CN105678167A - Safety protection method and apparatus - Google Patents

Abstract

The present invention provides a security protection method and device, wherein the security protection method includes: when the behavior of the process matches the preset local trigger strategy, upload the description information of the behavior of the process to the server, so that the server When it is determined that the behavior of the process matches any preset risk behavior, a temporary security policy corresponding to the preset risk behavior is issued; the temporary security policy includes: the withdrawal conditions of the temporary security policy, and Set the processing operation of the risky behavior and its triggering conditions; receive the temporary security policy from the server; load the temporary security policy to execute the corresponding processing operation when any triggering condition is met, and revoke the temporary security policy when any revocation condition is met. The present invention can solve the problem of contradiction between user resource occupation and application effectiveness in existing security policies, and greatly improve the operating efficiency and user experience of security protection software.

Description

Safety protection method and device

technical field

The invention relates to the field of computer technology, in particular to a safety protection method and device.

Background technique

Malicious program is an umbrella term for any program of code deliberately created to perform unauthorized and often harmful behavior, such as computer viruses, backdoors, keyloggers, password stealers, macro viruses, boot sector viruses , script viruses, Trojan horses, crimeware, spyware, adware, and more.

In order to cope with the huge and increasing number of malicious programs, existing security protection software can enhance the security protection capability against malicious programs by monitoring the behavior of application programs and monitoring and processing each behavior according to security policies. Among them, the security policy, as the core of the security protection capability, is usually updated, maintained and distributed by the server in the whole network. Of course, a unified security policy for the entire network has outstanding advantages in terms of timeliness and maintenance costs, but it has a big flaw in the balance between user resource occupation and application effectiveness.

For example, for a certain type of advertising promotion program, only stricter monitoring methods can be effectively intercepted, but if this monitoring method is applied in a unified security policy for the entire network, then all user terminals need to continuously execute Monitoring greatly increases the resource occupation of the user terminal; what's more, the popularity of this type of advertising promotion program may not be high, so the monitoring process on most user terminals may be meaningless. For this situation, the existing security protection software will adopt relatively loose monitoring means in consideration of user experience, but this will lose the effectiveness of blocking this type of advertising promotion program.

Contents of the invention

Aiming at the defects in the prior art, the present invention provides a security protection method and device, which can solve the problem of contradiction between user resource occupation and application effectiveness in existing security policies.

In a first aspect, the present invention provides a safety protection device, comprising:

The upload unit is used to upload the description information of the behavior of the process to the server when the behavior of the process matches the preset local trigger strategy, so that the server can judge whether the behavior of the process is consistent with any preset risk behavior When matching, issue a temporary security policy corresponding to the preset risk behavior; the temporary security policy includes: the revocation conditions of the temporary security policy, and the processing operations and trigger conditions used to deal with the preset risk behavior ;

a receiving unit, configured to receive the temporary security policy from the server;

The loading unit is configured to load the temporary security policy obtained by the receiving unit, so as to execute corresponding processing operations when any of the trigger conditions are met, and revoke the temporary security policy when any of the revocation conditions are met.

Optionally, the loading unit is further configured to load the temporary security policy into the memory, so that the temporary security policy can be canceled automatically after the memory is powered off.

Optionally, the behavior of the process matching the local trigger policy includes any one or more of the following:

Access to network addresses not related to the functionality of the application to which the process belongs;

Downloading files that are not related to the functionality of the application to which the process belongs;

Create a process that is not related to the functionality of the application to which the process belongs;

Inject code into other processes unrelated to the application to which the process belongs;

Write a file under the protected file directory;

Behavior of processes associated with blacklisted applications.

Optionally, the situation that the behavior of the process matches any preset risk behavior includes any one or more of the following:

Said process matches any of the preset risk processes;

The behavior of the process matches any of the preset risk behaviors;

The behavior of the process matches the precursor behavior of any predetermined risk behavior.

Optionally, the revocation conditions of the temporary security policy include any one or more of the following:

The effective time of the temporary security policy exceeds a predetermined threshold;

The user has approved the preset risk behavior in the prompt message;

The processing operation with the end mark in the temporary security policy has been completed;

A revocation instruction message from the server is received.

Optionally, the processing operations and trigger conditions for dealing with preset risk behaviors include any one or more of the following:

Operations that limit the operating authority and/or system resource usage of the process without triggering conditions;

Taking the detection of a preset risky behavior as a trigger condition to intercept the behavior of the process;

Taking the detection of a preset high-risk behavior as a trigger condition, ending the operation of the process or the application program to which the process belongs;

The detection of residual files is used as a trigger condition to clean up the residual files.

In a second aspect, the present invention also provides a safety protection device, comprising:

The receiving unit is configured to receive the description information of the behavior of the process from the terminal; the description information of the behavior of the process matches the preset local trigger strategy of the terminal;

a judging unit, configured to judge whether the behavior of the process matches any preset risk behavior according to the description information obtained by the receiving unit;

an issuing unit, configured to issue a temporary security policy corresponding to the preset risk behavior to the terminal when the judging unit judges that the behavior of the process matches any preset risk behavior, so that the The terminal receives and loads the temporary security policy;

Wherein, the temporary security policy includes: the revocation condition of the temporary security policy, and processing operations and trigger conditions for dealing with preset risk behaviors, so that the terminal loaded with the temporary security policy can Execute corresponding processing operations when the conditions are met, and revoke the temporary security policy when any revocation condition is met.

Optionally, the situation that the behavior of the process matches any preset risk behavior includes any one or more of the following:

Said process matches any of the preset risk processes;

The behavior of the process matches any of the preset risk behaviors;

The behavior of the process matches the precursor behavior of any predetermined risk behavior.

In a third aspect, the present invention also provides a safety protection method, including:

When the behavior of the process matches the preset local trigger policy, upload the description information of the behavior of the process to the server, so that when the server determines that the behavior of the process matches any preset risk behavior, download Sending a temporary security policy corresponding to the preset risk behavior; the temporary security policy includes: a revocation condition of the temporary security policy, and processing operations and trigger conditions for dealing with the preset risk behavior;

receiving the temporary security policy from the server;

Loading the temporary security policy to perform corresponding processing operations when any of the trigger conditions are met, and revoke the temporary security policy when any of the revocation conditions are met.

In a fourth aspect, the present invention also provides a safety protection method, including:

receiving the description information of the behavior of the process from the terminal; the description information of the behavior of the process matches the preset local trigger policy of the terminal;

judging whether the behavior of the process matches any preset risk behavior according to the description information;

When the behavior of the process matches any preset risk behavior, issue a temporary security policy corresponding to the preset risk behavior to the terminal, so that the terminal receives and loads the temporary security policy;

Wherein, the temporary security policy includes: the revocation condition of the temporary security policy, and processing operations and trigger conditions for dealing with preset risk behaviors, so that the terminal loaded with the temporary security policy can Execute corresponding processing operations when the conditions are met, and revoke the temporary security policy when any revocation condition is met.

It can be known from the above technical solution that the present invention can identify the risky operation to be executed by the process based on the setting of the local trigger policy, and can deal with the risky operation based on the setting of the temporary security policy. It can be understood that the targeted temporary security policy adopts strict monitoring means to effectively deal with malicious programs, and since the temporary security policy includes revocation conditions, it will not occupy the resources of the user terminal for a long time. Therefore, the present invention can solve the problem that existing security policies have contradictions between user resource occupation and application effectiveness.

Compared with the prior art, the present invention can improve the application effectiveness of security policies under the condition of equal user resource occupation, and can also reduce user resource occupation under the condition of ensuring application effectiveness. Moreover, the present invention can deal with risky operations of malicious programs in a targeted manner, not only occupying user resources and improving application effectiveness, but also realizing the interception of risky operations and the release of other operations. In addition, the storage, maintenance and distribution of temporary security policies can be realized by the server, which can effectively use its powerful information storage, collection and computing capabilities. It can be seen that the present invention can provide users with safer and more efficient security protection, greatly improving the operating efficiency and user experience of security protection software.

Of course, implementing any product or method of the present invention does not necessarily need to achieve all the above-mentioned advantages at the same time.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will give a brief introduction to the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description These are some embodiments of the present invention. Those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is a schematic flow chart of the steps of a security protection method in an embodiment of the present invention;

Fig. 2 is a schematic flow chart of a safety protection method in another embodiment of the present invention;

FIG. 3 is a schematic diagram of an interaction process between a terminal and a server in an embodiment of the present invention;

Fig. 4 is a structural block diagram of a safety protection device in an embodiment of the present invention;

Fig. 5 is a structural block diagram of a safety protection device in another embodiment of the present invention.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts fall within the protection scope of the present invention.

Fig. 1 is a schematic flowchart of steps of a security protection method in an embodiment of the present invention. Referring to Figure 1, the safety protection method includes:

Step 101: When the behavior of the process matches the preset local trigger policy, upload the description information of the behavior of the process to the server, so that the server can determine that the behavior of the process matches any preset risk behavior , issue a temporary security policy corresponding to the preset risk behavior; the temporary security policy includes: the revocation conditions of the temporary security policy, and the processing operations and trigger conditions used to deal with the preset risk behavior;

Step 102: Receive a temporary security policy from the server;

Step 103: Load the temporary security policy to perform corresponding processing operations when any trigger condition is met, and revoke the temporary security policy when any revocation condition is met.

It can be understood that the security protection method of the present invention can be applied to any terminal equipment, such as personal computers (such as desktop computers, notebook computers, tablet computers, all-in-one computers), smart phones, e-books, smart TVs, digital Any kind of equipment such as photo frame and smart navigator. And it can be understood that the above-mentioned step 101 can be executed independently of step 102 and step 103, and does not need to have a certain sequence; and step 102 and step 103 need to be executed after step 101, and step 103 needs to be executed after step 103 Execute after 102.

Corresponding to the security protection method applied to the terminal shown in FIG. 1 , FIG. 2 is a schematic flowchart of steps of a security protection method applied to the server in another embodiment of the present invention. Referring to Figure 2, the method includes:

Step 201: Receive the description information of the behavior of the process from the terminal; the description information of the behavior of the process matches the preset local trigger strategy of the terminal;

Step 202: According to the description information, determine whether the behavior of the process matches any preset risk behavior;

Step 203: When the behavior of the process matches any preset risk behavior, issue a temporary security policy corresponding to the preset risk behavior to the terminal, so that the terminal receives and loads the temporary security policy;

Among them, the temporary security policy includes: the revocation conditions of the temporary security policy, and the processing operations and trigger conditions used to deal with preset risk behaviors, so that the terminal loaded with the temporary security policy executes the corresponding processing operation when any trigger condition is met , and revoke the temporary security policy when any revoking condition is met.

It can be understood that the security protection method of the present invention can be applied to any kind of server device, such as a single server device, server group, server cluster or cloud server device, etc., and the present invention is not limited thereto.

It should be noted that the above-mentioned process can be a process running in the operating system and performing corresponding functions for any one or more applications; the behavior of the above-mentioned process refers to the actual operation or set of operations performed by the process, such as downloading files , write files to disk, inject code into other processes, and more. The above local trigger policy is pre-configured and is mainly used to describe what kind of process and/or its behavior needs attention from the perspective of security protection; of course, it can come from the delivery of external devices or from the The user's setting based on the default version may also be a combination of the two, which is not limited in the present invention. The above description information may belong to a part of the local trigger policy, or may be set separately, and is mainly used to describe which parameters are specifically concerned about the concerned process and/or its behavior.

It can be understood that the above-mentioned server has a network connection relationship with the device to which the security protection method is applied, so that the device can upload the above-mentioned description information to the server when it obtains the above-mentioned description information. The server is mainly used to analyze whether the behavior of the process matches any preset risk behavior, and deliver the corresponding temporary security policy to the device. Among them, the preset risk behavior refers to the operation that has corresponding description information in the server and is judged to be risky (the source can be artificially defined, automatic analysis of collected data or a combination thereof), such as bundling a certain software, The promotion of some kind of advertisement, the theft of a user name and password of a certain software, etc., belong to the objects that security protection software needs to deal with. The above-mentioned temporary security policy corresponds to a certain or a certain type of preset risk behavior, and is mainly used to deal with the corresponding preset risk behavior in a targeted manner within the effective time. It can be seen that the temporary security policy can be established, maintained and issued in the above-mentioned server (it can be manual operation, automatic operation based on data analysis or a combination thereof), and there are revocation conditions while being targeted. Specifically, the device loads the temporary security policy to make the temporary security policy take effect, so that when any trigger condition is met, corresponding processing operations are performed, such as blocking when downloading malicious programs is detected; and the device revokes the temporary security policy That is, the temporary security policy is invalidated, so that the temporary security policy no longer occupies any system resources.

It can be seen from the above technical solution that any one of the above security protection methods can identify the risky operation to be executed by the process based on the setting of the local trigger policy, and can process the risky operation based on the setting of the temporary security policy. It can be understood that the targeted temporary security policy adopts strict monitoring means to effectively deal with malicious programs, and since the temporary security policy includes revocation conditions, it will not occupy the resources of the user terminal for a long time. Therefore, the embodiments of the present invention can solve the problem that existing security policies have conflicts between user resource occupation and application effectiveness.

Compared with the prior art, the embodiment of the present invention can improve the application effectiveness of the security policy under the condition of equal user resource occupation, and can also reduce the user resource occupation under the condition of ensuring the application effectiveness. Moreover, the embodiments of the present invention can deal with the risky operations of malicious programs in a targeted manner, not only occupying user resources and improving application effectiveness, but also realizing the interception of risky operations and the release of other operations. In addition, the storage, maintenance and distribution of temporary security policies can be realized by the server, which can effectively use its powerful information storage, collection and computing capabilities. It can be seen that the embodiments of the present invention can provide users with safer and more efficient security protection, greatly improving the operating efficiency and user experience of security protection software.

As a more specific example, FIG. 3 is a schematic diagram of an interaction process between a terminal and a server in an embodiment of the present invention. Referring to Figure 3, first, when the behavior of the process matches the preset local trigger policy, the terminal uploads the description information of the behavior of the process to the server (step 101 above), so that the server receives the description of the behavior of the process from the terminal Information (step 201 above), and according to the description information, determine whether the behavior of the process matches any preset risk behavior (step 202 above). It is understandable that since the uploading of the description information is mainly for judging whether the preset risk behavior is happening or will happen, the terminal can directly release the process behavior without corresponding processing when uploading the description information, or can perform corresponding processing to The avoidance of losses mainly depends on the determination of the behavior of the process by the local security policy, which is not limited in the present invention. When the server determines that the behavior of the process does not match any of the preset risk behaviors, it means that the behavior of the process has not detected any security risks, so it can return a corresponding message to the terminal for release processing, or neither the server nor the terminal Do further processing to reduce system resource usage.

However, if the behavior of the process matches any preset risk behavior, then the server issues a temporary security policy corresponding to the preset risk behavior to the terminal (the above-mentioned step 203), so that the terminal receives the temporary security policy (the above-mentioned step 102) and load the temporary security policy, so as to execute the corresponding processing operation when any trigger condition is satisfied, and revoke the temporary security policy when any revocation condition is satisfied (step 103 above). For example, according to the received description information, the server judges that the downloading behavior of the browser process matches the preset risk behavior of the bundled music player software, and then issues a temporary security policy corresponding to the bundled music player software to the terminal. The temporary security policy includes the triggering condition of any process writing any related file of the music player software to the disk, the processing operation of intercepting the writing behavior, and cleaning up all the related files of the music player software the revocation conditions. It can be understood that the interaction process shown in FIG. 3 corresponds to the issuance, validation and invalidation process of a temporary security policy. In actual application scenarios, multiple such processes can be performed in parallel or in parallel.

Furthermore, for the revocation mechanism of the temporary security policy represented by the above revocation conditions, several representative examples are given below:

First, the temporary security policy is directly loaded into the memory, so that the temporary security policy can be automatically revoked after the memory is powered off. That is, the above step 103: load the temporary security policy to perform corresponding processing operations when any trigger condition is met, and revoke the temporary security policy when any revocation condition is met, including step 103a not shown in the figure: set the temporary security policy to The policy is loaded into memory so that the temporary security policy revokes itself after the memory is powered off. In this case, the information for instructing the terminal to load the temporary security policy into the memory is equivalent to a revocation condition included in the temporary security policy. Of course, in this case, other revocation conditions may not be set in the temporary security policy, and other revocation conditions may also be set corresponding to other situations that should be revoked, which is not limited in the present invention.

Second, the revocation condition includes that the effective time of the temporary security policy exceeds a predetermined threshold. Wherein, the preset threshold may be determined by the server based on the time relationship between the behavior matching the local trigger policy and the preset risk behavior, and in combination with the system resource occupation of the terminal. For example, there is usually not a long interval between the act of downloading the installation package of the bundled software and the act of prompting the user whether to install it, and the monitoring of the pop-up window will only occupy a small amount of system resources, so a predetermined threshold can be set after comprehensive consideration 15 to 40 minutes. Of course, when the description information includes information about available system resources, the server can determine the specific preset threshold based on the occupancy of the system resources of the terminal and the above-mentioned time relationship.

Third, the revocation condition includes that the user approves the preset risk behavior in the prompt message. For example, the temporary security policy can issue a prompt to the user whether to intercept the preset risk behavior. If the user chooses to allow the preset risk behavior, for example, the user chooses to allow the installation of the bundled software in the process of intercepting the bundled software. Then the temporary security policy may no longer take effect under the above revocation conditions, so as to avoid further occupation of system resources.

Fourth, the revocation condition includes that the processing operation with the end mark in the temporary security policy has been completed. Specifically, some of the processing operations included in the temporary security policy are end items, so an end mark can be added to these processing operations in advance; so that when the temporary security policy finishes executing any of these processing operations, Make the temporary security policy invalid according to the above revocation conditions to avoid further occupation of system resources.

Fifth, the revocation condition includes receiving a revocation instruction message from the server. Specifically, the revocation condition of the temporary security policy may not be judged by the local process but executed by the server. For example, if the server determines that there is a possibility of installing a preset risk behavior of a Trojan horse program based on the behavior of a certain process, a corresponding temporary security policy is issued for the preset risk behavior; however, based on the judgment of the subsequent process behavior on the server side, It is also determined that there is no risk of installing a Trojan horse program, so a revocation instruction message can be issued to the terminal, so that the previously issued temporary security policy becomes invalid. Therefore, compared with the prior art, the above security protection method can prevent preset risk behaviors more strictly and achieve better security protection effect.

It should be noted that one of the above-mentioned revocation condition setting methods may be selected, or any combination may be used to adapt to different application scenarios, which is not limited in the present invention.

As a specific example of the setting method of the above local trigger policy, the behavior of the process matching the local trigger policy may include any one or more of the following:

Access to network addresses not related to the functionality of the application to which the process belongs;

Downloading files that are not related to the functionality of the application to which the process belongs;

Create a process that is not related to the functionality of the application to which the process belongs;

Inject code into other processes unrelated to the application to which the process belongs;

Write a file under the protected file directory;

Behavior of processes associated with blacklisted applications.

It should be noted that the application to which the process belongs refers to the application that the process serves, and whether the function is related, whether the process is related to the application, the protected directory, and the blacklist of the application can all come from user settings. , issued by the server, or the default setting of the security protection software, which is not limited in the present invention.

It can be seen that the above-mentioned process behaviors have varying degrees of risks of installing or running malicious programs such as bundled software, Trojan horse programs, and spyware, or providing convenience for the installation, running, and self-protection of malicious programs. The application scenario of is set in the above local trigger strategy.

As a specific example of the setting method of the above-mentioned temporary security policy, the above-mentioned processing operations and trigger conditions for dealing with preset risk behaviors include any one or more of the following:

There are no trigger conditions, operations that limit the operating authority of the process and/or the amount of system resource usage (such as restricting network access to prevent the process from downloading or continuing to download the installation package of malicious programs);

Taking the detection of preset risky behaviors as a trigger condition to intercept the behavior of the process (such as intercepting when the process pops up to promote advertisements);

Use the detection of a preset high-risk behavior as a trigger condition to end the process or end the operation of the application to which the process belongs (such as ending the corresponding installation process when the installation of a Trojan horse program is detected);

The detection of residual files is used as a trigger condition to perform cleaning operations on residual files (for example, corresponding cleaning is performed when residual files of a Trojan horse program are detected).

It can be understood that when the preset risk behaviors that need to be dealt with are known, the above-mentioned processing operations and their trigger conditions involving both detection and processing can be highly targeted, including but not limited to the above-mentioned methods Respond to corresponding preset risk behaviors.

In addition, it should be noted that the situation that the behavior of the above process matches any preset risk behavior may include any one or more of the following: the process matches any preset risk process; the process behavior matches any Matching of preset risk behaviors; the behavior of the process matches the precursor behavior of any preset risk behavior. That is to say, when the server judges whether the behavior of the process matches any preset risk behavior, it can not only match the behavior of the process with any preset risk behavior, but also match the process with the preset risk , or a situation where the behavior of the process matches the precursor behavior of any pre-set risk behavior. Therefore, for the situations where the process itself is risky, the behavior of the process is risky, and the behavior of the process is a precursor to risky behavior, the server can choose according to the specific application scenario to achieve a better security protection effect.

Based on the same inventive concept, Fig. 4 is a structural block diagram of a safety protection device in an embodiment of the present invention. Referring to Figure 4, the safety protection device includes:

The upload unit 41 is configured to upload the description information of the behavior of the process to the server when the behavior of the process matches the preset local trigger policy, so that the server can determine whether the behavior of the process is consistent with any preset risk When the behavior matches, a temporary security policy corresponding to the preset risk behavior is issued; the temporary security policy includes: the revocation conditions of the temporary security policy, and the processing operations and trigger conditions used to deal with the preset risk behavior;

A receiving unit 42, configured to receive the temporary security policy from the server;

The loading unit 43 is configured to load the temporary security policy obtained by the receiving unit 42, so as to execute corresponding processing operations when any trigger condition is met, and revoke the temporary security policy when any revocation condition is met.

It can be understood that the functions realized by the safety protection device correspond to the steps of the safety protection method shown in FIG. 1 one by one, so they can have corresponding structures and functions. It can also be further used to load the temporary security policy into the memory, so that the temporary security policy can be revoked automatically after the memory is powered off, and details will not be described here.

Based on the same inventive concept, Fig. 5 is a structural block diagram of a safety protection device in an embodiment of the present invention. Referring to Figure 5, the safety protection device includes:

The receiving unit 51 is configured to receive the description information of the behavior of the process from the terminal; the description information of the behavior of the process matches the preset local trigger strategy of the terminal;

A judging unit 52, configured to judge whether the behavior of the process matches any preset risk behavior according to the description information obtained by the receiving unit 51;

The delivery unit 53 is configured to deliver a temporary security policy corresponding to the preset risk behavior to the terminal when the judging unit 52 determines that the behavior of the process matches any preset risk behavior, so that the terminal receives and loads the temporary security policy. Strategy;

Among them, the temporary security policy includes: the revocation conditions of the temporary security policy, and the processing operations and trigger conditions used to deal with preset risk behaviors, so that the terminal loaded with the temporary security policy executes the corresponding processing operation when any trigger condition is met , and revoke the temporary security policy when any revoking condition is met.

It can be understood that the functions implemented by the safety protection device correspond one-to-one to the steps and flow of the safety protection method shown in FIG. 2 , so it may have corresponding structures and functions, which will not be repeated here.

It should be understood that each embodiment of the present invention discloses the following technical solutions:

A1, a safety protection device, is characterized in that, comprising:

The upload unit is used to upload the description information of the behavior of the process to the server when the behavior of the process matches the preset local trigger strategy, so that the server can judge whether the behavior of the process is consistent with any preset risk behavior When matching, issue a temporary security policy corresponding to the preset risk behavior; the temporary security policy includes: the revocation conditions of the temporary security policy, and the processing operations and trigger conditions used to deal with the preset risk behavior ;

a receiving unit, configured to receive the temporary security policy from the server;

The loading unit is configured to load the temporary security policy obtained by the receiving unit, so as to execute corresponding processing operations when any of the trigger conditions are met, and revoke the temporary security policy when any of the revocation conditions are met.

A2. The safety protection device according to the aforementioned scheme A1, wherein the loading unit is further configured to load the temporary security policy into the memory, so that the temporary security policy can be automatically canceled after the memory is powered off.

A3. According to the safety protection device described in the aforementioned solution A1, the behavior of the process matching the local trigger policy includes any one or more of the following:

Access to network addresses not related to the functionality of the application to which the process belongs;

Downloading files that are not related to the functionality of the application to which the process belongs;

Create a process that is not related to the functionality of the application to which the process belongs;

Inject code into other processes unrelated to the application to which the process belongs;

Write a file under the protected file directory;

Behavior of processes associated with blacklisted applications.

A4. According to the safety protection device described in the aforementioned scheme A1, it is characterized in that the situation where the behavior of the process matches any preset risk behavior includes any one or more of the following:

Said process matches any of the preset risk processes;

The behavior of the process matches any of the preset risk behaviors;

The behavior of the process matches the precursor behavior of any predetermined risk behavior.

A5. According to the safety protection device described in the aforementioned scheme A1, it is characterized in that the revocation conditions of the temporary safety policy include any one or more of the following:

The effective time of the temporary security policy exceeds a predetermined threshold;

The user has approved the preset risk behavior in the prompt message;

The processing operation with the end mark in the temporary security policy has been completed;

A revocation instruction message from the server is received.

A6. The safety protection device according to the aforementioned scheme A1, characterized in that, the processing operations and trigger conditions for dealing with preset risk behaviors include any one or more of the following:

Operations that limit the operating authority and/or system resource usage of the process without triggering conditions;

Taking the detection of a preset risky behavior as a trigger condition to intercept the behavior of the process;

Taking the detection of a preset high-risk behavior as a trigger condition, ending the operation of the process or the application program to which the process belongs;

The detection of residual files is used as a trigger condition to clean up the residual files.

B7, a kind of safety protection device, is characterized in that, comprises:

The receiving unit is configured to receive the description information of the behavior of the process from the terminal; the description information of the behavior of the process matches the preset local trigger strategy of the terminal;

a judging unit, configured to judge whether the behavior of the process matches any preset risk behavior according to the description information obtained by the receiving unit;

an issuing unit, configured to issue a temporary security policy corresponding to the preset risk behavior to the terminal when the judging unit judges that the behavior of the process matches any preset risk behavior, so that the The terminal receives and loads the temporary security policy;

Wherein, the temporary security policy includes: the revocation condition of the temporary security policy, and processing operations and trigger conditions for dealing with preset risk behaviors, so that the terminal loaded with the temporary security policy can Execute corresponding processing operations when the conditions are met, and revoke the temporary security policy when any revocation condition is met.

B8. According to the safety protection device described in the aforementioned scheme B7, it is characterized in that the situation that the behavior of the process matches any preset risk behavior includes any one or more of the following:

Said process matches any of the preset risk processes;

The behavior of the process matches any of the preset risk behaviors;

The behavior of the process matches the precursor behavior of any predetermined risk behavior.

B9. According to the safety protection device described in the aforementioned scheme B7, it is characterized in that the revocation conditions of the temporary safety policy include any one or more of the following:

The effective time of the temporary security policy exceeds a predetermined threshold;

The user has approved the preset risk behavior in the prompt message;

The processing operation with the end mark in the temporary security policy has been completed;

A revocation instruction message from the server is received.

B10. According to the safety protection device described in the aforementioned scheme B7, it is characterized in that the processing operations and trigger conditions for dealing with preset risk behaviors include any one or more of the following:

Operations that limit the operating authority and/or system resource usage of the process without triggering conditions;

Taking the detection of a preset risky behavior as a trigger condition to intercept the behavior of the process;

Taking the detection of a preset high-risk behavior as a trigger condition, ending the operation of the process or the application program to which the process belongs;

The detection of residual files is used as a trigger condition to clean up the residual files.

C11, a security protection method, is characterized in that, comprises:

When the behavior of the process matches the preset local trigger policy, upload the description information of the behavior of the process to the server, so that when the server determines that the behavior of the process matches any preset risk behavior, download Sending a temporary security policy corresponding to the preset risk behavior; the temporary security policy includes: a revocation condition of the temporary security policy, and processing operations and trigger conditions for dealing with the preset risk behavior;

receiving the temporary security policy from the server;

Loading the temporary security policy to perform corresponding processing operations when any of the trigger conditions are met, and revoke the temporary security policy when any of the revocation conditions are met.

C12. The security protection method according to the aforementioned solution C11, wherein the loading of the temporary security policy is performed to perform corresponding processing operations when any of the trigger conditions are met, and when any of the revocation conditions are met Revoke said temporary security policy, including:

The temporary security policy is loaded into the memory, so that the temporary security policy can be automatically revoked after the memory is powered off.

C13. According to the security protection method described in the aforementioned scheme C11, the behavior of the process matching the local trigger policy includes any one or more of the following:

Access to network addresses not related to the functionality of the application to which the process belongs;

Downloading files that are not related to the functionality of the application to which the process belongs;

Create a process that is not related to the functionality of the application to which the process belongs;

Inject code into other processes unrelated to the application to which the process belongs;

Write a file under the protected file directory;

Behavior of processes associated with blacklisted applications.

C14. According to the security protection method described in the aforementioned scheme C11, it is characterized in that the situation where the behavior of the process matches any preset risk behavior includes any one or more of the following:

Said process matches any of the preset risk processes;

The behavior of the process matches any of the preset risk behaviors;

The behavior of the process matches the precursor behavior of any predetermined risk behavior.

C15. According to the security protection method described in the aforementioned solution C11, it is characterized in that the revocation conditions of the temporary security policy include any one or more of the following:

The effective time of the temporary security policy exceeds a predetermined threshold;

The user has approved the preset risk behavior in the prompt message;

The processing operation with the end mark in the temporary security policy has been completed;

A revocation instruction message from the server is received.

C16. According to the security protection method described in the aforementioned scheme C11, it is characterized in that the processing operations and trigger conditions for dealing with preset risk behaviors include any one or more of the following:

Operations that limit the operating authority and/or system resource usage of the process without triggering conditions;

Taking the detection of a preset risky behavior as a trigger condition to intercept the behavior of the process;

Taking the detection of a preset high-risk behavior as a trigger condition, ending the operation of the process or the application program to which the process belongs;

The detection of residual files is used as a trigger condition to clean up the residual files.

D17. A safety protection method, characterized in that it includes:

receiving the description information of the behavior of the process from the terminal; the description information of the behavior of the process matches the preset local trigger policy of the terminal;

judging whether the behavior of the process matches any preset risk behavior according to the description information;

When the behavior of the process matches any preset risk behavior, issue a temporary security policy corresponding to the preset risk behavior to the terminal, so that the terminal receives and loads the temporary security policy;

Wherein, the temporary security policy includes: the revocation condition of the temporary security policy, and processing operations and trigger conditions for dealing with preset risk behaviors, so that the terminal loaded with the temporary security policy can Execute corresponding processing operations when the conditions are met, and revoke the temporary security policy when any revocation condition is met.

D18. According to the security protection method described in the aforementioned scheme D17, it is characterized in that the situation that the behavior of the process matches any preset risk behavior includes any one or more of the following:

Said process matches any of the preset risk processes;

The behavior of the process matches any of the preset risk behaviors;

The behavior of the process matches the precursor behavior of any predetermined risk behavior.

D19. According to the security protection method described in the aforementioned solution D17, it is characterized in that the revocation conditions of the temporary security policy include any one or more of the following:

The effective time of the temporary security policy exceeds a predetermined threshold;

The user has approved the preset risk behavior in the prompt message;

The processing operation with the end mark in the temporary security policy has been completed;

A revocation instruction message from the server is received.

D20. The safety protection method according to the aforementioned solution D17, wherein the processing operations and trigger conditions for dealing with preset risk behaviors include any one or more of the following:

Operations that limit the operating authority and/or system resource usage of the process without triggering conditions;

Taking the detection of a preset risky behavior as a trigger condition to intercept the behavior of the process;

Taking the detection of a preset high-risk behavior as a trigger condition, ending the operation of the process or the application program to which the process belongs;

The detection of residual files is used as a trigger condition to clean up the residual files.

In the description of the invention, numerous specific details are set forth. However, it is understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure the understanding of this description.

Similarly, it should be appreciated that in the above description of exemplary embodiments of the invention, in order to streamline the present disclosure and to facilitate understanding of one or more of the various inventive aspects, various features of the invention are sometimes grouped together into a single embodiment , figure, or description of it. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the Detailed Description are hereby expressly incorporated into this Detailed Description, with each claim standing on its own as a separate embodiment of this invention.

Those skilled in the art can understand that the modules in the device in the embodiment can be adaptively changed and installed in one or more devices different from the embodiment. Modules or units or components in the embodiments may be combined into one module or unit or component, and furthermore may be divided into a plurality of sub-modules or sub-units or sub-assemblies. All features disclosed in this specification (including the accompanying claims and drawings) and any method or apparatus so disclosed may be used in any combination, except where at least some of such features and/or processes or units are mutually exclusive. All processes or units are combined. Each feature disclosed in this specification (including accompanying claims and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.

Furthermore, those skilled in the art will understand that although some embodiments described herein include some features included in other embodiments but not others, combinations of features from different embodiments are meant to be within the scope of the invention. and form different embodiments. For example, in the following claims, any of the claimed embodiments may be used in any combination.

The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art should understand that a microprocessor or a digital signal processor (DSP) may be used in practice to implement some or all functions of some or all components of the safety protection device according to the embodiment of the present invention. The present invention can also be implemented as an apparatus or an apparatus program (for example, a computer program and a computer program product) for performing a part or all of the methods described herein. Such a program for realizing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet site, or provided on a carrier signal, or provided in any other form.

It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means can be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. does not indicate any order. These words can be interpreted as names.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: It is still possible to modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the technical solutions of the various embodiments of the present invention. All of them should be covered by the scope of the claims and description of the present invention.

Claims (10)

1. A safety protection device, characterized in that, comprising: The upload unit is used to upload the description information of the behavior of the process to the server when the behavior of the process matches the preset local trigger strategy, so that the server can judge whether the behavior of the process is consistent with any preset risk behavior When matching, issue a temporary security policy corresponding to the preset risk behavior; the temporary security policy includes: the revocation conditions of the temporary security policy, and the processing operations and trigger conditions used to deal with the preset risk behavior ; a receiving unit, configured to receive the temporary security policy from the server; The loading unit is configured to load the temporary security policy obtained by the receiving unit, so as to execute corresponding processing operations when any of the trigger conditions are met, and revoke the temporary security policy when any of the revocation conditions are met. 2 . The security protection device according to claim 1 , wherein the loading unit is further configured to load the temporary security policy into the memory, so that the temporary security policy can be automatically canceled after the memory is powered off. 3 . 3. The security protection device according to claim 1, wherein the behavior of the process matching the local trigger policy includes any one or more of the following: Access to network addresses not related to the functionality of the application to which the process belongs; Downloading files that are not related to the functionality of the application to which the process belongs; Create a process that is not related to the functionality of the application to which the process belongs; Inject code into other processes unrelated to the application to which the process belongs; Write a file under the protected file directory; Behavior of processes associated with blacklisted applications. 4. The safety protection device according to claim 1, characterized in that the situation that the behavior of the process matches any preset risk behavior includes any one or more of the following: Said process matches any of the preset risk processes; The behavior of the process matches any of the preset risk behaviors; The behavior of the process matches the precursor behavior of any predetermined risk behavior. 5. The safety protection device according to claim 1, wherein the revocation conditions of the temporary security policy include any one or more of the following: The effective time of the temporary security policy exceeds a predetermined threshold; The user has approved the preset risk behavior in the prompt message; The processing operation with the end mark in the temporary security policy has been completed; A revocation instruction message from the server is received. 6. The safety protection device according to claim 1, characterized in that, the processing operations and trigger conditions for dealing with preset risk behaviors include any one or more of the following: Operations that limit the operating authority and/or system resource usage of the process without triggering conditions; Taking the detection of a preset risky behavior as a trigger condition to intercept the behavior of the process; Taking the detection of a preset high-risk behavior as a trigger condition, ending the operation of the process or the application program to which the process belongs; The detection of residual files is used as a trigger condition to clean up the residual files. 7. A safety protection device, characterized in that it comprises: The receiving unit is configured to receive the description information of the behavior of the process from the terminal; the description information of the behavior of the process matches the preset local trigger strategy of the terminal; a judging unit, configured to judge whether the behavior of the process matches any preset risk behavior according to the description information obtained by the receiving unit; an issuing unit, configured to issue a temporary security policy corresponding to the preset risk behavior to the terminal when the judging unit judges that the behavior of the process matches any preset risk behavior, so that the The terminal receives and loads the temporary security policy; Wherein, the temporary security policy includes: the revocation condition of the temporary security policy, and processing operations and trigger conditions for dealing with preset risk behaviors, so that the terminal loaded with the temporary security policy can Execute corresponding processing operations when the conditions are met, and revoke the temporary security policy when any revocation condition is met. 8. The safety protection device according to claim 7, characterized in that the situation that the behavior of the process matches any preset risk behavior includes any one or more of the following: Said process matches any of the preset risk processes; The behavior of the process matches any of the preset risk behaviors; The behavior of the process matches the precursor behavior of any predetermined risk behavior. 9. A safety protection method, characterized in that, comprising: When the behavior of the process matches the preset local trigger policy, upload the description information of the behavior of the process to the server, so that when the server determines that the behavior of the process matches any preset risk behavior, download Sending a temporary security policy corresponding to the preset risk behavior; the temporary security policy includes: a revocation condition of the temporary security policy, and processing operations and trigger conditions for dealing with the preset risk behavior; receiving the temporary security policy from the server; Loading the temporary security policy to perform corresponding processing operations when any of the trigger conditions are met, and revoke the temporary security policy when any of the revocation conditions are met. 10. A safety protection method, characterized in that, comprising: receiving the description information of the behavior of the process from the terminal; the description information of the behavior of the process matches the preset local trigger policy of the terminal; judging whether the behavior of the process matches any preset risk behavior according to the description information; When the behavior of the process matches any preset risk behavior, issue a temporary security policy corresponding to the preset risk behavior to the terminal, so that the terminal receives and loads the temporary security policy; Wherein, the temporary security policy includes: the revocation condition of the temporary security policy, and processing operations and trigger conditions for dealing with preset risk behaviors, so that the terminal loaded with the temporary security policy can Execute corresponding processing operations when the conditions are met, and revoke the temporary security policy when any revocation condition is met.