WO2019223095A1 - 监控进程运行的方法、终端设备及计算机可读存储介质 - Google Patents

监控进程运行的方法、终端设备及计算机可读存储介质 Download PDF

Info

Publication number
WO2019223095A1
WO2019223095A1 PCT/CN2018/097120 CN2018097120W WO2019223095A1 WO 2019223095 A1 WO2019223095 A1 WO 2019223095A1 CN 2018097120 W CN2018097120 W CN 2018097120W WO 2019223095 A1 WO2019223095 A1 WO 2019223095A1
Authority
WO
WIPO (PCT)
Prior art keywords
target
child process
child
instruction
monitoring
Prior art date
Application number
PCT/CN2018/097120
Other languages
English (en)
French (fr)
Inventor
谢丹力
张宇
王瑞雪
Original Assignee
深圳壹账通智能科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳壹账通智能科技有限公司 filed Critical 深圳壹账通智能科技有限公司
Publication of WO2019223095A1 publication Critical patent/WO2019223095A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/30—Monitoring
    • G06F11/3089—Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents
    • G06F11/3093—Configuration details thereof, e.g. installation, enabling, spatial arrangement of the probes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request

Definitions

  • the present application belongs to the technical field of resource management, and particularly relates to a method for monitoring the running of a process, a terminal device, and a computer-readable storage medium.
  • the system memory will execute multiple processes, and some processes will load a lot of user-related sensitive information during the execution, such as , province card number, mobile phone number, bank account, etc.
  • the target process is monitored, for example, a child process is created to monitor the target process.
  • the child process can be terminated or disabled to shield the child process from monitoring the target process. It can be seen that the existing process monitoring solution has a problem of low reliability.
  • the embodiments of the present application provide a method, a terminal device, and a computer-readable storage medium for monitoring the running of a process, so as to solve the problem of low reliability of the existing process monitoring solution.
  • a method for monitoring the operation of a process including:
  • the child process identifier is used to mark a target child process, and the target child process is used to perform interrupt monitoring on the target process;
  • a terminal device including:
  • the obtaining unit is used to obtain a child process ID created by the target process.
  • the child process identifier is used to mark a target child process, and the target child process is used to perform interrupt monitoring on the target process;
  • An allocation unit configured to allocate a monitoring thread to the target child process according to the child process identifier, and the monitoring thread is used to generate a system for prohibiting the target process from being configured when the target child process is detected to be disabled Prohibition of resources;
  • An execution unit is configured to prohibit the allocation of system resources to the target process if the prohibition instruction is detected.
  • a terminal device including a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor.
  • the processor executes the computer-readable instructions, Steps of the above method of monitoring the process running.
  • a computer-readable storage medium stores computer-readable instructions.
  • the steps of the foregoing method for monitoring a running process are implemented.
  • the embodiment of the present application obtains a child process identifier created by a target process, wherein the child process identifier is used to mark a target child process that performs interrupt monitoring on the target process, and a monitoring thread is assigned to the target child process according to the child process identifier, so that when the target is detected
  • a prohibition instruction is generated for disabling the allocation of system resources to the target process. According to the prohibition instruction, the allocation of system resources to the target process is prohibited.
  • the target child process monitors the target thread, the target child process is monitored by the monitor. Threads are monitored to form step-by-step monitoring among target processes, target sub-processes, and monitoring threads to improve the reliability of monitoring process operation.
  • FIG. 1 is an implementation flowchart of a method for monitoring a running process according to an embodiment of the present application
  • FIG. 2 is a specific implementation flowchart of a method for monitoring a running process according to another embodiment of the present application
  • FIG. 3 is a specific implementation flowchart of a method S22 for monitoring a running process according to another embodiment of the present application;
  • FIG. 4 is a specific implementation flowchart of a method S13 for monitoring a running process according to another embodiment of the present application.
  • FIG. 5 is a structural block diagram of a terminal device according to another embodiment of the present application.
  • FIG. 6 is a schematic diagram of a terminal device according to another embodiment of the present application.
  • a sub-process ID created by a target process is obtained, and the sub-process ID is used to mark a target sub-process that performs interrupt monitoring on the target process, and a monitoring thread is assigned to the target sub-process according to the sub-process ID, so that when the target sub-process is detected,
  • a process is banned, it generates a prohibition instruction for disabling the allocation of system resources to the target process, and then prohibits the allocation of system resources to the target process, forming a target child process to monitor the target thread.
  • the target child process is monitored by the monitoring thread to achieve the The dual monitoring of the process solves the problem of the low reliability of the existing process monitoring solutions.
  • the execution subject of the process is a terminal device or a terminal device.
  • the terminal device may include, but is not limited to, a mobile terminal such as a smart phone, a notebook computer, a computer, and a tablet computer.
  • FIG. 1 shows an implementation flowchart of a method for monitoring a process running provided by a first embodiment of the present application, which is detailed as follows:
  • step S11 the child process identifier is used to mark the target child process, and the target child process is used to perform interrupt monitoring on the target process.
  • the target child process is created by the target process, and when the target process creates the target child process, a child process identifier for marking the target child process is also generated.
  • a target child process is created by calling a fork function fork (), and then the target process is monitored by the target child process.
  • the target sub-process monitors the target process, specifically monitoring whether the target process has interrupted execution.
  • a target process is generated to terminate the target process.
  • Termination instructions where the termination instructions can be non-negligible signals, such as the SIGSTOP signal and the SIGKILL signal.
  • the target child process is the child process that is created with the highest priority among all child processes. That is, when the target process is executed, it is first created and executed. Target child processes before creating and executing other child processes.
  • S12 Allocate a monitoring thread to the target child process according to the child process identifier, and the monitoring thread is used to generate a prohibition for prohibiting the configuration of the system resource to the target process when it is detected that the target child process is prohibited. instruction.
  • the monitoring thread is a part of all threads for executing the target child process.
  • the system resources include: running threads, running memory, etc. Therefore, when the target process is in the execution process, If system resources are disabled, the target process cannot be executed.
  • the target child process can be executed simultaneously through multiple threads, and the monitoring process is one of the execution paths of the target child process.
  • the monitoring thread judges whether the target child process is prohibited, it determines whether the target child process is disabled by detecting whether system resources used to execute the target child process are occupied. Specifically, if the target child process is executed, and when the target child process is detected, When the system resources used to execute the target child process are occupied, it can be determined that the target child process is not prohibited; if the target child process is executed, and when it is detected that the system resources used to execute the target child process are not occupied, it can be Make sure the target child process is banned.
  • the system resource prohibition instruction can cause the target process to be terminated because it cannot call system resources during the execution process.
  • disabling the allocation of system resources to the target process may specifically include: disabling the allocation of running memory and / or running threads to the target process.
  • the prohibition instruction is generated by the monitoring thread.
  • the monitoring thread detects that the target child process is forbidden, it can be determined that the target child process cannot monitor the target process.
  • By generating a prohibition instruction and prohibiting the The target process configures system resources, thereby terminating the execution of the target process, avoiding the phenomenon of information leakage caused by the target sub-process and / or the target process being interrupted during execution.
  • the method for monitoring the running of a process obtains a sub-process identifier created by a target process, where the sub-process identifier is used to mark a target sub-process that performs interrupt monitoring on the target process.
  • the process identifier allocates a monitoring thread to the target child process, so that when it is detected that the target child process is prohibited, a prohibition instruction for prohibiting the allocation of system resources to the target process is generated.
  • the allocation of system resources to the target process is prohibited to achieve the goal While the child process monitors the target thread, the target child process is monitored by the monitoring thread to form a level-by-level monitoring among the target process, the target child process, and the monitoring thread to improve the reliability of monitoring the process operation.
  • FIG. 2 shows a specific implementation flowchart of a method for monitoring the running of a process according to a second embodiment of the present application.
  • a method for monitoring the running of a process provided in this embodiment further includes S21 and S22, which are detailed as follows:
  • the method before acquiring the child process identifier created by the target process, the method further includes:
  • S22 Start the target sub-process to terminate the target process when an interrupt instruction for interrupting the target process is detected.
  • the debugger is attached to the process of a node and the node is dynamically debugged to view the process execution process on the node.
  • the encryption information on the node for example, a transaction key, a random encryption rule, and the like.
  • the target process needs to be forcibly interrupted during the dynamic modulation process, in order to avoid information leakage caused by dynamic debugging of the target process executed on the node, when the target process is executed, the target subprocess is created and the target subprocess pair is started.
  • the target process monitors the interruption. When the target process is detected to be interrupted, it can be determined that there is a risk of information leakage in the target process. By detecting the interrupt instruction to interrupt the target process, the target process is terminated to prevent the target process from leaking information. .
  • the execution cycle of the target child process is synchronized with the execution cycle of the target process.
  • the target child process also ends.
  • FIG. 3 shows a specific implementation flowchart of a method S22 for monitoring the running of a process according to another embodiment of the present application.
  • S22 includes S221, S222, and S223, and the details are as follows:
  • the identifiers of the target sub-processes may be specified in advance, and the identifier set of all processes in the current task list may be obtained, and then whether the identifiers of the predetermined target sub-processes exist in the identifier set, It can then determine whether the target child process has been created.
  • a debugger to the terminal node or terminal device in the system, that is, configure a preset script for the terminal node or terminal device to steal user information.
  • the preset script is configured with an execution breakpoint and / or a data access breakpoint.
  • INT3 breakpoint instruction is generated no matter whether the execution breakpoint is called or the data access breakpoint is used to achieve the interrupt. Therefore, by analyzing the breakpoint and judging whether the breakpoint instruction is an INT3 breakpoint instruction, the target can be determined. Whether a debugger is attached to the terminal or terminal device where the process is located, that is, to determine whether the terminal or terminal device has been hacked, and there is a risk of information leakage.
  • the breakpoint Monitor the execution process of the target process by starting the target child process.
  • the breakpoint is analyzed to obtain a breakpoint instruction, and then the breakpoint instruction is determined. Whether it is an INT3 breakpoint instruction can further determine whether the breakpoint will cause the target process to be interrupted, and whether the terminal or terminal device has been hacked, and there is a risk of information leakage.
  • a target child process is created by controlling the target process to monitor interruption of the execution process of the target process.
  • the target process can be terminated by generating an interrupt control instruction when the target process is interrupted, thereby preventing information leakage, but when The target child process is prohibited from executing when it is created, so the execution process of the target thread cannot be monitored, and there is still a risk of information leakage.
  • a prohibition instruction can be generated when the target child process is detected to be banned. Terminate the target process.
  • FIG. 4 shows a specific implementation flowchart of a method S13 for monitoring the running of a process according to another embodiment of the present application.
  • the method S13 in a method for monitoring the running of a process provided in this embodiment includes: S131 to S133, and details are as follows:
  • S132 According to the child process identifier, determine a thread that can execute the child process from all the currently callable threads to obtain a target thread queue.
  • S133 Select any thread from the target thread queue as the monitoring thread.
  • the monitoring thread is one of the execution paths of the target process. If the monitoring thread detects that the target child process is prohibited from executing, it generates a prohibition instruction for prohibiting the allocation of system resources to the target process.
  • the child process can be executed simultaneously by multiple threads, and the monitoring process serves as One of the execution paths of the target child process.
  • the monitoring thread can know that the system resources used to execute the child process are not occupied, and then it can determine whether the child process is banned.
  • the target child process can be the target child process in an IO-intensive task, or the target child process in an intensive task.
  • the number of threads that execute the target child process can be determined by the number of cores of the processor and the task.
  • the clogging coefficient is determined, and can be specifically calculated by the following formula.
  • N Ncpu / (1-W / C);
  • N is the number of threads
  • Ncpu is the number of cores of the processor, which can be obtained by directly querying the running data
  • W / C is the ratio of the waiting time to the calculation time, that is, the blocking coefficient, and 0 ⁇ W / C ⁇ 1 , 1-W / C ⁇ 1.
  • the blocking factor can be determined according to the current execution environment by calling a performance analysis tool. For example, by calling the java.lang.managementAPI port to query the number of threads W of the executing process and the number of currently callable threads C-W, and then determine the blocking coefficient W / C.
  • the blocking coefficient W / C is determined to be 0.5.
  • the blocking coefficient W / C is equal to 0. If the target child process is a child process in an IO intensive task, the blocking coefficient W / C is greater than 0 .
  • the prohibition instruction is used to prohibit the allocation of system resources to the target process. After the target process is prohibited from configuring system resources, the target process cannot be executed.
  • the child process ID created by the target process is obtained, where the child process ID is used to mark the target child process that performs interrupt monitoring on the target process, and a monitoring thread is assigned to the target child process according to the child process ID so that When the target child process is prohibited, a prohibition instruction for disabling the allocation of system resources to the target process is generated. According to the prohibition instruction, the allocation of system resources to the target process is prohibited.
  • the target child process monitors the target thread, the target child process Monitoring is performed by the monitoring thread, and step-by-step monitoring between the target process, the target child process, and the monitoring thread is formed to improve the reliability of monitoring the process operation.
  • a control instruction for creating a sub-process is sent to the target process, so that the target process creates a target sub-process according to the control instruction, and starts the target sub-process to achieve the detection
  • the interrupt instruction for interrupting the target process is terminated, the target process is terminated, thereby preventing information leakage during the execution of the target process.
  • FIG. 5 shows a structural block diagram of a terminal device according to an embodiment of the present application, and each unit included in the terminal device is configured to execute steps in the embodiment corresponding to FIG. 2.
  • each unit included in the terminal device is configured to execute steps in the embodiment corresponding to FIG. 2.
  • only the parts related to this embodiment are shown.
  • the terminal device 30 includes: an obtaining unit 31, an allocation unit 32, and an execution unit 33. specifically:
  • the obtaining unit 31 is configured to obtain a child process identifier created by the target process.
  • the child process identifier is used to mark a target child process, and the target child process is used to perform interrupt monitoring on the target process.
  • An allocating unit 32 is configured to allocate a monitoring thread to the target child process according to the child process identifier, and the monitoring thread is used to generate a configuration for prohibiting the target child process from being configured when the target child process is prohibited. Disable instruction for system resources.
  • the execution unit 33 is configured to prohibit the allocation of system resources to the target process if the prohibition instruction is detected.
  • the terminal device further includes: a sending unit 301 and a starting unit 302.
  • a sending unit 301 is configured to: if a preset instruction for executing a target process is detected, send a control instruction for creating a child process to the target process, so that the target process creates a target child process according to the control instruction .
  • the starting unit 302 is configured to start the target sub-process to terminate the target process when an interrupt instruction for interrupting the target process is detected.
  • the starting unit 302 is specifically configured to start the target sub-process if it is detected that the target sub-process is created; if the target sub-process detects the target process When a breakpoint is inserted during execution, the breakpoint is parsed to obtain a breakpoint instruction; if the breakpoint instruction is an INT3 breakpoint instruction, a termination instruction is generated to terminate the target process.
  • the allocation unit 32 is specifically configured to, if a preset operation for initializing the target process is detected, obtain all current callable threads; according to the sub-process identifier, Among the currently callable threads, a thread that can execute a child process is determined to obtain a target thread queue; and any thread is selected from the target thread queue as the monitoring thread.
  • the child process ID created by the target process is obtained, where the child process ID is used to mark the target child process that performs interrupt monitoring on the target process, and a monitoring thread is assigned to the target child process according to the child process ID so that When the target child process is prohibited, a prohibition instruction for disabling the allocation of system resources to the target process is generated. According to the prohibition instruction, the allocation of system resources to the target process is prohibited.
  • the target child process monitors the target thread, the target child process Monitoring is performed by the monitoring thread, and step-by-step monitoring between the target process, the target child process, and the monitoring thread is formed to improve the reliability of monitoring the process operation.
  • a control instruction for creating a sub-process is sent to the target process, so that the target process creates a target sub-process according to the control instruction, and starts the target sub-process to achieve the detection
  • the interrupt instruction for interrupting the target process is terminated, the target process is terminated, thereby preventing information leakage during the execution of the target process.
  • FIG. 6 is a schematic diagram of a terminal device according to another embodiment of the present application.
  • the terminal device 6 of this embodiment includes a processor 60, a memory 61, and computer-readable instructions 62 stored in the memory 61 and executable on the processor 60, such as monitoring a process running program of.
  • the processor 60 executes the computer-readable instructions 62
  • the steps in the method embodiment for implementing the running of each monitoring process are described, for example, the steps shown in FIG. 2.
  • functions of each unit in the foregoing device embodiments are implemented, for example, functions of modules 61 to 65 shown in FIG. 6.
  • the computer-readable instructions 62 may be divided into one or more units, and the one or more units are stored in the memory 61 and executed by the processor 60 to complete the present application.
  • the one or more units may be a series of computer-readable instruction instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer-readable instructions 62 in the terminal device 6.
  • the computer-readable instructions 62 may be divided into a sending unit, a starting unit, an obtaining unit, an allocating unit, and an executing unit, and the specific functions of each unit are as described above.
  • the terminal device 6 may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud terminal device.
  • the terminal device may include, but is not limited to, a processor 60 and a memory 61.
  • FIG. 6 is only an example of the terminal device 6, and does not constitute a limitation on the terminal device 6, and may include more or less components than shown in the figure, or combine some components or different components.
  • the terminal device may further include an input / output device, a network access device, a bus, and the like.
  • the processor 60 may be a central processing unit (Central Processing Unit (CPU), or other general-purpose processors, Digital Signal Processors (DSPs), and application-specific integrated circuits (Applications) Specific Integrated Circuit (ASIC), off-the-shelf Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • CPU Central Processing Unit
  • DSP Digital Signal Processor
  • ASIC Applications
  • FPGA off-the-shelf Programmable Gate Array
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the memory 61 may be an internal storage unit of the terminal device 6, such as a hard disk or a memory of the terminal device 6.
  • the memory 61 may also be an external storage device of the terminal device 6, such as a plug-in hard disk, a smart media card (SMC), and a secure digital (SD) provided on the terminal device 6. Card, flash card, etc. Further, the memory 61 may further include both an internal storage unit of the terminal device 6 and an external storage device.
  • the memory 61 is configured to store the computer-readable instructions and other programs and data required by the terminal device.
  • the memory 61 may also be used to temporarily store data that has been output or is to be output.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each of the units may exist separately physically, or two or more units may be integrated into one unit.
  • the above integrated unit may be implemented in the form of hardware or in the form of software functional unit.
  • the integrated module / unit When the integrated module / unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the method of the above embodiment, and can also be completed by computer-readable instructions to instruct related hardware.
  • the computer-readable instructions can be stored in a computer-readable storage medium. In the computer-readable instructions, when executed by a processor, the steps of the foregoing method embodiments can be implemented.
  • the computer-readable instructions include computer-readable instruction codes, and the computer-readable instruction codes may be in a source code form, an object code form, an executable file, or some intermediate form.
  • the computer-readable medium may include: any entity or device capable of carrying the computer-readable instruction code, a recording medium, a U disk, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signals, telecommunication signals, and software distribution media.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • electric carrier signals telecommunication signals
  • software distribution media any entity or device capable of carrying the computer-readable instruction code
  • a recording medium a U disk, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signals, telecommunication signals, and software distribution media.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Quality & Reliability (AREA)
  • Debugging And Monitoring (AREA)

Abstract

本申请适用于资源管理技术领域，公开了一种监控进程运行的方法、终端设备及计算机可读存储介质，通过获取目标进程创建的子进程标识，其中，子进程标识用于标记对目标进程进行中断监控的目标子进程，根据子进程标识为目标子进程分配监控线程，使得在检测到目标子进程被禁止时，生成用于禁止向目标进程配置系统资源的禁止指令，根据该禁止指令，禁止向目标进程配置系统资源，实现目标子进程对目标线程进行监控的同时，目标子进程由监控线程进行监控，形成目标进程、目标子进程以及监控线程之间的逐级监控，提高对进程运行进行监控的可靠性。

Description

监控进程运行的方法、终端设备及计算机可读存储介质
本申请申明享有2018年5月22日递交的申请号为201810496141.5、名称为“监控进程运行的方法、终端设备及计算机可读存储介质”中国专利申请的优先权，该中国专利申请的整体内容以参考的方式结合在本申请中。
技术领域
本申请属于资源管理技术领域，尤其涉及一种监控进程运行的方法、终端设备及计算机可读存储介质。
 背景技术
随着人工成本越来越高，许多行业都采用智能终端，或者采用由智能终端和终端设备组成的多节点集群协同工作，以取代人工，进而降低人力成本。
无论是单个智能终端还是由智能终端和终端设备组成的多节点集群，在任务处理过程中，系统内存会执行多个进程，有些进程在执行过程中，会加载许多与用户相关的敏感信息，例如，省份证号码、手机号码、银行账户等。
现有技术中，为了防止进程执行过程的数据被非法读取，通过对目标进程进行监控，例如，创建子进程对目标进程进行监控。但是，对于系统中的终端节点或者终端设备来说，当黑客获取到终端节点或者终端设备的权限后，可以通过终止或者禁用子进程的方式，从而屏蔽子进程对目标进程的监控。可见，现有的进程监控方案存在可靠性低的问题。
 技术问题
本申请实施例提供了一种监控进程运行的方法、终端设备及计算机可读存储介质，以解决现有的进程监控方案存在可靠性低的问题。
 技术解决方案
第一方面，提供了一种监控进程运行的方法，包括：
获取目标进程创建的子进程标识；所述子进程标识用于标记目标子进程，所述目标子进程用于对所述目标进程进行中断监控；
根据所述子进程标识为所述目标子进程分配监控线程，所述监控线程用于当检测到所述目标子进程被禁止时，生成用于禁止向所述目标进程配置系统资源的禁止指令；
若检测到所述禁止指令，则禁止向所述目标进程配置系统资源。
第二方面，提供了一种终端设备，包括：
获取单元，用于获取目标进程创建的子进程标识。其中，所述子进程标识用于标记目标子进程，所述目标子进程用于对所述目标进程进行中断监控；
分配单元，用于根据所述子进程标识为所述目标子进程分配监控线程，所述监控线程用于当检测到所述目标子进程被禁止时，生成用于禁止向所述目标进程配置系统资源的禁止指令；
执行单元，用于若检测到所述禁止指令，则禁止向所述目标进程配置系统资源。
第三方面，提供了一种终端设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机可读指令，所述处理器执行所述计算机可读指令时上述的监控进程运行的方法的步骤。
第四方面，提供了一种计算机可读存储介质，所述计算机可读存储介质存储有计算机可读指令，所述计算机可读指令被处理器执行时实现上述的监控进程运行的方法的步骤。
 有益效果
本申请实施例通过获取目标进程创建的子进程标识，其中，子进程标识用于标记对目标进程进行中断监控的目标子进程，根据子进程标识为目标子进程分配监控线程，使得在检测到目标子进程被禁止时，生成用于禁止向目标进程配置系统资源的禁止指令，根据该禁止指令，禁止向目标进程配置系统资源，实现目标子进程对目标线程进行监控的同时，目标子进程由监控线程进行监控，形成目标进程、目标子进程以及监控线程之间的逐级监控，提高对进程运行进行监控的可靠性。
 附图说明
图1是本申请实施例提供的一种监控进程运行的方法的实现流程图；
图2是本申请另一实施例提供的一种监控进程运行的方法具体实现流程图；
图3是本申请另一实施例提供的一种监控进程运行的方法S22具体实现流程图；
图4是本申请另一实施例提供的一种监控进程运行的方法S13具体实现流程图；
图5是本申请另一实施例提供的一种终端设备的结构框图；
图6是本申请另一实施例提供的一种终端设备的示意图。
 本发明的实施方式
为了使本申请的目的、技术方案及优点更加清楚明白，以下结合附图及实施例，对本申请进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本申请，并不用于限定本申请。
本申请实施例通过获取目标进程创建的子进程标识，该子进程标识用于标记对目标进程进行中断监控的目标子进程，根据子进程标识为目标子进程分配监控线程，使得在检测到目标子进程被禁止时，生成用于禁止向目标进程配置系统资源的禁止指令，进而禁止向目标进程配置系统资源，形成目标子进程对目标线程进行监控，同时目标子进程由监控线程进行监控，实现对进程的双重监控，解决了现有的进程监控方案存在可靠性低的问题。
在本申请实施例中，流程的执行主体为终端设备或者终端设备，其中，终端设备可以包括但不限于：智能手机、笔记本电脑、计算机、平板电脑等移动终端。图1示出了本申请第一实施例提供的监控进程运行的方法的实现流程图，详述如下：
S11：获取目标进程创建的子进程标识。
在步骤S11中，子进程标识用于标记目标子进程，目标子进程用于对目标进程进行中断监控。
在本实施例中，目标子进程由目标进程创建，且在目标进程创建目标子进程的同时，还生成用于标记目标子进程的子进程标识。在实际中，在执行目标进程时，通过调用分叉函数fork()创建目标子进程，进而通过该目标子进程对目标进程进行监控。
需要说明的是，目标子进程对目标进程进行监控，具体是监控目标进程是否发生执行中断，当目标子进程监测到目标进程在执行过程中，发生了执行中断，则生成用于终止目标进程的终止指令，其中，终止指令可以为不可忽略信号，例如，SIGSTOP信号和SIGKILL信号。
可以理解的是，目标进程在执行的过程中，可以创建多个子进程，其中，目标子进程为所有子进程中最优先被创建的子进程，也即，在执行目标进程时，首先创建并执行目标子进程，然后再创建和执行其他的子进程。
S12：根据所述子进程标识为所述目标子进程分配监控线程，所述监控线程用于当检测到所述目标子进程被禁止时，生成用于禁止向所述目标进程配置系统资源的禁止指令。
在步骤S12中，监控线程为用于执行目标子进程的所有线程中的部分线程。由于在执行目标子进程的过程中，需要根据目标子进程的执行进度为目标子进程配置相应的系统资源，其中，系统资源包括：运行线程、运行内存等，因此，当目标进程在执行过程中，被禁用系统资源，则目标进程无法被执行。
在本实施例中，为目标子进程分配监控线程时，通过获取当前所有可调用的线程，再根据子进程标识，从所有可调用的线程中确定出监控线程。
需要说明的是，在执行目标进程的过程中，目标子进程可以通过多个线程被同时执行，监控进程作为目标子进程的执行路径之一。监控线程在判断目标子进程是否被禁止时，通过检测用于执行目标子进程的系统资源是否被占用，进而确定目标子进程是否被禁止，具体地，若目标子进程被执行，且当检测到用于执行目标子进程的系统资源被占用时，则可以确定目标子进程未被禁止；若目标子进程被执行，且当检测到用于执行目标子进程的系统资源未被占用时，则可以确定目标子进程被禁止。
可以理解的是，在目标子进程被执行的过程中，当检测到目标子进程被禁止时，则可以确定目标子进程无法对目标进程的执行过程进行监控，通过生成用于禁止向目标进程配置系统资源的禁止指令，可以使目标进程在被执行的过程中，因无法调用系统资源而被终止执行。
S13：若检测到所述禁止指令，则禁止向所述目标进程配置系统资源。
在步骤S13中，禁止向所述目标进程配置系统资源，具体可以包括：禁止向目标进程配置运行内存和/或运行线程。
在本实施例中，禁止指令由监控线程生成，当监控线程检测到目标子进程被禁止时，即可确定目标子进程无法对目标进程进行监控，通过生成禁止指令，并根据禁止指令，禁止向目标进程配置系统资源，进而终止目标进程的执行，避免了目标子进程和/或目标进程在执行过程中被中断，造成的信息泄漏的现象。
以上可以看出，本申请实施例提供的一种监控进程运行的方法，通过获取目标进程创建的子进程标识，其中，子进程标识用于标记对目标进程进行中断监控的目标子进程，根据子进程标识为目标子进程分配监控线程，使得在检测到目标子进程被禁止时，生成用于禁止向目标进程配置系统资源的禁止指令，根据该禁止指令，禁止向目标进程配置系统资源，实现目标子进程对目标线程进行监控的同时，目标子进程由监控线程进行监控，形成目标进程、目标子进程以及监控线程之间的逐级监控，提高对进程运行进行监控的可靠性。
图2示出了本申请第二实施例提供的一种监控进程运行的方法的具体实现流程图。参见图2所示，相对于图1所述实施例，本实施例提供的一种监控进程运行的方法中还包括S21和S22，具体详述如下：
进一步地，作为本申请另一实施例，在获取目标进程创建的子进程标识之前，还包括：
S21：若检测到用于执行目标进程的预设指令，则向所述目标进程发送用于创建子进程的控制指令，以使所述目标进程根据所述控制指令创建目标子进程。
S22：启动所述目标子进程，以在检测到用于中断所述目标进程的中断指令时，终止所述目标进程。
在实际中，当终端设备遭到黑客入侵，且黑客获取到权限后，通过将调试器附着于某一节点的进程上，并对该节点进行动态调试，以查看该节点上的进程执行过程，从而获取该节点上的加密信息例如，交易密钥、随机加密规则等。
由于动态调制的过程中需要强制中断目标进程的执行，因此，为了避免节点上执行的目标进程因动态调试导致的信息泄漏，在执行目标进程时，通过创建目标子进程并启动该目标子进程对目标进程进行中断监控，进而在检测到目标进程中断时，可以确定目标进程存在信息泄漏的风险，通过在检测到用于中断目标进程的中断指令时，终止目标进程，从而避免目标进程存在信息泄漏。
需要说明的是，目标子进程的执行周期与目标进程的执行周期同步，当目标进程执行结束时，目标子进程也随之结束。
图3示出了本申请另一实施例提供的一种监控进程运行的方法S22的具体实现流程图。参见图3所示，相对于图2所述实施例，本实施例提供的一种监控进程运行的方法中S22包括S221、S222以及S223，具体详述如下：
S221：若检测到所述目标子进程创建完成，则启动所述目标子进程。
S222：若所述目标子进程检测到所述目标进程的执行过程中被插入断点，则对所述断点进行解析，以得到断点指令。
S223：若所述断点指令为INT3断点指令，则所述目标子进程生成终止指令，以终止所述目标进程。
在本实施例中，目标子进程被创建前，可以通过预先制定目标子进程的标识，通过获取当前任务列表中所有进程的标识集合，再识别标识集合中是否存在预先制定目标子进程的标识，进而能够确定目标子进程是否被创建完成。
在实际中，当黑客入侵系统中的终端节点或者终端设备后，先向系统中的终端节点或者终端设备附着调试器，也即为终端节点或者终端设备配置用于窃取用户信息的预设脚本，其中，预设脚本中配置有执行断点和/或数据访问断点，通过调用执行断点和/或数据访问断点，能够在目标进程被执行的过程中，中断目标进程的进度，并通过获取目标进程在运行内存中所生成的信息，实现对信息数据的窃取。
需要说明的是，无论是调用执行断点还是调用数据访问断点实现中断，均会生成INT3断点指令，因此通过对断点进行解析并判断断点指令是否为INT3断点指令，能够确定目标进程所在的终端或者终端设备中是否被附着有调试器，也即确定终端或者终端设备是否已被黑客入侵，存在信息泄漏的风险。
通过启动目标子进程对目标进程的执行过程进行监控，在检测到目标进程的执行过程中被插入断点时，通过对该断点进行解析，进而得到断点指令，再通过判断该断点指令是否为INT3断点指令，进而可以确定该断点是否会造成目标进程中断，以及确定终端或者终端设备是否已被黑客入侵，存在信息泄漏的风险。
在本实施例中，通过控制目标进程创建目标子进程，以对目标进程的执行过程进行中断监控，虽然能够在目标进程中断时，通过生成中断控制指令终止目标进程，进而避免信息泄漏，但是当目标子进程在创建候被禁止执行，则无法对目标线程的执行过程进行监控，仍然存在信息泄漏的风险。为了解决当目标子进程在创建候被禁止执行造成的信息泄漏的问题，通过向目标子进程分配用于监控目标子进程的监控线程，可以在检测到目标子进程被禁止时生成禁止指令，以终止目标进程。
图4示出了本申请另一实施例提供的一种监控进程运行的方法S13的具体实现流程图。参见图4所示，相对于图2所述实施例，本实施例提供的一种监控进程运行的方法中所述S13包括：S131~S133，具体详述如下：
S131：若检测到对所述目标进程进行初始化的预设操作，则获取当前所有可调用线程。
S132：根据所述子进程标识，从所述当前所有可调用线程中确定出可执行子进程的线程，以得到目标线程队列。
S133：从所述目标线程队列中选取出任一线程作为所述监控线程。
在本实施例中，监控线程为目标进程的执行路径之一，若监控线程检测到目标子进程被禁止执行，则生成用于禁止向目标进程配置系统资源的禁止指令。
需要说明的是，目标进程在执行的过程中，可以通过创建多个子进程，并通过为子进程分配执行线程进行数据处理的操作，其中，子进程可以通过多个线程被同时执行，监控进程作为目标子进程的执行路径之一，当目标子进程被禁止时，监控线程可以获知用于执行子进程的系统资源未被占用，进而可以确定子进程是否被禁止。
在实际应用中，目标子进程可以为IO密集型任务中的目标子进程，或者为密集型任务中的目标子进程，执行目标子进程的线程个数可以通过处理的器的核心数以及任务的堵塞系数确定，具体可以通过以下公式计算得到。
N=Ncpu/（1-W/C）；
其中，N为线程个数，Ncpu为处理的器的核心数，可以通过直接查询运行数据得到；W/C为等待时间与计算时间的比率，也即堵塞系数，且0≤W/C＜1，1-W/C≤1。
需要说明的是，堵塞系数可以通过调用性能分析工具，根据当前的执行环境进行确定。例如，通过调用java.lang.managementAPI端口查询正在执行进程的线程个数W和当前可调用的线程个数C-W，进而确定堵塞系数W/C。
例如，正在执行进程的线程个数W为3，当前可调用的线程个数C-W为3，则确定堵塞系数W/C为0.5。
在本实施例中，如果目标子进程为密集型任务中的子进程，则堵塞系数W/C等于0，如果目标子进程为IO密集型任务中的子进程，则堵塞系数W/C大于0。
需要说明的是，禁止指令用于禁止向目标进程配置系统资源，当目标进程被禁止配置系统资源后，目标进程则无法被执行。
在本实施例中，通过获取目标进程创建的子进程标识，其中，子进程标识用于标记对目标进程进行中断监控的目标子进程，根据子进程标识为目标子进程分配监控线程，使得在检测到目标子进程被禁止时，生成用于禁止向目标进程配置系统资源的禁止指令，根据该禁止指令，禁止向目标进程配置系统资源，实现目标子进程对目标线程进行监控的同时，目标子进程由监控线程进行监控，形成目标进程、目标子进程以及监控线程之间的逐级监控，提高对进程运行进行监控的可靠性。
通过在检测到用于执行目标进程的预设指令时，向目标进程发送用于创建子进程的控制指令，以使目标进程根据控制指令创建目标子进程，并启动该目标子进程，实现在检测到用于中断目标进程的中断指令时，终止目标进程，进而避免了执行目标进程过程中出现信息泄漏的现象。
图5示出了本申请一实施例提供的一种终端设备的结构框图，该终端设备包括的各单元用于执行图2对应的实施例中的各步骤。具体请参阅图2与图2所对应的实施例中的相关描述。为了便于说明，仅示出了与本实施例相关的部分。
参见图5，所述终端设备30包括：获取单元31、分配单元32以及执行单元33。具体地：
获取单元31，用于获取目标进程创建的子进程标识。其中，所述子进程标识用于标记目标子进程，所述目标子进程用于对所述目标进程进行中断监控。
分配单元32，用于根据所述子进程标识为所述目标子进程分配监控线程，所述监控线程用于当检测到所述目标子进程被禁止时，生成用于禁止向所述目标进程配置系统资源的禁止指令。
执行单元33，用于若检测到所述禁止指令，则禁止向所述目标进程配置系统资源。
作为本实施例一种可能实现的方式，终端设备还包括：发送单元301和启动单元302。
发送单元301，用于若检测到用于执行目标进程的预设指令，则向所述目标进程发送用于创建子进程的控制指令，以使所述目标进程根据所述控制指令创建目标子进程。
启动单元302，用于启动所述目标子进程，以在检测到用于中断所述目标进程的中断指令时，终止所述目标进程。
作为本实施例一种可能实现的方式，启动单元302具体用于，若检测到所述目标子进程创建完成，则启动所述目标子进程；若所述目标子进程检测到所述目标进程的执行过程中被插入断点，则对所述断点进行解析，以得到断点指令；若所述断点指令为INT3断点指令，则生成终止指令，以终止所述目标进程。
作为本实施例一种可能实现的方式，分配单元32具体用于，若检测到对所述目标进程进行初始化的预设操作，则获取当前所有可调用线程；根据所述子进程标识，从所述当前所有可调用线程中确定出可执行子进程的线程，以得到目标线程队列；从所述目标线程队列中选取出任一线程作为所述监控线程。
在本实施例中，通过获取目标进程创建的子进程标识，其中，子进程标识用于标记对目标进程进行中断监控的目标子进程，根据子进程标识为目标子进程分配监控线程，使得在检测到目标子进程被禁止时，生成用于禁止向目标进程配置系统资源的禁止指令，根据该禁止指令，禁止向目标进程配置系统资源，实现目标子进程对目标线程进行监控的同时，目标子进程由监控线程进行监控，形成目标进程、目标子进程以及监控线程之间的逐级监控，提高对进程运行进行监控的可靠性。
通过在检测到用于执行目标进程的预设指令时，向目标进程发送用于创建子进程的控制指令，以使目标进程根据控制指令创建目标子进程，并启动该目标子进程，实现在检测到用于中断目标进程的中断指令时，终止目标进程，进而避免了执行目标进程过程中出现信息泄漏的现象。
图6是本申请另一实施例提供的一种终端设备的示意图。如图6所示，该实施例的终端设备6包括：处理器60、存储器61以及存储在所述存储器61中并可在所述处理器60上运行的计算机可读指令62，例如监控进程运行的程序。所述处理器60执行所述计算机可读指令62时实现上述各个监控进程运行的方法实施例中的步骤，例如图2所示的步骤。或者，所述处理器60执行所述计算机可读指令62时实现上述各装置实施例中各单元的功能，例如图6所示模块61至65功能。
示例性的，所述计算机可读指令62可以被分割成一个或多个单元，所述一个或者多个单元被存储在所述存储器61中，并由所述处理器60执行，以完成本申请。所述一个或多个单元可以是能够完成特定功能的一系列计算机可读指令指令段，该指令段用于描述所述计算机可读指令62在所述终端设备6中的执行过程。例如，所述计算机可读指令62可以被分割成发送单元、启动单元、获取单元、分配单元以及执行单元，各单元具体功能如上所述。
所述终端设备6可以是桌上型计算机、笔记本、掌上电脑及云端终端设备等计算设备。所述终端设备可包括，但不仅限于，处理器60、存储器61。本领域技术人员可以理解，图6仅仅是终端设备6的示例，并不构成对终端设备6的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件，例如所述终端设备还可以包括输入输出设备、网络接入设备、总线等。
所称处理器60可以是中央处理单元（Central Processing Unit，CPU），还可以是其他通用处理器、数字信号处理器（Digital Signal Processor，DSP）、专用集成电路（Application Specific Integrated Circuit，ASIC）、现成可编程门阵列（Field-Programmable Gate Array，FPGA）或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。
所述存储器61可以是所述终端设备6的内部存储单元，例如终端设备6的硬盘或内存。所述存储器61也可以是所述终端设备6的外部存储设备，例如所述终端设备6上配备的插接式硬盘，智能存储卡（Smart Media Card，SMC），安全数字（Secure Digital， SD）卡，闪存卡（Flash Card）等。进一步地，所述存储器61还可以既包括所述终端设备6的内部存储单元也包括外部存储设备。所述存储器61用于存储所述计算机可读指令以及所述终端设备所需的其他程序和数据。所述存储器61还可以用于暂时地存储已经输出或者将要输出的数据。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
所述集成的模块/单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请实现上述实施例方法中的全部或部分流程，也可以通过计算机可读指令来指令相关的硬件来完成，所述的计算机可读指令可存储于一计算机可读存储介质中，该计算机可读指令在被处理器执行时，可实现上述各个方法实施例的步骤。其中，所述计算机可读指令包括计算机可读指令代码，所述计算机可读指令代码可以为源代码形式、对象代码形式、可执行文件或某些中间形式等。所述计算机可读介质可以包括：能够携带所述计算机可读指令代码的任何实体或装置、记录介质、U盘、移动硬盘、磁碟、光盘、计算机存储器、只读存储器（ROM，Read-Only Memory）、随机存取存储器（RAM，Random Access Memory）、电载波信号、电信信号以及软件分发介质等。需要说明的是，所述计算机可读介质包含的内容可以根据司法管辖区内立法和专利实践的要求进行适当的增减，例如在某些司法管辖区，根据立法和专利实践，计算机可读介质不包括电载波信号和电信信号。
以上所述实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的精神和范围，均应包含在本申请的保护范围之内。

Claims (20)

  1. 一种监控进程运行的方法，其特征在于，包括：
    获取目标进程创建的子进程标识；所述子进程标识用于标记目标子进程，所述目标子进程用于对所述目标进程进行中断监控；
    根据所述子进程标识为所述目标子进程分配监控线程，所述监控线程用于当检测到所述目标子进程被禁止时，生成用于禁止向所述目标进程配置系统资源的禁止指令；
    若检测到所述禁止指令，则禁止向所述目标进程配置系统资源。
  2. 根据权利要求1所述的监控进程运行的方法，其特征在于，所述获取目标进程创建的子进程标识之前，包括：
    若检测到用于执行目标进程的预设指令，则向所述目标进程发送用于创建子进程的控制指令，以使所述目标进程根据所述控制指令创建目标子进程。
  3. 根据权利要求2所述的监控进程运行的方法，其特征在于，所述方法还包括：
    启动所述目标子进程，以在检测到用于中断所述目标进程的中断指令时，终止所述目标进程。
  4. 根据权利要求3所述的监控进程运行的方法，其特征在于，所述启动所述目标子进程，包括：
    若检测到所述目标子进程创建完成，则启动所述目标子进程；
    若所述目标子进程检测到所述目标进程的执行过程中被插入断点，则对所述断点进行解析，以得到断点指令；
    若所述断点指令为INT3断点指令，则所述目标子进程生成终止指令，以终止所述目标进程。
  5. 根据权利要求1所述的监控进程运行的方法，其特征在于，所述根据所述子进程标识为所述目标子进程分配监控线程，包括：
    若检测到对所述目标进程进行初始化的预设操作，则获取当前所有可调用线程；
    根据所述子进程标识，从所述当前所有可调用线程中确定出可执行子进程的线程，以得到目标线程队列；
    从所述目标线程队列中选取出任一线程作为所述监控线程。
  6. 一种终端设备，其特征在于，包括：
    获取单元，用于获取目标进程创建的子进程标识。其中，所述子进程标识用于标记目标子进程，所述目标子进程用于对所述目标进程进行中断监控；
    分配单元，用于根据所述子进程标识为所述目标子进程分配监控线程，所述监控线程用于当检测到所述目标子进程被禁止时，生成用于禁止向所述目标进程配置系统资源的禁止指令；
    执行单元，用于若检测到所述禁止指令，则禁止向所述目标进程配置系统资源。
  7. 根据权利要求6所述的终端设备，其特征在于，还包括：
    发送单元，用于若检测到用于执行目标进程的预设指令，则向所述目标进程发送用于创建子进程的控制指令，以使所述目标进程根据所述控制指令创建目标子进程。
  8. 根据权利要求7所述的终端设备，其特征在于，还包括：
    启动单元，用于启动所述目标子进程，以在检测到用于中断所述目标进程的中断指令时，终止所述目标进程。
  9. 根据权利要求8所述的终端设备，其特征在于，所述启动单元具体用于：
    若检测到所述目标子进程创建完成，则启动所述目标子进程；
    若所述目标子进程检测到所述目标进程的执行过程中被插入断点，则对所述断点进行解析，以得到断点指令；
    若所述断点指令为INT3断点指令，则所述目标子进程生成终止指令，以终止所述目标进程。
  10. 根据权利要求6所述的终端设备，其特征在于，所述分配单元具体用于：
    若检测到对所述目标进程进行初始化的预设操作，则获取当前所有可调用线程；
    根据所述子进程标识，从所述当前所有可调用线程中确定出可执行子进程的线程，以得到目标线程队列；
    从所述目标线程队列中选取出任一线程作为所述监控线程。
  11. 一种终端设备，包括存储器、处理器以及存储在所述存储器中并可在所述处理器上运行的计算机可读指令，其特征在于，所述处理器执行所述计算机可读指令时实现如下步骤：
    获取目标进程创建的子进程标识；所述子进程标识用于标记目标子进程，所述目标子进程用于对所述目标进程进行中断监控；
    根据所述子进程标识为所述目标子进程分配监控线程，所述监控线程用于当检测到所述目标子进程被禁止时，生成用于禁止向所述目标进程配置系统资源的禁止指令；
    若检测到所述禁止指令，则禁止向所述目标进程配置系统资源。
  12. 根据权利要求11所述的终端设备，其特征在于，所述获取目标进程创建的子进程标识之前，包括：
    若检测到用于执行目标进程的预设指令，则向所述目标进程发送用于创建子进程的控制指令，以使所述目标进程根据所述控制指令创建目标子进程。
  13. 根据权利要求12所述的终端设备，其特征在于，所述处理器执行所述计算机可读指令时还实现如下步骤：
    启动所述目标子进程，以在检测到用于中断所述目标进程的中断指令时，终止所述目标进程。
  14. 根据权利要求13所述的终端设备，其特征在于，所述启动所述目标子进程，包括：
    若检测到所述目标子进程创建完成，则启动所述目标子进程；
    若所述目标子进程检测到所述目标进程的执行过程中被插入断点，则对所述断点进行解析，以得到断点指令；
    若所述断点指令为INT3断点指令，则所述目标子进程生成终止指令，以终止所述目标进程。
  15. 根据权利要求11所述的终端设备，其特征在于，所述根据所述子进程标识为所述目标子进程分配监控线程，包括：
    若检测到对所述目标进程进行初始化的预设操作，则获取当前所有可调用线程；
    根据所述子进程标识，从所述当前所有可调用线程中确定出可执行子进程的线程，以得到目标线程队列；
    从所述目标线程队列中选取出任一线程作为所述监控线程。
  16. 一种计算机可读存储介质，所述计算机可读存储介质存储有计算机可读指令，其特征在于，所述计算机可读指令被处理器执行时实现如下步骤：
    获取目标进程创建的子进程标识；所述子进程标识用于标记目标子进程，所述目标子进程用于对所述目标进程进行中断监控；
    根据所述子进程标识为所述目标子进程分配监控线程，所述监控线程用于当检测到所述目标子进程被禁止时，生成用于禁止向所述目标进程配置系统资源的禁止指令；
    若检测到所述禁止指令，则禁止向所述目标进程配置系统资源。
  17. 根据权利要求16所述的计算机可读存储介质，其特征在于，所述获取目标进程创建的子进程标识之前，包括：
    若检测到用于执行目标进程的预设指令，则向所述目标进程发送用于创建子进程的控制指令，以使所述目标进程根据所述控制指令创建目标子进程。
  18. 根据权利要求17所述的计算机可读存储介质，其特征在于，所述计算机可读指令被处理器执行时还实现如下步骤：
    启动所述目标子进程，以在检测到用于中断所述目标进程的中断指令时，终止所述目标进程。
  19. 根据权利要求18所述的计算机可读存储介质，其特征在于，所述启动所述目标子进程，包括：
    若检测到所述目标子进程创建完成，则启动所述目标子进程；
    若所述目标子进程检测到所述目标进程的执行过程中被插入断点，则对所述断点进行解析，以得到断点指令；
    若所述断点指令为INT3断点指令，则所述目标子进程生成终止指令，以终止所述目标进程。
  20. 根据权利要求16所述的计算机可读存储介质，其特征在于，所述根据所述子进程标识为所述目标子进程分配监控线程，包括：
    若检测到对所述目标进程进行初始化的预设操作，则获取当前所有可调用线程；
    根据所述子进程标识，从所述当前所有可调用线程中确定出可执行子进程的线程，以得到目标线程队列；
    从所述目标线程队列中选取出任一线程作为所述监控线程。
PCT/CN2018/097120 2018-05-22 2018-07-25 监控进程运行的方法、终端设备及计算机可读存储介质 WO2019223095A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810496141.5 2018-05-22
CN201810496141.5A CN108776633B (zh) 2018-05-22 2018-05-22 监控进程运行的方法、终端设备及计算机可读存储介质

Publications (1)

Publication Number Publication Date
WO2019223095A1 true WO2019223095A1 (zh) 2019-11-28

Family

ID=64027515

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/097120 WO2019223095A1 (zh) 2018-05-22 2018-07-25 监控进程运行的方法、终端设备及计算机可读存储介质

Country Status (2)

Country Link
CN (1) CN108776633B (zh)
WO (1) WO2019223095A1 (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111198723B (zh) * 2018-11-19 2023-03-07 深圳市优必选科技有限公司 一种进程注入方法、终端设备及计算机可读存储介质
CN110941825B (zh) * 2019-12-13 2022-05-27 支付宝(杭州)信息技术有限公司 一种应用监控方法及装置
CN111381965B (zh) * 2020-03-03 2023-01-31 百度在线网络技术（北京）有限公司 用于处理请求的方法和装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060136916A1 (en) * 2004-12-17 2006-06-22 Rowland John R Method and apparatus for transaction performance and availability management based on program component monitor plugins and transaction performance monitors
CN1996257A (zh) * 2006-12-26 2007-07-11 华为技术有限公司 对进程进行监控的方法和系统
CN104156298A (zh) * 2014-08-19 2014-11-19 腾讯科技（深圳）有限公司 一种应用监控方法及装置
CN105574406A (zh) * 2015-12-23 2016-05-11 北京奇虎科技有限公司 一种进程监控的方法和装置

Family Cites Families (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102436404B (zh) * 2011-08-24 2013-08-14 苏州阔地网络科技有限公司 一种进程守护方法
CN103246589B (zh) * 2012-02-03 2015-07-15 京信通信系统（中国）有限公司 一种多线程的监控方法及装置
CN103383689A (zh) * 2012-05-03 2013-11-06 阿里巴巴集团控股有限公司 一种服务进程故障检测方法、装置及服务节点
CN103440189A (zh) * 2013-08-13 2013-12-11 江苏华大天益电力科技有限公司 一种基于进程强制运行控制的软件抗死锁方法
CN104932965B (zh) * 2014-03-18 2019-05-28 北京奇虎科技有限公司 对象实时监控方法和装置
CN106330523A (zh) * 2015-07-03 2017-01-11 中国移动通信集团广西有限公司 一种集群服务器容灾系统、方法和服务器节点
JP2017091077A (ja) * 2015-11-06 2017-05-25 富士通株式会社 擬似故障の発生プログラム、発生方法、及び発生装置

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060136916A1 (en) * 2004-12-17 2006-06-22 Rowland John R Method and apparatus for transaction performance and availability management based on program component monitor plugins and transaction performance monitors
CN1996257A (zh) * 2006-12-26 2007-07-11 华为技术有限公司 对进程进行监控的方法和系统
CN104156298A (zh) * 2014-08-19 2014-11-19 腾讯科技（深圳）有限公司 一种应用监控方法及装置
CN105574406A (zh) * 2015-12-23 2016-05-11 北京奇虎科技有限公司 一种进程监控的方法和装置

Also Published As

Publication number Publication date
CN108776633B (zh) 2021-07-02
CN108776633A (zh) 2018-11-09

Similar Documents

Publication Publication Date Title
US9990490B2 (en) Generic privilege escalation prevention
CN108197032B (zh) Ios应用的主线程卡顿监测方法、介质、设备及系统
CN100492300C (zh) 在微处理器实现的设备上执行进程的系统和方法
WO2022027867A1 (zh) 基于mdc多线程链路追踪方法、装置及计算机可读存储介质
US20050251864A1 (en) System for invoking a privileged function in a device
WO2019223095A1 (zh) 监控进程运行的方法、终端设备及计算机可读存储介质
JP5159896B2 (ja) プロセス分離実行を通じたｄｒｍクライアント衝突防止システム及び方法
US11032159B2 (en) Apparatus for preformance analysis of virtual network functions in network functional virtualization platform and method thereof
CN107122656B (zh) 一种通过自调试防止外部调试的方法和装置
CN101599113A (zh) 驱动型恶意软件防御方法和装置
US10867030B2 (en) Methods and devices for executing trusted applications on processor with support for protected execution environments
CN113282436A (zh) 事件处理方法、装置、设备以及存储介质
WO2021139113A1 (zh) 交易信息的加签方法、装置、计算机设备和存储介质
US20170235943A1 (en) Application Access Control Method and Apparatus
CN115454576B (zh) 一种虚拟机进程管理方法、系统及电子设备
JPWO2008111382A1 (ja) 情報処理装置、情報処理方法およびプログラム
US7784034B1 (en) System, method and computer program product for hooking a COM interface
CN116956272A (zh) 权限调用监控方法、装置及电子设备
CN113836529A (zh) 进程检测方法、装置、存储介质以及计算机设备
CN114238021A (zh) 一种sdk接口定位方法、装置、设备及计算机存储介质
CN104572036B (zh) 事件的处理方法及装置
CN113961366A (zh) 操作系统的内核函数调用方法及计算机设备
CN112632534A (zh) 一种恶意行为检测方法及装置
CN113448585A (zh) 一种对线程池的优化方法、装置、电子设备和存储介质
WO2020082354A1 (zh) 一种系统状态检测方法、系统状态装置及终端设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18920151

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 18920151

Country of ref document: EP

Kind code of ref document: A1

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 15-04-2021)

122 Ep: pct application non-entry in european phase

Ref document number: 18920151

Country of ref document: EP

Kind code of ref document: A1