SYSTEM SECURITY METHOD AND APPARATUS

• US 20190318089A1
• Filed: 03/20/2019
• Published: 10/17/2019
• Est. Priority Date: 11/11/2016
• Status: Active Grant

• Current Assignee: Tencent Technology Shenzhen Company Limited (Tencent Holdings Limited)
• Original Assignee: Tencent Technology Shenzhen Company Limited (Tencent Holdings Limited)
• Inventors: WANG, Lingling
• Granted Patent: US 11,126,716 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 18/214 Generating training patterns; Bootstrap methods, e.g. bagging or boosting
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/564 by virus signature recognition
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06N 20/20 Ensemble learning
• CPC Class Codes: G06N 3/04 Architecture, e.g. interconnection topology

Abstract

A safeguarding method, a safeguarding apparatus, and a computer storage medium are provided. The method includes detecting a program operating on a terminal, and intercepting an operation performed by the program; identifying an object on which the program performs the operation; obtaining configuration information of the object on the terminal, and determining, based on the configuration information, that the object is a targeted monitored object. The method further includes determining, based on the configuration information of the targeted monitored object, whether the operation performed by the program on the object is a legitimate operation; and canceling intercepting the operation if the operation is a legitimate operation, and continuously intercepting the operation if the operation is an illegitimate operation.

Claims

1. A system safeguarding method, comprising:

detecting, by a computing terminal a program operating on a terminal, and intercepting an operation performed by the program;

identifying, by the computing terminal, an object on which the program performs the operation;

obtaining, by the computing terminal, configuration information of the object on the terminal, and determining, based on the configuration information, that the object is a targeted monitored object;

determining, by the computing terminal based on the configuration information of the targeted monitored object, whether the operation performed by the program on the object is a legitimate operation; and

canceling, by the computing terminal, intercepting the operation if the operation is a legitimate operation, and continuously intercepting the operation if the operation is an illegitimate operation.

2. The method according to claim 1, wherein the determining, based on the configuration information, that the object is the targeted monitored object comprises:

determining that the object is the targeted monitored object if the object on which the program performs the operation matches the targeted monitored object based on the configuration information.

3. The method according to claim 2, wherein the determining that the object is the targeted monitored object if the object on which the program performs the operation matches the targeted monitored object based on the configuration information comprises:

determining that the object is the targeted monitored object if the object on which the program performs the operation is a program based on the configuration information, and the program is in a foreground operating state.

4. The method according to claim 1, wherein determining, based on the configuration information of the targeted monitored object, whether the operation performed by the program on the object is a legitimate operation comprises:

determining whether a pre-configured illegitimate operation in the configuration information of the targeted monitored object corresponds to the operation performed by the program on the object, and if yes, determining that the operation performed by the program on the object is an illegitimate operation;

otherwise, determining that the operation is a legitimate operation.

5. The method according to claim 1, further comprising:

detecting the program by matching a malicious program signature database of the terminal with an attribute of the program or running a malicious program detection service when it is determined that the object is a non-targeted monitored object; and

performing a prompt operation based on a detection result.

6. The method according to claim 5, wherein the detecting the program by matching a malicious program signature database of the terminal with an attribute of the program and running a malicious program detection service comprises:

matching an attribute comprised in the malicious program signature database of the terminal with the attribute of the program, and if the attributes are not matched, detecting the program by invoking a malicious program detection service in a cloud.

7. The method according to claim 5, wherein the detecting the program by matching a malicious program signature database of the terminal with an attribute of the program comprises:

correspondingly matching attributes in at least two dimensions comprised in the malicious program signature database of the terminal with attributes in corresponding dimensions of the program, and determining that the program is a malicious program when attributes in at least one dimension are successfully matched.

8. The method according to claim 5, wherein the detecting the program by running a malicious program detection service comprises:

determining weights corresponding to attributes in different dimensions of the program, matching the attributes in the different dimensions with an attribute of a prior malicious program in parallel, and determining, based on a weight corresponding to a successfully matched attribute, whether the detected program is a malicious program.

9. The method according to claim 8, wherein the determining, based on a weight corresponding to a successfully matched attribute, whether the detected program is a malicious program comprises:

determining whether a sum of the weights corresponding to the successfully matched attributes is greater than a sum threshold, and if it is determined that the detected program is a malicious program, determining a corresponding threat level based on a value by which the sum exceeds the sum threshold;

otherwise, determining that the detected program is a trusted program.

10. The method according to claim 8, wherein the determining weights corresponding to attributes in different dimensions of the program comprises:

inputting the attributes in different dimensions of the program into a machine learning model used for weight distribution, and distributing, based on distribution of attributes in different dimensions of a prior malicious program, a weight for an attribute in a corresponding dimension of the program.

11. The method according to claim 10, further comprising:

updating a training set of the machine learning model with a sample constructed based on the detection result of the program, training a multilayer feed-forward neural network in the machine learning model based on the training set, and correcting an error of the multilayer feed-forward neural network based on the multilayer feed-forward neural network.

12. A safeguarding apparatus, comprising a processor and a memory, the processor being capable of running a computer executable instruction in each function unit on the memory, and the functional unit on the memory comprising:

a monitoring unit, configured to detect a program running on a terminal, and determine an object on which an operation is performed by the program;

an interception unit, configured to intercept the operation performed by the program;

a targeted monitoring determining unit, configured to obtain configuration information of a targeted monitored object in the terminal, and determine, based on the configuration information, that the object is the targeted monitored object; and

a processing unit, configured to determining, based on the configuration information of the targeted monitored object, whether the operation performed by the program on the object is a legitimate operation,

the interception unit canceling intercepting the operation if the operation is a legitimate operation, and continuously intercepting the operation if the operation is an illegitimate operation.

13. The apparatus according to claim 12, wherein

the targeted monitoring determining unit determines that the object is the targeted monitored object if the object on which the program performs the operation matches the targeted monitored object configured in the configuration information.

14. The apparatus according to claim 13, wherein

the targeted monitoring determining unit determines that the object is the targeted monitored object if the object on which the program performs the operation is a program configured in the configuration information, and the program is in a foreground operating state.

15. The apparatus according to claim 12, wherein

the processing unit determines whether a pre-configured illegitimate operation in the configuration information of the targeted monitored object comprises the operation performed by the program on the object, and if yes, determines that the operation performed by the program on the object is an illegitimate operation;

otherwise, the operation is a legitimate operation.

16. The apparatus according to claim 12, wherein

the processing unit detects the program by matching a malicious program signature database of the terminal with an attribute of the program when it is determined that the object is a non-targeted monitored object;

and/or

detects the program running a malicious program detection service and performs a prompt operation based on a detection result.

17. The apparatus according to claim 16, wherein

the processing unit matches an attribute comprised in the malicious program signature database of the terminal with the attribute of the program, and if the attributes are not matched, detects the program by invoking the malicious program detection service in a cloud.

18. The apparatus according to claim 16, wherein

the processing unit correspondingly matches attributes in at least two dimensions comprised in the malicious program signature database of the terminal with attributes in corresponding dimensions of the program, and determines that the program is a malicious program when attributes in at least one dimension are successfully matched.

19. A non-transitory computer-readable storage medium storing computer program instructions executable by at least one processor to perform:

;

detecting a program running on the terminal, and intercepting an operation performed by the program;

determining an object on which the program performs the operation;

obtaining configuration information of a targeted monitored object in the terminal, and determining, based on the configuration information, that the object is the targeted monitored object;

determining, based on the configuration information of the targeted monitored object, whether the operation performed by the program on the object is a legitimate operation; and

canceling intercepting the operation if the operation is a legitimate operation, and continuously intercepting the operation if the operation is an illegitimate operation.

20. The storage medium according to claim 19, wherein the determining, based on the configuration information, that the object is the targeted monitored object comprises:

determining that the object is the targeted monitored object if the object on which the program performs the operation matches the targeted monitored object configured in the configuration information.