WO2014044223A1 - Systems and methods for security detection - Google Patents

Systems and methods for security detection Download PDF

Info

Publication number
WO2014044223A1
WO2014044223A1 PCT/CN2013/084022 CN2013084022W WO2014044223A1 WO 2014044223 A1 WO2014044223 A1 WO 2014044223A1 CN 2013084022 W CN2013084022 W CN 2013084022W WO 2014044223 A1 WO2014044223 A1 WO 2014044223A1
Authority
WO
WIPO (PCT)
Prior art keywords
sensitive operation
black
initiation module
security
identification information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2013/084022
Other languages
French (fr)
Inventor
Quanju XIAO
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Priority to BR112014016534-3A priority Critical patent/BR112014016534B1/en
Priority to SG11201402925WA priority patent/SG11201402925WA/en
Priority to US14/104,332 priority patent/US20140101770A1/en
Publication of WO2014044223A1 publication Critical patent/WO2014044223A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action

Definitions

  • the present invention is directed to computer technology. More particularly, the invention provides systems and methods for computer security. Merely by way of example, the invention has been applied to security detection. But it would be recognized that the invention has a much broader range of applicability.
  • the information related to the process includes at least one of the following: md5 information of the process, digital-signature information of the process, and file- vendor information of the process. Then, security of the initiating process is detected based on the information related to the process to determine whether to release the sensitive operation.
  • the security of the initiating process is detected by determining a black-or-white attribute of the initiating process based on the information related to the process. If the black-or-white attribute of the initiating process is white, the process is safe and consequently the sensitive operation can be released. If the black-or- white attribute of the initiating process is black, the initiating process is dangerous (i.e., not safe) and consequently, the sensitive operation cannot be released.
  • the conventional techniques of real-time protection may have some problems under certain circumstances.
  • the security detection is performed only on the process that initiates the sensitive operation.
  • the initiating process may include multiple modules.
  • the process itself is considered safe (e.g., the black-or-white attribute is white)
  • it may include one or more modules that are dangerous (e.g., the black-or-white attribute of such modules is black).
  • dangerous modules may have entered the initiating process through injection or dll hijacking and initiated the sensitive operation.
  • the conventional techniques of real-time protection may release the sensitive operation because the initiating process itself is detected to be "safe,” even though the sensitive operation is actually initiated by the dangerous modules.
  • the security and stability of the computer system may be severely affected. Therefore, the conventional techniques of real-time protection are often too coarse for security detection, and may lead to poor security and stability of computer systems.
  • the present invention is directed to computer technology. More particularly, the invention provides systems and methods for computer security. Merely by way of example, the invention has been applied to security detection. But it would be recognized that the invention has a much broader range of applicability.
  • a method for security detection. For example, an initiation module in a process that initiates a sensitive operation is determined; identification information of the initiation module is collected; and security of the sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database.
  • a device for security detection includes a
  • the determination unit is configured to determine an initiation module in a process that initiates a sensitive operation.
  • the collection unit is configured to collect identification information of the initiation module.
  • the detection unit is configured to detect security of the sensitive operation based on at least information associated with the collected information and a predetermined database.
  • a non-transitory computer readable storage medium includes programming instructions for security detection.
  • the programming instructions are configured to cause one or more data processors to execute certain operations. For example, an initiation module in a process that initiates a sensitive operation is determined; identification information of the initiation module is collected; and security of the sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database.
  • a computer-implemented system for security detection includes one or more data processors and a computer-readable storage medium.
  • the computer-readable storage medium is encoded with instructions for commanding the data processors to execute certain operations. For example, an initiation module in a process that initiates a sensitive operation is determined; identification information of the initiation module is collected; and security of the sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database.
  • the systems and methods described herein are configured to adopt a finer detection granularity and improve security and stability of computer systems.
  • the systems and methods described herein are configured to detect a module with a black attribute (i.e., being dangerous) that initiates a sensitive operation by hijacking a process with a white attribute (i.e., being considered as safe), so as to improve the efficiency of security detection and ensure the security and stability of computer systems.
  • Figure 1 is a simplified diagram showing a method for security detection according to one embodiment of the present invention
  • Figure 2 is a simplified diagram showing a method for security detection according to another embodiment of the present invention.
  • Figure 3 is a simplified diagram showing a method for security detection according to yet another embodiment of the present invention.
  • Figure 4 is a simplified diagram of a security-detection device according to one embodiment of the present invention.
  • Figure 5 is a simplified diagram showing certain components of the security-detection device as shown in Figure 4 according to another embodiment of the present invention.
  • FIG. 1 is a simplified diagram showing a method for security detection according to one embodiment of the present invention. This diagram is merely an example, which should not unduly limit the scope of the claims. One of ordinary skill in the art would recognize many variations, alternatives, and modifications.
  • the method 1000 includes at least the process 100 for determining an initiation module in a process that initiates a sensitive operation, the process 101 for collecting identification information of the initiation module, and the process 102 for detecting security of the sensitive operation based on at least information associated with the collected identification information and a predetermined database.
  • the initiation module in the process that initiates the sensitive operation is determined.
  • the sensitive operation includes loading certain drivers, changing key items in a system registry, and/or injection.
  • the identification information of the initiation module is collected.
  • the identification information of the initiation module includes at least one of the following: digital signature information, file- vendor information and file-description information.
  • the security of the initiated sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database.
  • the initiation module refers to the module that initiates the sensitive operation.
  • the predetermined database includes a database of black attributes (e.g., a database that includes identification information of dangerous initiation modules) or a database of white attributes (e.g., a database that includes identification information of safe initiation modules).
  • the predetermined database includes both the database of black attributes and the database of white attributes.
  • the security detection is performed by checking whether the collected identification information of the initiation module in the process is included in the database of black attributes. For example, if the collected identification information is included in the database of black attributes, the sensitive operation is deemed as not safe (i.e., dangerous); and if the collected identification information of the initiation module in the process is not included in the database of black attributes, the sensitive operation is considered as safe.
  • the security detection is performed by checking whether the collected identification information of the initiation module in the process is included in the database of white attributes. For example, if the collected identification information is included in the database of white attributes, the sensitive operation is deemed as safe; and if the collected identification information of the initiation module in the process is not included in the database of white attributes, the sensitive operation is considered as not safe (i.e., dangerous).
  • the security detection is performed by checking whether the collected identification information of the initiation module in the process is included in the database of white attributes or the database of black attributes. For example, if the collected identification information is included in the database of white attributes, the sensitive operation is deemed as safe; and if the collected identification information of the initiation module in the process is included in the database of black attributes, the sensitive operation is considered as not safe (i.e., dangerous). In another example, if neither the database of white attributes nor the database of black attributes includes the collected identification information, the sensitive operation is temporarily deemed to be dangerous, and prompts may be provided to the computer for users to make further determination.
  • a security-detection device may be implemented to perform the security detection as shown in Figure 1.
  • the security-detection device can be included in a real-time security protection equipment of a computer.
  • a process for determining whether to release the sensitive operation based on at least information associated with the detection of security of the sensitive operation is executed. For example, if the initiation of the sensitive operation is determined to be safe based on at least information associated with the detection of security of the sensitive operation, the sensitive operation is released. In another example, if the initiation of the sensitive operation is determined to be dangerous based on at least information associated with the detection of security of the sensitive operation, the sensitive operation is refused to be performed, and a prompt "initiation of the sensitive operation is dangerous" may be provided to the computer, e.g., by the security-detection device. As an example, such a prompt is displayed on a computer screen to notify a user that the sensitive operation is prohibited.
  • the security-detection device may provide corresponding prompts to the computer based on at least information associated with the detection of security of the sensitive operation so that a user who operates the computer may determine whether to release the sensitive operation. For example, if the initiation of the sensitive operation is determined to be safe based on at least information associated with the detection of security of the sensitive operation, a prompt "initiation of the sensitive operation is safe" is provided to the computer (e.g., on the computer screen), and the user may determine whether to release the sensitive operation using a keyboard or a mouse.
  • a prompt "initiation of the sensitive operation is dangerous" is provided to the computer (e.g., on the computer screen), and the user may determine whether to release the sensitive operation using the keyboard or the mouse.
  • the security-detection device may not automatically determine whether to release the sensitive operation after the security detection but only send a prompt to the computer to allow the user to determine whether to release the sensitive operation according to the prompt.
  • the process 100 includes, determining the initiation module in the process that initiates the sensitive operation using a stack back-traces method, or determining the initiation module in the process that initiates the sensitive operation using an initial-thread-address- inquiry method.
  • the parameters of the sensitive operation include certain basic parameters of the sensitive operation.
  • the parameters of the sensitive operation include the driver names and/or related directories.
  • the parameters include a registry key, a registry item and altered new value(s) and old value(s).
  • the sensitive operation is injection, the parameters include the name and/or the process ID of an injection process. In certain embodiments, the above-noted process for collecting parameters associated with the sensitive operation, and the processes 100 and 101 have no sequential relationship.
  • a process for monitoring and capturing the sensitive operation is executed before the process 100.
  • the above-noted process for collecting the parameters of the sensitive operation is executed after the process for monitoring and capturing the sensitive operation.
  • the process 102 includes a process for detecting the security of the sensitive operation based on at least information associated with the identification information of the initiation module, the parameters of the sensitive operation and the predetermined database.
  • the process for detecting the security of the sensitive operation based on at least information associated with the identification information of the initiation module, the parameters of the sensitive operation and the predetermined database includes the following steps:
  • the predetermined database includes a database of black attributes (i.e., a database that includes identification information of dangerous initiation modules) or a database of white attributes (i.e., a database that includes identification information of safe initiation modules).
  • the predetermined database includes both the database of black attributes and the database of white attributes.
  • the step (1) is performed by checking whether the collected
  • identification information of the initiation module in the process is included in the database of black attributes. For example, if the collected identification information is included in the database of black attributes, the sensitive operation is deemed as not safe, i.e., the black-or-white attribute of the initiation module is black. In another example, if the collected identification information of the initiation module in the process is not included in the database of black attributes, the black-or-white attribute of the initiation module is white, i.e., the sensitive operation is safe.
  • the step (1) is performed by checking whether the collected
  • identification information of the initiation module in the process is included in the database of white attributes.
  • the sensitive operation is deemed as safe, i.e., the black-or-white attribute of the initiation module is white.
  • the black-or-white attribute of the initiation module is black, i.e., the sensitive operation is dangerous.
  • the step (1) is performed by checking whether the collected identification information of the initiation module in the process is included in the database of white attributes or the database of black attributes. For example, if the collected identification information of the initiation module in the process is included in the database of black attributes, the sensitive operation is considered as not safe, i.e., the black-or-white attribute of the initiation module is black. In another example, if the collected identification information is included in the database of white attributes, the sensitive operation is deemed as safe, i.e., the black- or- white attribute of the initiation module is white.
  • the sensitive operation is temporarily deemed to be not safe, i.e., the black-or-white attribute of the initiation module is black.
  • prompts are provided to the computer to inform a user that the identification information of the initiation module is not detected in the predetermined database and the initiation module is temporarily considered as not safe.
  • the step (2) may be performed by checking whether certain parameters of the sensitive operation are included in the predetermined database, in certain embodiments.
  • the step (3) includes: determining the sensitive operation is safe if both the black-or-white attribute of the initiation module and the black-or-white attribute of the sensitive operation are white; and determining the sensitive operation is dangerous if the black-or-white attribute of the initiation module and/or the black-or-white attribute of the sensitive operation are black.
  • FIG. 2 is a simplified diagram showing a method for security detection according to another embodiment of the present invention. This diagram is merely an example, which should not unduly limit the scope of the claims. One of ordinary skill in the art would recognize many variations, alternatives, and modifications.
  • the method 2000 includes multiple processes that are performed, e.g., by a security-detection device.
  • the method 200 includes the process 200 for monitoring and capturing a sensitive operation, the process 201 for determining an initiation module in a process that initiates the sensitive operation using a stack back-traces method, the process 202 for collecting identification information of the initiation module, and the process 203 for determining whether the collected identification information is included in a predetermined database of black attributes. For example, if the collected identification information is included in the predetermined database of black attributes, the process 204 is executed; otherwise the process 205 is executed.
  • the process 204 includes determining that a black-or- white attribute of the initiation module is black and determining that the sensitive operation is dangerous. For example, at the process 205, the black-or-white attribute of the initiation module is determined to be white and the sensitive operation is determined to be safe. In another example, the process 207 is executed, where the sensitive operation is released to be performed. In yet another example, at the process 206, the sensitive operation is prohibited. In yet another example, the process 208 is executed, where a prompt "the sensitive operation is dangerous" is provided to the computer to notify a user of the reason for prohibiting the sensitive operation. [0038] Figure 3 is a simplified diagram showing a method for security detection according to yet another embodiment of the present invention.
  • the method 3000 includes at least the process 300 for monitoring and capturing a sensitive operation by a security-detection device, the process 301 for collecting parameters of the sensitive operation by the security-detection device, the process 302 for determining an initiation module in a process that initiates the sensitive operation by the security- detection device using an initial-thread-address-inquiry method, and the process 303 for collecting identification information of the initiation module by the security-detection device.
  • the method 3000 further includes the process 304 for determining whether the collected identification
  • the process 305 is executed, where a prompt "the sensitive operation is safe" is provided to the computer by the security-detection device. For example, the computer releases the sensitive operation to be performed.
  • the process 306 is executed, where a prompt "the sensitive operation is dangerous" is provided to the computer by the security-detection device. For example, the computer prohibits the sensitive operation.
  • FIG. 4 is a simplified diagram of a security-detection device according to one embodiment of the present invention. This diagram is merely an example, which should not unduly limit the scope of the claims. One of ordinary skill in the art would recognize many variations, alternatives, and modifications.
  • the security-detection device 4000 includes a first determination unit 10, a collection unit 1 1 and a detection unit 12.
  • the first determination unit 10 is configured to determine an initiation module in a process that initiates a sensitive operation.
  • the collection unit 1 1 is connected with the first determination unit 10 and is configured to collect identification information of the initiation module determined by the first determination unit 10.
  • the detection unit 12 is connected with the collection unit 11 and is configured to detect security of the sensitive operation based on at least information associated with the information collected by the collection unit 11 and a predetermined database.
  • the security-detection device 4000 as shown in Figure 4, performs security detection by implementing one or more of the methods described above, such as the methods 1000, 2000 and/or 3000, in certain embodiments.
  • FIG. 5 is a simplified diagram showing certain components of the security-detection device as shown in Figure 4 according to another embodiment of the present invention. This diagram is merely an example, which should not unduly limit the scope of the claims. One of ordinary skill in the art would recognize many variations, alternatives, and modifications.
  • the security- detection device 4000 further includes a second determination unit 13.
  • the detection unit 12 includes a first detection sub-unit 121, a second detection sub-unit 122, and a third detection sub-unit 123.
  • the second determination unit 13 is configured to determine whether to release the sensitive operation based on at least information associated with the detection of security of the sensitive operation performed by the detection unit 12.
  • the first determination unit 10 is further configured to determine the initiation module in the process that initiates the sensitive operation using a stack back-traces method, or determine the initiation module in the process that initiates the sensitive operation using an initial-thread-address-inquiry method.
  • the collection unit 11 is further configured to collect parameters associated with the sensitive operation before the detection unit 12 performs the detection of security of the sensitive operation.
  • the detection unit 12 is further configured to detect the security of the sensitive operation based on at least information associated with identification information of the initiation module, the parameters associated with the sensitive operation and the predetermined database.
  • the first detection sub-unit 121 is specifically connected with the collection unit 11 and configured to detect a first black-or-white attribute of the initiation module based on at least information associated with the identification information of the initiation module and the predetermined database.
  • the second detection sub-unit 122 can also be specifically connected with the collection unit 11 and configured to detect a second black-or-white attribute of the sensitive operation based on at least information associated with the parameters of the sensitive operation and the predetermined database.
  • the third detection sub-unit 123 is connected with the first detection sub-unit 121 and the second detection sub-unit 122, and configured to detect the security of the sensitive operation based on at least information associated with the first black-or-white attribute of the initiation module detected by the first detection sub-unit 121 and the second black-or-white attribute of the sensitive operation detected by the second detection sub-unit 122.
  • the third detection sub-unit is further configured to, in response to both the first black-or-white attribute and the second black-or-white attribute being white, determine the sensitive operation to be safe, and in response to the first black-or-white attribute and/or the second black-or-white attribute being black, determine the sensitive operation to be dangerous.
  • the second determination unit 13 is connected with the third detection sub-unit 123 and configured to determine whether to release the sensitive operation based on at least information associated with the detection of security of the sensitive operation performed by the third detection sub-unit 123.
  • the identification information of the initiation module includes one selected from a group consisting of: digital- signature information, file-vendor information, and file-description information.
  • the security-detection device 4000 performs security detection by implementing one or more of the methods described above, such as the methods 1000, 2000 and/or 3000, in some embodiments.
  • the security-detection device 4000 as shown in Figure 4 or Figure 5, is implemented on a real-time protection server for security detection of a client computer, using certain software or hardware.
  • a method for security detection. For example, an initiation module in a process that initiates a sensitive operation is determined; identification information of the initiation module is collected; and security of the sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database.
  • the method is implemented according to at least Figure 1 , Figure 2, and/or Figure 3.
  • a device for security detection includes a
  • the determination unit is configured to determine an initiation module in a process that initiates a sensitive operation.
  • the collection unit is configured to collect identification information of the initiation module.
  • the detection unit is configured to detect security of the sensitive operation based on at least information associated with the collected information and a predetermined database.
  • the device is implemented according to at least Figure 4, and/or Figure 5.
  • a non-transitory computer readable storage medium includes programming instructions for security detection.
  • the programming instructions are configured to cause one or more data processors to execute certain operations. For example, an initiation module in a process that initiates a sensitive operation is determined; identification information of the initiation module is collected; and security of the sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database.
  • the storage medium is implemented according to at least Figure 1 , Figure 2, and/or Figure 3.
  • a computer-implemented system for security detection includes one or more data processors and a computer-readable storage medium.
  • the computer-readable storage medium is encoded with instructions for commanding the data processors to execute certain operations. For example, an initiation module in a process that initiates a sensitive operation is determined; identification information of the initiation module is collected; and security of the sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database.
  • the system is implemented according to at least Figure 1, Figure 2, and/or Figure 3.
  • some or all components of various embodiments of the present invention each are, individually and/or in combination with at least another component, implemented using one or more software components, one or more hardware components, and/or one or more combinations of software and hardware components.
  • some or all components of various embodiments of the present invention each are, individually and/or in combination with at least another component, implemented in one or more circuits, such as one or more analog circuits and/or one or more digital circuits.
  • various embodiments and/or examples of the present invention can be combined.
  • the methods and systems described herein may be implemented on many different types of processing devices by program code comprising program instructions that are executable by the device processing subsystem.
  • the software program instructions may include source code, object code, machine code, or any other stored data that is operable to cause a processing system to perform the methods and operations described herein.
  • Other implementations may also be used, however, such as firmware or even appropriately designed hardware configured to carry out the methods and systems described herein.
  • the systems' and methods' data may be stored and implemented in one or more different types of computer-implemented data stores, such as different types of storage devices and programming constructs (e.g., RAM, ROM, Flash memory, flat files, databases, programming data structures, programming variables, IF-THEN (or similar type) statement constructs, etc.).
  • storage devices and programming constructs e.g., RAM, ROM, Flash memory, flat files, databases, programming data structures, programming variables, IF-THEN (or similar type) statement constructs, etc.
  • data structures describe formats for use in organizing and storing data in databases, programs, memory, or other computer-readable media for use by a computer program.
  • the systems and methods may be provided on many different types of computer-readable media including computer storage mechanisms (e.g., CD-ROM, diskette, RAM, flash memory, computer's hard drive, etc.) that contain instructions (e.g., software) for use in execution by a processor to perform the methods' operations and implement the systems described herein.
  • computer storage mechanisms e.g., CD-ROM, diskette, RAM, flash memory, computer's hard drive, etc.
  • instructions e.g., software
  • a module or processor includes but is not limited to a unit of code that performs a software operation, and can be implemented for example as a subroutine unit of code, or as a software function unit of code, or as an object (as in an object- oriented paradigm), or as an applet, or in a computer script language, or as another type of computer code.
  • the software components and/or functionality may be located on a single computer or distributed across multiple computers depending upon the situation at hand.
  • the computing system can include clients and servers.
  • a client and server are generally remote from each other and typically interact through a communication network.
  • the relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Alarm Systems (AREA)
  • Storage Device Security (AREA)

Description

Description
SYSTEMS AND METHODS FOR SECURITY DETECTION
CROSS-REFERENCES TO RELATED APPLICATIONS
[0001] This application claims priority to Chinese Patent Application No. 201210358322.4, filed September 24, 2012, incorporated by reference herein for all purposes.
BACKGROUND OF THE INVENTION
[0002] The present invention is directed to computer technology. More particularly, the invention provides systems and methods for computer security. Merely by way of example, the invention has been applied to security detection. But it would be recognized that the invention has a much broader range of applicability.
[0003] With the development of science and technology, real-time protection of computers has become very important to ensure safe operations of the computers. Conventional techniques of realtime protection often monitor sensitive system operations, such as loading certain drivers, changing key items in a system registry, and injection. When a sensitive system operation is captured, information related to a process that initiates the sensitive operation is collected. For example, the information related to the process (e.g., .exe) includes at least one of the following: md5 information of the process, digital-signature information of the process, and file- vendor information of the process. Then, security of the initiating process is detected based on the information related to the process to determine whether to release the sensitive operation. For example, the security of the initiating process is detected by determining a black-or-white attribute of the initiating process based on the information related to the process. If the black-or-white attribute of the initiating process is white, the process is safe and consequently the sensitive operation can be released. If the black-or- white attribute of the initiating process is black, the initiating process is dangerous (i.e., not safe) and consequently, the sensitive operation cannot be released.
[0004] The conventional techniques of real-time protection may have some problems under certain circumstances. For example, the security detection is performed only on the process that initiates the sensitive operation. But in reality, the initiating process may include multiple modules. When the process itself is considered safe (e.g., the black-or-white attribute is white), it may include one or more modules that are dangerous (e.g., the black-or-white attribute of such modules is black). Such dangerous modules may have entered the initiating process through injection or dll hijacking and initiated the sensitive operation. The conventional techniques of real-time protection may release the sensitive operation because the initiating process itself is detected to be "safe," even though the sensitive operation is actually initiated by the dangerous modules. The security and stability of the computer system may be severely affected. Therefore, the conventional techniques of real-time protection are often too coarse for security detection, and may lead to poor security and stability of computer systems.
[0005] Hence it is highly desirable to improve the techniques for security detection.
BRIEF SUMMARY OF THE INVENTION
[0006] The present invention is directed to computer technology. More particularly, the invention provides systems and methods for computer security. Merely by way of example, the invention has been applied to security detection. But it would be recognized that the invention has a much broader range of applicability.
[0007] According to one embodiment, a method is provided for security detection. For example, an initiation module in a process that initiates a sensitive operation is determined; identification information of the initiation module is collected; and security of the sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database.
[0008] According to another embodiment, a device for security detection includes a
determination unit, a collection unit, and a detection unit. The determination unit is configured to determine an initiation module in a process that initiates a sensitive operation. The collection unit is configured to collect identification information of the initiation module. The detection unit is configured to detect security of the sensitive operation based on at least information associated with the collected information and a predetermined database.
[0009] According to yet another embodiment, a non-transitory computer readable storage medium includes programming instructions for security detection. The programming instructions are configured to cause one or more data processors to execute certain operations. For example, an initiation module in a process that initiates a sensitive operation is determined; identification information of the initiation module is collected; and security of the sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database.
[0010] According to yet another embodiment, a computer-implemented system for security detection includes one or more data processors and a computer-readable storage medium. The computer-readable storage medium is encoded with instructions for commanding the data processors to execute certain operations. For example, an initiation module in a process that initiates a sensitive operation is determined; identification information of the initiation module is collected; and security of the sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database.
[0011] For example, the systems and methods described herein are configured to adopt a finer detection granularity and improve security and stability of computer systems. In another example, the systems and methods described herein are configured to detect a module with a black attribute (i.e., being dangerous) that initiates a sensitive operation by hijacking a process with a white attribute (i.e., being considered as safe), so as to improve the efficiency of security detection and ensure the security and stability of computer systems.
[0012] Depending upon embodiment, one or more benefits may be achieved. These benefits and various additional objects, features and advantages of the present invention can be fully appreciated with reference to the detailed description and accompanying drawings that follow.
BRIEF DESCRIPTION OF THE DRAWINGS
[0013] Figure 1 is a simplified diagram showing a method for security detection according to one embodiment of the present invention;
[0014] Figure 2 is a simplified diagram showing a method for security detection according to another embodiment of the present invention;
[0015] Figure 3 is a simplified diagram showing a method for security detection according to yet another embodiment of the present invention;
[0016] Figure 4 is a simplified diagram of a security-detection device according to one embodiment of the present invention; and
[0017] Figure 5 is a simplified diagram showing certain components of the security-detection device as shown in Figure 4 according to another embodiment of the present invention.
DETAILED DESCRIPTION OF THE INVENTION
[0018] The present invention is directed to computer technology. More particularly, the invention provides systems and methods for computer security. Merely by way of example, the invention has been applied to security detection. But it would be recognized that the invention has a much broader range of applicability. [0019] Figure 1 is a simplified diagram showing a method for security detection according to one embodiment of the present invention. This diagram is merely an example, which should not unduly limit the scope of the claims. One of ordinary skill in the art would recognize many variations, alternatives, and modifications. The method 1000 includes at least the process 100 for determining an initiation module in a process that initiates a sensitive operation, the process 101 for collecting identification information of the initiation module, and the process 102 for detecting security of the sensitive operation based on at least information associated with the collected identification information and a predetermined database.
[0020] According to one embodiment, at the process 100, the initiation module in the process that initiates the sensitive operation is determined. For example, the sensitive operation includes loading certain drivers, changing key items in a system registry, and/or injection. In another example, at the process 101, the identification information of the initiation module is collected. As an example, the identification information of the initiation module includes at least one of the following: digital signature information, file- vendor information and file-description information. As another example, at the process 102, the security of the initiated sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database. Herein, the initiation module refers to the module that initiates the sensitive operation. For example, the predetermined database includes a database of black attributes (e.g., a database that includes identification information of dangerous initiation modules) or a database of white attributes (e.g., a database that includes identification information of safe initiation modules). In another example, the predetermined database includes both the database of black attributes and the database of white attributes.
[0021] According to another embodiment, if the predetermined database includes only the database of black attributes, the security detection is performed by checking whether the collected identification information of the initiation module in the process is included in the database of black attributes. For example, if the collected identification information is included in the database of black attributes, the sensitive operation is deemed as not safe (i.e., dangerous); and if the collected identification information of the initiation module in the process is not included in the database of black attributes, the sensitive operation is considered as safe.
[0022] According to yet another embodiment, if the predetermined database includes only the database of white attributes, the security detection is performed by checking whether the collected identification information of the initiation module in the process is included in the database of white attributes. For example, if the collected identification information is included in the database of white attributes, the sensitive operation is deemed as safe; and if the collected identification information of the initiation module in the process is not included in the database of white attributes, the sensitive operation is considered as not safe (i.e., dangerous).
[0023] According to yet another embodiment, if the predetermined database includes both the database of white attributes and the database of black attributes, the security detection is performed by checking whether the collected identification information of the initiation module in the process is included in the database of white attributes or the database of black attributes. For example, if the collected identification information is included in the database of white attributes, the sensitive operation is deemed as safe; and if the collected identification information of the initiation module in the process is included in the database of black attributes, the sensitive operation is considered as not safe (i.e., dangerous). In another example, if neither the database of white attributes nor the database of black attributes includes the collected identification information, the sensitive operation is temporarily deemed to be dangerous, and prompts may be provided to the computer for users to make further determination.
[0024] In some embodiments, a security-detection device may be implemented to perform the security detection as shown in Figure 1. For example, the security-detection device can be included in a real-time security protection equipment of a computer.
[0025] In one embodiment, after the process 102, a process for determining whether to release the sensitive operation based on at least information associated with the detection of security of the sensitive operation is executed. For example, if the initiation of the sensitive operation is determined to be safe based on at least information associated with the detection of security of the sensitive operation, the sensitive operation is released. In another example, if the initiation of the sensitive operation is determined to be dangerous based on at least information associated with the detection of security of the sensitive operation, the sensitive operation is refused to be performed, and a prompt "initiation of the sensitive operation is dangerous" may be provided to the computer, e.g., by the security-detection device. As an example, such a prompt is displayed on a computer screen to notify a user that the sensitive operation is prohibited.
[0026] In one embodiment, after the process 102, the security-detection device may provide corresponding prompts to the computer based on at least information associated with the detection of security of the sensitive operation so that a user who operates the computer may determine whether to release the sensitive operation. For example, if the initiation of the sensitive operation is determined to be safe based on at least information associated with the detection of security of the sensitive operation, a prompt "initiation of the sensitive operation is safe" is provided to the computer (e.g., on the computer screen), and the user may determine whether to release the sensitive operation using a keyboard or a mouse. In another example, if the initiation of the sensitive operation is determined to be dangerous based on at least information associated with the detection of security of the sensitive operation, a prompt "initiation of the sensitive operation is dangerous" is provided to the computer (e.g., on the computer screen), and the user may determine whether to release the sensitive operation using the keyboard or the mouse. In yet another example, the security-detection device may not automatically determine whether to release the sensitive operation after the security detection but only send a prompt to the computer to allow the user to determine whether to release the sensitive operation according to the prompt.
[0027] In another embodiment, the process 100 includes, determining the initiation module in the process that initiates the sensitive operation using a stack back-traces method, or determining the initiation module in the process that initiates the sensitive operation using an initial-thread-address- inquiry method.
[0028] In yet another embodiment, before the process 102, a process for collecting the
parameters associated with the sensitive operation is executed. For example, the parameters of the sensitive operation include certain basic parameters of the sensitive operation. In another example, if the sensitive operation involves loading certain drivers, the parameters of the sensitive operation include the driver names and/or related directories. In yet another example, if the sensitive operation involves changing a key item of the system registry, the parameters include a registry key, a registry item and altered new value(s) and old value(s). In yet another example, if the sensitive operation is injection, the parameters include the name and/or the process ID of an injection process. In certain embodiments, the above-noted process for collecting parameters associated with the sensitive operation, and the processes 100 and 101 have no sequential relationship.
[0029] According to one embodiment, before the process 100, a process for monitoring and capturing the sensitive operation is executed. For example, the above-noted process for collecting the parameters of the sensitive operation is executed after the process for monitoring and capturing the sensitive operation. In another example, the process 102 includes a process for detecting the security of the sensitive operation based on at least information associated with the identification information of the initiation module, the parameters of the sensitive operation and the predetermined database. In yet another example, the process for detecting the security of the sensitive operation based on at least information associated with the identification information of the initiation module, the parameters of the sensitive operation and the predetermined database includes the following steps:
(1) detecting a black-or-white attribute of the initiation module based on at least information associated with the identification information of the initiation module and the predetermined database; (2) detecting a black-or-white attribute of the sensitive operation based on at least information associated with the parameters of the sensitive operation and the predetermined database; and
(3) detecting the security of the sensitive operation based on at least information associated with the black-or-white attribute of the initiation module and the black-or-white attribute of the sensitive operation.
[0030] In one embodiment, the predetermined database includes a database of black attributes (i.e., a database that includes identification information of dangerous initiation modules) or a database of white attributes (i.e., a database that includes identification information of safe initiation modules). In another embodiment, the predetermined database includes both the database of black attributes and the database of white attributes.
[0031] According to another embodiment, if the predetermined database includes only the database of black attributes, the step (1) is performed by checking whether the collected
identification information of the initiation module in the process is included in the database of black attributes. For example, if the collected identification information is included in the database of black attributes, the sensitive operation is deemed as not safe, i.e., the black-or-white attribute of the initiation module is black. In another example, if the collected identification information of the initiation module in the process is not included in the database of black attributes, the black-or-white attribute of the initiation module is white, i.e., the sensitive operation is safe.
[0032] According to yet another embodiment, if the predetermined database includes only the database of white attributes, the step (1) is performed by checking whether the collected
identification information of the initiation module in the process is included in the database of white attributes. For example, if the collected identification information is included in the database of white attributes, the sensitive operation is deemed as safe, i.e., the black-or-white attribute of the initiation module is white. In another example, if the collected identification information of the initiation module in the process is not included in the database of white attributes, the black-or-white attribute of the initiation module is black, i.e., the sensitive operation is dangerous.
[0033] According to yet another embodiment, if the predetermined database includes both the database of white attributes and the database of black attributes, the step (1) is performed by checking whether the collected identification information of the initiation module in the process is included in the database of white attributes or the database of black attributes. For example, if the collected identification information of the initiation module in the process is included in the database of black attributes, the sensitive operation is considered as not safe, i.e., the black-or-white attribute of the initiation module is black. In another example, if the collected identification information is included in the database of white attributes, the sensitive operation is deemed as safe, i.e., the black- or- white attribute of the initiation module is white. In yet another example, if neither the database of white attributes nor the database of black attributes includes the collected identification information, the sensitive operation is temporarily deemed to be not safe, i.e., the black-or-white attribute of the initiation module is black. In yet another example, prompts are provided to the computer to inform a user that the identification information of the initiation module is not detected in the predetermined database and the initiation module is temporarily considered as not safe.
[0034] Similar to what is described above for the step (1), the step (2) may be performed by checking whether certain parameters of the sensitive operation are included in the predetermined database, in certain embodiments. For example, the step (3) includes: determining the sensitive operation is safe if both the black-or-white attribute of the initiation module and the black-or-white attribute of the sensitive operation are white; and determining the sensitive operation is dangerous if the black-or-white attribute of the initiation module and/or the black-or-white attribute of the sensitive operation are black.
[0035] Figure 2 is a simplified diagram showing a method for security detection according to another embodiment of the present invention. This diagram is merely an example, which should not unduly limit the scope of the claims. One of ordinary skill in the art would recognize many variations, alternatives, and modifications. The method 2000 includes multiple processes that are performed, e.g., by a security-detection device.
[0036] According to one embodiment, the method 200 includes the process 200 for monitoring and capturing a sensitive operation, the process 201 for determining an initiation module in a process that initiates the sensitive operation using a stack back-traces method, the process 202 for collecting identification information of the initiation module, and the process 203 for determining whether the collected identification information is included in a predetermined database of black attributes. For example, if the collected identification information is included in the predetermined database of black attributes, the process 204 is executed; otherwise the process 205 is executed.
[0037] According to another embodiment, the process 204 includes determining that a black-or- white attribute of the initiation module is black and determining that the sensitive operation is dangerous. For example, at the process 205, the black-or-white attribute of the initiation module is determined to be white and the sensitive operation is determined to be safe. In another example, the process 207 is executed, where the sensitive operation is released to be performed. In yet another example, at the process 206, the sensitive operation is prohibited. In yet another example, the process 208 is executed, where a prompt "the sensitive operation is dangerous" is provided to the computer to notify a user of the reason for prohibiting the sensitive operation. [0038] Figure 3 is a simplified diagram showing a method for security detection according to yet another embodiment of the present invention. This diagram is merely an example, which should not unduly limit the scope of the claims. One of ordinary skill in the art would recognize many variations, alternatives, and modifications. The method 3000 includes at least the process 300 for monitoring and capturing a sensitive operation by a security-detection device, the process 301 for collecting parameters of the sensitive operation by the security-detection device, the process 302 for determining an initiation module in a process that initiates the sensitive operation by the security- detection device using an initial-thread-address-inquiry method, and the process 303 for collecting identification information of the initiation module by the security-detection device. The method 3000 further includes the process 304 for determining whether the collected identification
information and parameters of the sensitive operation are both included in a predetermined database of white attributes.
[0039] According to one embodiment, if the collected identification information and the parameters of the sensitive operation are both included in the predetermined database of white attributes, the process 305 is executed, where a prompt "the sensitive operation is safe" is provided to the computer by the security-detection device. For example, the computer releases the sensitive operation to be performed.
[0040] According to another embodiment, if the collected identification information and the parameters of the sensitive operation are not both included in the predetermined database of white attributes, the process 306 is executed, where a prompt "the sensitive operation is dangerous" is provided to the computer by the security-detection device. For example, the computer prohibits the sensitive operation.
[0041] Figure 4 is a simplified diagram of a security-detection device according to one embodiment of the present invention. This diagram is merely an example, which should not unduly limit the scope of the claims. One of ordinary skill in the art would recognize many variations, alternatives, and modifications. The security-detection device 4000 includes a first determination unit 10, a collection unit 1 1 and a detection unit 12.
[0042] According to one embodiment, the first determination unit 10 is configured to determine an initiation module in a process that initiates a sensitive operation. For example, the collection unit 1 1 is connected with the first determination unit 10 and is configured to collect identification information of the initiation module determined by the first determination unit 10. In another example, the detection unit 12 is connected with the collection unit 11 and is configured to detect security of the sensitive operation based on at least information associated with the information collected by the collection unit 11 and a predetermined database. The security-detection device 4000, as shown in Figure 4, performs security detection by implementing one or more of the methods described above, such as the methods 1000, 2000 and/or 3000, in certain embodiments.
[0043] Figure 5 is a simplified diagram showing certain components of the security-detection device as shown in Figure 4 according to another embodiment of the present invention. This diagram is merely an example, which should not unduly limit the scope of the claims. One of ordinary skill in the art would recognize many variations, alternatives, and modifications. In addition to the first determination unit 10, the collection unit 11 and the detection unit 12, the security- detection device 4000 further includes a second determination unit 13. The detection unit 12 includes a first detection sub-unit 121, a second detection sub-unit 122, and a third detection sub-unit 123.
[0044] According to one embodiment, the second determination unit 13 is configured to determine whether to release the sensitive operation based on at least information associated with the detection of security of the sensitive operation performed by the detection unit 12. For example, the first determination unit 10 is further configured to determine the initiation module in the process that initiates the sensitive operation using a stack back-traces method, or determine the initiation module in the process that initiates the sensitive operation using an initial-thread-address-inquiry method. In another example, the collection unit 11 is further configured to collect parameters associated with the sensitive operation before the detection unit 12 performs the detection of security of the sensitive operation. In yet another example, the detection unit 12 is further configured to detect the security of the sensitive operation based on at least information associated with identification information of the initiation module, the parameters associated with the sensitive operation and the predetermined database.
[0045] According to another embodiment, the first detection sub-unit 121 is specifically connected with the collection unit 11 and configured to detect a first black-or-white attribute of the initiation module based on at least information associated with the identification information of the initiation module and the predetermined database. For example, the second detection sub-unit 122 can also be specifically connected with the collection unit 11 and configured to detect a second black-or-white attribute of the sensitive operation based on at least information associated with the parameters of the sensitive operation and the predetermined database. In another example, the third detection sub-unit 123 is connected with the first detection sub-unit 121 and the second detection sub-unit 122, and configured to detect the security of the sensitive operation based on at least information associated with the first black-or-white attribute of the initiation module detected by the first detection sub-unit 121 and the second black-or-white attribute of the sensitive operation detected by the second detection sub-unit 122. [0046] According to yet another embodiment, the third detection sub-unit is further configured to, in response to both the first black-or-white attribute and the second black-or-white attribute being white, determine the sensitive operation to be safe, and in response to the first black-or-white attribute and/or the second black-or-white attribute being black, determine the sensitive operation to be dangerous. For example, the second determination unit 13 is connected with the third detection sub-unit 123 and configured to determine whether to release the sensitive operation based on at least information associated with the detection of security of the sensitive operation performed by the third detection sub-unit 123. As an example, the identification information of the initiation module includes one selected from a group consisting of: digital- signature information, file-vendor information, and file-description information.
[0047] The security-detection device 4000, as shown in Figure 5, performs security detection by implementing one or more of the methods described above, such as the methods 1000, 2000 and/or 3000, in some embodiments. In certain embodiments, the security-detection device 4000, as shown in Figure 4 or Figure 5, is implemented on a real-time protection server for security detection of a client computer, using certain software or hardware.
[0048] According to one embodiment, a method is provided for security detection. For example, an initiation module in a process that initiates a sensitive operation is determined; identification information of the initiation module is collected; and security of the sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database. For example, the method is implemented according to at least Figure 1 , Figure 2, and/or Figure 3.
[0049] According to another embodiment, a device for security detection includes a
determination unit, a collection unit, and a detection unit. The determination unit is configured to determine an initiation module in a process that initiates a sensitive operation. The collection unit is configured to collect identification information of the initiation module. The detection unit is configured to detect security of the sensitive operation based on at least information associated with the collected information and a predetermined database. For example, the device is implemented according to at least Figure 4, and/or Figure 5.
[0050] According to yet another embodiment, a non-transitory computer readable storage medium includes programming instructions for security detection. The programming instructions are configured to cause one or more data processors to execute certain operations. For example, an initiation module in a process that initiates a sensitive operation is determined; identification information of the initiation module is collected; and security of the sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database. For example, the storage medium is implemented according to at least Figure 1 , Figure 2, and/or Figure 3.
[0051] According to yet another embodiment, a computer-implemented system for security detection includes one or more data processors and a computer-readable storage medium. The computer-readable storage medium is encoded with instructions for commanding the data processors to execute certain operations. For example, an initiation module in a process that initiates a sensitive operation is determined; identification information of the initiation module is collected; and security of the sensitive operation is detected based on at least information associated with the collected identification information and a predetermined database. For example, the system is implemented according to at least Figure 1, Figure 2, and/or Figure 3.
[0052] The above only describes several scenarios presented by this invention, and the description is relatively specific and detailed, yet it cannot therefore be understood as limiting the scope of this invention's patent. It should be noted that ordinary technicians in the field may also, without deviating from the invention's conceptual premises, make a number of variations and modifications, which are all within the scope of this invention. As a result, in terms of protection, the patent claims shall prevail.
[0053] For example, some or all components of various embodiments of the present invention each are, individually and/or in combination with at least another component, implemented using one or more software components, one or more hardware components, and/or one or more combinations of software and hardware components. In another example, some or all components of various embodiments of the present invention each are, individually and/or in combination with at least another component, implemented in one or more circuits, such as one or more analog circuits and/or one or more digital circuits. In yet another example, various embodiments and/or examples of the present invention can be combined.
[0054] Additionally, the methods and systems described herein may be implemented on many different types of processing devices by program code comprising program instructions that are executable by the device processing subsystem. The software program instructions may include source code, object code, machine code, or any other stored data that is operable to cause a processing system to perform the methods and operations described herein. Other implementations may also be used, however, such as firmware or even appropriately designed hardware configured to carry out the methods and systems described herein.
[0055] The systems' and methods' data (e.g., associations, mappings, data input, data output, intermediate data results, final data results, etc.) may be stored and implemented in one or more different types of computer-implemented data stores, such as different types of storage devices and programming constructs (e.g., RAM, ROM, Flash memory, flat files, databases, programming data structures, programming variables, IF-THEN (or similar type) statement constructs, etc.). It is noted that data structures describe formats for use in organizing and storing data in databases, programs, memory, or other computer-readable media for use by a computer program.
[0056] The systems and methods may be provided on many different types of computer-readable media including computer storage mechanisms (e.g., CD-ROM, diskette, RAM, flash memory, computer's hard drive, etc.) that contain instructions (e.g., software) for use in execution by a processor to perform the methods' operations and implement the systems described herein.
[0057] The computer components, software modules, functions, data stores and data structures described herein may be connected directly or indirectly to each other in order to allow the flow of data needed for their operations. It is also noted that a module or processor includes but is not limited to a unit of code that performs a software operation, and can be implemented for example as a subroutine unit of code, or as a software function unit of code, or as an object (as in an object- oriented paradigm), or as an applet, or in a computer script language, or as another type of computer code. The software components and/or functionality may be located on a single computer or distributed across multiple computers depending upon the situation at hand.
[0058] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.
[0059] While this specification contains many specifics, these should not be construed as limitations on the scope or of what may be claimed, but rather as descriptions of features specific to particular embodiments. Certain features that are described in this specification in the context or separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination. Moreover, although features may be described above as acting in certain combinations and even initially claimed as such, one or more features from a claimed combination can in some cases be excised from the combination, and the claimed combination may be directed to a subcombination or variation of a subcombination.
[0060] Similarly, while operations are depicted in the drawings in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Moreover, the separation of various system components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.
[0061] Although specific embodiments of the present invention have been described, it will be understood by those of skill in the art that there are other embodiments that are equivalent to the described embodiments. Accordingly, it is to be understood that the invention is not to be limited by the specific illustrated embodiments, but only by the scope of the appended claims.

Claims

Claims
1. A processor-implemented method for security detection, comprising:
determining, using one or more data processors, an initiation module in a process that initiates a sensitive operation;
collecting, using the one or more data processors, identification information of the initiation module; and
detecting, using the one or more data processors, security of the sensitive operation based on at least information associated with the collected identification information and a predetermined database.
2. The method of claim 1, further comprising:
determining whether to release the sensitive operation based on at least information associated with the detection of security of the sensitive operation.
3. The method of claim 1, wherein the determining an initiation module in a process that initiates a sensitive operation includes:
determining the initiation module in the process that initiates the sensitive operation using a stack back-traces method; or
determining the initiation module in the process that initiates the sensitive operation using an initial-thread-address-inquiry method.
4. The method of claim 1, further comprising:
collecting parameters associated with the sensitive operation.
5. The method of claim 4, wherein the detecting security of the sensitive operation based on at least information associated with the collected identification information and a predetermined database includes:
detecting the security of the sensitive operation based on at least information associated with identification information of the initiation module, the parameters associated with the sensitive operation and the predetermined database.
6. The method of claim 4, wherein the detecting security of the sensitive operation based on at least information associated with the collected identification information and a predetermined database includes:
detecting a first black-or-white attribute of the initiation module based on at least information associated with the identification information of the initiation module and the predetermined database;
detecting a second black-or-white attribute of the sensitive operation based on at least information associated with the parameters of the sensitive operation and the predetermined database; and detecting the security of the sensitive operation based on at least information associated with the first black-or-white attribute of the initiation module and the second black-or-white attribute of the sensitive operation.
7. The method of claim 6, wherein the detecting the security of the sensitive operation based on at least information associated with the first black-or-white attribute of the initiation module and the second black-or-white attribute of the sensitive operation includes:
in response to both the first black-or-white attribute and the second black-or-white attribute being white, determining the sensitive operation to be safe; and
in response to the first black-or-white attribute or the second black-or-white attribute being black, determining the sensitive operation to be dangerous.
8. The method of claim 7, wherein the sensitive operation is determined to be dangerous in response to both the first black-or-white attribute and the second black-or-white attribute being black.
9. The method as in one of claims 1-8, wherein the identification information of the initiation module includes one selected from a group consisting of: digital-signature information, file- vendor information, and file-description information.
10. A device for security detection, comprising:
a first determination unit configured to determine an initiation module in a process that initiates a sensitive operation;
a collection unit configured to collect identification information of the initiation module; and a detection unit configured to detect security of the sensitive operation based on at least information associated with the collected information and a predetermined database.
11. The device of claim 10, further comprising:
a second determination unit configured to determine whether to release the sensitive operation based on at least information associated with the detection of security of the sensitive operation.
12. The device of claim 10, wherein the first determination unit is further configured to determine the initiation module in the process that initiates the sensitive operation using a stack backtraces method, or determine the initiation module in the process that initiates the sensitive operation using an initial-thread-address-inquiry method.
13. The device of claim 10, wherein the collection unit is further configured to collect parameters associated with the sensitive operation.
14. The device of claim 13, wherein the detection unit is further configured to detect the security of the sensitive operation based on at least information associated with identification information of the initiation module, the parameters associated with the sensitive operation and the predetermined database.
15. The device of claim 13, wherein the detection unit includes:
a first detection sub-unit configured to detect a first black-or-white attribute of the initiation module based on at least information associated with the identification information of the initiation module and the predetermined database;
a second detection sub-unit configured to detect a second black-or-white attribute of the sensitive operation based on at least information associated with the parameters of the sensitive operation and the predetermined database; and
a third detection sub-unit configured to detect the security of the sensitive operation based on at least information associated with the first black-or-white attribute of the initiation module and the second black-or-white attribute of the sensitive operation.
16. The device of claim 15, wherein the third detection sub-unit is further configured to, in response to both the first black-or-white attribute and the second black-or-white attribute being white, determine the sensitive operation to be safe, and in response to the first black-or-white attribute or the second black-or-white attribute being black, determine the sensitive operation to be dangerous.
17. The device of claim 16, wherein the third detection sub-unit is further configured to, in response to both the first black-or-white attribute and the second black-or-white attribute being black, determine the sensitive operation to be dangerous.
18. The device as in one of claims 10-17, wherein the identification information of the initiation module includes one selected from a group consisting of: digital-signature information, file- vendor mformation, and file-description information.
19. A non-transitory computer readable storage medium comprising programming instructions for security detection, the programming instructions configured to cause one or more data processors to execute operations comprising:
determining an initiation module in a process that initiates a sensitive operation;
collecting identification information of the initiation module; and
detecting security of the sensitive operation based on at least mformation associated with the collected identification information and a predetermined database.
20. A computer-implemented system for security detection, said system comprising: one or more data processors; and
a computer-readable storage medium encoded with instructions for commanding the data processors to execute operations including:
determining an initiation module in a process that initiates a sensitive operation; collecting identification information of the initiation module; and
detecting security of the sensitive operation based on at least information associated with the collected identification mformation and a predetermined database.
PCT/CN2013/084022 2012-09-24 2013-09-23 Systems and methods for security detection Ceased WO2014044223A1 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
BR112014016534-3A BR112014016534B1 (en) 2012-09-24 2013-09-23 PROCESSOR IMPLANTED METHOD FOR SECURITY DETECTION; SECURITY DETECTION DEVICE; LEGIBLE STORAGE MEANS BY NON-TRANSITIONAL COMPUTER; AND SYSTEM IMPLANTED BY COMPUTER FOR SECURITY DETECTION
SG11201402925WA SG11201402925WA (en) 2012-09-24 2013-09-23 Systems and methods for security detection
US14/104,332 US20140101770A1 (en) 2012-09-24 2013-12-12 Systems and Methods for Security Detection

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201210358322.4A CN103679035B (en) 2012-09-24 2012-09-24 Safety detecting method and device
CN201210358322.4 2012-09-24

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US14/104,332 Continuation US20140101770A1 (en) 2012-09-24 2013-12-12 Systems and Methods for Security Detection

Publications (1)

Publication Number Publication Date
WO2014044223A1 true WO2014044223A1 (en) 2014-03-27

Family

ID=50316545

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2013/084022 Ceased WO2014044223A1 (en) 2012-09-24 2013-09-23 Systems and methods for security detection

Country Status (5)

Country Link
US (1) US20140101770A1 (en)
CN (1) CN103679035B (en)
BR (1) BR112014016534B1 (en)
SG (1) SG11201402925WA (en)
WO (1) WO2014044223A1 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104376266A (en) * 2014-11-21 2015-02-25 工业和信息化部电信研究院 Determination method and device for security level of application software

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105471807B (en) * 2014-05-28 2019-05-24 腾讯科技（深圳）有限公司 Network-access security detection method and system based on bar code information
CN105184162B (en) * 2015-08-18 2019-01-04 安一恒通（北京）科技有限公司 program monitoring method and device
CN109033820A (en) * 2018-06-29 2018-12-18 北京奇虎科技有限公司 User rs credentials guard method, device and equipment
CN108985095B (en) * 2018-07-05 2022-04-01 深圳市网心科技有限公司 Non-public file access method, system, electronic equipment and storage medium

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040268365A1 (en) * 2003-06-24 2004-12-30 Bray Brandon R. Safe exceptions
CN101373501A (en) * 2008-05-12 2009-02-25 公安部第三研究所 Dynamic Behavior Capturing Method for Computer Viruses
CN102004882A (en) * 2010-11-26 2011-04-06 北京安天电子设备有限公司 Method and device for detecting and processing remote-thread injection type Trojan
CN102902919A (en) * 2012-08-30 2013-01-30 北京奇虎科技有限公司 Method, device and system for identifying and processing suspicious practices

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7340777B1 (en) * 2003-03-31 2008-03-04 Symantec Corporation In memory heuristic system and method for detecting viruses
JP4732874B2 (en) * 2005-11-28 2011-07-27 株式会社エヌ・ティ・ティ・ドコモ Software behavior modeling device, software behavior monitoring device, software behavior modeling method, and software behavior monitoring method
US8606895B2 (en) * 2006-01-17 2013-12-10 Kidaro (Israel) Ltd. Seamless integration of multiple computing environments
GB2448149B (en) * 2007-04-03 2011-05-18 Advanced Risc Mach Ltd Protected function calling
US7930744B2 (en) * 2008-07-02 2011-04-19 Check Point Software Technologies Ltd. Methods for hooking applications to monitor and prevent execution of security-sensitive operations
US8302210B2 (en) * 2009-08-24 2012-10-30 Apple Inc. System and method for call path enforcement
CN102063588A (en) * 2010-12-15 2011-05-18 北京北信源软件股份有限公司 Control method and system for safety protection of computer terminal network
US9038176B2 (en) * 2011-03-31 2015-05-19 Mcafee, Inc. System and method for below-operating system trapping and securing loading of code into memory
CN102222194A (en) * 2011-07-14 2011-10-19 哈尔滨工业大学 Module and method for LINUX host computing environment safety protection
CN102646173A (en) * 2012-02-29 2012-08-22 成都新云软件有限公司 Safety protection control method and system based on white and black lists
US9721120B2 (en) * 2013-05-14 2017-08-01 Apple Inc. Preventing unauthorized calls to a protected function

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040268365A1 (en) * 2003-06-24 2004-12-30 Bray Brandon R. Safe exceptions
CN101373501A (en) * 2008-05-12 2009-02-25 公安部第三研究所 Dynamic Behavior Capturing Method for Computer Viruses
CN102004882A (en) * 2010-11-26 2011-04-06 北京安天电子设备有限公司 Method and device for detecting and processing remote-thread injection type Trojan
CN102902919A (en) * 2012-08-30 2013-01-30 北京奇虎科技有限公司 Method, device and system for identifying and processing suspicious practices

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104376266A (en) * 2014-11-21 2015-02-25 工业和信息化部电信研究院 Determination method and device for security level of application software

Also Published As

Publication number Publication date
BR112014016534A2 (en) 2017-06-13
BR112014016534A8 (en) 2017-07-04
CN103679035B (en) 2016-12-28
BR112014016534B1 (en) 2020-12-15
SG11201402925WA (en) 2014-07-30
US20140101770A1 (en) 2014-04-10
CN103679035A (en) 2014-03-26

Similar Documents

Publication Publication Date Title
US9489292B2 (en) Devices and methods for acquiring abnormal information
CN102663288B (en) Virus killing method and device thereof
EP2940957B1 (en) Method, apparatus and system for detecting malicious process behavior
US8245080B2 (en) Model-based testing of an application program under test
US20140101770A1 (en) Systems and Methods for Security Detection
KR101990598B1 (en) Method and device for recommending solution based on user operation behavior
US20160142437A1 (en) Method and system for preventing injection-type attacks in a web based operating system
CN110472381B (en) Root permission hiding method and system based on android system and storage medium
JP2019500680A5 (en)
WO2014032596A1 (en) Systems and methods for enhancement of single sign-on protection
US20160156645A1 (en) Method and apparatus for detecting macro viruses
JPWO2021079495A5 (en)
CN104598806A (en) Method and device for registering detecting
CN107818028A (en) A kind of computer data backup and restoring method
CN113656809A (en) Mirror image security detection method, device, equipment and medium
CN109828780B (en) Open source software identification method and device
US11811803B2 (en) Method of threat detection
CN106789973B (en) Page security detection method and terminal equipment
CN109916551B (en) Braking performance detection method, device and electronic device
WO2016197827A1 (en) Method and apparatus for processing malicious bundled software
CN106104553A (en) For detecting the equipment distorted and the method for program code
WO2020134033A1 (en) Method used to determine security of application program when running, and device for same
CN111966630B (en) File type detection method, device, equipment and medium
CN106156574A (en) A kind of Information Authentication method, Apparatus and system
CN104516752A (en) Information processing method and electronic equipment

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 13839573

Country of ref document: EP

Kind code of ref document: A1

REG Reference to national code

Ref country code: BR

Ref legal event code: B01A

Ref document number: 112014016534

Country of ref document: BR

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC OF 110815

122 Ep: pct application non-entry in european phase

Ref document number: 13839573

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 112014016534

Country of ref document: BR

Kind code of ref document: A2

Effective date: 20140703