performance criterion based on the preset determination result. If the plugin does not meet the performance criterion, proceed to Step 404; if the plugin meets the performance criterion, proceed to Step 405.
  • Step 404 cleaning-up the plug-in.
  • Step 405 no action taken.
  • the plugin monitoring module 501 can catch the plugin when it is being loaded at the user terminal, and sends to evaluation/determination module 502.
  • the evaluation/determination module 502 can visit cloud empirical database 504 or local empirical database 505 to obtain performance attributes of the plugin.
  • the data in the cloud empirical database 504 is acquired through the backend module 507.
  • the performance attributes will be matched with empirical data. If a match is successfully found, a preset determination result is obtained, and whether the plugin meets the performance criterion is determined based on the preset determination result. If the plugin does not meet the performance criterion, prohibit the loading of the plugin if permitted by the user terminal, and process the plugin using plugin processing module 503 if permitted by the user terminal. If the plugin meets the performance criterion, no action will be taken. During the removal of the plugin, identifying characteristics of the plugin should be obtained from the plugin signature database 505.
  • the evaluation and processing of plugin running at the user terminal will be described in reference to Figures 10 and 11.
  • the process includes:
  • Step 601 monitoring the running of a plugin at a user terminal, obtaining performance attributes of the plugin;
  • Step 602 evaluate the performance attributes of the plugin
  • Step 603 determining whether the plugin meets the performance criterion based on the performance attributes. If the plugin does not meet the performance criterion, proceed to Step 604; if the plugin meets the performance criterion, proceed to Step 605.
  • Step 604 cleaning-up the plug-in.
  • Step 605 no action taken.
  • a running plugin may have passed the testing during its loading, or its performance attributes might not been collected by the cloud empirical database 704 o local empirical database 705 through the backend module 707.
  • the plugin monitor module 701 can be used to catch the plugin, and send it to the evaluation/determination module 702 to obtain the performance attribute of the plugin. It can also test the performance of the plugin in real time if needed, and derive a determination result. If the plugin does not meet the performance criterion, clean-up the plugin using plugin processing module 703 if permitted by the user terminal. If the plugin meets the performance criterion, no action will be taken. During the cleanup of the plugin, identifying characteristics of the plugin should be obtained from the plugin signature database 706. If the performance attributes of the plugin has already be collected, the plugin can be processed in similar fashion discussed above when it is being installed or loaded.
  • Figure 12 is an exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with an embodiment of the present invention.
  • the apparatus 20 includes a performance acquisition module 21, a first performance determination module 22, and a plugin processing module 23.
  • the performance acquisition module 21 is used for obtaining performance attributes of a plugin;
  • the first performance determination module 22 is sued for determining whether the plugin meets a performance criterion based on the performance attributes and empirical data;
  • the plugin processing module 23 is used for intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
  • the performance attributes of a plugin can be evaluated to determine whether the plugin meets a preset performance criterion, and the plugin can then be processed according to the result of the determination.
  • This embodiment of the present invention is primarily directed to evaluating and processing plugins that are being installed, loaded, or running: if the plugin does meet the performance criterion, it will be intercepted if being installed, and cleaned-up if being loaded or running; if the plugin meets the performance criterion, no action is taken.
  • Figure 13 is an exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with another embodiment of the present invention.
  • the apparatus 20 can further include a plugin monitoring module 24 for monitoring activity of the plugin in a user terminal, wherein the activity is selected from a group comprising installing, loading, and running of the plugin; identifying the plugin based on the monitored activity; and obtaining performance attributes of the plugin when the plugin is identified.
  • Figure 14 is an exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with yet another embodiment of the present invention.
  • the apparatus 20 can further include a performance evaluation module 25 for, after the plugin is not identified, evaluating performance attributes of the plugin; wherein the first performance determination module 22 is configured for determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and the plugin processing module 23 is configured for intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
  • the empirical data can be obtained through plugin testing, backend collection, and/or web crawling, backend collection comprises frontend collection and end user review, frontend collection comprises hook mode and notification mode, the empirical data is stored in a remote cloud database or a local database.
  • Figure 15 is another exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with an embodiment of the present invention.
  • the apparatus 20 can further include an empirical data acquisition module 26 and a second performance determination module 28; the empirical data acquisition module 26 is used for obtaining empirical data of the plugin, wherein the empirical data comprises plugin importance data, plugin performance data, and/or end user review data.
  • the second performance determination module 28 is used for determining whether the plugin meets a performance criterion based on the empirical data.
  • the apparatus 20 for intercepting or cleaning-up a plugin can be implemented in a client and a server, and the client can include a performance acquisition module 201, a evaluation/determination module 202 and a plugin processing module 203.
  • the apparatus can also be implemented in a plugin signature database 206 and a local empirical database 205.
  • the server can include backend module 207.
  • the method can also be implemented in cloud empirical data database 204.
  • the performance acquisition module 201, evaluation/determination module 202 and plugin processing module 203 generally can be one or several independent installation files based on the needs, and whose functionalities can be implemented as either Dynamic Link Library (DLL) or Label Information Base (LIB).
  • DLL Dynamic Link Library
  • LIB Label Information Base
  • the performance acquisition module 24 is equivalent to the performance acquisition module 201 in Figure 5
  • the performance acquisition module 21, the first performance determination module 22 and performance evaluation module 25 are equivalent to evaluation/determination module 202 in Figure 5
  • the plugin processing module 23 is equivalent to plugin processing module 203
  • the empirical data acquisition module 26 and the second performance determination module 28 are equivalent to backend module 207 in Figure 5.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Stored Programmes (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Description

METHOD AND APPARATUS FOR INTERCEPTING OR
CLEANING-UP PLUGINS
CROSS-REFERENCE TO RELATED APPLICATIONS
This application claims the benefit and priority of Chinese Patent Application No.
201210264230.X, entitled "Method and Apparatus for Intercepting or Cleaning-up Plugins," filed on July 27, 2012. The entire disclosures of each of the above applications are incorporated herein by reference.
TECHNICAL FIELD
The present invention relates to plugin detection technologies, and more particularly to a method and apparatus for intercepting or cleaning-up plugins.
BACKGROUND
In the prior art, plugin interception or cleanup is generally based on the malicious acts or reputations of the plugins. For example, malicious plugin like Adware or Spyware monitors the internet activities of user terminals, and sends the recorded data to a remote monitoring center for the purposes of advertising or stealing game or bank account passwords, which causes severe adverse effects on user terminals.
However, some plugins are not malicious, have some useful functions, but may consume large amount of resources at the user terminal when they are running. Such plugins are usually not blocked or cleaned-up by security software, and are not easily found by the user terminal.
Since the current security software only blocks or cleans-up plugin based on maliciousness, it may miss some plugins, which could affect the stability of the user terminal system.
SUMMARY OF THE INVENTION
The present invention aims to provide a method for intercepting or cleaning-up plugins to ensure a more complete interception and cleanup of the plugins, and enhances the stability of the system.
In accordance with embodiments of the present invention, a method for intercepting or cleaning-up a plugin is provided, the method comprising: obtaining performance attributes of a plugin; determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
Preferably, the method further comprises monitoring activity of the plugin in a user terminal, wherein the activity is selected from a group comprising installing, loading, and running of the plugin; identifying the plugin based on the monitored activity; and obtaining performance attributes of the plugin when the plugin is identified.
Preferably, the method further comprises, after identifying the plugin based on the monitored activity, evaluating performance attributes of the plugin when the plugin is not identified; determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
Preferably, the method further comprises, prior to obtaining performance attributes of the plugin, obtaining empirical data of the plugin, wherein the empirical data comprises plugin importance data, plugin performance data, and/or end user review data; and determining whether the plugin meets the performance criterion based on the empirical data.
Preferably, the empirical data obtained through plugin testing, backend collection, and/or web crawling, backend collection comprises frontend collection and end user review, frontend collection comprises hook mode and notification mode, plug testing comprises testing the plugin in an automatic module to obtain information on the plugin's CPU usage, load time and/or memory usage; hook mode comprises using a hook to obtain a start time and an end time for loading the plugin, a start time and an end time for running the plugin, and information on the plug's CPU usage and/or memory usage while the plugin is loading and running; reception mode comprises a client directly notifying starting and ending of loading and running of the plugin; end user review comprises collecting reviews of end users on the performance of the plugin; web crawling comprises crawling search engine data and/or website review data to evaluate the performance of the plugin; and the empirical data is stored in a remote cloud database or a local database.
Preferably, determining if the plugin meets the performance criterion based on the performance attributes and empirical data comprises: matching the performance attributes with empirical data stored on a cloud database; obtaining a preset determination result after a successful match, and determining whether the plugin meets the performance criterion based on the preset determination result.
In accordance with embodiments of the present invention, an apparatus for intercepting or cleaning-up a plugin is provided, the apparatus comprising: a performance acquisition module for obtaining performance attributes of a plugin; a first performance determination module for determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and a plugin processing module for intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
Preferably, the apparatus further comprises a plugin monitoring module for monitoring activity of the plugin in a user terminal, wherein the activity is selected from a group comprising installing, loading, and running of the plugin; identifying the plugin based on the monitored activity; and obtaining performance attributes of the plugin when the plugin is identified.
Preferably, the apparatus further comprises a performance evaluation module for, after identifying the plugin based on the monitored activity, evaluating performance attributes of the plugin when the plugin is not identified; wherein the first performance determination module is configured for determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and the plugin processing module is configured for intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
Preferably, the apparatus further comprises an empirical data acquisition module for obtaining empirical data of the plugin, wherein the empirical data comprises plugin importance data, plugin performance data, and/or end user review data; and a second performance determination module for determining whether the plugin meets a performance criterion based on the empirical data.
Preferably, the empirical data obtained through plugin testing, backend collection, and/or web crawling, wherein backend collection comprises frontend collection and end user review, frontend collection comprises hook mode and notification mode, plug testing comprises testing the plugin in an automatic module to obtain information on the plugin's CPU usage, load time and/or memory usage; hook mode comprises using a hook to obtain a start time and an end time for loading the plugin, a start time and an end time for running the plugin, and information on the plug's CPU usage and/or memory usage while the plugin is loading and running; reception mode comprises a client directly notifying starting and ending of loading and running of the plugin; end user review comprises collecting reviews of end users on the performance of the plugin; web crawling comprises crawling search engine data and/or website review data to evaluate the performance of the plugin; and the empirical data is stored in a remote cloud database or a local database.
Preferably, the first performance determination module is further configured for: matching the performance attributes with empirical data stored on a cloud database; obtaining a preset determination result after a successful match, and determining whether the plugin meets the performance criterion based on the preset determination result. In accordance with embodiments of the present invention, the performance attributes of a plugin can be evaluated to determine whether the plugin meets a preset performance criterion, and the plugin can then be processed according to the result of the determination. The embodiments of the present invention are primarily directed to evaluate and process plugins that are being installed, loaded, or running: if the plugin does meet the performance criterion, it will be intercepted if being installed, and cleaned-up if being loaded or running.
BRIEF DESCRIPTION OF THE DRAWINGS
Figure 1 is an exemplary flowchart for a method for intercepting or cleaning-up plugins in accordance with an embodiment of the present invention.
Figure 2 is an exemplary flowchart for a method for intercepting or cleaning-up plugins in accordance with another embodiment of the present invention.
Figure 3 is an exemplary flowchart for a method for intercepting or cleaning-up plugins in accordance with yet another embodiment of the present invention.
Figure 4 is an exemplary flowchart for acquiring empirical data in accordance with an embodiment of the present invention.
Figure 5 is an exemplary schematic diagram for relevant components for acquiring empirical data in accordance with an embodiment of the present invention.
Figure 6 is an exemplary flowchart for processing a plugin being installed in accordance with an embodiment of the present invention.
Figure 7 is an exemplary schematic diagram for an interface for intercepting a plugin being installed in accordance with an embodiment of the present invention.
Figure 8 is an exemplary flowchart for processing a plugin being loaded in accordance with an embodiment of the present invention.
Figure 9 is an exemplary schematic diagram for relevant components for processing a plugin being loaded in accordance with an embodiment of the present invention.
Figure 10 is an exemplary flowchart for processing a running plugin in accordance with an embodiment of the present invention.
Figure 11 is an exemplary schematic diagram for relevant components for processing a running plugin in accordance with an embodiment of the present invention.
Figure 12 is an exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with an embodiment of the present invention. Figure 13 is an exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with another embodiment of the present invention.
Figure 14 is an exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with yet another embodiment of the present invention.
Figure 15 is another exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with an embodiment of the present invention.
To better illustrate the technical features of the embodiments of the present invention, various embodiments of the present invention will be briefly described in conjunction with the accompanying drawings.
DESCRIPTION OF THE PREFERRED EMBODIMENTS
It should be noted that the various embodiments are merely provided to illustrate the present invention, and are not intended to limit the scope of the present invention.
Plugins are common in computer software, and are supported by many types of software. For example, text editor software Ultra Edit and software development tool Visual Studio both support plugins. There are also plugins for browsers, which comes in different forms, such as browser helper object (BHO), ActiveX, Url SearchHook, and ToolBar.
BHO: Browser Helper Objects (BHOs) are applets that automatically run whenever an Internet browser (such as IE) starts. Usually, a BHO file is installed into the user terminal systems by some other software. For example, some Adware with downloading capability may install a BHO file to track the various advertisements while the user terminal surfs the web. BHO usually makes it easier for user terminals to browse the Internet or use various accessory functions, but some BHOs are Adware or Spyware as which monitor the online behavior of user terminals and transmit recorded data to the creator of the BHO. BHO may also create conflicts with other programs that are running, and causes various display and running-time errors that may prevents the normal browsing.
ActiveX: ActiveX plugins, also known as OLE controls or OCX controls, are software components or objects that can be inserted into a webpage or other applications. Typical software needs to be separately downloaded by a user terminal before being installed, while ActiveX plugins will be automatically downloaded by the browser when the user navigates to a particular webpage, and the user will be prompted to install them. ActiveX plug-ins must be downloaded first, authenticated, and eventually confirmed by the user terminal before they can be installed. A webpage embedded with ActiveX scripts may become very slow, or may even freeze the browser.
Url SearchHook: when a user terminal enters a non-standard Web address in the address bar, such as English characters or Chinese characters, that cannot be successfully interpreted by the address bar, the browser will automatically open a page containing the search result where the string entered by the user is used as the search term, which may help the user to find the needed contents. Url SearchHook object is the plugin that completes such search, usually developed by a third-party company or individual, and installed on the browser as a plugin to help the user to better use the Internet. For example, if the user terminal enters "mobile phone" in the address bar, the search results for "mobile phone" will directly appear. Some companies or individuals may modify a browser's Url SearchHook without the knowledge of the user terminal in order to direct traffic to a particular website or for other commercial purposes.
Toolbar usually refers to accessory tools loaded in a browser, located below the standard browser toolbar. In Internet Explorer, one can right click the blank space in the toolbar to check the installed toolbars, and to display or hide the installed toolbars by making the corresponding selections.
The plugins in accordance with embodiments of the present invention are programs written accordance to certain standard application programming interfaces. For example, after being installed, browser plugins can be called directly by the browser. The plugin can also be a component for certain software features, which can facilitate or impede the user's use of the software. Performance refers to the specification parameters of a computer, such as speed, which is an important indicator of computer performance. The performance of a computer can typically be evaluated by the CPU usage and the time it takes to complete a task. Inception refers to stopping the installation or loading of a plugin. Clean-up refers to the removal of the plugin from the computer.
Windows-NT-family Host Intrusion Prevention System( WinHIPS )is a kernel driver which uses techniques such as filtering and system call hooking to implement intelligence interception and safeguard computer systems.
As shown in Figure 1, in accordance with an embodiment of the present invention, a method for intercepting or cleaning-up a plugin is provided, the method comprising:
Step 11 : obtaining performance attributes of a plugin;
Step 12: determining whether the plugin meets a performance criterion based on the performance attributes and empirical data. If the plugin does not meet the performance criterion, proceed to Step 13; if the plugin meets the performance criterion, proceed to Step 14. Step 13: intercepting or cleaning-up the plugin; Step 14: no action taken.
In accordance with the method for intercepting or cleaning-up a plugin, the performance attributes of a plugin can be evaluated to determine whether the plugin meets a preset performance criterion, and the plugin can then be processed according to the result of the determination. This embodiment of the present invention is primarily directed to evaluating and processing plugins that are being installed, loaded, or running: if the plugin does meet the performance criterion, it will be intercepted if being installed, and cleaned-up if being loaded or running; if the plugin meets the performance criterion, no action is taken.
As shown in Figure 2, in accordance with another embodiment of the present invention, the method further comprises, prior to the above method,
Step 10: monitoring activity of the plugin in a user terminal, wherein the activity is selected from a group comprising installing, loading, and running of the plugin; identifying the plugin based on the monitored activity; if the plugin is identified, proceeds to step 11; if the plug is not identified, proceeds to step 15.
Step 15: evaluating performance attributes of the plugin when the plugin is not identified;
Step 16: determining whether the plugin meets a performance criterion based on the performance attributes and empirical data. If the plugin does not meet the performance criterion, proceed to Step 13; if the plugin meets the performance criterion, proceed to Step 14.
As shown in Figure 3, in accordance with another embodiment of the present invention, the method further comprises, prior to Step 10:
Step 8: obtaining empirical data of the plugin, wherein the empirical data comprises plugin importance data, plugin performance data, and/or end user review data; and
Step 9: determining whether the plugin meets a performance criterion based on the empirical data.
As shown in Figure 4, the empirical data can be obtained through plugin testing, backend collection, and/or web crawling, backend collection comprises frontend collection and end user review, frontend collection comprises hook mode and notification mode, the empirical data is stored in a remote cloud database or a local database. The cloud database is located at the server and can be used to store empirical data, and can communicate with the client over the network. The local database is located locally at the client and can be used to store empirical data. Further, plug testing comprises testing the plugin in an automatic module to obtain information on the plugin' s CPU usage, load time and/or memory usage.
Frontend collection can be implemented through a client, and includes hook mode and notification mode.
1. Hook mode: using a hook to obtain a start time and an end time for loading the plugin, a start time and an end time for running the plugin, and information on the plug's CPU usage and/or memory usage while the plugin is loading and running;
2. Reception mode: a client directly notifying starting and ending of loading and running of the plugin.
Frontend collection includes collection hardware and software environment to further evaluate performance data.
End user review includes collecting reviews of end users on the performance of the plugin, which can be placed in the plugin cleanup module of security software, or plugin monitoring modules, or any other places.
Web crawling includes crawling search engine data and/or website review data to evaluate the performance of the plugin.
In constructing the cloud database for empirical data, one factor that should be considered is the necessity of the plugin. For example, plugins like the Flash are highly necessary, and should be loaded even if its performance is poorer than other plugins, and the performance attributes of such plugins should be directly set as meeting the criterion. The factors to be considered regarding whether or not a plugin meets the performance criterion include but are not limited to plugins necessity or importance data, end user plugin performance review data; plugin performance testing data, frontend collected performance data, and relevant performance data on the Internet. For example, a plugin with long loading time, poor end user review and not particularly important can be set as not meeting the performance criterion.
The method for intercepting or cleaning-up a plugin can be implemented in a client and a server, and the client can include a performance acquisition module 201, an evalution/determination module 202 and a plugin processing module 203. The method can also be implemented in a plugin signature database 206 and a local empirical database 205. The server can include backend module 207. The method can also be implemented in cloud empirical data database 204 as shown in Figure 5. The performance acquisition module 201, evaluation/determination module 202 and plugin processing module 203 generally can be one or several independent installation files based on the needs, and whose functionalities can be implemented as either Dynamic Link Library (DLL) or Label Information Base (LIB).
The evaluating and processing of a plugin being installed at the user terminal will be described in reference to Figure 6. The process includes:
Step 101 : monitoring the installation of a plugin at a user terminal;
Step 102: obtaining the performance attributes of the plugin;
Step 103: matching the performance attributes with empirical data stored on a cloud database; obtaining a preset determination result after a successful match, and determining whether the plugin meets the performance criterion based on the preset determination result. If the plugin does not meet the performance criterion, proceed to Step 104; if the plugin meets the performance criterion, proceed to Step 105.
Step 104: intercepting or cleaning-up the plug- in.
Step 105: no action taken.
The plugin monitoring module 201 monitors various activities at the user terminal, such as addition, deletion, or modification of entries in the registry, files, and services. The plugin monitoring module 201 generally runs in the driver layer. The plugin signature database 206 can record identifying characteristics of plugins, such as those written to specific locations of the registry, which can be used to identify the plugin. When the plugin is being installed at the user terminal, the plugin monitoring module 201 can catch such activity, and compares such activity with plugin signature database 206 to identify the plugin and obtain other information on the plugin. As a result, it can be confirmed that the monitored activity is the installation of the specific plugin.
The plugin monitoring module 201 then sends information regarding the plugin, such as the identification (ID) of the plugin, to the evaluation/determination module 202. The evaluation/ determination module 202 is mainly used to obtain performance attributes of the plugin. The evaluation/determination module 202 can visit cloud empirical database 204 or local empirical database 205 to obtain performance attributes of the plugin. The evaluation/determination module 202 visits cloud empirical database 204 first to obtain performance attributes of the plugin from the server, then determines whether the plugin meets the performance criterion or directly obtains a preset result on whether the plugin meets the performance criterion. The result can be pre-obtained by backend module 207. The local empirical database 205 is a backup when there is no network connection, or when the network connection is poor and the cloud empirical database 204 cannot be connected. In accordance with this embodiment, the present result on whether the plugin meets the performance criterion can be located on the server, and be updated when data on the server data is being updated. The present result can also be located at the client, and be updated through replacement of the relevant files.
Whether the plugin meets the performance criterion is determined not only based on the loading time of the plugin, or any other individual data, but can also be based on a variety of factors, such as combining the loading time with end user review.
Plugin can be installed as regular software, such as through a plugin installation package, or can be installed while other software is being installed. When a plugin is being installed, if it is determined that the plugin does not meet the performance criterion, the plugin can be intercepted by the plugin processing module 203 as shown in Figure 7. The interception user interface can be a popup window shown in Figure 7. If the plugin meets the performance criterion, no action will be taken.
The evaluation and processing of plugin being loaded at the user terminal will be described in reference to Figures 8 and 9. The process includes:
Step 401: monitoring the loading of a plugin at a user terminal;
Step 402: obtaining the performance attributes of the plugin;
Step 403: matching the performance attributes with empirical data stored on a cloud database; obtaining a preset determination result after a successful match, and determining whether the plugin meets the performance criterion based on the preset determination result. If the plugin does not meet the performance criterion, proceed to Step 404; if the plugin meets the performance criterion, proceed to Step 405.
Step 404: cleaning-up the plug-in.
Step 405: no action taken.
For plugin that has already been installed, the plugin monitoring module 501 can catch the plugin when it is being loaded at the user terminal, and sends to evaluation/determination module 502. The evaluation/determination module 502 can visit cloud empirical database 504 or local empirical database 505 to obtain performance attributes of the plugin. The data in the cloud empirical database 504 is acquired through the backend module 507. The performance attributes will be matched with empirical data. If a match is successfully found, a preset determination result is obtained, and whether the plugin meets the performance criterion is determined based on the preset determination result. If the plugin does not meet the performance criterion, prohibit the loading of the plugin if permitted by the user terminal, and process the plugin using plugin processing module 503 if permitted by the user terminal. If the plugin meets the performance criterion, no action will be taken. During the removal of the plugin, identifying characteristics of the plugin should be obtained from the plugin signature database 505.
The evaluation and processing of plugin running at the user terminal will be described in reference to Figures 10 and 11. The process includes:
Step 601 : monitoring the running of a plugin at a user terminal, obtaining performance attributes of the plugin;
Step 602: evaluate the performance attributes of the plugin;
Step 603: determining whether the plugin meets the performance criterion based on the performance attributes. If the plugin does not meet the performance criterion, proceed to Step 604; if the plugin meets the performance criterion, proceed to Step 605.
Step 604: cleaning-up the plug-in.
Step 605: no action taken.
A running plugin may have passed the testing during its loading, or its performance attributes might not been collected by the cloud empirical database 704 o local empirical database 705 through the backend module 707. Thus, the plugin monitor module 701 can be used to catch the plugin, and send it to the evaluation/determination module 702 to obtain the performance attribute of the plugin. It can also test the performance of the plugin in real time if needed, and derive a determination result. If the plugin does not meet the performance criterion, clean-up the plugin using plugin processing module 703 if permitted by the user terminal. If the plugin meets the performance criterion, no action will be taken. During the cleanup of the plugin, identifying characteristics of the plugin should be obtained from the plugin signature database 706. If the performance attributes of the plugin has already be collected, the plugin can be processed in similar fashion discussed above when it is being installed or loaded.
Figure 12 is an exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with an embodiment of the present invention. As shown in Figure 12, the apparatus 20 includes a performance acquisition module 21, a first performance determination module 22, and a plugin processing module 23. The performance acquisition module 21 is used for obtaining performance attributes of a plugin; the first performance determination module 22 is sued for determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and the plugin processing module 23 is used for intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion. In accordance with the apparatus 20 for intercepting or cleaning-up a plugin, the performance attributes of a plugin can be evaluated to determine whether the plugin meets a preset performance criterion, and the plugin can then be processed according to the result of the determination. This embodiment of the present invention is primarily directed to evaluating and processing plugins that are being installed, loaded, or running: if the plugin does meet the performance criterion, it will be intercepted if being installed, and cleaned-up if being loaded or running; if the plugin meets the performance criterion, no action is taken.
Figure 13 is an exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with another embodiment of the present invention. As shown in Figure 13, the apparatus 20 can further include a plugin monitoring module 24 for monitoring activity of the plugin in a user terminal, wherein the activity is selected from a group comprising installing, loading, and running of the plugin; identifying the plugin based on the monitored activity; and obtaining performance attributes of the plugin when the plugin is identified.
Figure 14 is an exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with yet another embodiment of the present invention. As shown in Figure 14, the apparatus 20 can further include a performance evaluation module 25 for, after the plugin is not identified, evaluating performance attributes of the plugin; wherein the first performance determination module 22 is configured for determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and the plugin processing module 23 is configured for intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
As shown in Figure 4, the empirical data can be obtained through plugin testing, backend collection, and/or web crawling, backend collection comprises frontend collection and end user review, frontend collection comprises hook mode and notification mode, the empirical data is stored in a remote cloud database or a local database.
Figure 15 is another exemplary schematic diagram for an apparatus for intercepting or cleaning-up plugins in accordance with an embodiment of the present invention. As shown in Figure 15, the apparatus 20 can further include an empirical data acquisition module 26 and a second performance determination module 28; the empirical data acquisition module 26 is used for obtaining empirical data of the plugin, wherein the empirical data comprises plugin importance data, plugin performance data, and/or end user review data. The second performance determination module 28 is used for determining whether the plugin meets a performance criterion based on the empirical data. As shown in Figure 5, the apparatus 20 for intercepting or cleaning-up a plugin can be implemented in a client and a server, and the client can include a performance acquisition module 201, a evaluation/determination module 202 and a plugin processing module 203. The apparatus can also be implemented in a plugin signature database 206 and a local empirical database 205. The server can include backend module 207. The method can also be implemented in cloud empirical data database 204. The performance acquisition module 201, evaluation/determination module 202 and plugin processing module 203 generally can be one or several independent installation files based on the needs, and whose functionalities can be implemented as either Dynamic Link Library (DLL) or Label Information Base (LIB).
In this embodiment, the performance acquisition module 24 is equivalent to the performance acquisition module 201 in Figure 5, the performance acquisition module 21, the first performance determination module 22 and performance evaluation module 25 are equivalent to evaluation/determination module 202 in Figure 5; the plugin processing module 23 is equivalent to plugin processing module 203; the empirical data acquisition module 26 and the second performance determination module 28 are equivalent to backend module 207 in Figure 5.
The various embodiments of the present invention are merely preferred embodiments, and are not intended to limit the scope of the present invention, which includes any modification, equivalent, or improvement that does not depart from the spirit and principles of the present invention.

Claims

Claims
1. A method for intercepting or cleaning-up a plugin, the method comprising: obtaining performance attributes of a plugin; determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
2. The method of claim 1, further comprising monitoring activity of the plugin in a user terminal, wherein the activity is selected from a group comprising installing, loading, and running of the plugin; identifying the plugin based on the monitored activity; and obtaining performance attributes of the plugin when the plugin is identified.
3. The method of claim 2, further comprising, after identifying the plugin based on the monitored activity, evaluating performance attributes of the plugin when the plugin is not identified; determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
4. The method of claim 1, further comprising, prior to obtaining performance attributes of the plugin, obtaining empirical data of the plugin, wherein the empirical data comprises plugin importance data, plugin performance data, and/or end user review data; and determining whether the plugin meets the performance criterion based on the empirical data.
5. The method of claim 1, wherein the empirical data is obtained through plugin testing, backend collection, and/or web crawling, backend collection comprises frontend collection and end user review, frontend collection comprises hook mode and notification mode, plug testing comprises testing the plugin in an automatic module to obtain information on the plugin's CPU usage, load time and/or memory usage; hook mode comprises using a hook to obtain a start time and an end time for loading the plugin, a start time and an end time for running the plugin, and information on the plug's CPU usage and/or memory usage while the plugin is loading and running; reception mode comprises a client directly notifying starting and ending of loading and running of the plugin; end user review comprises collecting reviews of end users on the performance of the plugin; web crawling comprises crawling search engine data and/or website review data to evaluate the performance of the plugin; and the empirical data is stored in a remote cloud database or a local database.
6. The method of claim 1, wherein determining if the plugin meets a performance criterion based on the performance attributes and empirical data comprises: matching the performance attributes with empirical data stored on a cloud database;
obtaining a preset determination result after a successful match, and determining whether the plugin meets the performance criterion based on the preset determination result.
7. An apparatus for intercepting or cleaning-up a plugin, the apparatus comprising: a performance acquisition module for obtaining performance attributes of a plugin; a first performance determination module for determining whether the plugin meets a performance criterion based on the performance attributes and empirical data; and a plugin processing module for intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
8. The apparatus of claim 7, further comprising a plugin monitoring module for monitoring activity of the plugin in a user terminal, wherein the activity is selected from a group comprising installing, loading, and running of the plugin; identifying the plugin based on the monitored activity; and obtaining performance attributes of the plugin when the plugin is identified.
9. The apparatus of claim 8, further comprising a performance evaluation module for, after identifying the plugin based on the monitored activity, evaluating performance attributes of the plugin when the plugin is not identified; wherein the first performance determination module is configured for determining whether the plugin meets the performance criterion based on the performance attributes and empirical data; and the plugin processing module is configured for intercepting or cleaning-up the plugin if the plugin does not meet the performance criterion.
10. The apparatus of claim 7, further comprising an empirical data acquisition module for obtaining empirical data of the plugin, wherein the empirical data comprises plugin importance data, plugin performance data, and/or end user review data; and a second performance determination module for determining whether the plugin meets the performance criterion based on the empirical data.
11. The apparatus of claim 7, wherein the empirical data is obtained through plugin testing, backend collection, and/or web crawling, wherein backend collection comprises frontend collection and end user review, frontend collection comprises hook mode and notification mode, plug testing comprises testing the plugin in an automatic module to obtain information on the plugin' s CPU usage, load time and/or memory usage; hook mode comprises using a hook to obtain a start time and an end time for loading the plugin, a start time and an end time for running the plugin, and information on the plug's CPU usage and/or memory usage while the plugin is loading and running; reception mode comprises a client directly notifying starting and ending of loading and running of the plugin; end user review comprises collecting reviews of end users on the performance of the plugin; web crawling comprises crawling search engine data and/or website review data to evaluate the performance of the plugin; and the empirical data is stored in a remote cloud database or a local database.
12. The apparatus of claim 7, wherein the first performance determination module is further configured for: matching the performance attributes with empirical data stored on a cloud database; obtaining a preset determination result after a successful match, and determining whether the plugin meets the performance criterion based on the preset determination result.
PCT/CN2013/079482 2012-07-27 2013-07-16 Method and apparatus for intercepting or cleaning-up plugins Ceased WO2014015753A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
BR112014017310A BR112014017310A8 (en) 2012-07-27 2013-07-16 flug interception or cleaning method and apparatus
US14/607,044 US9531734B2 (en) 2012-07-27 2015-01-27 Method and apparatus for intercepting or cleaning-up plugins

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201210264230.X 2012-07-27
CN201210264230XA CN102831021A (en) 2012-07-27 2012-07-27 Method and device for interrupting or cleaning plugin

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/607,044 Continuation US9531734B2 (en) 2012-07-27 2015-01-27 Method and apparatus for intercepting or cleaning-up plugins

Publications (1)

Publication Number Publication Date
WO2014015753A1 true WO2014015753A1 (en) 2014-01-30

Family

ID=47334170

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2013/079482 Ceased WO2014015753A1 (en) 2012-07-27 2013-07-16 Method and apparatus for intercepting or cleaning-up plugins

Country Status (4)

Country Link
US (1) US9531734B2 (en)
CN (1) CN102831021A (en)
BR (1) BR112014017310A8 (en)
WO (1) WO2014015753A1 (en)

Families Citing this family (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102831021A (en) * 2012-07-27 2012-12-19 腾讯科技（深圳）有限公司 Method and device for interrupting or cleaning plugin
CN103077194B (en) * 2012-12-25 2016-10-05 北京奇虎科技有限公司 The creation method of browser moving object, device and browser
CN103235913B (en) * 2013-04-03 2016-12-28 北京奇虎科技有限公司 A kind of for identifying, intercept the system of bundled software, Apparatus and method for
CN105447383B (en) * 2013-09-10 2018-05-29 北京奇虎科技有限公司 Browser execution environment detection method, client, server and system
CN104965827A (en) * 2014-04-25 2015-10-07 腾讯科技（深圳）有限公司 Method, apparatus and terminal for processing plug-ins
CN104268198B (en) * 2014-09-22 2018-04-17 北京金山安全软件有限公司 Browser plug-in control method and device and terminal
US9940637B2 (en) 2015-06-05 2018-04-10 Apple Inc. User interface for loyalty accounts and private label accounts
US10037216B2 (en) * 2015-06-07 2018-07-31 Apple Inc. Intelligent disabling of browser plugins
CN106919573A (en) * 2015-12-24 2017-07-04 北京奇虎科技有限公司 A kind of method and apparatus for restarting browser
CN106897051B (en) * 2015-12-24 2022-01-25 北京奇虎科技有限公司 Process cleaning method and device
US11580608B2 (en) 2016-06-12 2023-02-14 Apple Inc. Managing contact information for communication applications
DK179992B1 (en) 2018-05-07 2020-01-14 Apple Inc. DISPLAY OF USER INTERFACES ASSOCIATED WITH PHYSICAL ACTIVITIES
CN109670913B (en) * 2018-12-14 2021-02-05 泰康保险集团股份有限公司 Method, device, medium and electronic equipment for providing service for platform tenant
DK201970531A1 (en) 2019-05-06 2021-07-09 Apple Inc Avatar integration with multiple applications
CN114546511A (en) * 2020-11-11 2022-05-27 华为技术有限公司 Plug-in management method, system and device
CN113868104B (en) * 2021-08-10 2025-02-21 南京中科逆熵科技有限公司 A comprehensive evaluation method for container network plug-ins
TWI809874B (en) * 2022-05-17 2023-07-21 華碩電腦股份有限公司 Artificial intelligence model control system

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101291305A (en) * 2008-06-25 2008-10-22 腾讯科技（深圳）有限公司 Method and customer terminal realizing plug-in management
CN101727380A (en) * 2008-10-13 2010-06-09 三星电子株式会社 System maintaining device and method for portable terminal
US20100251034A1 (en) * 2009-03-31 2010-09-30 Alibaba Group Holding Limited Execution of a plugin according to plugin stability level
CN102831021A (en) * 2012-07-27 2012-12-19 腾讯科技（深圳）有限公司 Method and device for interrupting or cleaning plugin

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6825941B1 (en) * 1998-09-21 2004-11-30 Microsoft Corporation Modular and extensible printer device driver and text based method for characterizing printer devices for use therewith
US6871345B1 (en) * 2000-04-04 2005-03-22 Motive, Inc. Self managing software agents with introspection
US8332943B2 (en) * 2004-02-17 2012-12-11 Microsoft Corporation Tiered object-related trust decisions
CN100385852C (en) * 2004-06-22 2008-04-30 腾讯科技（深圳）有限公司 Realization and realizing device for selective download from webpage inserted piece
US20100037317A1 (en) * 2008-08-06 2010-02-11 Jeong Wook Oh Mehtod and system for security monitoring of the interface between a browser and an external browser module
CN102314561B (en) * 2010-07-01 2014-07-23 电子科技大学 Automatic analysis method and system of malicious codes based on API (application program interface) HOOK
CN102375735B (en) * 2010-08-24 2014-07-16 腾讯科技（深圳）有限公司 Plugin scanning method and system
US8250228B1 (en) * 2011-09-27 2012-08-21 Google Inc. Pausing or terminating video portion while continuing to run audio portion of plug-in on browser
CN102510380B (en) * 2011-11-10 2015-07-01 福建天晴数码有限公司 On-line game cheating prewarning method

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101291305A (en) * 2008-06-25 2008-10-22 腾讯科技（深圳）有限公司 Method and customer terminal realizing plug-in management
CN101727380A (en) * 2008-10-13 2010-06-09 三星电子株式会社 System maintaining device and method for portable terminal
US20100251034A1 (en) * 2009-03-31 2010-09-30 Alibaba Group Holding Limited Execution of a plugin according to plugin stability level
CN102831021A (en) * 2012-07-27 2012-12-19 腾讯科技（深圳）有限公司 Method and device for interrupting or cleaning plugin

Also Published As

Publication number Publication date
BR112014017310A2 (en) 2017-06-13
BR112014017310A8 (en) 2017-07-04
US20150150128A1 (en) 2015-05-28
CN102831021A (en) 2012-12-19
US9531734B2 (en) 2016-12-27

Similar Documents

Publication Publication Date Title
US9531734B2 (en) Method and apparatus for intercepting or cleaning-up plugins
CN109743315B (en) Behavior recognition method, device, device and readable storage medium for website
US11687653B2 (en) Methods and apparatus for identifying and removing malicious applications
CN113489713B (en) Network attack detection method, device, equipment and storage medium
CN106796635B (en) determining device and determining method
US9424424B2 (en) Client based local malware detection method
EP2701092A1 (en) Method for identifying malicious executables
CN108667855B (en) Network flow abnormity monitoring method and device, electronic equipment and storage medium
CN111835756B (en) APP privacy compliance detection method and device, computer equipment and storage medium
CN110933103B (en) Anti-crawler method, device, equipment and medium
CN101582887A (en) Safety protection method, gateway device and safety protection system
Gianazza et al. Puppetdroid: A user-centric ui exerciser for automatic dynamic analysis of similar android applications
JP2014510353A (en) Risk detection processing method and apparatus for website address
CN101964026A (en) Method and system for detecting web page horse hanging
US20110219454A1 (en) Methods of identifying activex control distribution site, detecting security vulnerability in activex control and immunizing the same
US9450980B2 (en) Automatic malignant code collecting system
WO2017071148A1 (en) Cloud computing platform-based intelligent defense system
CN107392028A (en) The detection method and its detection means of sensitive information, storage medium, electronic equipment
CN111079138A (en) Abnormal access detection method and device, electronic equipment and readable storage medium
CN111212055A (en) Non-invasive website remote detection system and detection method
CN103209414B (en) A kind of method, device and mobile terminal of controlling web page access
JP6258189B2 (en) Specific apparatus, specific method, and specific program
Vecchiato et al. A security configuration assessment for android devices
CN105653948B (en) Method and device for preventing malicious operation
CN112948831A (en) Application program risk identification method and device

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13823412

Country of ref document: EP

Kind code of ref document: A1

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112014017310

Country of ref document: BR

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 09/04/2015)

122 Ep: pct application non-entry in european phase

Ref document number: 13823412

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 112014017310

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20140714