WO2015078264A1 - 安全防护方法及装置、终端 - Google Patents

安全防护方法及装置、终端 Download PDF

Info

Publication number
WO2015078264A1
WO2015078264A1 PCT/CN2014/089962 CN2014089962W WO2015078264A1 WO 2015078264 A1 WO2015078264 A1 WO 2015078264A1 CN 2014089962 W CN2014089962 W CN 2014089962W WO 2015078264 A1 WO2015078264 A1 WO 2015078264A1
Authority
WO
WIPO (PCT)
Prior art keywords
policy
monitoring
monitoring point
behavior
attribute
Prior art date
Application number
PCT/CN2014/089962
Other languages
English (en)
French (fr)
Inventor
李伟
俞骁
Original Assignee
腾讯科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 腾讯科技（深圳）有限公司 filed Critical 腾讯科技（深圳）有限公司
Publication of WO2015078264A1 publication Critical patent/WO2015078264A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Definitions

  • the present invention relates to the field of network technologies, and in particular, to a security protection method and apparatus, and a terminal.
  • security protection software In order to effectively protect the security of the network, security protection software is currently used to protect the network.
  • the security protection software adopts a configuration file configuration policy.
  • the policy file in the configuration file and the logic of the main program in the security protection software must be modified, and the modification may result in a configuration file and
  • the logic of the main program of the security protection software is more and more complicated, and the configurable processing mode in the configuration file can only prompt the user to select blocking or permission, which is fixed, and cannot be customized to handle the operation after some monitoring points are triggered. .
  • an embodiment of the present invention provides a security protection method and apparatus, and a terminal.
  • the technical solution is as follows:
  • a security protection method comprising:
  • the behavior of the monitoring point is processed according to an attribute of the monitored process, an attribute of a process that triggers the monitoring point, and a processing policy corresponding to the monitoring point in the monitoring policy.
  • a safety guard comprising:
  • An acquisition module configured to traverse a policy dynamic link library to obtain a monitoring policy, where the policy dynamic link library includes at least one monitoring policy; and obtain a monitoring point of the monitored process from the monitoring policy;
  • a sending module configured to send the monitoring point to the monitoring driving module, so that the monitoring driving module monitors whether the behavior of the monitoring point occurs;
  • a receiving module configured to receive a report message of the monitoring driving module, where the reporting message is initiated when the monitoring driving module monitors that the behavior of the monitoring point occurs;
  • the processing module is configured to process the behavior of the monitoring point according to an attribute of the monitored process, an attribute of a process that triggers the monitoring point, and a processing policy corresponding to the monitoring point in the monitoring policy.
  • a terminal having the security guard as described above disposed thereon.
  • the security protection method, apparatus, and terminal of the embodiment of the present invention acquire a monitoring policy by traversing a policy dynamic link library, where the policy dynamic link library includes at least one monitoring policy; obtaining a monitoring point of the monitored process from the monitoring policy; and monitoring the driving module Sending a monitoring point for monitoring the behavior of the monitoring module to monitor whether the behavior of the monitoring point occurs; receiving the reporting and driving module The message is reported when the monitoring driver module monitors the behavior of the monitoring point.
  • the behavior of the monitoring point is determined according to the attributes of the monitored process, the attributes of the process that triggers the monitoring point, and the processing policy corresponding to the monitoring point in the monitoring policy. deal with.
  • the monitoring policy is configured by using a dynamic link library, and the behavior of the monitoring point can be processed according to the attribute of the monitored process, the attribute of the process that triggers the monitoring point, and the processing policy corresponding to the monitoring point in the monitoring policy.
  • the processing mode can be specially processed according to requirements, so the security protection technology of the embodiment of the present invention is very flexible to use.
  • the policy file in the configuration file and the logic of the main program in the security protection software must be modified, which may result in configuration files and security protection software.
  • the logic of the main program is more and more complicated, and the technical solution of the embodiment of the present invention configures the policy file in the form of a dynamic policy library.
  • a special special monitoring item needs to be added, it can be added only in the dynamic policy library,
  • the logic that causes the main program of the security software is more and more complicated, and it is very convenient to use.
  • the security protection software using the configuration file is started in the service mode, and the policy can be updated only after the next startup, and the dynamic update cannot be supported, and the use is very inflexible.
  • the dynamic policy library is used to configure the policy file.
  • the dynamic policy library supports dynamic update. When there is a new policy, the dynamic link library can be updated in real time and is very flexible to use.
  • FIG. 1 is a flowchart of a security protection method according to an embodiment of the present invention.
  • FIG. 2 is a flowchart of a security protection method according to another embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a safety protection device according to an embodiment of the present invention.
  • FIG. 4 is a schematic structural diagram of a safety protection device according to another embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a terminal device according to an embodiment of the present invention.
  • a configuration file is usually preset, and the configuration file may include a policy for special processing of specified operations of certain specified files, a registry, or a process.
  • the configuration file may include a policy that is intercepted when the A process is maliciously terminated.
  • the corresponding real-time protection process may be: the driver module receives the configuration file in advance, and reports to the application (such as the security protection software) when the A process is forcibly terminated by the unknown process according to the policy in the configuration file. After the application receives the message, the specified processing is obtained through the policy in the loaded configuration file (ie, the application can know that the corresponding specified processing is intercepting the ending action according to the configuration file), and the application returns the designation to the driver module. The handling of the "end A process” was intercepted, and the behavior of "ending the A process” was intercepted.
  • the configurable processing mode of the configuration file in the security protection technology can only prompt the user to select blocking or allowing, and is fixed, and cannot specifically customize the operation processing after the triggering of some monitoring points. Therefore, the use of relatively rigid, very inflexible.
  • FIG. 1 is a flowchart of a security protection method according to an embodiment of the present invention. As shown in FIG. 1 , the security protection method in this embodiment may specifically include the following steps:
  • Step 100 The traversal policy dynamic link library (DLL) acquires a monitoring policy, and the policy DLL includes at least one monitoring policy.
  • the policy DLL can be stored In the local folder of the terminal, for example, a special policy folder can be created for storage to be searched by an application (such as security software).
  • Step 101 Obtain a monitoring point of the monitored process from the monitoring policy.
  • the monitored process is the A process, and the monitoring point can be forced to end for the A process, or the A process can modify the Host file, or other operations.
  • the monitored process can be a monitored process of an application running in the terminal.
  • Step 102 Send a monitoring point to the monitoring driving module, so that the monitoring driving module monitors whether the behavior of the monitoring point occurs. For example, if the monitoring point is to modify the Host file, the monitoring driver module can monitor whether the A process attempts to modify the Host file, that is, whether the behavior of the monitoring point occurs.
  • the monitoring driver module in this embodiment may specifically refer to a driver running at the kernel layer of the terminal. Because the driver has high operation authority on files, a registry, and a process, it is possible to monitor whether the behavior of the monitoring point occurs.
  • Step 103 Receive a report message of the monitoring driver module, where the report message is initiated when the monitoring drive module monitors the behavior of the monitoring point.
  • Step 104 Process the behavior of the monitoring point according to the attribute of the monitored process, the attribute of the process that triggers the monitoring point, and the processing policy corresponding to the monitoring point in the monitoring policy.
  • the execution body of the safety protection method of the embodiment is a safety protection device, and the safety protection device can be an integrated structure of safety protection software integration.
  • the monitoring policy is configured by using a dynamic link library, and the behavior of the monitoring point can be processed according to the attribute of the monitored process, the attribute of the process that triggers the monitoring point, and the processing policy corresponding to the monitoring point in the monitoring policy.
  • the processing method can be specially processed according to requirements, so the security protection technology of this embodiment is very flexible to use.
  • the policy file is configured in the form of a dynamic policy library, when some special specials need to be added. When monitoring items, you can add them only in the dynamic policy library. It will not cause the logic of the main program of the security software to become more and more complicated, and it is very convenient to use.
  • Some technologies adopt a configuration file configuration policy, and the security protection software using the configuration file is started in a service manner.
  • the policy can be updated only after the next startup, and dynamic update cannot be supported, and the use is very inflexible.
  • the dynamic policy library is used to configure dynamic policies.
  • the dynamic policy library supports dynamic updates. When there are new policies, the dynamic link library can be updated in real time and is very flexible to use.
  • step 104 “according to the attribute of the monitored process, the attribute of the process that triggers the monitoring point, and the monitoring policy.
  • the method further includes: calling a pre-callback processing function of the policy DLL to obtain a processing strategy corresponding to the monitoring point.
  • the action of the monitoring point is processed according to the attribute of the monitored process, the attribute of the process that triggers the monitoring point, and the processing policy corresponding to the monitoring point in the monitoring policy, which may include:
  • Step (1) determining, according to the processing strategy, whether the behavior of the monitoring point needs to be processed; when the behavior of the monitoring point needs to be processed, performing step (2); when the behavior of the monitoring point is not required to be processed, performing the step ( 3). For example, if the monitoring point is that the A process modifies the Host file, if the A process is found to attempt to modify the Host file, that is, when the behavior of the monitoring point occurs, if the processing policy stipulates that the behavior needs to be processed, the behavior is processed; If the processing policy stipulates that the behavior does not need to be handled, the behavior may not be processed.
  • Step (2) determining whether the attribute of the monitored process is a protected process, if it is monitored The attribute of the program is a protected process, and step (4) is further performed; otherwise, if the attribute of the monitored process is an unprotected process, step (3) is performed.
  • the attributes of the monitored process in this embodiment may be determined according to some parameters of the monitored process. For example, whether the version of the monitored process is a protected version, whether the process signature is legal, whether the process is a masquerading process, and so on.
  • Step (3) Release the behavior of the monitoring point. For example, when the monitoring point behavior of the "A process to modify the Host file" occurs, if the A process is a legal process for modifying the Host file, the modification operation can be accepted in this step instead of blocking the modification operation.
  • Step (4) determining whether the attribute of the process that triggers the monitoring point is an insecure process. If the attribute of the process that triggers the monitoring point is an insecure process, step (5) is performed; otherwise, if the attribute of the process that triggers the monitoring point is a security process, Perform step (6).
  • the unsecure process of this embodiment refers to a black process.
  • a list of blacklisted security processes can be enumerated, and those that are not part of the security process can be considered as insecure processes. Or you can list some blacklisted insecure processes in the processing policy.
  • Step (5) prevents the behavior of the monitoring point from occurring. For example, you can prevent the behavior of a monitoring point from occurring by returning an error, such as an error in the called system function.
  • Step (6) pops up a prompt box to ask the user how to handle the behavior of the monitoring point.
  • the behavior of the monitoring point can be specially processed according to requirements, and the use is very flexible.
  • the steps (1)-(6) in the foregoing embodiment are only examples of a specialization process in the embodiment of the present invention. In actual applications, the actual specialization process may be set according to actual conditions, and no longer One by one example.
  • the pre-callback processing function of the calling policy DLL acquires the processing strategy corresponding to the monitoring point, and determines whether it is necessary according to the processing policy.
  • the behavior of the monitoring point is processed, and if necessary, further determines whether the current QQ process is a protected process, for example Here you can do specialization, you can set a higher version of the QQ process as a protected process, while the lower version of the process is an unprotected process. If the current QQ process is a protected process, further determine whether the X process is a black process. If the X process is a black process, the process of preventing the X process from ending the QQ process may be returned.
  • step 104 “processes the behavior of the monitoring point according to the attribute of the monitored process, the attribute of the process that triggers the monitoring point, and the processing policy corresponding to the monitoring point in the monitoring policy. After that, you can also include the following steps:
  • the supplemental processing strategy includes reporting or analyzing the process that triggered the monitoring point. That is to say, for some special requirements, some supplementary strategies can be configured. After the behavior of the monitoring points is processed, the process of triggering the monitoring points can be reported or processed according to the supplementary configuration policy, or analyzed and processed to meet actual needs.
  • the security protection method of the foregoing embodiment may further include the following steps:
  • the background server actively informs the terminal that a new policy DLL needs to be updated, or the terminal periodically or irregularly queries the background server to learn that a new policy DLL needs to be updated; for example, the web server presents a new policy DLL on the web page. Wait.
  • step (C) Check if the policy DLL has been loaded, this refers to the old one before the update. DLL; if yes, perform step (D); if the policy DLL is not loaded, load the new policy DLL directly.
  • (D) Clear the monitoring point sent to the monitoring driver module, and cancel the reporting DLL of the policy DLL.
  • the policy DLL is called, the policy DLL is uninstalled and the new policy DLL is reloaded.
  • the policy DLL After the policy DLL is called, it can be judged whether the reference count of the reported callback function is 0. When the reference count of the reported callback function is 0, the call is completed, and the policy DLL can be uninstalled at this time. With the technical solution of the embodiment, the policy DLL can be dynamically updated online in real time, without the need to update at startup as in the configuration file, and the use is very flexible and very convenient.
  • the monitoring policy is configured by using a dynamic link library, and the behavior of the monitoring point can be processed according to the attribute of the monitored process, the attribute of the process that triggers the monitoring point, and the processing policy corresponding to the monitoring point in the monitoring policy.
  • the method can be specially processed according to requirements, so the security protection technology of this embodiment is very flexible to use.
  • the policy file is configured in the form of a dynamic policy library.
  • a special monitoring item needs to be added, it can be added only in the dynamic policy library, and the main program of the security protection software is not caused.
  • the logic is more and more complicated, and it is very convenient to use.
  • the policy file is configured in the form of a dynamic policy library, and the dynamic policy library supports dynamic update.
  • the dynamic link library can be updated in real time, and the use is very flexible.
  • FIG. 2 is a flowchart of a security protection method according to another embodiment of the present invention.
  • the security protection method of the present embodiment further describes the technical solution of the present invention in more detail on the basis of the technical solutions of FIG. 1 and its alternative embodiments.
  • the security protection method of this embodiment may specifically include the following steps:
  • Step 200 The security guard traverses the policy DLL to obtain a monitoring policy.
  • Step 201 The security guard acquires, from the monitoring policy, a monitoring point that is blocked by the monitored A process.
  • the monitoring point is taken as the A process is cut off as an example, and there are many monitoring points in the actual application, which are not repeated here.
  • Step 202 The security guard sends a monitoring point to the monitoring driver module.
  • Step 203 The monitoring driver module monitors that the A process is terminated by the B process, that is, when the monitoring point occurs, the message is reported to the security protection device.
  • Step 204 The security caller invokes a pre-callback processing function of the policy DLL to obtain a processing policy corresponding to the monitoring point of the A process.
  • Step 205 The security protection device determines, according to the processing policy, whether the behavior of the monitoring point of the A process needs to be processed; if necessary, execute step 206; otherwise, release the behavior that the A process is terminated by the B process;
  • Step 206 The security guard determines whether the attribute of the B process is an unsecure process. If yes, go to step 207; otherwise, go to step 208.
  • Step 207 The security guard prevents the A process from being intercepted by the B process. Step 210 is performed.
  • Step 208 The security protection device further determines whether the version of the monitored process A is a protected version; if yes, execute step 209; otherwise, release the behavior that the A process is terminated by the B process;
  • Step 209 The security guard pops up a prompt box to ask the user how to handle the behavior of the monitoring point; and step 210 is performed.
  • Step 210 The security guard invokes a post-callback processing function of the policy DLL to obtain a supplementary processing policy. Step 211 is performed.
  • Step 211 The security protection device reports or analyzes the B process according to the supplementary configuration policy.
  • the technical solution of this embodiment adopts a dynamic link library to configure a monitoring policy, which can be The attribute of the monitoring process, the attribute of the process that triggers the monitoring point, and the processing policy corresponding to the monitoring point in the monitoring policy, and the behavior of the monitoring point is processed.
  • the processing mode can be specially processed according to the requirements. Therefore, the security protection technology of this embodiment is used. Very flexible.
  • the policy file is configured in the form of a dynamic policy library.
  • a special monitoring item needs to be added, it can be added only in the dynamic policy library, and the main program of the security protection software is not caused.
  • the logic is more and more complicated, and it is very convenient to use.
  • the policy file is configured in the form of a dynamic policy library, and the dynamic policy library supports dynamic update.
  • the dynamic link library can be updated in real time, and the use is very flexible.
  • FIG. 3 is a schematic structural diagram of a safety protection device according to an embodiment of the present invention.
  • the security protection device of this embodiment may specifically include an obtaining module 10, a sending module 11, a receiving module 12, and a processing module 13.
  • the obtaining module 10 is configured to traverse the policy DLL to obtain a monitoring policy, and the policy DLL includes at least one monitoring policy; the obtaining module 10 is further configured to obtain a monitoring point of the monitored process from the monitoring policy; the sending module 11 is connected to the obtaining module 10, The sending module 11 is configured to send the monitoring point acquired by the acquiring module 10 to the monitoring driving module, so that the monitoring driving module monitors whether the behavior of the monitoring point occurs; the receiving module 12 is configured to receive the reporting message of the monitoring driving module, and report the message as monitoring.
  • the driving module is configured to be triggered when the behavior of the monitoring point occurs.
  • the processing module 13 is connected to the obtaining module 10 and the receiving module 12 respectively, and is configured to determine that the monitoring point is triggered according to the report message received by the receiving module 12, and according to the monitored The attribute of the process, the attribute of the process that triggers the monitoring point, and the processing strategy corresponding to the monitoring point in the monitoring policy acquired by the obtaining module 10, and the behavior of the monitoring point is processed.
  • the security protection device of the present embodiment is the same as the implementation mechanism of the foregoing method embodiment by using the foregoing module.
  • the security protection device of this embodiment adopts a dynamic link library to configure a monitoring policy, which can be rooted According to the attributes of the monitored process, the attributes of the process that triggers the monitoring point, and the processing policy corresponding to the monitoring point in the monitoring policy, the behavior of the monitoring point is processed, and the processing mode can be specially processed according to requirements. Therefore, the security protection of this embodiment
  • the use of technology is very flexible.
  • some technologies adopt a configuration file configuration policy.
  • the policy files in the configuration file and the logic of the main program in the security protection software must be modified, which may result in configuration files and security protection software.
  • the logic of the main program is more and more complicated, and the technical solution of the embodiment is used to configure the policy file in the form of a dynamic policy library.
  • the logic that causes the main program of the security software is more and more complicated, and it is very convenient to use.
  • Some technologies adopt a configuration file configuration policy, and the security protection software using the configuration file is started in a service manner.
  • the policy can be updated only after the next startup, and dynamic update cannot be supported, and the use is very inflexible.
  • the dynamic policy library is used to configure the policy file.
  • the dynamic policy library supports dynamic update. When there is a new policy, the dynamic link library can be updated in real time and is very flexible to use.
  • FIG. 4 is a schematic structural diagram of a safety protection device according to another embodiment of the present invention. As shown in FIG. 4, the security protection device of the present embodiment further includes the following technical solutions based on the foregoing embodiment shown in FIG.
  • the security protection device of the embodiment further includes a calling module 14; the calling module 14 is configured to: after the receiving module 12 receives the reporting message of the monitoring driving module, the processing module 13 triggers according to the attribute of the monitored process.
  • the pre-callback processing function of the policy DLL is called to obtain the processing strategy corresponding to the monitoring point. That is, the processing module 13 is connected to the calling module 14, and the processing module 13 controls the monitoring point according to the attribute of the monitored process, the attribute of the process that triggers the monitoring point, and the processing strategy corresponding to the monitoring point in the monitoring policy invoked by the calling module 14. Behavior is handled.
  • the processing module 13 is specifically configured to determine, according to the processing policy, whether the behavior of the monitoring point needs to be processed; when the behavior of the monitoring point needs to be processed, determine whether the attribute of the monitored process is The protected process, if the attribute of the monitored process is an unprotected process, release the behavior of the monitoring point; otherwise, if the attribute of the monitored process is a protected process, further determine whether the attribute of the process that triggered the monitoring point is an insecure process, if The attribute of the process that triggers the monitoring point is an insecure process that prevents the behavior of the monitoring point from occurring; otherwise, if the attribute of the process that triggers the monitoring point is a security process, a prompt box is popped up to ask the user how to handle the behavior of the monitoring point.
  • the processing module 13 is further configured to release the behavior of the monitoring point when the behavior of the monitoring point is not required to be processed.
  • the calling module 14 is further configured to: in the processing module 13, according to the attribute of the monitored process, the attribute of the process that triggers the monitoring point, and the processing policy corresponding to the monitoring point in the monitoring policy, the monitoring point After the behavior is processed, the post-callback processing function of the calling policy DLL is used to obtain a supplementary processing strategy; the processing module 13 is further configured to perform supplementary processing on the process of triggering the monitoring point according to the supplementary processing strategy invoked by the calling module 14.
  • the supplemental processing strategy may include reporting or analyzing the process that triggered the monitoring point.
  • the security protection device of this embodiment further includes an update module 15.
  • the update module 15 is configured to determine whether a new policy DLL needs to be updated on the background server or on the Internet; if a new policy DLL needs to be updated on the background server or the network, for example, the background server actively informs the terminal that a new policy DLL needs to be updated. Or the terminal periodically or irregularly queries the background server to learn that a new policy DLL needs to be updated; for example, the web server presents a new policy DLL on the web page; the update module 15 can correspondingly from the background server or the Internet. Download the new policy DLL.
  • the processing module 13 is also connected to the update module 15, and the processing module 13 is further configured to check whether the policy DLL has been loaded, and if so, clear and send to the monitoring Drive the monitoring point of the module, and cancel the reporting callback of the policy DLL.
  • the policy DLL is called, the policy DLL is uninstalled, and the new policy DLL updated by the update module 15 is reloaded; if the policy DLL is not loaded, the update module 15 is directly updated.
  • the new strategy DLL is also connected to the update module 15, and the processing module 13 is further configured to check whether the policy DLL has been loaded, and if so, clear and send to the monitoring Drive the monitoring point of the module, and cancel the reporting callback of the policy DLL.
  • the security protection device of the present embodiment is the same as the implementation mechanism of the foregoing method embodiment by using the foregoing module.
  • the security protection device of the embodiment uses the dynamic link library to configure the monitoring policy by using the above module, and can perform the behavior of the monitoring point according to the attribute of the monitored process, the attribute of the process that triggers the monitoring point, and the processing policy corresponding to the monitoring point in the monitoring policy.
  • the processing is performed, and the processing manner can be specially processed according to requirements, so the security protection technology of this embodiment is very flexible to use.
  • the policy file is configured in the form of a dynamic policy library.
  • a special monitoring item needs to be added, it can be added only in the dynamic policy library, and the main program of the security protection software is not caused.
  • the logic is more and more complicated, and it is very convenient to use.
  • the policy file is configured in the form of a dynamic policy library, and the dynamic policy library supports dynamic update.
  • the dynamic link library can be updated in real time, and the use is very flexible.
  • FIG. 5 is a schematic structural diagram of a terminal device according to an embodiment of the present invention.
  • the terminal device can be used to implement the security protection method provided in the foregoing embodiment.
  • the terminal device 800 can include a memory 120 of one or more computer readable storage media and one or more processors 180.
  • the memory 120 can be used to store software programs and modules, and the processor 180 executes various security protection function applications and data processing by running software programs and modules stored in the memory 120.
  • the memory 120 can include a storage program area and a storage data area, wherein the storage program area can store an operating system, An application (such as a security guard, etc.) required for at least one function; the storage data area can store data created according to the use of the terminal device 800, and the like.
  • memory 120 can include high speed random access memory, and can also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid state storage device. Accordingly, memory 120 may also include a memory controller to provide access to memory 120 by processor 180.
  • the terminal device can be a mobile phone, a server, a computer, or the like.
  • the terminal device 800 may further include a communication unit 110, an input unit 130, a display unit 140, a sensor 150, an audio circuit 160, a WiFi (Wireless Fidelity) module 170, and a power supply 190.
  • a communication unit 110 an input unit 130, a display unit 140, a sensor 150, an audio circuit 160, a WiFi (Wireless Fidelity) module 170, and a power supply 190.
  • WiFi Wireless Fidelity
  • the communication unit 110 can be used for transmitting and receiving information and receiving and transmitting signals during a call.
  • the communication unit 110 can be an RF (Radio Frequency) circuit, a router, a modem, or the like.
  • RF circuits as communication units include, but are not limited to, an antenna, at least one amplifier, a tuner, one or more oscillators, a Subscriber Identity Module (SIM) card, a transceiver, a coupler, and a LNA (Low Noise Amplifier, low).
  • SIM Subscriber Identity Module
  • the communication unit 110 can also communicate with the network and other devices through wireless communication.
  • the wireless communication may use any communication standard or protocol, including but not limited to GSM (Global System of Mobile communication), GPRS (General Packet Radio Service), CDMA (Code Division Multiple Access). , Code Division Multiple Access), WCDMA (Wideband Code Division Multiple Access), LTE (Long Term Evolution), e-mail, SMS (Short Messaging Service), and the like.
  • the input unit 130 can be configured to receive input numeric or character information and to generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function controls.
  • input unit 130 can include touch-sensitive surface 131 as well as other input devices 132.
  • Touch-sensitive surface 131 also referred to as a touch display or trackpad, can collect touch operations on or near the user (such as a user using a finger, stylus, etc., on any suitable object or accessory on touch-sensitive surface 131 or The operation near the touch-sensitive surface 131) and driving the corresponding connecting device according to a preset program.
  • the touch-sensitive surface 131 can include two portions of a touch detection device and a touch controller.
  • the touch detection device detects the touch orientation of the user, and detects a signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts the touch information into contact coordinates, and sends the touch information.
  • the processor 180 is provided and can receive commands from the processor 180 and execute them.
  • the touch-sensitive surface 131 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves.
  • the input unit 130 can also include other input devices 132.
  • other input devices 132 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), trackballs, mice, joysticks, and the like.
  • the display unit 140 can be used to display information input by the user or information provided to the user and various graphical user interfaces of the terminal device 800, which can be composed of graphics, text, icons, video, and any combination thereof.
  • the display unit 140 may include a display panel 141, or the display panel 141 may be configured in the form of an LCD (Liquid Crystal Display), an OLED (Organic Light-Emitting Diode), or the like.
  • the touch-sensitive surface 131 may cover the display panel 141, and when the touch-sensitive surface 131 detects a touch operation thereon or nearby, it is transmitted to the processor 180 to determine the type of the touch event, and then the processor 180 according to the touch event The type provides a corresponding visual output on display panel 141.
  • touch-sensitive surface 131 and display panel 141 are implemented as two separate components to perform input and input functions, in some embodiments, The touch-sensitive surface 131 is integrated with the display panel 141 to implement input and output functions.
  • Terminal device 800 may also include at least one type of sensor 150, such as a light sensor, motion sensor, and other sensors.
  • the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 141 according to the brightness of the ambient light, and the proximity sensor may close the display panel 141 when the terminal device 800 moves to the ear. And / or backlight.
  • the gravity acceleration sensor can detect the magnitude of acceleration in all directions (usually three axes). When it is stationary, it can detect the magnitude and direction of gravity.
  • the terminal device 800 can also be configured with gyroscopes, barometers, hygrometers, thermometers, infrared sensors and other sensors, here No longer.
  • the audio circuit 160, the speaker 161, and the microphone 162 can provide an audio interface between the user and the terminal device 800.
  • the audio circuit 160 can transmit the converted electrical data of the received audio data to the speaker 161 for conversion to the sound signal output by the speaker 161; on the other hand, the microphone 162 converts the collected sound signal into an electrical signal by the audio circuit 160. After receiving, it is converted into audio data, and then processed by the audio data output processor 180, transmitted to the terminal device such as another terminal device via the RF circuit 110, or outputted to the memory 120 for further processing.
  • the audio circuit 160 may also include an earbud jack to provide communication of the peripheral earphones with the terminal device 800.
  • the terminal device may be configured with a wireless communication unit 170, which may be a WiFi module.
  • WiFi is a short-range wireless transmission technology
  • the terminal device 800 can help a user to send and receive emails, browse web pages, and access streaming media through the wireless communication unit 170, which provides wireless broadband Internet access for users.
  • FIG. 5 shows the wireless communication unit 170, it can be understood that it does not belong to the essential configuration of the terminal device 800, and can be completely within the scope of not changing the essence of the invention as needed. Omitted.
  • the processor 180 is the control center of the terminal device 800, which connects various portions of the entire handset using various interfaces and lines, by running or executing software programs and/or modules stored in the memory 120, and recalling data stored in the memory 120.
  • the various functions and processing data of the terminal device 800 are executed to perform overall monitoring of the mobile phone.
  • the processor 180 may include one or more processing cores; in addition, the processor 180 may integrate an application processor and a modem processor, where the application processor processes an operating system, a user interface, an application, etc., and performs modulation and demodulation.
  • the processor handles wireless communication. It can be understood that the above modem processor may not be integrated into the processor 180.
  • a power supply 190 (such as a battery) is used to power the various components.
  • the power supply can be logically coupled to the processor 180 through a power management system to manage functions such as charging, discharging, and power management through the power management system.
  • Power supply 190 may also include any one or more of a DC or AC power source, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and the like.
  • the terminal device 800 may further include a camera, a Bluetooth module, and the like, and details are not described herein again.
  • the display unit of the terminal device is a touch screen display
  • the terminal device further includes a memory, and one or more programs, wherein one or more programs are stored in the memory and configured to be one or one
  • the above processor executing the one or more programs includes instructions for: traversing a policy dynamic link library to acquire a monitoring policy, the policy dynamic link library including at least one monitoring policy; obtaining the selected from the monitoring policy Monitoring a monitoring point of the process; sending the monitoring point to the monitoring driver module, wherein the monitoring driving module monitors whether the behavior of the monitoring point occurs; receiving the reporting message of the monitoring driving module, where the reporting message is The monitoring driver module detects that the behavior of the monitoring point is initiated; according to the attribute of the monitored process, the attribute of the process that triggers the monitoring point, and the monitoring point corresponding to the monitoring policy. Processing strategy to process the behavior of the monitoring point.
  • the memory is further configured to: store a pre-callback processing function of the policy dynamic link library to acquire a processing policy corresponding to the monitoring point.
  • the memory is further configured to store an instruction of: determining, according to the processing policy, whether the behavior of the monitoring point needs to be processed;
  • the attribute of the monitored process is a protected process, and if the attribute of the monitored process is an unprotected process, release the behavior of the monitoring point; otherwise If the attribute of the monitored process is a protected process, further determining whether the attribute of the process that triggers the monitoring point is an unsecure process, and if the attribute of the process that triggers the monitoring point is an unsecure process, blocking the monitoring The occurrence of the behavior of the point; otherwise, if the attribute of the process that triggers the monitoring point is a security process, a prompt box is popped up to ask the user how to handle the behavior of the monitoring point.
  • the memory is further configured to store an instruction to release the behavior of the monitoring point when the behavior of the monitoring point is not required to be processed.
  • the memory is further configured to: store a post-callback processing function of the policy dynamic link library to obtain a supplementary processing policy; and perform supplementary processing on the process that triggers the monitoring point according to the supplementary processing policy.
  • the supplementary processing strategy includes reporting or analyzing a process that triggers the monitoring point.
  • the memory is further configured to store the following instructions: determining whether there is a new policy dynamic link library on the Internet that needs to be updated; if a new policy dynamic link library needs to be updated on the Internet, downloading a new policy from the Internet Dynamic link library
  • a person skilled in the art may understand that all or part of the steps of implementing the above embodiments may be completed by hardware, or may be instructed by a program to execute related hardware, and the program may be stored in a computer readable storage medium.
  • the storage medium mentioned may be a read only memory, a magnetic disk or an optical disk or the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)

Abstract

本发明公开了一种安全防护方法及装置、终端，属于网络技术领域。所述方法包括：遍历策略动态链接库获取监控策略，策略动态链接库中包括至少一个监控策略；从监控策略中获取被监控进程的监控点；向监控驱动模块下发监控点，以供监控驱动模块监控监控点的行为是否发生；接收监控驱动模块的上报消息，上报消息为所述驱动模块监控到监控点的行为发生时发起的；根据被监控进程的属性、触发监控点的进程的属性以及监控策略中所述监控点对应的处理策略，对监控点的行为进行处理。本发明通过采用上述技术方案对监控点的行为进行处理，处理方式可以根据需求做特殊化处理，因此本发明的安全防护技术使用非常灵活。

Description

安全防护方法及装置、终端
本申请要求于2013年11月26日提交中国专利局、申请号为201310610885.2、发明名称为“安全防护方法及装置、终端”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及网络技术领域，特别涉及一种安全防护方法及装置、终端。
发明背景
随着互联网科技的发展，为了保护系统安全稳定的运行，保护用户隐私不被窃取，系统不被恶意攻击等，网络的安全问题也变得日益严峻。
为了有效地保护网络的安全，目前采用安全防护软件来保护网络。但该安全防护软件采用配置文件的形式配置策略，当需要新增一些特殊的监控项，必须修改配置文件中的策略文件以及安全防护软件中的主程序的逻辑，该修改可能会导致配置文件和安全防护软件的主程序的逻辑越来越复杂，且配置文件中可配置的处理方式只能弹框提示用户选择阻止或允许，是固定的，不能特殊化定制某些监控点触发后的操作处理。
发明内容
鉴于此，本发明实施例提供了一种安全防护方法及装置、终端。所述技术方案如下：
一方面，提供了一种安全防护方法，所述方法包括：
遍历策略动态链接库获取监控策略，所述策略动态链接库中包括至少一个监控策略；
从所述监控策略中获取被监控进程的监控点；
向监控驱动模块下发所述监控点，以供所述监控驱动模块监控所述监控点的行为是否发生；
接收所述监控驱动模块的上报消息，所述上报消息为所述监控驱动模块监控到所述监控点的行为发生时发起的；
根据所述被监控进程的属性、触发所述监控点的进程的属性以及所述监控策略中所述监控点对应的处理策略，对所述监控点的行为进行处理。
另一方面，提供了一种安全防护装置，所述装置包括：
获取模块，用于遍历策略动态链接库获取监控策略，所述策略动态链接库中包括至少一个监控策略；从所述监控策略中获取被监控进程的监控点；
下发模块，用于向监控驱动模块下发所述监控点，以供所述监控驱动模块监控所述监控点的行为是否发生；
接收模块，用于接收所述监控驱动模块的上报消息，所述上报消息为所述监控驱动模块监控到所述监控点的行为发生时发起的；
处理模块，用于根据所述被监控进程的属性、触发所述监控点的进程的属性以及所述监控策略中所述监控点对应的处理策略，对所述监控点的行为进行处理。
再一方面，还提供了一种终端，所述终端上设置有如上所述的安全防护装置。
本发明实施例的安全防护方法及装置、终端，通过遍历策略动态链接库获取监控策略，策略动态链接库中包括至少一个监控策略；从监控策略中获取被监控进程的监控点；向监控驱动模块下发监控点，以供监控驱动模块监控监控点的行为是否发生；接收监控驱动模块的上报消 息，上报消息为监控驱动模块监控到监控点的行为发生时发起的；根据被监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理。采用本发明实施例的技术方案，采用动态链接库配置监控策略，可以根据被监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理，处理方式可以根据需求做特殊化处理，因此本发明实施例的安全防护技术使用非常灵活。
另外，在采用配置文件的形式配置策略中，当需要新增一些特殊的监控项，必须修改配置文件中的策略文件以及安全防护软件中的主程序的逻辑，可能导致配置文件和安全防护软件的主程序的逻辑越来越复杂，而本发明实施例的技术方案，采用动态策略库的形式配置策略文件，当需要新增一些特殊的监控项，可以仅在动态策略库中增加即可，不会导致安全防护软件的主程序的逻辑越来越复杂，使用也非常方便，
再者，在采用配置文件的形式配置策略中，采用配置文件的安全防护软件都是以服务的方式启动的，只有等到下一次启动才能更新策略，不能支持动态更新，使用非常不灵活。而采用动态策略库的形式配置策略文件，动态策略库支持动态更新，当有新的策略时，动态链接库可以实时更新，使用非常灵活。
附图简要说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为本发明一实施例提供的安全防护方法的流程图。
图2为本发明另一实施例提供的安全防护方法的流程图。
图3为本发明一实施例提供的安全防护装置的结构示意图。
图4为本发明另一实施例提供的安全防护装置的结构示意图。
图5是本发明实施例提供的一种终端设备结构示意图。
实施本发明的方式
目前的安全防护技术在实现时，通常预先设置有配置文件，该配置文件可以包括对某些指定的文件、注册表或进程的指定操作做特殊处理的策略。如该配置文件中可以包括A进程被恶意结束时拦截的策略。此时对应的实时防护过程可以为：驱动模块预先接收到配置文件，并根据配置文件中的策略，在监控到A进程被未知进程强制结束时，上报给应用程序(如可以为安全防护软件)，应用程序收到消息后通过加载后的配置文件中的策略获取指定的处理(即应用程序根据配置文件可以知道此时对应的指定处理为拦截该结束动作)，应用程序并向驱动模块返回指定的处理即“结束A进程”被拦截，最终“结束A进程”这种行为被拦截。
在实现本发明的过程中，所述安全防护技术中配置文件可配置的处理方式只能弹框提示用户选择阻止或允许，是固定的，不能特殊化定制某些监控点触发后的操作处理，因此，使用比较死板，非常不灵活。
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
图1为本发明一实施例提供的安全防护方法的流程图。如图1所示，本实施例的安全防护方法，具体可以包括如下步骤：
步骤100、遍历策略动态链接库(Dynamic Link Library；DLL)获取监控策略，策略DLL中包括至少一个监控策略。该策略DLL可存储 在终端的本地文件夹中，例如可建立一个专门的策略文件夹进行存储，以便于应用程序(如安全防护软件)查找。
步骤101、从监控策略中获取被监控进程的监控点。
例如被监控的进程为A进程，监控点可以为A进程被强制结束，或A进程修改Host文件，或者其他操作等等。其中，被监控进程可以为在终端中运行的应用程序的被监控进程。
步骤102、向监控驱动模块下发监控点，以供监控驱动模块监控监控点的行为是否发生。例如，如果监控点是修改Host文件，则监控驱动模块可监控A进程是否试图修改Host文件，也即监控监控点的行为是否发生。
本实施例中的监控驱动模块具体可以指的是运行在终端内核层的驱动，因为驱动对文件、注册表、进程有很高的操作权限，因此可以监控监控点的行为是否发生。
步骤103、接收监控驱动模块的上报消息，上报消息为监控驱动模块监控到监控点的行为发生时发起的。
步骤104、根据被监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理。
本实施例的安全防护方法的执行主体为安全防护装置，该安全防护装置可以为一安全防护软件集成的一体化结构。
在本实施例的技术方案中，采用动态链接库配置监控策略，可以根据被监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理，处理方式可以根据需求做特殊化处理，因此本实施例的安全防护技术使用非常灵活。
另外，目前有些技术采用配置文件的形式配置策略，当需要新增一些特殊的监控项，必须修改配置文件中的策略文件以及安全防护软件中 的主程序的逻辑，可能导致配置文件和安全防护软件的主程序的逻辑越来越复杂，而采用本实施例的技术方案，采用动态策略库的形式配置策略文件，当需要新增一些特殊的监控项时，可以仅在动态策略库中增加即可，不会导致安全防护软件的主程序的逻辑越来越复杂，使用也非常方便。
再者，有些技术采用配置文件的形式配置策略，采用配置文件的安全防护软件都是以服务的方式启动的，只有等到下一次启动才能更新策略，不能支持动态更新，使用非常不灵活。而采用动态策略库的形式配置策略，动态策略库支持动态更新，当有新的策略时，动态链接库可以实时更新，使用非常灵活。
此外，在上述图1所述实施例的技术方案的基础上，步骤103“接收监控驱动模块的上报消息”之后，步骤104“根据被监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理”之前，还可以包括：调用策略DLL的前置回调处理函数获取监控点对应的处理策略。
进一步地，上述实施例的步骤104“根据被监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理”，具体可以包括：
步骤(1)根据处理策略判断是否需要对监控点的行为进行处理；当需要对监控点的行为进行处理时，执行步骤(2)；当不需要对监控点的行为进行处理时，执行步骤(3)。例如，如果监控点是A进程修改Host文件，则若发现A进程试图修改Host文件时，也即监控点的行为发生时，如果处理策略规定需要处理该行为的话，则对该行为进行处理；如果处理策略规定不需要处理该行为的话，则可不对该行为进行处理。
步骤(2)判断被监控进程的属性是否为受保护进程，若被监控进 程的属性是受保护进程，进一步执行步骤(4)；否则若被监控进程的属性是不受保护进程，执行步骤(3)。
本实施例中被监控进程的属性可以根据被监控进程的一些参数确定。如被监控进程的版本是否为受保护的版本、进程签名是否合法、进程是否是伪装进程等等。
步骤(3)放行监控点的行为。例如，当“A进程修改Host文件”的监控点行为发生时，如果A进程为修改Host文件的合法进程，则本步骤中可接受该修改操作而不是阻止该修改操作。
步骤(4)判断触发监控点的进程的属性是否为不安全进程，若触发监控点的进程的属性是不安全进程，执行步骤(5)；否则若触发监控点的进程的属性是安全进程，执行步骤(6)。
本实施例的不安全进程指的是黑进程。例如在处理策略中可以列举一下白名单的安全进程列表，不属于安全进程的都可以认为是不安全进程。或者也可以在处理策略中列举一些黑名单不安全进程列表。
步骤(5)阻止监控点的行为发生。例如，可通过在所调用的系统函数中返回错误等操作来阻止监控点的行为发生。
步骤(6)弹出提示框，以询问用户监控点的行为如何处理。
通过采用上述实施例的步骤(1)-(6)，可以根据需求对监控点的行为做特殊化处理，使用非常灵活。且上述实施例中的步骤(1)-(6)仅为本发明实施例的一种特殊化处理的举例，实际应用中，还可以根据实际情况设置符合实际的特殊化处理，在此不再一一举例。
例如当监控点为QQ进程被结束，当监控驱动模块监测到QQ进程被X进程强制结束时，调用策略DLL的前置回调处理函数获取监控点对应的处理策略，并根据处理策略判断是否需要对监控点的行为进行处理，若需要的话，进一步判断当前QQ进程是否为受保护的进程，例如 这里可以做特殊化处理，可以设置较高版本的QQ进程为受保护的进程，而较低版本的进程为不受保护的进程。若当前QQ进程是受保护的进程，进一步判断X进程是否为黑进程，若X进程是为黑进程，可以返回阻止X进程结束QQ进程的处理。
进一步地，在上述实施例的技术方案的基础上，其中步骤104“根据被监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理”之后，还可以包括如下步骤：
(a)调用策略DLL的后置回调处理函数获取补充处理策略；
(b)并根据补充处理策略对触发监控点的进程进行补充处理。
例如，补充处理策略包括对触发监控点的进程进行上报或者分析。也就是说对于一些特殊的需求，可以配置一些补充策略，对监控点的行为进行处理之后，可以根据补充配置策略对触发监控点的进程进行上报处理，或者分析处理，以满足实际需求。
进一步地，在上述实施例的技术方案的基础上，上述实施例的安全防护方法，还可以包括如下步骤：
(A)判断后台服务器上或互联网上是否有新的策略DLL需要更新。
(B)若后台服务器或互联网上有新的策略DLL需要更新，从后台服务器或互联网上下载新的策略DLL。例如，后台服务器主动告知终端有新的策略DLL需要更新，或终端通过定期或不定期询问后台服务器得知有新的策略DLL需要更新；又如，网络服务器于网页上呈现出了新的策略DLL等。
当然，若后台服务器或互联网上没有新的策略DLL需要更新，继续定期检测即可。
(C)检查策略DLL是否已被加载，这里指的是未更新前的旧的 DLL；若是，执行步骤(D)；若策略DLL未被加载，直接加载新的策略DLL即可。
(D)清空下发至监控驱动模块的监控点，并取消策略DLL的上报回调，在策略DLL调用完毕时，卸载策略DLL，重新加载新的策略DLL。
其中策略DLL调用完毕可以通过判断上报回调函数的引用计数是否为0，当该上报回调函数的引用计数为0时，调用完毕，此时可以卸载该策略DLL。采用该实施例的技术方案，可以实时动态在线更新策略DLL，而不需要像配置文件那样，只能在启动时进行更新，使用非常灵活，非常方便。
上述实施例的所有可选技术方案，可以采用结合的方式任意组合，形成本发明的可选实施例在此不再一一赘述。
上述实施例的技术方案，采用动态链接库配置监控策略，可以根据被监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理，处理方式可以根据需求做特殊化处理，因此本实施例的安全防护技术使用非常灵活。
另外，采用本实施例的技术方案，采用动态策略库的形式配置策略文件，当需要新增一些特殊的监控项，可以仅在动态策略库中增加即可，不会导致安全防护软件的主程序的逻辑越来越复杂，使用也非常方便，
再者，采用动态策略库的形式配置策略文件，动态策略库支持动态更新，当有新的策略时，动态链接库可以实时更新，使用非常灵活。
图2为本发明另一实施例提供的安全防护方法的流程图。本实施例的安全防护方法在上述图1及其可选实施例的技术方案的基础上，进一步更加详细地介绍本发明的技术方案。如图2所示，本实施例的安全防护方法，具体可以包括如下步骤：
步骤200、安全防护装置遍历策略DLL获取监控策略。
步骤201、安全防护装置从监控策略中获取被监控A进程被截止的监控点。
本实施例中以监控点为A进程被截止为例，实际应用中还可以有很多的监控点，在此不再一一赘述。
步骤202、安全防护装置向监控驱动模块下发监控点。
步骤203、监控驱动模块监控到A进程被B进程截止，即监控点发生时，向安全防护装置上报消息。
步骤204、安全防护装置调用策略DLL的前置回调处理函数获取A进程的监控点对应的处理策略。
步骤205、安全防护装置根据处理策略判断是否需要对A进程的监控点的行为进行处理；若需要，执行步骤206；否则，放行A进程被B进程截止的行为；结束。
步骤206、安全防护装置判断B进程的属性是否为不安全进程，若是，执行步骤207；否则如不是，执行步骤208。
步骤207、安全防护装置阻止A进程被B进程的拦截；执行步骤210。
步骤208、安全防护装置进一步判断被监控进程A的版本是否为受保护的版本；若是，执行步骤209；否则放行A进程被B进程截止的行为；结束。
步骤209、安全防护装置弹出提示框，以询问用户监控点的行为如何处理；执行步骤210。
步骤210、安全防护装置调用策略DLL的后置回调处理函数获取补充处理策略；执行步骤211。
步骤211、安全防护装置根据补充配置策略对B进程进行上报或者分析处理。
本实施例的技术方案，采用动态链接库配置监控策略，可以根据被 监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理，处理方式可以根据需求做特殊化处理，因此本实施例的安全防护技术使用非常灵活。
另外，采用本实施例的技术方案，采用动态策略库的形式配置策略文件，当需要新增一些特殊的监控项，可以仅在动态策略库中增加即可，不会导致安全防护软件的主程序的逻辑越来越复杂，使用也非常方便，
再者，采用动态策略库的形式配置策略文件，动态策略库支持动态更新，当有新的策略时，动态链接库可以实时更新，使用非常灵活。
图3为本发明一实施例提供的安全防护装置的结构示意图。如图3所示，本实施例的安全防护装置，具体可以包括获取模块10、下发模块11、接收模块12和处理模块13。
其中获取模块10用于遍历策略DLL获取监控策略，策略DLL中包括至少一个监控策略；获取模块10还用于从监控策略中获取被监控进程的监控点；下发模块11与获取模块10连接，下发模块11用于向监控驱动模块下发获取模块10获取的监控点，以供监控驱动模块监控监控点的行为是否发生；接收模块12用于接收监控驱动模块的上报消息，上报消息为监控驱动模块监控到监控点的行为发生时发起的；处理模块13分别与获取模块10和接收模块12连接，用于根据接收模块12接收到的上报消息，确定监控点被触发，此时根据被监控进程的属性、触发监控点的进程的属性以及获取模块10获取的监控策略中监控点对应的处理策略，对监控点的行为进行处理。
本实施例的安全防护装置，通过采用上述模块实现安全防护方法与上述相关方法实施例的实现机制相同，详细可以参考上述相关实施例的记载，在此不再赘述。
本实施例的安全防护装置，采用动态链接库配置监控策略，可以根 据被监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理，处理方式可以根据需求做特殊化处理，因此本实施例的安全防护技术使用非常灵活。
另外，有些技术采用配置文件的形式配置策略，当需要新增一些特殊的监控项，必须修改配置文件中的策略文件以及安全防护软件中的主程序的逻辑，可能导致配置文件和安全防护软件的主程序的逻辑越来越复杂，而采用本实施例的技术方案，采用动态策略库的形式配置策略文件，当需要新增一些特殊的监控项，可以仅在动态策略库中增加即可，不会导致安全防护软件的主程序的逻辑越来越复杂，使用也非常方便，
再者，有些技术采用配置文件的形式配置策略，采用配置文件的安全防护软件都是以服务的方式启动的，只有等到下一次启动才能更新策略，不能支持动态更新，使用非常不灵活。而采用动态策略库的形式配置策略文件，动态策略库支持动态更新，当有新的策略时，动态链接库可以实时更新，使用非常灵活。
图4为本发明另一实施例提供的安全防护装置的结构示意图。如图4所示，本实施例的安全防护装置，在上述图3所示实施例的基础上，进一步包括如下技术方案。
如图4所示，本实施例的安全防护装置，还包括调用模块14；该调用模块14用于在接收模块12接收监控驱动模块的上报消息之后，处理模块13根据被监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理之前，调用策略DLL的前置回调处理函数获取监控点对应的处理策略。也就是说，处理模块13与调用模块14连接，处理模块13根据被监控进程的属性、触发监控点的进程的属性以及调用模块14调用的监控策略中监控点对应的处理策略，对监控点的行为进行处理。
此外，本实施例的安全防护装置中，处理模块13具体用于根据处理策略判断是否需要对监控点的行为进行处理；当需要对监控点的行为进行处理时，判断被监控进程的属性是否为受保护进程，若被监控进程的属性是不受保护进程，放行监控点的行为；否则若被监控进程的属性是受保护进程，进一步判断触发监控点的进程的属性是否为不安全进程，若触发监控点的进程的属性是不安全进程，阻止监控点的行为的发生；否则若触发监控点的进程的属性是安全进程，弹出提示框，以询问用户监控点的行为如何处理。
进一步地，本实施例的安全防护装置中，处理模块13还用于当不需要对监控点的行为进行处理时，放行监控点的行为。
进一步地，本实施例的安全防护装置中，调用模块14还用于在处理模块13根据被监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理之后，调用策略DLL的后置回调处理函数获取补充处理策略；处理模块13还用于根据调用模块14调用得到的补充处理策略对触发监控点的进程进行补充处理。例如补充处理策略可以包括对触发监控点的进程进行上报或者分析。
如图4所示，本实施例的安全防护装置，还包括更新模块15。该更新模块15用于判断后台服务器上或互联网上是否有新的策略DLL需要更新；若后台服务器或联网上有新的策略DLL需要更新，例如，后台服务器主动告知终端有新的策略DLL需要更新，或终端通过定期或不定期询问后台服务器得知有新的策略DLL需要更新；又如，网络服务器于网页上呈现出了新的策略DLL等；更新模块15则可相应地从后台服务器或互联网上下载新的策略DLL。处理模块13还与更新模块15连接，处理模块13还用于检查策略DLL是否已被加载，若是，清空下发至监控 驱动模块的监控点，并取消策略DLL的上报回调，在策略DLL调用完毕时，卸载策略DLL，重新加载更新模块15更新的新的策略DLL；若策略DLL未被加载，直接加载更新模块15更新的新的策略DLL。
本实施例的安全防护装置，通过采用上述模块实现安全防护方法与上述相关方法实施例的实现机制相同，详细可以参考上述相关实施例的记载，在此不再赘述。
本实施例的安全防护装置的所有可选技术方案，可以采用可以结合的方式任意组合，形成本发明的可选实施例在此不再一一赘述。
本实施例的安全防护装置，通过上述模块采用动态链接库配置监控策略，可以根据被监控进程的属性、触发监控点的进程的属性以及监控策略中监控点对应的处理策略，对监控点的行为进行处理，处理方式可以根据需求做特殊化处理，因此本实施例的安全防护技术使用非常灵活。
另外，采用本实施例的技术方案，采用动态策略库的形式配置策略文件，当需要新增一些特殊的监控项，可以仅在动态策略库中增加即可，不会导致安全防护软件的主程序的逻辑越来越复杂，使用也非常方便，
再者，采用动态策略库的形式配置策略文件，动态策略库支持动态更新，当有新的策略时，动态链接库可以实时更新，使用非常灵活。
图5是本发明实施例提供的一种终端设备结构示意图。参见图5，该终端设备可以用于实施上述实施例中提供的安全防护方法。具体来讲：该终端设备800可以包括一个或一个以上计算机可读存储介质的存储器120和一个或者一个以上处理器180。其中，存储器120可用于存储软件程序以及模块，处理器180通过运行存储在存储器120的软件程序以及模块，从而执行各种安全防护功能应用以及数据处理。存储器120可包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、 至少一个功能所需的应用程序(比如安全防护程序等)等；存储数据区可存储根据终端设备800的使用所创建的数据等。此外，存储器120可以包括高速随机存取存储器，还可以包括非易失性存储器，例如至少一个磁盘存储器件、闪存器件、或其他易失性固态存储器件。相应地，存储器120还可以包括存储器控制器，以提供处理器180对存储器120的访问。该终端设备可以为手机、服务器、电脑等设备。
在有些应用中，该终端设备800可能还包括通信单元110、输入单元130、显示单元140、传感器150、音频电路160、WiFi(wireless fidelity，无线保真)模块170、以及电源190等部件。本领域技术人员可以理解，图5中示出的终端设备结构并不构成对终端设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。其中：
通信单元110可用于收发信息或通话过程中，信号的接收和发送，该通信单元110可以为RF(Radio Frequency，射频)电路、路由器、调制解调器、等网络通信设备。特别地，当通信单元110为RF电路时，将基站的下行信息接收后，交由一个或者一个以上处理器180处理；另外，将涉及上行的数据发送给基站。通常，作为通信单元的RF电路包括但不限于天线、至少一个放大器、调谐器、一个或多个振荡器、用户身份模块(SIM)卡、收发信机、耦合器、LNA(Low Noise Amplifier，低噪声放大器)、双工器等。此外，通信单元110还可以通过无线通信与网络和其他设备通信。所述无线通信可以使用任一通信标准或协议，包括但不限于GSM(Global System of Mobile communication，全球移动通讯系统)、GPRS(General Packet Radio Service，通用分组无线服务)、CDMA(Code Division Multiple Access，码分多址)、WCDMA(Wideband Code Division Multiple Access,宽带码分多址)、LTE(Long Term Evolution,长期演进)、电子邮件、SMS(Short Messaging Service，短消息服务)等。
输入单元130可用于接收输入的数字或字符信息，以及产生与用户设置以及功能控制有关的键盘、鼠标、操作杆、光学或者轨迹球信号输入。具体地，输入单元130可包括触敏表面131以及其他输入设备132。触敏表面131，也称为触摸显示屏或者触控板，可收集用户在其上或附近的触摸操作(比如用户使用手指、触笔等任何适合的物体或附件在触敏表面131上或在触敏表面131附近的操作)，并根据预先设定的程式驱动相应的连接装置。此外，触敏表面131可包括触摸检测装置和触摸控制器两个部分。其中，触摸检测装置检测用户的触摸方位，并检测触摸操作带来的信号，将信号传送给触摸控制器；触摸控制器从触摸检测装置上接收触摸信息，并将它转换成触点坐标，再送给处理器180，并能接收处理器180发来的命令并加以执行。此外，可以采用电阻式、电容式、红外线以及表面声波等多种类型实现触敏表面131。除了触敏表面131，输入单元130还可以包括其他输入设备132。具体地，其他输入设备132可以包括但不限于物理键盘、功能键(比如音量控制按键、开关按键等)、轨迹球、鼠标、操作杆等中的一种或多种。
显示单元140可用于显示由用户输入的信息或提供给用户的信息以及终端设备800的各种图形用户接口，这些图形用户接口可以由图形、文本、图标、视频和其任意组合来构成。显示单元140可包括显示面板141，或者，可以采用LCD(Liquid Crystal Display，液晶显示器)、OLED(Organic Light-Emitting Diode,有机发光二极管)等形式来配置显示面板141。进一步的，触敏表面131可覆盖显示面板141，当触敏表面131检测到在其上或附近的触摸操作后，传送给处理器180以确定触摸事件的类型，随后处理器180根据触摸事件的类型在显示面板141上提供相应的视觉输出。虽然在图5中，触敏表面131与显示面板141是作为两个独立的部件来实现输入和输入功能，但是在某些实施例中，可以 将触敏表面131与显示面板141集成而实现输入和输出功能。
终端设备800还可包括至少一种传感器150，比如光传感器、运动传感器以及其他传感器。具体地，光传感器可包括环境光传感器及接近传感器，其中，环境光传感器可根据环境光线的明暗来调节显示面板141的亮度，接近传感器可在终端设备800移动到耳边时，关闭显示面板141和/或背光。作为运动传感器的一种，重力加速度传感器可检测各个方向上(一般为三轴)加速度的大小，静止时可检测出重力的大小及方向，可用于识别手机姿态的应用(比如横竖屏切换、相关游戏、磁力计姿态校准)、振动识别相关功能(比如计步器、敲击)等；至于终端设备800还可配置的陀螺仪、气压计、湿度计、温度计、红外线传感器等其他传感器，在此不再赘述。
音频电路160、扬声器161，传声器162可提供用户与终端设备800之间的音频接口。音频电路160可将接收到的音频数据转换后的电信号，传输到扬声器161，由扬声器161转换为声音信号输出；另一方面，传声器162将收集的声音信号转换为电信号，由音频电路160接收后转换为音频数据，再将音频数据输出处理器180处理后，经RF电路110以发送给比如另一终端设备，或者将音频数据输出至存储器120以便进一步处理。音频电路160还可能包括耳塞插孔，以提供外设耳机与终端设备800的通信。
为了实现无线通信，该终端设备上可以配置有无线通信单元170，该无线通信单元170可以为WiFi模块。WiFi属于短距离无线传输技术，终端设备800通过无线通信单元170可以帮助用户收发电子邮件、浏览网页和访问流式媒体等，它为用户提供了无线的宽带互联网访问。虽然图5示出了无线通信单元170，但是可以理解的是，其并不属于终端设备800的必须构成，完全可以根据需要在不改变发明的本质的范围内而 省略。
处理器180是终端设备800的控制中心，利用各种接口和线路连接整个手机的各个部分，通过运行或执行存储在存储器120内的软件程序和/或模块，以及调用存储在存储器120内的数据，执行终端设备800的各种功能和处理数据，从而对手机进行整体监控。其中，处理器180可包括一个或多个处理核心；此外，处理器180可集成应用处理器和调制解调处理器，其中，应用处理器处理操作系统、用户界面和应用程序等，调制解调处理器处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器180中。
电源190(比如电池)用于给各个部件供电，此外，电源可以通过电源管理系统与处理器180逻辑相连，从而通过电源管理系统实现管理充电、放电、以及功耗管理等功能。电源190还可以包括一个或一个以上的直流或交流电源、再充电系统、电源故障检测电路、电源转换器或者逆变器、电源状态指示器等任意组件。
尽管未示出，终端设备800还可以包括摄像头、蓝牙模块等，在此不再赘述。具体在本实施例中，终端设备的显示单元是触摸屏显示器，终端设备还包括有存储器，以及一个或者一个以上的程序，其中一个或者一个以上程序存储于存储器中，且经配置以由一个或者一个以上处理器执行所述一个或者一个以上程序包含用于进行以下操作的指令：遍历策略动态链接库获取监控策略，所述策略动态链接库中包括至少一个监控策略；从所述监控策略中获取被监控进程的监控点；向监控驱动模块下发所述监控点，以供所述监控驱动模块监控所述监控点的行为是否发生；接收所述监控驱动模块的上报消息，所述上报消息为所述监控驱动模块监控到所述监控点的行为发生时发起的；根据所述被监控进程的属性、触发所述监控点的进程的属性以及所述监控策略中所述监控点对应 的处理策略，对所述监控点的行为进行处理。
其中，该存储器还用于存储以下指令：调用所述策略动态链接库的前置回调处理函数获取所述监控点对应的处理策略。
该存储器还可用于存储以下指令：根据所述处理策略判断是否需要对所述监控点的行为进行处理；
当需要对所述监控点的行为进行处理时，判断所述被监控进程的属性是否为受保护进程，若所述被监控进程的属性是不受保护进程，放行所述监控点的行为；否则，若所述被监控进程的属性是受保护进程，进一步判断触发所述监控点的进程的属性是否为不安全进程，若触发所述监控点的进程的属性是不安全进程，阻止所述监控点的行为的发生；否则若触发所述监控点的进程的属性是安全进程，弹出提示框，以询问用户所述监控点的行为如何处理。
此外，该存储器还用于存储以下指令：当不需要对所述监控点的行为进行处理时，放行所述监控点的行为。
进一步地，该存储器还用于存储以下指令：调用所述策略动态链接库的后置回调处理函数获取补充处理策略；并根据所述补充处理策略对触发所述监控点的进程进行补充处理。
所述补充处理策略包括对触发所述监控点的进程进行上报或者分析。
进一步地，该存储器还用于存储以下指令：判断互联网上是否有新的策略动态链接库需要更新；若所述互联网上有新的策略动态链接库需要更新，从所述互联网上下载新的策略动态链接库；
检查所述策略动态链接库是否已被加载，若是，清空下发至所述监控驱动模块的所述监控点，并取消所述策略动态链接库的上报回调，在所述策略动态链接库调用完毕时，卸载所述策略动态链接库，重新加载 所述新的策略动态链接库；若所述策略动态链接库未被加载，直接加载所述新的策略动态链接库。
需要说明的是：上述实施例提供的安全防护装置在安全防护时，仅以上述各功能模块的划分进行举例说明，实际应用中，可以根据需要而将上述功能分配由不同的功能模块完成，即将装置的内部结构划分成不同的功能模块，以完成以上描述的全部或者部分功能。另外，上述实施例提供的安全防护装置与安全防护方法实施例属于同一构思，其具体实现过程详见方法实施例，这里不再赘述。
上述本发明实施例序号仅仅为了描述，不代表实施例的优劣。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本发明的较佳实施例，并不用以限制本发明，凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。

Claims (15)

  1. 一种安全防护方法，其特征在于，所述方法包括：
    遍历策略动态链接库获取监控策略，所述策略动态链接库中包括至少一个监控策略；
    从所述监控策略中获取被监控进程的监控点；
    向监控驱动模块下发所述监控点，以供所述监控驱动模块监控所述监控点的行为是否发生；
    接收所述监控驱动模块的上报消息，所述上报消息为所述监控驱动模块监控到所述监控点的行为发生时发起的；
    根据所述被监控进程的属性、触发所述监控点的进程的属性以及所述监控策略中所述监控点对应的处理策略，对所述监控点的行为进行处理。
  2. 根据权利要求1所述的方法，其特征在于，接收所述监控驱动模块的上报消息之后，根据所述被监控进程的属性、触发所述监控点的进程的属性以及所述监控策略中所述监控点对应的处理策略，对所述监控点的行为进行处理之前，所述方法还包括：调用所述策略动态链接库的前置回调处理函数获取所述监控点对应的处理策略。
  3. 根据权利要求2所述的方法，其特征在于，根据所述被监控进程的属性、触发所述监控点的进程的属性以及所述监控策略中所述监控点对应的处理策略，对所述监控点的行为进行处理，包括：
    根据所述处理策略判断是否需要对所述监控点的行为进行处理；
    当需要对所述监控点的行为进行处理时，判断所述被监控进程的属 性是否为受保护进程，若所述被监控进程的属性是不受保护进程，放行所述监控点的行为；否则，若所述被监控进程的属性是受保护进程，进一步判断触发所述监控点的进程的属性是否为不安全进程，若触发所述监控点的进程的属性是不安全进程，阻止所述监控点的行为的发生；否则若触发所述监控点的进程的属性是安全进程，弹出提示框，以询问用户所述监控点的行为如何处理。
  4. 根据权利要求3所述的方法，其特征在于，所述方法还包括：
    当不需要对所述监控点的行为进行处理时，放行所述监控点的行为。
  5. 根据权利要求1-4任一所述的方法，其特征在于，根据所述被监控进程的属性、触发所述监控点的进程的属性以及所述监控策略中所述监控点对应的处理策略，对所述监控点的行为进行处理之后，所述方法还包括：
    调用所述策略动态链接库的后置回调处理函数获取补充处理策略；
    并根据所述补充处理策略对触发所述监控点的进程进行补充处理。
  6. 根据权利要求5所述的方法，其特征在于，所述补充处理策略包括对触发所述监控点的进程进行上报或者分析。
  7. 根据权利要求6所述的方法，其特征在于，所述方法还包括：
    判断后台服务器或互联网上是否有新的策略动态链接库需要更新；
    若所述后台服务器或互联网上有新的策略动态链接库需要更新，从所述后台服务器或互联网上下载新的策略动态链接库；
    检查所述策略动态链接库是否已被加载，若是，清空下发至所述监控驱动模块的所述监控点，并取消所述策略动态链接库的上报回调，在所述策略动态链接库调用完毕时，卸载所述策略动态链接库，重新加载所述新的策略动态链接库；若所述策略动态链接库未被加载，直接加载所述新的策略动态链接库。
  8. 一种安全防护装置，其特征在于，所述装置包括：
    获取模块，用于遍历策略动态链接库获取监控策略，所述策略动态链接库中包括至少一个监控策略；从所述监控策略中获取被监控进程的监控点；
    下发模块，用于向监控驱动模块下发所述监控点，以供所述监控驱动模块监控所述监控点的行为是否发生；
    接收模块，用于接收所述监控驱动模块的上报消息，所述上报消息为所述监控驱动模块监控到所述监控点的行为发生时发起的；
    处理模块，用于根据所述被监控进程的属性、触发所述监控点的进程的属性以及所述监控策略中所述监控点对应的处理策略，对所述监控点的行为进行处理。
  9. 根据权利要求8所述的装置，其特征在于，所述装置还包括调用模块；
    所述调用模块，用于在接收模块接收所述监控驱动模块的上报消息之后，所述处理模块根据所述被监控进程的属性、触发所述监控点的进程的属性以及所述监控策略中所述监控点对应的处理策略，对所述监控点的行为进行处理之前，调用所述策略动态链接库的前置回调处理函数获取所述监控点对应的处理策略。
  10. 根据权利要求9所述的装置，其特征在于，所述处理模块，具体用于根据所述处理策略判断是否需要对所述监控点的行为进行处理；当需要对所述监控点的行为进行处理时，判断所述被监控进程的属性是否为受保护进程，若所述被监控进程的属性是不受保护进程，放行所述监控点的行为；否则，若所述被监控进程的属性是受保护进程，进一步判断触发所述监控点的进程的属性是否为不安全进程，若触发所述监控点的进程的属性是不安全进程，阻止所述监控点的行为的发生；否则若触发所述监控点的进程的属性是安全进程，弹出提示框，以询问用户所述监控点的行为如何处理。
  11. 根据权利要求10所述的装置，其特征在于，所述处理模块，还用于当不需要对所述监控点的行为进行处理时，放行所述监控点的行为。
  12. 根据权利要求10-11任一所述的装置，其特征在于，所述调用模块，还用于在所述处理模块根据所述被监控进程的属性、触发所述监控点的进程的属性以及所述监控策略中所述监控点对应的处理策略，对所述监控点的行为进行处理之后，调用所述策略动态链接库的后置回调处理函数获取补充处理策略；
    所述处理模块，还用于根据所述补充处理策略对触发所述监控点的进程进行补充处理。
  13. 根据权利要求12所述的装置，其特征在于，所述补充处理策 略包括对触发所述监控点的进程进行上报或者分析。
  14. 根据权利要求13所述的装置，其特征在于，所述装置还包括更新模块；
    所述更新模块，用于判断后台服务器或互联网上是否有新的策略动态链接库需要更新；若所述后台服务器或互联网上有新的策略动态链接库需要更新，从所述后台服务器或互联网上下载新的策略动态链接库。
    所述处理模块，还用于检查所述策略动态链接库是否已被加载，若是，清空下发至所述监控驱动模块的所述监控点，并取消所述策略动态链接库的上报回调，在所述策略动态链接库调用完毕时，卸载所述策略动态链接库，重新加载所述新的策略动态链接库；若所述策略动态链接库未被加载，直接加载所述新的策略动态链接库。
  15. 一种终端，其特征在于，所述终端上设置有如上权利要求8-14任一所述的安全防护装置。
PCT/CN2014/089962 2013-11-26 2014-10-31 安全防护方法及装置、终端 WO2015078264A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310610885.2 2013-11-26
CN201310610885.2A CN103634311B (zh) 2013-11-26 2013-11-26 安全防护方法及装置、终端

Publications (1)

Publication Number Publication Date
WO2015078264A1 true WO2015078264A1 (zh) 2015-06-04

Family

ID=50214938

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/089962 WO2015078264A1 (zh) 2013-11-26 2014-10-31 安全防护方法及装置、终端

Country Status (2)

Country Link
CN (1) CN103634311B (zh)
WO (1) WO2015078264A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103634311B (zh) * 2013-11-26 2016-01-20 腾讯科技（深圳）有限公司 安全防护方法及装置、终端
CN105279433B (zh) * 2014-07-10 2020-10-16 腾讯科技（深圳）有限公司 一种应用程序的防护方法及装置
CN106656668A (zh) * 2016-12-22 2017-05-10 上海斐讯数据通信技术有限公司 一种云终端设备监控方法及系统
CN107204989B (zh) * 2017-06-30 2020-11-10 腾讯科技（深圳）有限公司 广告拦截方法、终端、服务器和存储介质
CN109697360A (zh) * 2018-12-24 2019-04-30 珠海海鸟科技有限公司 一种防监控方法及相关设备
CN112398778B (zh) * 2019-08-12 2022-09-20 北京优特捷信息技术有限公司 一种对模块化环境中的安全问题自动响应的方法
CN112714035A (zh) * 2019-10-25 2021-04-27 中兴通讯股份有限公司 监控方法及系统
CN111338922B (zh) * 2020-03-02 2023-04-11 武汉思普崚技术有限公司 Dll失效的检测方法及装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101777020A (zh) * 2009-12-25 2010-07-14 北京讯鸟软件有限公司 一种用于分布式程序的容错方法和系统
CN102521099A (zh) * 2011-11-24 2012-06-27 深圳市同洲视讯传媒有限公司 一种进程监控方法及进程监控系统
CN103150511A (zh) * 2013-03-18 2013-06-12 珠海市君天电子科技有限公司 一种安全防护系统
CN103218561A (zh) * 2013-03-18 2013-07-24 珠海市君天电子科技有限公司 一种保护浏览器的防篡改方法和装置
CN103634311A (zh) * 2013-11-26 2014-03-12 腾讯科技（深圳）有限公司 安全防护方法及装置、终端

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101123493B (zh) * 2007-09-20 2011-11-09 杭州华三通信技术有限公司 网络接入控制应用系统的安全检查方法及安全策略服务器
CN103019765B (zh) * 2012-11-15 2016-08-03 北京奇虎科技有限公司 一种文件重定向方法、装置和计算机系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101777020A (zh) * 2009-12-25 2010-07-14 北京讯鸟软件有限公司 一种用于分布式程序的容错方法和系统
CN102521099A (zh) * 2011-11-24 2012-06-27 深圳市同洲视讯传媒有限公司 一种进程监控方法及进程监控系统
CN103150511A (zh) * 2013-03-18 2013-06-12 珠海市君天电子科技有限公司 一种安全防护系统
CN103218561A (zh) * 2013-03-18 2013-07-24 珠海市君天电子科技有限公司 一种保护浏览器的防篡改方法和装置
CN103634311A (zh) * 2013-11-26 2014-03-12 腾讯科技（深圳）有限公司 安全防护方法及装置、终端

Also Published As

Publication number Publication date
CN103634311A (zh) 2014-03-12
CN103634311B (zh) 2016-01-20

Similar Documents

Publication Publication Date Title
WO2015078264A1 (zh) 安全防护方法及装置、终端
US9800609B2 (en) Method, device and system for detecting malware in a mobile terminal
US10198573B2 (en) Method, device and computer storage medium for controlling the running of an application
CN106598584B (zh) 一种处理资源文件的方法、装置和系统
US9584476B2 (en) Safety protection method, firewall, terminal device and computer-readable storage medium
CN108932429B (zh) 应用程序的分析方法、终端及存储介质
US11205001B2 (en) Virus program cleanup method, storage medium and electronic terminal
CN106502703B (zh) 一种函数调用方法和装置
CN106529312B (zh) 一种移动终端的权限控制方法、装置及移动终端
WO2015035835A1 (zh) 应用程序检测方法及装置
WO2018024138A1 (zh) 检测恶意网址的方法、装置、终端以及计算机存储介质
WO2018094631A1 (zh) 数据处理的方法及其终端
CN105279433B (zh) 一种应用程序的防护方法及装置
CN107015866B (zh) 一种数据处理方法及装置
WO2015062234A1 (zh) 移动终端资源处理方法、装置和设备
WO2015062240A1 (zh) 一种应用安装的方法、装置和设备
EP2869233B1 (en) Method, device and terminal for protecting application program
EP3129883B1 (en) Method and apparatus for repairing dynamic link library file
US10073957B2 (en) Method and terminal device for protecting application program
US10664436B2 (en) Application acceleration method and application acceleration device
CN104700031B (zh) 防止应用操作中远程代码被执行的方法、装置及系统
WO2019084783A1 (zh) 服务调度方法和装置、计算机设备、计算机可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14865925

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205 DATED 12/10/2016)

122 Ep: pct application non-entry in european phase

Ref document number: 14865925

Country of ref document: EP

Kind code of ref document: A1