WO2017028459A1 - 程序监控方法和装置 - Google Patents

程序监控方法和装置 Download PDF

Info

Publication number
WO2017028459A1
WO2017028459A1 PCT/CN2015/099892 CN2015099892W WO2017028459A1 WO 2017028459 A1 WO2017028459 A1 WO 2017028459A1 CN 2015099892 W CN2015099892 W CN 2015099892W WO 2017028459 A1 WO2017028459 A1 WO 2017028459A1
Authority
WO
WIPO (PCT)
Prior art keywords
program
malicious
target program
operational
target
Prior art date
Application number
PCT/CN2015/099892
Other languages
English (en)
French (fr)
Inventor
易鸿斌
陈唐晖
杨景杰
Original Assignee
安一恒通（北京）科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 安一恒通（北京）科技有限公司 filed Critical 安一恒通（北京）科技有限公司
Publication of WO2017028459A1 publication Critical patent/WO2017028459A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G06F21/563—Static detection by source code analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/568—Computer malware detection or handling, e.g. anti-virus arrangements eliminating virus, restoring damaged files
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/033—Test or assess software

Definitions

  • the present application relates to the field of computer technologies, and in particular, to the field of computer security technologies, and in particular, to a program monitoring method and apparatus.
  • malware has become increasingly rampant and has become a major threat to computer hardware or user data.
  • Internet malicious programs can be spread by means of the network and run on electronic devices that access the network, thereby stealing user information, destroying user data, pushing advertisements or fraudulent information, and possibly affecting the operation of electronic devices, jeopardizing electronic devices.
  • the hardware and software of the device are secure.
  • the purpose of the present application is to propose an improved program monitoring method and apparatus to solve the technical problems mentioned in the background section above.
  • the present application provides a program monitoring method, the method comprising: extracting at least one operating feature of a running target program, wherein the operating feature comprises an operation type and an operation object of an operation performed by the target program Matching each of the extracted operational features with respective operational features in the malicious program operational feature template, wherein The malicious program operation feature template includes a set of operational characteristics of the malicious program; determining, according to the matched matching result, whether the target program is a malicious program or a modified program of the malicious program; if yes, processing the target program .
  • the type of operation comprises at least one of: deleting a file; infecting a file; operating a process; finding and/or closing a security program; collecting sensitive information.
  • the extracting at least one operational characteristic of the running target program comprises: intercepting an operation performed by the target program; extracting at least one operational feature based on the intercepting the operation.
  • the determining, according to the matching result of the matching, whether the target program is a malicious program or a modified program of a malicious program comprising: determining whether the extracted each operating feature and the malicious program operating feature template More than the first predetermined number of operational characteristics are matched; if the determination is yes, it is determined that the target program is a malicious program.
  • the determining, according to the matching result of the matching, whether the target program is a malware program or a modification program of the malicious program further comprising: if the determination result is no, further determining the extracted operation features. Whether to match the second predetermined number of operational features in the malicious program operation feature template, wherein the second predetermined number is less than the first predetermined number; if the determination result is yes, determining that the target program is malicious The program's morphing program.
  • the method before the extracting the at least one operational feature of the running target program, the method further comprises: running the target program in a virtual environment.
  • the processing of the target program includes at least one of: clearing the target program; giving a warning or prompt associated with the target program.
  • the present application provides a program monitoring apparatus, the apparatus comprising: an extracting unit configured to extract at least one operating feature of a running target program, wherein the operating feature comprises an operation performed by the target program The operation type and the operation object; the matching unit is configured to match each of the extracted operation features with each of the operation features of the malicious program operation feature template, wherein the malicious program operation feature template includes an operation feature of the malicious program a unit that is configured to be based on the match a matching result, determining whether the target program is a malformed program of a malicious program or a malicious program; and a processing unit configured to: if the determining unit determines that the target program is a malicious program or a modified program of a malicious program, The program handles it.
  • the type of operation comprises at least one of: deleting a file; infecting a file; operating a process; finding and/or closing a security program; collecting sensitive information.
  • the extracting unit is further configured to: intercept an operation performed by the target program; extract at least one operational feature based on the intercepting the operation.
  • the determining unit is further configured to: determine whether the extracted respective operating features match the first predetermined number of operating features in the malicious program operating feature template; if the determination result is yes, It is determined that the target program is a malicious program.
  • the determining unit is further configured to: if the determination result is no, further determine whether the extracted respective operation features match the second predetermined number of operational features in the malicious program operation feature template And wherein the second predetermined number is smaller than the first predetermined number; if the determination result is yes, determining that the target program is a modified program of a malicious program.
  • the apparatus further includes an execution unit configured to run the target program in a virtual environment.
  • the processing unit is further configured to: clear the target program; and/or, present a warning or prompt associated with the target program.
  • the program monitoring method and apparatus provided by the present application firstly extracts at least one operational feature of a running target program, and then matches each extracted operational feature with each operational feature in the malicious program operational feature template, and then based on the The matching matching result is used to determine whether the target program is a malformed program of a malicious program or a malicious program, and if the determination is YES, the target program is processed, and effective monitoring of the malicious program and its deformed program is realized.
  • 1 is an exemplary system architecture of an embodiment of a program monitoring method or program monitoring device to which the present application can be applied;
  • FIG. 2 is a flow chart of one embodiment of a program monitoring method in accordance with the present application.
  • FIG. 3 is a flow chart of still another embodiment of a program monitoring method according to the present application.
  • FIG. 4 is a schematic structural diagram of an embodiment of a program monitoring apparatus according to the present application.
  • FIG. 5 is a schematic structural diagram of a computer system suitable for implementing a terminal device or a server of an embodiment of the present application.
  • FIG. 1 illustrates an exemplary system architecture 100 in which an embodiment of a program monitoring method or program monitoring device of the present application may be applied.
  • system architecture 100 can include terminal devices 101, 102, 103, network 104, and server 105.
  • the network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105.
  • Network 104 may include various types of connections, such as wired, wireless communication links, fiber optic cables, and the like.
  • the user can interact with the server 105 over the network 104 using the terminal devices 101, 102, 103 to receive or transmit messages and the like.
  • Various communication client applications such as anti-malware programs (such as anti-virus) applications, document management applications, search applications, email clients, social platform software, etc., can be installed on the terminal devices 101, 102, and 103.
  • the terminal devices 101, 102, 103 may be various electronic devices, including but not limited to smart phones, tablets, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III, motion picture expert compression standard audio layer 3) , MP4 (Moving Picture Experts Group Audio Layer IV, dynamic image expert compression standard Quasi-audio level 4) Players, laptops and desktop computers, etc.
  • MP3 players Moving Picture Experts Group Audio Layer III, motion picture expert compression standard audio layer 3
  • MP4 Moving Picture Experts Group Audio Layer IV, dynamic image expert compression standard Quasi-audio level 4
  • Players laptops and desktop computers, etc.
  • the server 105 may be a server that provides various services, such as a background processing server that provides support for anti-malware application (such as anti-virus software) on the terminal devices 101, 102, 103.
  • the background processing server may store, analyze, and the like data (such as computer virus/malicious program related data) received from the terminal device, and feed back the processing result to the terminal device.
  • the program monitoring method provided by the embodiment of the present application may be performed by the terminal device 101, 102, and 103 (in this case, an anti-malware application such as anti-virus software may be pre-installed on the terminal device), or It can be executed by the server 105.
  • the program monitoring device can be installed in the terminal device 101, 102, 103 or in the server 105.
  • terminal devices, networks, and servers in Figure 1 is merely illustrative. Depending on the implementation needs, there can be any number of terminal devices, networks, and servers.
  • the program monitoring method includes the following steps:
  • Step 201 Extract at least one operational feature of the running target program.
  • the electronic device on which the program monitoring method runs may extract at least one operational feature of the running target program.
  • the operational characteristics of the target program may include an operation type and an operation object of an operation performed by the target program.
  • the above operation types may generally include, but are not limited to, deleting a file, for example, deleting a registry file of an anti-virus software, and deleting, for example, a ".gho" format ghost (a commercially available hard disk backup and restore tool) backup file; infecting a file, For example, in order to run its own code, a computer virus or malicious program attaches itself to a legitimate executable file to infect the file; operational processes, such as ending the anti-virus software process; finding and/or closing security programs, such as shutting down anti-virus software.
  • Collect sensitive information such as collecting user accounts and password information for electronic devices.
  • the above operation object can be a specific file, or it can be a running process/thread.
  • the electronic device may extract the operation feature of the target program by intercepting the operation of the target program, and may specifically perform the following steps: First, intercept the operation performed by the target program.
  • Step 202 Match each of the extracted operation features with each of the operational features in the malicious program operation feature template.
  • the electronic device on which the program monitoring method runs may further operate the extracted operation features one by one with the malicious program.
  • Each operational feature in the feature template is matched.
  • the malicious program operation feature template is used to describe or describe a malicious program, which specifically includes a set of operational characteristics of the malicious program.
  • a malicious program operation feature template can be used for description.
  • the malicious program operation feature template may further include a name and description of the malicious program, and the operation features of the corresponding malicious program included in the template may be subjected to prior manual analysis and/or analysis of the malicious program (or computer virus). Automatic analysis to get.
  • the operational features included in the malware operational feature template can also be updated in various ways, such as by networking with a back-end support server.
  • the malicious program operation feature template may be saved as an XML (Extensible Markup Language) file, and after the XML file is read into the memory, the program monitoring method may read the recorded file.
  • XML Extensible Markup Language
  • Step 203 Determine, according to the matching result of the matching, whether the target program is a malicious program or a modified program of the malicious program.
  • the electronic device on which the program monitoring method runs may determine whether the target program is a malicious program or a modified program of the malicious program based on the matching result obtained in step 202.
  • the malformed program of the malicious program refers to a program that processes the malicious program by an algorithm (for example, changing the length of the malicious program, content, and the like) so that the changed program is changed.
  • an algorithm for example, changing the length of the malicious program, content, and the like
  • Step 204 if yes, processing the target program.
  • the electronic device on which the program monitoring method runs may process the target program.
  • the electronic device may directly clear the target program; or may also give the user a warning or prompt related to the target program.
  • the morphing program of whether the target program is a malicious program or a malicious program may be determined in step 203 as follows:
  • a program is a variant of a malicious program.
  • the second predetermined number is smaller than the first predetermined number, and the number may be set by default, or may be manually set by a technician.
  • the scenario of the application may be: the user presets the malicious program operation feature template for various malicious programs; after that, at least one operation feature of the target program running in the system is extracted, and the malicious Comparing the various operational features set in the program operation feature template; if it is determined according to the comparison result that the target program is a malformed program of a malicious program or a malicious program, subsequent processing of the target program is performed to eliminate/prevent potential danger .
  • the method provided by the above embodiment of the present application achieves reliable monitoring of malicious programs and their deformed programs by extracting and analyzing the operational characteristics of the target program.
  • the process 300 of the program monitoring method includes the following steps:
  • step 301 the target program is run in the virtual environment.
  • the target program when the target program starts running, it may be judged according to its signature information whether it is an unknown program, and if so, the target program is run in a virtual environment (for example, a sandbox).
  • a virtual environment for example, a sandbox
  • sandbox is a dynamic protection technology suitable for computer security. It mainly provides an isolated and virtual running platform, so that the program can run normally in the virtualized environment without other other Partially has any effect. It should be noted that the sandbox technology described above is a well-known technology widely studied and applied at present, and will not be described herein.
  • Step 302 extracting at least one operational feature of the running target program.
  • the electronic device on which the program monitoring method runs may extract at least one operational feature of the target program running in the virtual environment.
  • the operational characteristics of the target program may include an operation type and an operation object of an operation performed by the target program.
  • Step 303 Match each of the extracted operation features with each operation feature in the malicious program operation feature template.
  • the electronic device on which the program monitoring method runs may further operate the extracted operation features one by one with the malicious program.
  • Each operational feature in the feature template is matched.
  • the malicious program operation feature template is used to describe or describe a malicious program, which specifically includes a set of operational characteristics of the malicious program.
  • Step 304 Determine, according to the matching result of the matching, whether the target program is a malicious program or a modified program of the malicious program.
  • the electronic device may determine, according to the matching result obtained in step 303, whether the target program is a malicious program or a modified program of the malicious program.
  • Step 305 if yes, processing the target program.
  • the electronic device may process the target program.
  • the above electronic device may directly clear the target program; or may The user gives a warning or prompt related to the above target program.
  • the step 302, the step 303, the step 304, and the step 305 in the foregoing implementation process are substantially the same as the step 201, the step 202, the step 203, and the step 204 in the foregoing embodiment, and details are not described herein again.
  • the flow 300 of the program monitoring method in this embodiment is more than the step 301 of running the target program in the virtual environment.
  • the scheme described in this embodiment can more securely monitor the malicious program and its variant program.
  • the present application provides an embodiment of a program monitoring apparatus, and the apparatus embodiment corresponds to the method embodiment shown in FIG. Used in a variety of electronic devices.
  • the program monitoring apparatus 400 described in this embodiment includes an extracting unit 401, a matching unit 402, a determining unit 403, and a processing unit 404.
  • the extracting unit 401 is configured to extract at least one operating feature of the running target program, wherein the operating feature includes an operation type and an operation object of the operation performed by the target program, and the matching unit 402 is configured to use the extracted operations.
  • the feature is matched with each of the operational features in the malicious program operation feature template, where the malicious program operation feature template includes a set of operational features of the malicious program; the determining unit 403 is configured to determine the target based on the matching result of the matching Whether the program is a malformed program of a malicious program or a malicious program; and the processing unit 404 is configured to process the target program if the determining unit 403 determines that the target program is a modified program of a malicious program or a malicious program.
  • the extracting unit 401 of the program monitoring apparatus 400 can extract at least one operational feature of the running target program.
  • the operational characteristics of the target program may include an operation type and an operation object of an operation performed by the target program.
  • the matching unit 402 of the program monitoring device 400 may further extract the extracted operation features one by one with the malicious program operation feature template.
  • the individual operational features in the match are matched.
  • the malicious program operation feature template is used for malicious programs. Description or description, which specifically includes a collection of operational characteristics of a malicious program.
  • the determining unit 403 may determine whether the target program is a malicious program or a modified program of the malicious program based on the matching result generated by the matching unit 402. If the above determining unit 403 determines that the target program is a malicious program or a modified program of the malicious program, the processing unit 404 of the program monitoring device 400 can process the target program. As an example, the processing unit 404 described above may directly clear the target program described above; or may also give the user a warning or prompt related to the target program.
  • program monitoring apparatus 400 also includes some other well-known structures, such as processors, memories, etc., which are not shown in FIG. 4 in order to unnecessarily obscure the embodiments of the present disclosure.
  • FIG. 5 there is shown a block diagram of a computer system 500 suitable for use in implementing a terminal device or server of an embodiment of the present application.
  • computer system 500 includes a central processing unit (CPU) 501 that can be loaded into a program in random access memory (RAM) 503 according to a program stored in read only memory (ROM) 502 or from storage portion 508. And perform various appropriate actions and processes.
  • RAM random access memory
  • ROM read only memory
  • RAM 503 various programs and data required for the operation of the system 500 are also stored.
  • the CPU 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504.
  • An input/output (I/O) interface 505 is also coupled to bus 504.
  • the following components are connected to the I/O interface 505: an input portion 506 including a keyboard, a mouse, etc.; an output portion 507 including, for example, a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a storage portion 508 including a hard disk or the like. And a communication portion 509 including a network interface card such as a LAN card, a modem, or the like. The communication section 509 performs communication processing via a network such as the Internet.
  • Driver 510 is also coupled to I/O interface 505 as needed.
  • a removable medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory or the like is mounted on the drive 510 as needed so that a computer program read therefrom is installed into the storage portion 508 as needed.
  • an embodiment of the present disclosure includes a computer program product comprising a computer program tangibly embodied on a machine readable medium,
  • the computer program contains program code for executing the method shown in the flowchart.
  • the computer program can be downloaded and installed from the network via the communication portion 509, and/or installed from the removable medium 511.
  • each block of the flowchart or block diagrams can represent a module, a program segment, or a portion of code that includes one or more logic for implementing the specified.
  • Functional executable instructions can also occur in a different order than that illustrated in the drawings. For example, two successively represented blocks may in fact be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending upon the functionality involved.
  • each block of the block diagrams and/or flowcharts, and combinations of blocks in the block diagrams and/or flowcharts can be implemented in a dedicated hardware-based system that performs the specified function or operation. Or it can be implemented by a combination of dedicated hardware and computer instructions.
  • the units involved in the embodiments of the present application may be implemented by software or by hardware.
  • the described unit may also be provided in a processor, for example, as a processor including an extracting unit, a matching unit, a determining unit, and a processing unit.
  • the names of these units do not constitute a limitation on the unit itself in some cases, for example, the extraction unit may also be described as "a unit for extracting at least one operational feature of the target program in operation".
  • the present application further provides a computer readable storage medium, which may be a computer readable storage medium included in the apparatus described in the foregoing embodiment, or may exist separately, not A computer readable storage medium that is assembled into a terminal.
  • the computer readable storage medium stores one or more programs that are used by one or more processors to perform the program monitoring methods described in this application.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Virology (AREA)
  • General Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Debugging And Monitoring (AREA)

Abstract

提供一种程序监控方法和装置，该方法包括：提取运行中的目标程序的至少一个操作特征，其中所述操作特征包括所述目标程序所执行操作的操作类型和操作对象；将所提取的各个操作特征与恶意程序操作特征模板中的各个操作特征进行匹配，其中所述恶意程序操作特征模板包括了恶意程序的操作特征的集合；基于所述匹配的匹配结果，确定所述目标程序是否是恶意程序或者恶意程序的变形程序；如果是，则对所述目标程序进行处理。该方法实现了对恶意程序及其变形程序的有效监控。

Description

程序监控方法和装置
相关申请的交叉引用
本申请要求于2015年08月18日提交的中国专利申请号为“201510508253.4”的优先权，其全部内容作为整体并入本申请中。
技术领域
本申请涉及计算机技术领域，具体涉及计算机安全技术领域，尤其涉及程序监控方法和装置。
背景技术
随着计算机技术尤其是互联网技术的发展，恶意程序(Malware)也日益泛滥，成为了对计算机硬件或者用户数据的重大威胁。例如，互联网恶意程序可以借助于网络进行传播，并运行于接入网络的电子设备之上，从而窃取用户信息、破坏用户数据、推送广告或欺诈信息，并且还可能影响电子设备的运行，危害电子设备的软硬件安全。
现有的针对恶意程序的监控技术通常基于恶意程序(例如计算机病毒)的特征码来查杀恶意程序。然而，存在着恶意程序及其变形程序(例如计算机病毒变种)通过加壳、免杀等技术手段来逃避基于特征码的恶意程序查杀引擎的扫描和检测的问题。
发明内容
本申请的目的在于提出一种改进的程序监控方法和装置，来解决以上背景技术部分提到的技术问题。
第一方面，本申请提供了一种程序监控方法，所述方法包括：提取运行中的目标程序的至少一个操作特征，其中所述操作特征包括所述目标程序所执行操作的操作类型和操作对象；将所提取的各个操作特征与恶意程序操作特征模板中的各个操作特征进行匹配，其中所述 恶意程序操作特征模板包括了恶意程序的操作特征的集合；基于所述匹配的匹配结果，确定所述目标程序是否是恶意程序或者恶意程序的变形程序；如果是，则对所述目标程序进行处理。
在一些实施例中，所述操作类型包括以下至少一项：删除文件；感染文件；操作进程；寻找和/或关闭安全程序；收集敏感信息。
在一些实施例中，所述提取运行中的目标程序的至少一个操作特征，包括：拦截所述目标程序所执行的操作；基于拦截的所述操作，提取至少一个操作特征。
在一些实施例中，所述基于所述匹配的匹配结果，确定所述目标程序是否是恶意程序或者恶意程序的变形程序，包括：判断所提取的各个操作特征是否与所述恶意程序操作特征模板中超过第一预定数目的操作特征相匹配；如果判断结果为是，则确定所述目标程序是恶意程序。
在一些实施例中，所述基于所述匹配的匹配结果，确定所述目标程序是否是恶意程序或者恶意程序的变形程序，还包括：如果判断结果为否，则进一步判断所提取的各个操作特征是否与所述恶意程序操作特征模板中超过第二预定数目的操作特征相匹配，其中所述第二预定数目小于所述第一预定数目；如果判断结果为是，则确定所述目标程序是恶意程序的变形程序。
在一些实施例中，所述提取运行中的目标程序的至少一个操作特征之前，还包括：在虚拟环境中运行所述目标程序。
在一些实施例中，所述对所述目标程序进行处理，包括以下操作中的至少一项：清除所述目标程序；给出与所述目标程序相关的警告或提示。
第二方面，本申请提供了一种程序监控装置，所述装置包括：提取单元，配置用于提取运行中的目标程序的至少一个操作特征，其中所述操作特征包括所述目标程序所执行操作的操作类型和操作对象；匹配单元，配置用于将所提取的各个操作特征与恶意程序操作特征模板中的各个操作特征进行匹配，其中所述恶意程序操作特征模板包括了恶意程序的操作特征的集合；确定单元，配置用于基于所述匹配的 匹配结果，确定所述目标程序是否是恶意程序或者恶意程序的变形程序；处理单元，配置用于如果所述确定单元确定所述目标程序是恶意程序或者恶意程序的变形程序，则对所述目标程序进行处理。
在一些实施例中，所述操作类型包括以下至少一项：删除文件；感染文件；操作进程；寻找和/或关闭安全程序；收集敏感信息。
在一些实施例中，所述提取单元进一步配置用于：拦截所述目标程序所执行的操作；基于拦截的所述操作，提取至少一个操作特征。
在一些实施例中，所述确定单元进一步配置用于：判断所提取的各个操作特征是否与所述恶意程序操作特征模板中超过第一预定数目的操作特征相匹配；如果判断结果为是，则确定所述目标程序是恶意程序。
在一些实施例中，所述确定单元进一步配置用于：如果判断结果为否，则进一步判断所提取的各个操作特征是否与所述恶意程序操作特征模板中超过第二预定数目的操作特征相匹配，其中所述第二预定数目小于所述第一预定数目；如果判断结果为是，则确定所述目标程序是恶意程序的变形程序。
在一些实施例中，所述装置还包括：运行单元，配置用于在虚拟环境中运行所述目标程序。
在一些实施例中，所述处理单元进一步配置用于：清除所述目标程序；和/或，给出与所述目标程序相关的警告或提示。
本申请提供的程序监控方法和装置，通过首先提取运行中的目标程序的至少一个操作特征，之后将所提取的各个操作特征与恶意程序操作特征模板中的各个操作特征进行匹配，再基于所述匹配的匹配结果来确定上述目标程序是否是恶意程序或者恶意程序的变形程序并且在确定为是的情况下对上述目标程序进行处理，实现了对恶意程序及其变形程序的有效监控。
附图说明
通过阅读参照以下附图所作的对非限制性实施例所作的详细描述，本申请的其它特征、目的和优点将会变得更明显：
图1是可以应用本申请的程序监控方法或程序监控装置的实施例的示例性系统架构；
图2是根据本申请的程序监控方法的一个实施例的流程图；
图3是根据本申请的程序监控方法的又一个实施例的流程图；
图4是根据本申请的程序监控装置的一个实施例的结构示意图；
图5是适于用来实现本申请实施例的终端设备或服务器的计算机系统的结构示意图。
具体实施方式
下面结合附图和实施例对本申请作进一步的详细说明。可以理解的是，此处所描述的具体实施例仅仅用于解释相关发明，而非对该发明的限定。另外还需要说明的是，为了便于描述，附图中仅示出了与有关发明相关的部分。
需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。下面将参考附图并结合实施例来详细说明本申请。
图1示出了可以应用本申请的程序监控方法或程序监控装置的实施例的示例性系统架构100。
如图1所示，系统架构100可以包括终端设备101、102、103，网络104和服务器105。网络104用以在终端设备101、102、103和服务器105之间提供通信链路的介质。网络104可以包括各种连接类型，例如有线、无线通信链路或者光纤电缆等等。
用户可以使用终端设备101、102、103通过网络104与服务器105交互，以接收或发送消息等。终端设备101、102、103上可以安装有各种通讯客户端应用，例如防恶意程序(例如防计算机病毒)类应用、文档管理类应用、搜索类应用、邮箱客户端、社交平台软件等。
终端设备101、102、103可以是各种电子设备，包括但不限于智能手机、平板电脑、电子书阅读器、MP3播放器(Moving Picture Experts Group Audio Layer III，动态影像专家压缩标准音频层面3)、MP4(Moving Picture Experts Group Audio Layer IV，动态影像专家压缩标 准音频层面4)播放器、膝上型便携计算机和台式计算机等等。
服务器105可以是提供各种服务的服务器，例如对终端设备101、102、103上的防恶意程序类应用(例如杀毒软件)等提供支持的后台处理服务器。后台处理服务器可以对从终端设备接收到的数据(例如计算机病毒/恶意程序相关数据)进行存储、分析等处理，并将处理结果反馈给终端设备。
需要说明的是，本申请实施例所提供的程序监控方法可以由终端设备101、102、103执行(这时可以在终端设备上预先安装诸如杀毒软件之类的防恶意程序类应用)，或者也可以由服务器105执行。相应地，程序监控装置可以设置于终端设备101、102、103中，也可以设置于服务器105中。
应该理解，图1中的终端设备、网络和服务器的数目仅仅是示意性的。根据实现需要，可以具有任意数目的终端设备、网络和服务器。
继续参考图2，示出了根据本申请的程序监控方法的一个实施例的流程200。所述的程序监控方法，包括以下步骤：
步骤201，提取运行中的目标程序的至少一个操作特征。
在本实施例中，程序监控方法运行于其上的电子设备可以对运行中的目标程序的至少一个操作特征进行提取。
其中，上述目标程序的操作特征可以包括该目标程序所执行操作的操作类型和操作对象。上述操作类型通常可以包括但不限于：删除文件，例如，删除杀毒软件的注册表文件，再例如删除“.gho”格式的ghost(一种市售的硬盘备份还原工具)备份文件；感染文件，例如，为了运行其自身的代码，计算机病毒或者恶意程序将自己附着在合法的可执行文件上从而感染该文件；操作进程，例如结束杀毒软件进程；寻找和/或关闭安全程序，例如关闭杀毒软件；收集敏感信息，例如收集电子设备的用户账号、密码信息。而上述操作对象可以是具体的文件，也可以是运行中的进程/线程。
在本实施例的一些可选的实现方式中，上述电子设备可以通过对目标程序的操作进行拦截的方式来提取目标程序的操作特征，具体可以如下进行：首先，拦截该目标程序所执行的操作，作为示例，可以 先自定义一个拦截处理函数，再将目标程序执行操作所利用的函数的地址重定向到自定义的拦截处理函数，即可实现对相应操作的拦截；之后，基于拦截的目标程序的操作，提取至少一个操作特征。
步骤202，将所提取的各个操作特征与恶意程序操作特征模板中的各个操作特征进行匹配。
在本实施例中，通过上述步骤201提取出运行中的目标程序的至少一个操作特征之后，程序监控方法运行于其上的电子设备可以进一步地将所提取的这些操作特征逐一地与恶意程序操作特征模板中的各个操作特征进行匹配。
在这里，恶意程序操作特征模板用于对恶意程序进行描述或者说明，其具体包括了恶意程序的操作特征的集合。可选地，对于每种类型的恶意程序(或者计算机病毒)，可以用一个恶意程序操作特征模板来进行描述。这时，该恶意程序操作特征模板还可以包括恶意程序的名称和说明，而该模板所包括的相应恶意程序的操作特征，可以通过对恶意程序(或者计算机病毒)进行预先的人工分析和/或自动分析来获取。并且，还可以通过各种方式(例如借助于与后台支持服务器的联网)来对该恶意程序操作特征模板所包括的操作特征进行更新。
在实践中，可以将上述恶意程序操作特征模板保存为XML(Extensible Markup Language，可扩展标记语言)文件，在将该XML文件读取进内存后，上述程序监控方法就可以读取其所记录的各条操作特征。
步骤203，基于匹配的匹配结果，确定目标程序是否是恶意程序或者恶意程序的变形程序。
在本实施例中，程序监控方法运行于其上的电子设备可以基于步骤202得到的匹配结果，来确定目标程序是否是恶意程序或者恶意程序的变形程序。其中，恶意程序的变形程序是指通过某种算法对恶意程序进行处理(例如改变恶意程序的长度、内容之类的处理)使得其发生变化后的程序。作为示例，如果所提取的上述目标程序的各个操作特征都能与上述恶意程序操作特征模板中记录的某条操作特征相匹配，则可以确定上述目标程序就是恶意程序。
步骤204，如果是，则对目标程序进行处理。
在本实施例中，如果基于步骤203确定出目标程序是恶意程序或者恶意程序的变形程序，程序监控方法运行于其上的电子设备可以对该目标程序进行处理。
作为示例，上述电子设备可以直接清除上述目标程序；或者还可以向用户给出与上述目标程序相关的警告或提示。
在本实施例的一些可选的实现方式中，还可以通过如下方式来在步骤203中确定目标程序是恶意程序还是恶意程序的变形程序：
首先，判断所提取的各个操作特征是否与恶意程序操作特征模板中超过第一预定数目的操作特征相匹配；如果判断结果为是，则确定所述目标程序是恶意程序。
而如果上述判断的结果为否，则还将进一步判断所提取的各个操作特征是否与上述恶意程序操作特征模板中超过第二预定数目的操作特征相匹配；如果判断结果为是，则确定上述目标程序是恶意程序的变形程序。
其中，第二预定数目小于第一预定数目，且这这种数目可以是缺省设置的，也可以是由技术人员手动设置的。
对于本申请的上述实施例，应用的场景可以为：用户针对各种恶意程序，预先设置了恶意程序操作特征模板；之后，系统中运行的目标程序的至少一个操作特征被提取，并且与上述恶意程序操作特征模板中设置的各个操作特征进行比较；如果根据比较结果，确定上述目标程序是恶意程序或者恶意程序的变形程序，则将会对上述目标程序进行后继处理以消除/防止潜在的危险性。
本申请的上述实施例提供的方法通过对目标程序的操作特征的提取和分析，实现了对恶意程序及其变形程序的可靠监控。
进一步参考图3，其示出了程序监控方法的又一个实施例的流程300。该程序监控方法的流程300，包括以下步骤：
步骤301，在虚拟环境中运行目标程序。
在本实施例中，对于需要被监控的目标程序，由于事先可能无法 确定其是不是恶意程序或者恶意程序的变形程序，因此，一种稳妥的做法是在虚拟环境(例如沙箱)中运行上述目标程序。
作为一种实现方式，可以在上述目标程序开始运行时，根据其签名信息判断其是否是未知程序，如果是，则在虚拟环境(例如沙箱)中运行上述目标程序。
其中，沙箱是一种适用于计算机安全领域的动态防护技术，其主要通过提供一个隔离、虚拟的运行平台，使程序能够正常运行在该虚拟化环境中，而不会对该计算机系统的其他部分产生任何影响。需要说明的是，上述沙箱技术是目前广泛研究和应用的公知技术，在此不再赘述。
步骤302，提取运行中的目标程序的至少一个操作特征。
在本实施例中，程序监控方法运行于其上的电子设备可以对虚拟环境中运行的目标程序的至少一个操作特征进行提取。其中，上述目标程序的操作特征可以包括该目标程序所执行操作的操作类型和操作对象。
步骤303，将所提取的各个操作特征与恶意程序操作特征模板中的各个操作特征进行匹配。
在本实施例中，通过上述步骤302提取出运行中的目标程序的至少一个操作特征之后，程序监控方法运行于其上的电子设备可以进一步地将所提取的这些操作特征逐一地与恶意程序操作特征模板中的各个操作特征进行匹配。在这里，恶意程序操作特征模板用于对恶意程序进行描述或者说明，其具体包括了恶意程序的操作特征的集合。
步骤304，基于匹配的匹配结果，确定目标程序是否是恶意程序或者恶意程序的变形程序。
在本实施例中，上述电子设备可以基于步骤303得到的匹配结果，来确定目标程序是否是恶意程序或者恶意程序的变形程序。
步骤305，如果是，则对目标程序进行处理。
在本实施例中，如果基于步骤304确定出目标程序是恶意程序或者恶意程序的变形程序，则上述电子设备可以对该目标程序进行处理。作为示例，上述电子设备可以直接清除上述目标程序；或者还可以向 用户给出与上述目标程序相关的警告或提示。
在本实施例中，上述实现流程中的步骤302、步骤303、步骤304和步骤305分别与前述实施例中的步骤201、步骤202、步骤203和步骤204基本相同，在此不再赘述。
从图3中可以看出，与图2对应的实施例主要的不同点是，本实施例中的程序监控方法的流程300多出了在虚拟环境中运行目标程序的步骤301。通过增加的步骤301，本实施例描述的方案可以更加安全地监控恶意程序及其变形程序。
进一步参考图4，作为对上述各图所示方法的实现，本申请提供了一种程序监控装置的一个实施例，该装置实施例与图2所示的方法实施例相对应，该装置具体可以应用于各种电子设备中。
如图4所示，本实施例所述的程序监控装置400包括：提取单元401，匹配单元402，确定单元403和处理单元404。其中，提取单元401配置用于提取运行中的目标程序的至少一个操作特征，其中上述操作特征包括上述目标程序所执行操作的操作类型和操作对象；匹配单元402配置用于将所提取的各个操作特征与恶意程序操作特征模板中的各个操作特征进行匹配，在这里，上述恶意程序操作特征模板包括了恶意程序的操作特征的集合；确定单元403配置用于基于上述匹配的匹配结果，确定上述目标程序是否是恶意程序或者恶意程序的变形程序；而处理单元404配置用于如果上述确定单元403确定上述目标程序是恶意程序或者恶意程序的变形程序，则对上述目标程序进行处理。
在本实施例中，程序监控装置400的提取单元401可以对运行中的目标程序的至少一个操作特征进行提取。其中，上述目标程序的操作特征可以包括该目标程序所执行操作的操作类型和操作对象。
在本实施例中，通过提取单元401提取出运行中的目标程序的至少一个操作特征之后，程序监控装置400的匹配单元402可以进一步地将所提取的这些操作特征逐一地与恶意程序操作特征模板中的各个操作特征进行匹配。在这里，恶意程序操作特征模板用于对恶意程序 进行描述或者说明，其具体包括了恶意程序的操作特征的集合。
在本实施例中，确定单元403可以基于匹配单元402生成的匹配结果，来确定目标程序是否是恶意程序或者恶意程序的变形程序。如果上述确定单元403确定出目标程序是恶意程序或者恶意程序的变形程序，则程序监控装置400的处理单元404可以对该目标程序进行处理。作为示例，上述处理单元404可以直接清除上述目标程序；或者还可以向用户给出与上述目标程序相关的警告或提示。
本领域技术人员可以理解，上述程序监控装置400还包括一些其他公知结构，例如处理器、存储器等，为了不必要地模糊本公开的实施例，这些公知的结构在图4中未示出。
下面参考图5，其示出了适于用来实现本申请实施例的终端设备或服务器的计算机系统500的结构示意图。
如图5所示，计算机系统500包括中央处理单元(CPU)501，其可以根据存储在只读存储器(ROM)502中的程序或者从存储部分508加载到随机访问存储器(RAM)503中的程序而执行各种适当的动作和处理。在RAM 503中，还存储有系统500操作所需的各种程序和数据。CPU 501、ROM 502以及RAM 503通过总线504彼此相连。输入/输出(I/O)接口505也连接至总线504。
以下部件连接至I/O接口505：包括键盘、鼠标等的输入部分506；包括诸如阴极射线管(CRT)、液晶显示器(LCD)等以及扬声器等的输出部分507；包括硬盘等的存储部分508；以及包括诸如LAN卡、调制解调器等的网络接口卡的通信部分509。通信部分509经由诸如因特网的网络执行通信处理。驱动器510也根据需要连接至I/O接口505。可拆卸介质511，诸如磁盘、光盘、磁光盘、半导体存储器等等，根据需要安装在驱动器510上，以便于从其上读出的计算机程序根据需要被安装入存储部分508。
特别地，根据本公开的实施例，上文参考流程图描述的过程可以被实现为计算机软件程序。例如，本公开的实施例包括一种计算机程序产品，其包括有形地包含在机器可读介质上的计算机程序，所述计 算机程序包含用于执行流程图所示的方法的程序代码。在这样的实施例中，该计算机程序可以通过通信部分509从网络上被下载和安装，和/或从可拆卸介质511被安装。
附图中的流程图和框图，图示了按照本申请各种实施例的系统、方法和计算机程序产品的可能实现的体系架构、功能和操作。在这点上，流程图或框图中的每个方框可以代表一个模块、程序段、或代码的一部分，所述模块、程序段、或代码的一部分包含一个或多个用于实现规定的逻辑功能的可执行指令。也应当注意，在有些作为替换的实现中，方框中所标注的功能也可以以不同于附图中所标注的顺序发生。例如，两个接连地表示的方框实际上可以基本并行地执行，它们有时也可以按相反的顺序执行，这依所涉及的功能而定。也要注意的是，框图和/或流程图中的每个方框、以及框图和/或流程图中的方框的组合，可以用执行规定的功能或操作的专用的基于硬件的系统来实现，或者可以用专用硬件与计算机指令的组合来实现。
描述于本申请实施例中所涉及到的单元可以通过软件的方式实现，也可以通过硬件的方式来实现。所描述的单元也可以设置在处理器中，例如，可以描述为：一种处理器包括提取单元、匹配单元、确定单元和处理单元。其中，这些单元的名称在某种情况下并不构成对该单元本身的限定，例如，提取单元还可以被描述为“用于提取运行中的目标程序的至少一个操作特征的单元”。
作为另一方面，本申请还提供了一种计算机可读存储介质，该计算机可读存储介质可以是上述实施例中所述装置中所包含的计算机可读存储介质；也可以是单独存在，未装配入终端中的计算机可读存储介质。所述计算机可读存储介质存储有一个或者一个以上程序，所述程序被一个或者一个以上的处理器用来执行描述于本申请的程序监控方法。
以上描述仅为本申请的较佳实施例以及对所运用技术原理的说明。本领域技术人员应当理解，本申请中所涉及的发明范围，并不限于上述技术特征的特定组合而成的技术方案，同时也应涵盖在不脱离所述发明构思的情况下，由上述技术特征或其等同特征进行任意组合 而形成的其它技术方案。例如上述特征与本申请中公开的(但不限于)具有类似功能的技术特征进行互相替换而形成的技术方案。

Claims (16)

  1. 一种程序监控方法，其特征在于，所述方法包括：
    提取运行中的目标程序的至少一个操作特征，其中所述操作特征包括所述目标程序所执行操作的操作类型和操作对象；
    将所提取的各个操作特征与恶意程序操作特征模板中的各个操作特征进行匹配，其中所述恶意程序操作特征模板包括了恶意程序的操作特征的集合；
    基于所述匹配的匹配结果，确定所述目标程序是否是恶意程序或者恶意程序的变形程序；
    如果是，则对所述目标程序进行处理。
  2. 根据权利要求1所述的方法，其特征在于，所述操作类型包括以下至少一项：删除文件；感染文件；操作进程；寻找和/或关闭安全程序；收集敏感信息。
  3. 根据权利要求1所述的方法，其特征在于，所述提取运行中的目标程序的至少一个操作特征，包括：
    拦截所述目标程序所执行的操作；
    基于拦截的所述操作，提取至少一个操作特征。
  4. 根据权利要求1-3之一所述的方法，其特征在于，所述基于所述匹配的匹配结果，确定所述目标程序是否是恶意程序或者恶意程序的变形程序，包括：
    判断所提取的各个操作特征是否与所述恶意程序操作特征模板中超过第一预定数目的操作特征相匹配；
    如果判断结果为是，则确定所述目标程序是恶意程序。
  5. 根据权利要求4所述的方法，其特征在于，所述基于所述匹配的匹配结果，确定所述目标程序是否是恶意程序或者恶意程序的变形 程序，还包括：
    如果判断结果为否，则进一步判断所提取的各个操作特征是否与所述恶意程序操作特征模板中超过第二预定数目的操作特征相匹配，其中所述第二预定数目小于所述第一预定数目；
    如果判断结果为是，则确定所述目标程序是恶意程序的变形程序。
  6. 根据权利要求1-3，5之一所述的方法，其特征在于，所述提取运行中的目标程序的至少一个操作特征之前，还包括：
    在虚拟环境中运行所述目标程序。
  7. 根据权利要求1-3之一所述的方法，其特征在于，所述对所述目标程序进行处理，包括以下操作中的至少一项：
    清除所述目标程序；
    给出与所述目标程序相关的警告或提示。
  8. 一种程序监控装置，其特征在于，所述装置包括：
    提取单元，配置用于提取运行中的目标程序的至少一个操作特征，其中所述操作特征包括所述目标程序所执行操作的操作类型和操作对象；
    匹配单元，配置用于将所提取的各个操作特征与恶意程序操作特征模板中的各个操作特征进行匹配，其中所述恶意程序操作特征模板包括了恶意程序的操作特征的集合；
    确定单元，配置用于基于所述匹配的匹配结果，确定所述目标程序是否是恶意程序或者恶意程序的变形程序；
    处理单元，配置用于如果所述确定单元确定所述目标程序是恶意程序或者恶意程序的变形程序，则对所述目标程序进行处理。
  9. 根据权利要求8所述的装置，其特征在于，所述操作类型包括以下至少一项：删除文件；感染文件；操作进程；寻找和/或关闭安全程序；收集敏感信息。
  10. 根据权利要求8所述的装置，其特征在于，所述提取单元进一步配置用于：
    拦截所述目标程序所执行的操作；
    基于拦截的所述操作，提取至少一个操作特征。
  11. 根据权利要求8-10之一所述的装置，其特征在于，所述确定单元进一步配置用于：
    判断所提取的各个操作特征是否与所述恶意程序操作特征模板中超过第一预定数目的操作特征相匹配；
    如果判断结果为是，则确定所述目标程序是恶意程序。
  12. 根据权利要求11所述的装置，其特征在于，所述确定单元进一步配置用于：
    如果判断结果为否，则进一步判断所提取的各个操作特征是否与所述恶意程序操作特征模板中超过第二预定数目的操作特征相匹配，其中所述第二预定数目小于所述第一预定数目；
    如果判断结果为是，则确定所述目标程序是恶意程序的变形程序。
  13. 根据权利要求8-10，12之一所述的装置，其特征在于，所述装置还包括：运行单元，配置用于在虚拟环境中运行所述目标程序。
  14. 根据权利要求8-10之一所述的装置，其特征在于，所述处理单元进一步配置用于：
    清除所述目标程序；和/或
    给出与所述目标程序相关的警告或提示。
  15. 一种设备，包括：
    处理器；和
    存储器，
    所述存储器中存储有能够被所述处理器执行的计算机可读指令，在所述计算机可读指令被执行时，所述处理器执行权利要求1至7中任一项所述的方法。
  16. 一种非易失性计算机存储介质，所述计算机存储介质存储有能够被处理器执行的计算机可读指令，当所述计算机可读指令被处理器执行时，所述处理器执行权利要求1至7中任一项所述的方法。
PCT/CN2015/099892 2015-08-18 2015-12-30 程序监控方法和装置 WO2017028459A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510508253.4A CN105184162B (zh) 2015-08-18 2015-08-18 程序监控方法和装置
CN201510508253.4 2015-08-18

Publications (1)

Publication Number Publication Date
WO2017028459A1 true WO2017028459A1 (zh) 2017-02-23

Family

ID=54906236

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/099892 WO2017028459A1 (zh) 2015-08-18 2015-12-30 程序监控方法和装置

Country Status (2)

Country Link
CN (1) CN105184162B (zh)
WO (1) WO2017028459A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110414232A (zh) * 2019-06-26 2019-11-05 腾讯科技（深圳）有限公司 恶意程序预警方法、装置、计算机设备及存储介质

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105184162B (zh) * 2015-08-18 2019-01-04 安一恒通（北京）科技有限公司 程序监控方法和装置
CN110801630B (zh) * 2019-11-04 2023-07-25 网易（杭州）网络有限公司 作弊程序确定方法、装置、设备和存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103020524A (zh) * 2012-12-11 2013-04-03 北京奇虎科技有限公司 计算机病毒监控系统
CN103049695A (zh) * 2012-12-11 2013-04-17 北京奇虎科技有限公司 一种计算机病毒的监控方法和装置
CN103839003A (zh) * 2012-11-22 2014-06-04 腾讯科技（深圳）有限公司 恶意文件检测方法及装置
CN103902892A (zh) * 2012-12-24 2014-07-02 珠海市君天电子科技有限公司 基于行为的病毒防御方法及系统
CN105184162A (zh) * 2015-08-18 2015-12-23 安一恒通（北京）科技有限公司 程序监控方法和装置

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103679035B (zh) * 2012-09-24 2016-12-28 腾讯科技（深圳）有限公司 安全性检测方法与装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103839003A (zh) * 2012-11-22 2014-06-04 腾讯科技（深圳）有限公司 恶意文件检测方法及装置
CN103020524A (zh) * 2012-12-11 2013-04-03 北京奇虎科技有限公司 计算机病毒监控系统
CN103049695A (zh) * 2012-12-11 2013-04-17 北京奇虎科技有限公司 一种计算机病毒的监控方法和装置
CN103902892A (zh) * 2012-12-24 2014-07-02 珠海市君天电子科技有限公司 基于行为的病毒防御方法及系统
CN105184162A (zh) * 2015-08-18 2015-12-23 安一恒通（北京）科技有限公司 程序监控方法和装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110414232A (zh) * 2019-06-26 2019-11-05 腾讯科技（深圳）有限公司 恶意程序预警方法、装置、计算机设备及存储介质

Also Published As

Publication number Publication date
CN105184162B (zh) 2019-01-04
CN105184162A (zh) 2015-12-23

Similar Documents

Publication Publication Date Title
US10872151B1 (en) System and method for triggering analysis of an object for malware in response to modification of that object
EP3251043B1 (en) Methods and systems for identifying potential enterprise software threats based on visual and non-visual data
US9336390B2 (en) Selective assessment of maliciousness of software code executed in the address space of a trusted process
US8955124B2 (en) Apparatus, system and method for detecting malicious code
JP5961183B2 (ja) 文脈上の確からしさ、ジェネリックシグネチャ、および機械学習法を用いて悪意のあるソフトウェアを検出する方法
US10462160B2 (en) Method and system for identifying uncorrelated suspicious events during an attack
US10135830B2 (en) Utilizing transport layer security (TLS) fingerprints to determine agents and operating systems
US10484419B1 (en) Classifying software modules based on fingerprinting code fragments
US8256000B1 (en) Method and system for identifying icons
WO2015163953A2 (en) Behavioral analytics driven host-based malicious behavior and data exfiltration disruption
EP3547121B1 (en) Combining device, combining method and combining program
US10885162B2 (en) Automated determination of device identifiers for risk-based access control in a computer network
US10412101B2 (en) Detection device, detection method, and detection program
WO2017028459A1 (zh) 程序监控方法和装置
US10880316B2 (en) Method and system for determining initial execution of an attack
US9785775B1 (en) Malware management
Geetha Ramani et al. Nonvolatile kernel rootkit detection using cross‐view clean boot in cloud computing
US11886585B1 (en) System and method for identifying and mitigating cyberattacks through malicious position-independent code execution
WO2016095671A1 (zh) 一种应用程序的消息处理方法和装置
Li et al. A review on signature-based detection for network threats
US11811803B2 (en) Method of threat detection
JP2016525750A (ja) 合法的オブジェクトの誤用の識別
US11989290B2 (en) Action plan estimation apparatus, action plan estimation method, and computer-readable recording medium
Stephen Investigation of Ransomware in Digital Forensic tools
Boyton et al. Forensic Investigation of Ransomware Activity–Part 2

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15901659

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 01/06/2018)

122 Ep: pct application non-entry in european phase

Ref document number: 15901659

Country of ref document: EP

Kind code of ref document: A1