WO2014206268A1

WO2014206268A1 - Action processing method and device on windows platform

Info

Publication number: WO2014206268A1
Application number: PCT/CN2014/080579
Authority: WO
Inventors: 潘剑锋; 李宜檑
Original assignee: 北京奇虎科技有限公司; 奇智软件（北京）有限公司
Priority date: 2013-06-25
Filing date: 2014-06-24
Publication date: 2014-12-31
Also published as: CN103294956A; CN103294956B

Abstract

An actions processing method and device on a Windows platform. The method is applied to a CPU supporting hardware virtualization, and comprises: starting an operating system, and performing an operation of hardware virtualization in the operating system to generate a virtual machine monitor (VMM); installing and running the operating system on a client to make sure that the operating system has a lower permission than the VMM; setting the operating system to be in a monitored state, using the VMM to monitor at least one action triggered by the CPU, and taking relevant measures according to the triggered result. The method improves security of a computer system.

Description

Method and device for performing behavior processing on Windows platform

The present invention relates to the field of the Internet, and in particular, to a method and apparatus for performing behavior processing on a Windows platform. Background technique

Currently, more and more malicious programs (such as computer viruses, backdoors, Trojans, spyware, and adware) are attacking users' computers. In order to protect users' computers from malicious programs, many third-party companies have introduced proactive defense software. Active defense is a real-time protection technology based on independent analysis and judgment of program behavior. It does not use feature code as the basis for judging malicious programs. Instead, it starts from the most primitive definition and directly uses the behavior of the program as the basis for judging malicious programs. The active defense software first intercepts the malicious program and then processes it accordingly. Among them, the interception of program behavior is an important first step of active defense. The way many malicious programs resist active defense also interferes with or bypasses behavioral interception.

Currently, for Microsoft's Windows platform, in addition to using Microsoft's standard interface, behavioral interception requires more third-party software system kernels to perform patch operations. On Microsoft's 32-bit Windows platform, third-party software can modify the operating system through the patch to obtain the operating system kernel code and key data, so as to effectively intercept the suspicious programs executed by the operating system.

However, Microsoft introduced a kernel protection system (Patch Guard) mechanism in its 64-bit Windows operating system, which prohibits any unauthorized third-party software patch operating system kernel code and critical data. Microsoft designed Patch Guard to ensure that the Windows kernel is not attacked by malicious code, which also prevents third-party software from monitoring Windows behavior, so this feature makes it difficult to secure Windows computers.

In the prior art, because Microsoft prohibits third-party software from patching its 64-bit Windows kernel, third-party companies cannot provide a complete active defense product on the 64-bit Windows platform, which brings a very high degree to the user computer system. A big security risk. Summary of the invention

In view of the above problems, the present invention has been made in order to provide an apparatus for performing behavior processing on a Windows platform and a corresponding method of performing behavior processing on a Windows platform that overcomes the above problems or at least partially solves the above problems.

According to an aspect of the present invention, a method for performing behavior processing on a Windows platform is provided, which is applied to a CPU supporting hardware virtualization, including:

Starting a local operating system, performing a hardware virtualization operation on the local operating system, and generating a virtual machine monitor V匪;

Putting the native operating system into the client operation, so that the authority of the operating system is lower than the authority of the VMM;

The local operating system is placed in a supervised state, and the behavior triggered by the at least one CPU is monitored by the V匪, and corresponding processing is performed according to the triggering result.

Optionally, the generating manner of the V匪 includes the following steps:

And transmitting, by the driver, an instruction for implementing V匪 to the at least one CPU; wherein, the at least one CPU executes a hardware virtualization operation according to the instruction to generate the VMM.

Optionally, placing the native operating system in a supervised state, including:

The current state of the native operating system is switched from a host host state to a client guest state, and the at least one CPU is placed in a supervised state.

Optionally, the foregoing method further includes: setting a V匪 mode for the local operating system.

Optionally, the current state of the native operating system is switched from a host host state to a client guest state, including:

The native operating system is set to run in a non-root virtualized VMX-non-root mode, correspondingly,

The V匪 is set to run in root virtualization VMX-root mode.

Optionally, corresponding processing is performed according to the triggering result, including:

When the triggering result is that the behavior triggered by the CPU is an unsafe behavior,

V匪 intercepts the unsafe behavior.

Optionally, after the intercepting the unsafe behavior by using the V匪, the method includes: searching, in a pre-stored processing list, the unsafe behavior and a corresponding processing manner, where the processing list stores at least one Unsafe events and how they are handled; The intercepted unsafe behavior is processed according to the search result.

Optionally, the intercepted unsafe behavior is processed according to the search result, including:

When the unsafe behavior is an operation of reading or writing or modifying, the behavior value determined by the user is returned by using the V匪, wherein the behavior value is different from the actual value obtained by the read/write or modification operation.

Optionally, the unsafe behavior includes at least one of the following:

The read and write behavior of the special registers, the malicious read and write behavior of the control registers, and the malicious behavior of the control flow.

Optionally, the Windows platform includes a 64-bit Windows platform.

According to another aspect of the present invention, an apparatus for performing behavior processing on a Windows platform, which is applied to a CPU supporting hardware virtualization, includes:

a virtual module, configured to start a local operating system, perform a hardware virtualization operation on the local operating system, and generate a virtual machine monitor V;

a permission setting module configured to place the native operating system into a client operation, such that the authority of the operating system is lower than the authority of the V匪;

The processing module is configured to put the local operating system into a supervised state, and monitor, by using the V匪, the behavior triggered by the at least one CPU, and perform corresponding processing according to the triggering result.

Optionally, the virtual module is further configured to:

Optionally, the processing module is further configured to:

Optionally, the processing module is further configured to: set a V匪 mode for the local operating system. Optionally, the processing module is further configured to:

The V匪 is set to run in root virtualization VMX-root mode.

Optionally, the processing module is further configured to: the trigger result is triggered by the CPU When the behavior is unsafe, use the V匪 to intercept the unsafe behavior.

Optionally, the foregoing apparatus further includes:

The locating module is configured to search for the unsafe behavior and the corresponding processing manner in the pre-stored processing list, where the processing list stores at least one unsafe event and a processing manner of the unsafe event;

The processing module is further configured to process the intercepted unsafe behavior based on the lookup result.

Optionally, the processing module is further configured to:

Optionally, the unsafe behavior includes at least one of the following:

Optionally, the Windows platform includes a 64-bit Windows platform.

According to still another aspect of the present invention, a computer program is provided, comprising computer readable code, when the computer readable code is run on a computing device, causing the computing device to perform according to any of the above A method of behavioral processing on the Windows platform.

According to still another aspect of the present invention, a computer readable medium is provided, wherein a computer program as described above is stored.

The beneficial effects of the invention are:

In the embodiment of the present invention, the local operating system is started, the hardware virtualization operation is performed on the system, the VMM is generated, and at least one CPU is monitored by using a V权限 having a higher authority than the local operating system, and corresponding processing is performed according to the trigger result. . It can be seen that the behavior of Windows can be monitored by generating V匪, and those skilled in the art can execute third-party software in the VMM, thereby realizing the use of third-party software for the Windows platform (especially the 64-bit and even the kernel cannot be modified) A higher level) patching provides a complete active defense product on a 64-bit Windows platform, solving existing security problems for the user's computer system and improving security.

The above description is merely an overview of the technical solution of the present invention, and in order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification, and in order to make the present invention The above and other objects, features and advantages of the present invention will become more apparent and understood. DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art from a The drawings are only for the purpose of illustrating the preferred embodiments and are not intended to limit the invention. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the drawing:

1 shows a process flow diagram of a method for performing behavior processing on a Windows platform in accordance with one embodiment of the present invention;

2 is a block diagram showing the structure of an apparatus for performing behavior processing on a Windows platform according to an embodiment of the present invention;

3 is a schematic diagram showing a system architecture for performing behavior processing on a Windows platform according to an embodiment of the present invention;

4 is a block diagram schematically showing a computing device for performing a method of performing behavior processing on a Windows platform in accordance with the present invention;

Figure 5 is a schematic representation of a method for maintaining or carrying in accordance with the present invention.

A storage unit of program code for a method of behavior processing on a Windows platform. detailed description

The invention is further described below in conjunction with the drawings and specific embodiments.

The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general purpose systems can also be used with the teaching based on the teachings herein. The structure required to construct such a system is apparent from the above description. Moreover, the invention is not directed to any particular programming language. It is to be understood that the present invention may be embodied in a variety of programming language, and the description of the specific language has been described above in order to disclose the preferred embodiments of the invention.

The present invention is applicable to computer systems/servers that can operate with numerous other general purpose or special purpose computing system environments or configurations. Examples of well-known computing system environments and/or configurations suitable for use with computer systems/servers include, but are not limited to: personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, based on micro Processor system, set-top box, programmable consumer electronics, network PC, Small computer systems, mainframe systems, and distributed cloud computing technology environments including any of the above, and the like.

The computer system/server can be described in the general context of computer system executable instructions (such as program modules) executed by the computer system. Generally, program modules may include routines, programs, target programs, components, logic, data structures, and the like, which perform particular tasks or implement particular abstract data types. The computer system/server can be implemented in a distributed cloud computing environment where tasks are performed by remote processing devices connected through a communication network. In a distributed cloud computing environment, program modules can be located on a local or remote computing system storage medium including storage devices.

After the introduction of the Patch Guard mechanism in the 64-bit Windows platform, any unauthorized third-party software is prohibited from patching the operating system kernel code and key data, but the consequence is that the third-party software cannot be effective on the Windows platform based on the Windows platform. Monitoring, this brings a great security risk to the user's computer system.

In order to solve this technical problem, the embodiment of the present invention adopts a unique technical solution, and the main idea is to: expand the support by hardware virtualization of a CPU (Central Processing Unit) (such as Intel or AMD), so that Implement full behavior processing on 64-bit or higher Windows platforms. Among them, hardware virtualization refers to the realization of efficient full virtualization with the support of hardware (mainly host processor). For example, with the support of Intel-VT technology, the execution environment of Guest OS and VMM is automatically and completely isolated. Guest OS has its own register and can run directly at the highest level. The solution provided by the embodiment of the present invention can break through the limitation of an operating system such as Microsoft, and the method can provide a complete and effective active defense software system on a 64-bit or higher system.

The main reason for adopting the above ideas is that virtualization technology has been widely used. Hardware virtualization can have an independent operating platform to intercept and handle unsafe behavior. The specific principles of virtualization technology are:

Virtualization technology allows physical machines (such as servers, PCs, tablets, etc.) to be partitioned or shared so that the underlying hardware of the machine is presented as one or more virtual machines that work independently. The hypervisor can run on a computer and present an abstraction of one or more virtual machines to other software. Each virtual machine can be used as a self-sustaining platform to run its own operating system (OS) and/or application software. Software execution performed within a virtual machine can be referred to as client software. Guest The user software can be expected to run on a dedicated computer rather than a VM (Virtual Machine), at which point V匪 and Guest OS can share the underlying processor resources. That is, client software can expect to control various events and access hardware resources on a computer, such as a physical machine. The hardware resources of the physical machine may include one or more processors, resources residing on the processor (eg, control registers, caches, and others), memory (and structures resident in memory such as descriptor tables) ) and other resources that reside in the physical machine (such as input/output (I/O) devices).

The embodiment of the invention provides a method for performing behavior processing on a Windows platform, which is applied to a CPU supporting hardware virtualization. 1 is a process flow diagram of a method for performing behavior processing on a Windows platform according to an embodiment of the present invention, including:

Step S102: Start a local operating system, perform a hardware virtualization operation on the system, and generate a VMM (Virtual Machine Monitor).

The system includes an operating system, a CPU, and application layer software.

It should be noted that the native operating system runs on the CPU it manages and manages and monitors all CPUs. In this case, if you need to supervise the local operating system, you need to modify its permissions. For details, see step S104.

Step S104: Put the local operating system into the client operation, so that the authority of the local operating system is lower than the generated V匪 permission.

Specifically, this step can be performed with the permissions of the driver. Considering that the driver has the same highest authority as the native operating system, the highest privilege of the driver can be used to make the CPU run in the mode that supports virtualization extension, then the native operating system will be in the management mode, its permissions Will be lower than the V匪 permission. At this point, the CPU can switch to the non-root state of the customer state, restore the Windows execution environment, and change from the root state to the non-root state when the environment resumes switching.

Step S106: The system is placed in a supervised state, and the generated V匪 is used to monitor behavior triggered by at least one CPU, and corresponding processing is performed according to the trigger result.

Since the local operating system is in the management mode, it is equivalent to running in the client. At this time, the V匪 is still located in the local machine, and the behavior triggered by the CPU can be monitored, and then the subsequent operation processing can be performed.

It is worth noting here that the step of correspondingly processing according to the triggering result specifically includes: first determining the nature of the behavior triggered by the CPU, determining whether the triggered behavior is a safe behavior, and then performing different differentiation processing on the safe behavior and the unsafe behavior. . This embodiment focuses on In order to ensure that unsafe behavior does not harm the computer terminal and the software running on it, you can use V匪 to intercept unsafe behavior, and then process the intercepted behavior according to the pre-stored behavior processing method. .

In the embodiment of the present invention, the local operating system is started, the hardware virtualization operation is performed on the system, the VMM is generated, and at least one CPU is monitored by using a V权限 having a higher authority than the local operating system, and corresponding processing is performed according to the trigger result. . It can be seen that the behavior of Windows can be monitored by generating V匪, and third-party software can be executed in V匪, thereby realizing the use of third-party software for Windows platforms (especially 64-bit or higher which cannot modify the kernel) Patching can provide a complete active defense product on the 64-bit Windows platform, solve the existing security risks for the user computer system, and improve the security performance.

Considering different computer systems or functions or capabilities or capabilities or hardware or software configurations, the means of implementing behavioral processing on different Windows platforms is different. For example, take the x86 processor as an example. The x86 processor has 4 privilege levels, Rin _g 0 ~ Ring 3, and the processor can access privileged resources or execute privileged instructions only when running at Ring 0 to 2; when running at Ring 0, the processor can access all Privileged state. The operating system on the x86 platform generally uses only the two levels of Ring 0 and Ring 3, the operating system runs at Ring 0, and the user process runs at Ring 3. In order to satisfy the first sufficient condition-resource control above, V匪 must run at the Ring O level, and in order to avoid the Guest OS control system resources, Guest OS has to lower its own running level, running at Ring 1 or Ring 3 (Ring 2 is not used).

This is merely an example. The method for performing behavior processing on different Windows platforms provided by the embodiments of the present invention does not impose any limitation.

In step S102, the driver may send an instruction for implementing the VMM to at least one CPU by using a driver, and in order to implement V, the corresponding code is carried in the instruction. After at least one CPU receives the instruction, it parses the specific code. Subsequently, each CPU executes the code and performs a hardware virtualization operation on its own to generate a VMM.

In order to achieve the purpose of placing at least one CPU in a supervised state mentioned in step S106, the embodiment of the present invention preferably switches the current state of the CPU from a host state to a guest state, and sets at least one CPU. In a regulated state. In the case where the CPU can be in a supervised state, the native operating system is further set to the V匪 mode. At this time, referring to the V匪 permission mentioned in step S104, the authority of the operating system is higher than that of the native operating system, therefore, Monitoring of at least one CPU can be achieved using V匪.

There are many ways to switch the current state of the CPU. VMX-non-root is just for example. For example, for Intel CPU type, at least one CPU can be set to non-root virtualization (VMX-non-root). Run in mode, and correspondingly, set V to run in root virtualization (VMX root) mode. Set the CPU and V匪 to different modes, and the mode level of V匪 is higher than the mode the CPU is in. For other CPU types, you can also select the other mode of the CPU to run, so that V is set to run in virtualized mode. For example, AMD also has a corresponding AMD-V (Virtualization) mode for the x86 platform.

There are many triggering results, for example, the behavior triggered by the CPU is an unsafe behavior is a result,

The behavior triggered by the CPU is that some specific processing or behavior is another result, the behavior triggered by the CPU is that the safe behavior is another result, and so on. The result of each trigger is different and the corresponding processing is different. For example, if the triggering result proves that the behavior triggered by the CPU is a safe behavior, then the security behavior can be released directly. For another example, when the triggering result proves that the behavior triggered by the CPU is unsafe, the V不 can be used to intercept the unsafe behavior.

After intercepting the unsafe behaviors with V匪, the intercepted unsafe behavior needs to be handled. Embodiments of the present invention provide a pre-stored processing list in which at least one unsecure event and a manner of processing the unsecure event are stored. Any kind of unsafe event can be handled in one way or in multiple ways. In addition, a variety of unsafe events may be handled in the same way. δΡ, the correspondence between unsafe events and their processing methods may be one-to-one, one-to-many, or many-to-one. After the unsafe behavior and the corresponding processing mode are found in the pre-stored processing list, the intercepted unsafe behavior is processed according to the search result.

For example, an unsafe behavior is an operation of reading or writing or modifying. A malicious program attempts to read, write or modify the stored data. At this time, the machine can use V匪 to return the behavior value determined by the user, where The value is different from the actual value obtained by the read or write or modify operation. Since the behavior value returned by V匪 is not the actual value, the behavior value that the malicious program reads or prepares to write or modify must also be a false value. A malicious program subsequently attacks a false value without affecting the actual value, thereby improving the security and stability of the computer system.

The unsafe behavior mentioned above may be any behavior that adversely affects a computer system (including a combination of an operating system, computer software, and computer hardware), the present invention The example exemplifies it, for example, the read and write behavior of the special register, the malicious read and write behavior of the control register, the malicious behavior of changing the control flow, and the like.

Various unsafe acts are now specified. Various types of insecure events (also known as sensitive behaviors) including but not limited to:

1. The read and write behavior of the special registers (MSRs) of various modes. For example, if V匪 modifies the MSR of PatchGuard protection (such as LSTAR), it needs to intercept the access of the operating system to the register, maintain its consistency, and prevent blue screen. Among them, PatchGuard adds a new security operation layer to Windows Vi sta. PatchGuard can effectively prevent kernel mode from changing or replacing any content of Windows kernel. Third-party software will no longer be able to give

Add any "patches" to the Windows Vistat kernel.

2, the read and write behavior of various control registers, it is possible to capture the behavior of some malicious kernel modules, for example, the way to modify the system kernel code will clear the WP of the CR0 register first.

(Write protection) Protection bit.

3. This behavior changes the control flow in the interception of page exceptions that are initiated during the execution of the client code by controlling the client page table.

The above method is applicable to the Windows platform, especially the 64-bit or higher-bit Windows platform. For details, please refer to the above, and I will not repeat them here. Since the CPUs of the x86 and X86-64 architectures do not meet the definition of efficient VMM in Popek and Goldberg's theorem, Intel and AMD each designed a hardware virtualization extension support for their own CPUs, namely Intel-VT and AMD-V. , in order to improve processor acceleration virtualization. This case is only a description of the Windows system. In addition, it can also be applied to other systems such as Unix systems. The application method can refer to the Windows system.

Further, the above method can provide an interface for the upper driver, realizes the virtualized operation on the 64-bit windows platform, and places the operating system in the state of the client (client software), thereby completely monitoring the operating system. In the user mode part and the kernel mode part, the caller can be provided with a complete operation call library of related events, and the call library can be used to return a corresponding callback result for the requester, and the call library can be called an interface, and It can be called a function, which is specifically a general term for a function interface or service provided by a certain system. Because the operating system permissions are reduced, the method can be applied to the technical fields of active defense, Trojan attack and defense, and can not only provide protection against files, registry, processes and thread objects by using Microsoft's standard callback interface, but also provide window messages. Attack, use RPC (Remote Procedure Call) and other interprocess communication machines System attacks, etc., can also achieve many functions on the 32-bit Windows platform such as keyboard protection.

Further, the embodiment of the present invention can complete the security behavior and event interception that cannot be implemented on a 64-bit or higher-bit Windows system, and can greatly prevent the security software or other security software that needs behavior event interception at 64 bits or higher. The ability on a Windows system to provide a complete and effective active defense software system on 64-bit or higher systems.

In summary, the embodiment of the present invention provides a new operation mode, such that the V匪 is in an unrestricted operation mode, and the client operating system of the ring 0 or the client application software of the ring 3 are limited in operation. The operational mode, sensitive behaviors and events of the guest operating system or client application software can be perceived and intercepted by V匪. The method provided by the embodiment of the present invention can intercept behaviors and events that are not intercepted or difficult to implement in a traditional manner (for example, the embedded hook Inl ine H00K), for example, can intercept system service calls (this is not allowed in x64 systems) , page exception mode, etc. More importantly, the customer operating system and client applications that are not regulated can be detected and interfered with, so they can coexist with PatchGuard, greatly improving the ability of active defense software or other security software that requires behavioral event interception on 64-bit Windows systems.

The method provided by the embodiments of the present invention will be described in detail with reference to specific embodiments.

Embodiment 1

In this embodiment, the CPU is extended by means of hardware virtualization, and the entire operating system to be monitored is placed in a lower-order customer state, and the monitor is in a relatively advanced environment.

After the driver is loaded, instructions containing the code are sent to each CPU, and the state of the CPU is switched from the current host state to the guest state on each CPU, placing it in a supervised state.

When a CPU triggers some events (such as sensitive behaviors or instructions) or operations that are of interest, for example, some read or write or modified operations. The triggered event is returned to the virtual machine monitor (located on the outside host), at which point the user can change their behavior. For example, after the user monitors the operation of reading a register, it monitors its behavior and returns a behavior value that is confirmed by the user (for example, the content read from the memory, that is, the value of the read or write register). The behavior value is not the same as the actual value actually read, so that the operating system can be completely monitored and taken over. At this time, the user can modify the data, and the system scan check cannot obtain the real result. In practice, a part of the code can be set in the operating system of the client, and work with the V匪 part of the code. V匪 can handle some interception results by itself, or switch the control flow to the collaboration part in the client, which actually handles the interception result, and finally restores the execution of the correct position of the client code as needed.

Based on the same inventive concept, an embodiment of the present invention further provides an apparatus for performing behavior processing on a Windows platform, which is applied to a CPU supporting hardware virtualization. 2 is a block diagram showing the structure of an apparatus for performing behavior processing on a Windows platform according to an embodiment of the present invention. The apparatus of Figure 2 is capable of implementing a method of behavioral processing on a Windows platform as provided by any of the preferred embodiments described above or a combination thereof. Referring to Figure 2, the apparatus includes at least:

The virtual module 210 is configured to start a local operating system, perform a hardware virtualization operation on the local operating system, and generate a V匪;

The permission setting module 220 is coupled to the virtual module 210 and configured to place the native operating system into the client operation, so that the operating system has lower authority than the VMM;

The processing module 230 is coupled to the permission setting module 220, configured to place the local operating system in a supervised state, and monitors at least one CPU triggered behavior by using V匪, and performs corresponding processing according to the triggering result.

In a preferred embodiment, the virtual module 210 can also be configured to:

Using a driver to send an instruction for implementing a VMM to at least one CPU, the instruction carrying a corresponding code;

At least one CPU executes a hardware virtualization operation according to the code, and generates a VMM. In a preferred embodiment, the processing module 230 can also be configured to:

Switch the current state of the native operating system from the host host state to the guest guest state, placing at least one CPU in a supervised state.

In a preferred embodiment, the processing module 230 can also be configured to:

Set the V匪 mode for the local operating system.

In a preferred embodiment, the processing module 230 can also be configured to:

At least one CPU is set to run in non-root virtualization VMX-non-root mode, corresponding,

Set V匪 to run in root virtualization VMX-root mode.

In a preferred embodiment, the processing module 230 can also be configured to:

When the trigger result is that the behavior triggered by the CPU is unsafe, use V匪 to intercept the Unsafe behavior.

In a preferred embodiment, referring to FIG. 2, the above apparatus may further include:

The searching module 240 is coupled to the processing module 230, configured to search for unsafe behaviors and corresponding processing manners in the pre-stored processing list, where the processing list stores at least one unsafe event and the unsafe event. Processing method

At this time, the processing module 230 may be further configured to process the intercepted unsafe behavior according to the search result.

In a preferred embodiment, the processing module 230 can also be configured to:

When the unsafe behavior is an operation of reading or writing or modifying, the behavior value determined by the user is returned by using V匪, wherein the behavior value is different from the actual value obtained by the reading/writing or modification operation.

In a preferred embodiment, the unsafe behavior includes at least one of the following:

In a preferred embodiment, the Windows platform includes a 64-bit Windows platform. Based on the same inventive concept, an embodiment of the present invention further provides a system for performing behavior processing on a Windows platform. Figure 3 illustrates an embodiment in accordance with one embodiment of the present invention.

Schematic diagram of the system architecture for behavior processing on the Windows platform. In Figure 3, multiple clients can be converted into Virtual Guests in the system through virtualization operations. Virtual Hosts (or Virtual Hosts, or Virtual Machine Monitors) can monitor triggers in Virtual Guests. The various behaviors are handled accordingly.

The system provided by the embodiment of the present invention can support the method and corresponding device for performing behavior processing on the Windows platform provided by any one of the above embodiments or a combination thereof.

The method and the device provided by the embodiments of the present invention can achieve the following beneficial effects: In the embodiment of the present invention, the local operating system is started, the hardware virtualization operation is performed on the system, and the VMM is generated, and the utilization authority is higher than that of the local operating system. V匪 monitors at least one CPU and processes it according to the trigger result. It can be seen that the behavior of Windows can be monitored by generating V匪, and those skilled in the art can execute third-party software in the VMM, thereby realizing the use of third-party software for the Windows platform (especially the 64-bit and even the kernel cannot be modified) A higher level) patching provides a complete active defense product on a 64-bit Windows platform, solving existing security problems for the user's computer system and improving security. In practice, the present invention can be applied to numerous security products (for example, "360 Security Guard" system first aid kit, Trojan horse killing engine, main Machine defense system and other products).

Numerous specific details are set forth in the description provided herein. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of the specification.

Similarly, the various features of the present invention are sometimes grouped together into a single embodiment, in the above description of the exemplary embodiments of the invention, Figure, or a description of it. However, the method disclosed is not to be interpreted as reflecting the intention that the claimed invention requires more features than those recited in the appended claims. Rather, as the following claims reflect, inventive aspects reside in less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the specific embodiments, and each of the claims as a separate embodiment of the invention.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further, they may be divided into a plurality of sub-modules or sub-units or sub-assemblies. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in the specification (including the accompanying claims, the abstract, and the drawings) may be replaced by alternative features that provide the same, equivalent, or similar purpose, unless stated otherwise.

In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features that are included in other embodiments and not in other features, combinations of features of different embodiments are intended to be within the scope of the present invention. Different embodiments are formed and formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that some or all of the devices for performing behavioral processing on the Windows platform in accordance with embodiments of the present invention may be implemented in practice using a microprocessor or digital signal processor (DSP). Some or all of the features of the part. The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

For example, Figure 4 illustrates a computing device, such as an application server, that can implement a method of behavior processing on a Windows platform in accordance with the present invention. The computing device conventionally includes a processor 410 and a computer program product or computer readable medium in the form of a memory 420. The memory 420 can be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM. Memory 420 has a memory space 430 for program code 431 for performing any of the method steps described above. For example, storage space 430 for program code may include various program code 431 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such a computer program product is typically a portable or fixed storage unit as described with reference to Figure 5. The storage unit can have storage segments, storage spaces, and the like that are similarly arranged to memory 420 in the computing device of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 431 ', ie, code that can be read by a processor, such as 410, which, when executed by a computing device, causes the computing device to perform each of the methods described above step.

"an embodiment," or "one or more embodiments" as used herein means that the particular features, structures, or characteristics described in connection with the embodiments are included in at least one embodiment of the invention. In addition, it should be noted that the examples of the words "in one embodiment" are not necessarily all referring to the same embodiment.

It is to be noted that the above-described embodiments are illustrative of the invention and are not intended to limit the scope of the invention, and those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or the steps in the claims. The word "a" or "an" preceding the <RTIgt; The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be the same A hardware item is embodied. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

In addition, it should be noted that the language used in the specification has been selected for the purpose of readability and teaching, and is not intended to be construed or limited. Therefore, many modifications and variations will be apparent to those of ordinary skill in the art. The disclosure of the present invention is intended to be illustrative, and not restrictive, and the scope of the invention is defined by the appended claims.

Claims

Rights request

1. A method of behavioral processing on the Windows platform, applied to CPUs that support hardware virtualization, including:

Start the native operating system, perform a hardware virtualization operation on the native operating system, and generate a virtual machine monitor VMM;

Put the local operating system into the client computer to run, so that the permissions of the operating system are lower than the permissions of the VMM;

Put the local operating system into a supervised state, use the V bandit to monitor the behavior triggered by the at least one CPU, and perform corresponding processing according to the trigger result.

2. The method according to claim 1, wherein the generation method of the V bandit includes the following steps:

The driver is used to send instructions for implementing VMM to the at least one CPU; wherein the at least one CPU performs a hardware virtualization operation on itself according to the instructions to generate the VMM.

3. The method according to claim 1 or 2, wherein placing the local operating system in a supervised state includes:

Switch the current state of the local operating system from the host state to the guest state, and place the at least one CPU in a supervised state.

4. The method according to claim 3, further comprising: setting a VMM mode for the local operating system.

5. The method according to claim 3 or 4, wherein switching the current state of the local operating system from the host state to the guest state includes:

Set the native operating system to run in non-root virtualization VMX-non-root mode, accordingly,

Configure the VMX to run in root virtualization VMX-root mode.

6. The method according to any one of claims 1 to 5, wherein corresponding processing is performed according to the triggering result, including:

When the triggering result is that the behavior triggered by the CPU is an unsafe behavior, the V bandit is used to intercept the unsafe behavior.

7. The method according to claim 6, wherein, after using the V bandit to intercept unsafe behaviors, the method includes: Search for the unsafe behavior and the corresponding processing method in a pre-stored processing list, where at least one unsafe event and a processing method for the unsafe event are stored in the processing list;

The intercepted unsafe behavior is processed according to the search results.

8. The method according to claim 7, wherein the intercepted unsafe behavior is processed according to the search results, including:

When the unsafe behavior is a read, write or modify operation, the VMM is used to return a behavior value determined by the user, where the behavior value is different from the actual value obtained by the read, write or modify operation.

9. The method according to any one of claims 6 to 8, wherein the unsafe behavior includes at least one of the following:

The reading and writing behavior of special registers, the malicious reading and writing behavior of control registers, and the malicious behavior of changing the control flow.

10. The method according to any one of claims 1 to 9, wherein the Windows platform includes a 64-bit Windows platform.

11. A device for behavioral processing on the Windows platform, applied to CPUs that support hardware virtualization, including:

A virtual module configured to start a native operating system, perform a hardware virtualization operation on the native operating system, and generate a virtual machine monitor VMM;

The permission setting module is configured to put the local operating system into the client to run, so that the permissions of the operating system are lower than the permissions of the V bandit;

The processing module is configured to put the native operating system into a supervised state, use the VMM to monitor the behavior triggered by the at least one CPU, and perform corresponding processing according to the trigger result.

12. The device according to claim 11, wherein the virtual module is further configured to: use a driver to send instructions for implementing VMM to the at least one CPU; wherein the at least one CPU performs the VMM according to the instructions. Perform hardware virtualization operations on itself to generate the VMM.

13. The device according to claim 11 or 12, wherein the processing module is further configured to:

The current state of the local operating system is switched from the host state to the guest state, and the at least one CPU is placed in a supervised state.

14. The device according to claim 13, wherein the processing module is further configured to: set a VPN mode for the local operating system.

15. The device according to claim 13 or 14, wherein the processing module is further configured to:

Configure the VMX to run in root virtualization VMX-root mode.

16. The device according to any one of claims 11 to 15, wherein the processing module is further configured to: use the V bandit to intercept when the trigger result is that the behavior triggered by the CPU is an unsafe behavior. unsafe behavior.

17. The device according to claim 16, further comprising:

A search module configured to search for the unsafe behavior and the corresponding processing method in a pre-stored processing list, where at least one unsafe event and a processing method for the unsafe event are stored in the processing list;

The processing module is also configured to process the intercepted unsafe behavior according to the search results.

18. The device according to claim 17, wherein the processing module is further configured to: when the unsafe behavior is a read, write or modify operation, use the VMM to return a behavior value determined by the user, wherein, the The behavior value is different from the actual value obtained by the read, write or modify operation.

19. The device according to any one of claims 16 to 18, wherein the unsafe behavior includes at least one of the following:

20. The device according to any one of claims 11 to 19, wherein the Windows platform includes a 64-bit Windows platform.

21. A computer program, comprising computer readable code, which, when run on a computing device, causes the computing device to execute the method according to any one of claims 1 to 10 on a Windows platform. Methods for behavioral processing.

22. A computer-readable medium in which the computer program according to claim 21 is stored.