CN109784035B - Installation process tracking processing method and device - Google Patents

Abstract

Embodiments of the present invention disclose a method and device for tracking an installation process. The method includes: if process exit information is received, determining whether the exited first target process is in a process tracking list of the installation process according to the process exit information. If it is judged that the first target process is in the process tracking list, then the release file of the release file list is obtained; If it is judged that the release file meets the whitelist feature, then the release file is added to the whitelist . In the embodiment of the present invention, when the software is installed or updated, the release file is automatically added to the whitelist, which facilitates unified management by the administrator, and can avoid mistaken whitening and tedious manual operations.

Description

Method and device for tracking and processing installation process

technical field

Embodiments of the present invention relate to the technical field of network security, and in particular, to a method and device for tracking and processing an installation process.

Background technique

In the current industrial Internet, the "application whitelist" defense technology is mainly used to protect the host security of the industrial control system, and the whitelist security baseline is constructed by scanning to prevent virus infection and malicious program intrusion. However, after the whitelist security baseline is formed, if you want to install or update the software on the host, you must append the newly generated files after installing the software to the whitelist, or perform a whitelist scan again to form a new whitelist security Baseline, very time consuming and laborious.

The existing technology cannot realize the automatic tracking of the installation and update process of the application program. The user needs to manually add the installation program to the installation tracking list, click to start the update, and then start to install the software. After the installation is completed, click the end of the update. Software installation tracking. At the same time, the automatic installation tracking function of applications cannot be implemented for all hosts, or the automatically whitened files may contain files released by non-installers, resulting in false whitening.

SUMMARY OF THE INVENTION

Due to the above-mentioned problems in the existing methods, the embodiments of the present invention provide a method and device for tracking and processing an installation process.

In a first aspect, an embodiment of the present invention provides a method for tracking and processing an installation process, including:

If the process exit information is received, determine whether the exited first target process is in the process tracking list of the installation process according to the process exit information;

If it is determined that the first target process is in the process tracking list, the release file of the release file list is obtained;

If it is determined that the release file conforms to the whitelist feature, the release file is added to the whitelist.

Optionally, the method further includes:

If the process start information is received, determine whether the started second target process is an installation tracking process according to the process start information;

If it is determined that the second target process is an installation tracking process, adding the second target process to the process tracking list;

Monitoring the release files generated during the running of the second target process, and adding the generated release files to the release file list.

Optionally, the installation tracking process is predetermined according to software tracking requirements.

Optionally, the method further includes:

The first target process is deleted from the process tracking list, and the release files in the release file list are deleted.

In a second aspect, an embodiment of the present invention further provides an installation process tracking and processing device, including:

a process judgment module, configured to judge whether the exited first target process is in the process tracking list of the installation process according to the process exit information if the process exit information is received;

A file acquisition module, configured to acquire the release file of the release file list if it is judged that the first target process is in the process tracking list;

The whitelist judging module is configured to add the released file to the whitelist if it is determined that the released file conforms to the characteristics of the whitelist.

Optionally, the device further includes:

a startup judging module, configured to determine whether the started second target process is an installation tracking process according to the process startup information if the process startup information is received;

a process adding module, configured to add the second target process to the process tracking list if it is determined that the second target process is an installation tracking process;

A file adding module, configured to monitor the release file generated during the running of the second target process, and add the generated release file to the release file list.

Optionally, the installation tracking process is predetermined according to software tracking requirements.

Optionally, the device further includes:

A process deletion module, configured to delete the first target process from the process tracking list, and delete the release files in the release file list.

In a third aspect, an embodiment of the present invention further provides an electronic device, including:

at least one processor; and

at least one memory communicatively coupled to the processor, wherein:

The memory stores program instructions executable by the processor, the processor invoking the program instructions capable of performing the above-described method.

In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores a computer program, and the computer program causes the computer to execute the above method.

It can be known from the above technical solutions that the embodiments of the present invention automatically add release files to the whitelist during software installation or update, which facilitates unified management by administrators, and can avoid mistaken whitening and tedious manual operations.

Description of drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained from these drawings without creative efforts.

1 is a schematic flowchart of a method for tracking and processing an installation process according to an embodiment of the present invention;

2 is a schematic flowchart of a method for tracking an installation process according to another embodiment of the present invention;

3 is a schematic structural diagram of an apparatus for tracking and processing an installation process according to an embodiment of the present invention;

FIG. 4 is a logical block diagram of an electronic device provided by an embodiment of the present invention.

Detailed ways

The specific embodiments of the present invention will be further described below with reference to the accompanying drawings. The following examples are only used to illustrate the technical solutions of the present invention more clearly, and cannot be used to limit the protection scope of the present invention.

FIG. 1 shows a schematic flowchart of a method for tracking and processing an installation process provided by this embodiment, including:

S101. If the process exit information is received, determine whether the exited first target process is in the process tracking list of the installation process according to the process exit information.

The process exit information is a message that any process ends.

The first target process is the currently exited process.

The process tracking list is a list of all processes being tracked by the system.

S102. If it is determined that the first target process is in the process tracking list, acquire a release file of the release file list.

The release file list is a list of release files generated by the currently tracked process during the software installation or update process.

S103. If it is determined that the release file conforms to the whitelist feature, add the release file to the whitelist.

Wherein, the whitelist feature is a predetermined feature of the safe release file.

In this embodiment, when the software is installed or updated, the release file is automatically added to the whitelist, which facilitates unified management by the administrator, and can avoid mistaken whitening and tedious manual operations.

Further, on the basis of the above method embodiments, the method further includes:

S104. If the process start information is received, determine whether the started second target process is an installation tracking process according to the process start information.

Wherein, the process startup information is information about any process startup.

The second target process is the currently started process.

The installation tracking process is predetermined according to software tracking requirements. The installation tracking process includes the installation program process added by the user and its sub-processes.

S105. If it is determined that the second target process is an installation tracking process, add the second target process to the process tracking list.

S106. Monitor the release file generated during the running of the second target process, and add the generated release file to the release file list.

S107. Delete the first target process from the process tracking list, and delete the release file in the release file list.

Specifically, referring to Figure 2, the driver layer monitors the start and exit of the process. When the process is monitored, it notifies the application layer; after the application layer receives the process start information, it determines whether the process is an installation tracking process. If so, The unique identification PID of the process is recorded, and the PID is added to the list A; if it is not an installation tracking process, it will not be processed. After monitoring the process exit, notify the application layer; after receiving the process exit information, the application layer judges whether the PID of the process is in list A, if so, add the file in list B to the whitelist and delete it from list A The PID;; if not in list A, do not process.

The driver layer also monitors the file operations of the processes in list A, and notifies the application layer when a file is generated, deleted, or a directory is renamed; after the application layer receives the file operation information, it determines whether the PID of the operated process is in list A. , if it is, update the file list of the PID operation, and update the list B at the same time; if it is not in the list A, it will not be processed.

In this embodiment, the files released by each process during the software installation process are monitored, and the released files are automatically added to the whitelist when the software installation is completed. The user/administrator selects the software to be tracked, and then the security software monitors the currently activated software When the program is tracking software, monitor the files it releases. If the released files conform to the whitelist characteristics, all files that meet the characteristics will be automatically added to the whitelist when the software installation is complete. You only need to set the software to be tracked on the server. That is, it is convenient for users to manage the whitelist more effectively and accurately, and avoid tedious operations.

3 shows a schematic structural diagram of an installation process tracking and processing device provided in this embodiment, the device includes: a process judgment module 301, a file acquisition module 302, and a whitelist judgment module 303, wherein:

The process judgment module 301 is configured to, if the process exit information is received, judge whether the exited first target process is in the process tracking list of the installation process according to the process exit information;

The file acquisition module 302 is configured to acquire the release file of the release file list if it is judged that the first target process is in the process tracking list;

The whitelist judging module 303 is configured to add the released file to the whitelist if it is determined that the released file conforms to the characteristics of the whitelist.

Specifically, if the process judging module 301 receives the process exit information, it will judge whether the exited first target process is in the process tracking list of the installation process according to the process exit information; The first target process is in the process tracking list, then acquires the release file of the release file list; the whitelist judgment module 303 adds the release file to the whitelist if it judges that the release file conforms to the whitelist feature. in the list.

In this embodiment, when the software is installed or updated, the release file is automatically added to the whitelist, which facilitates unified management by the administrator, and can avoid mistaken whitening and tedious manual operations.

Further, on the basis of the above device embodiments, the device further includes:

a startup judging module, configured to determine whether the started second target process is an installation tracking process according to the process startup information if the process startup information is received;

a process adding module, configured to add the second target process to the process tracking list if it is determined that the second target process is an installation tracking process;

A file adding module, configured to monitor the release file generated during the running of the second target process, and add the generated release file to the release file list.

Further, on the basis of the above apparatus embodiment, the installation tracking process is predetermined according to software tracking requirements.

Further, on the basis of the above device embodiments, the device further includes:

A process deletion module, configured to delete the first target process from the process tracking list, and delete the release files in the release file list.

The apparatus for tracking and processing an installation process described in this embodiment can be used to execute the above method embodiments, and the principles and technical effects thereof are similar, and details are not described herein again.

4, the electronic device includes: a processor (processor) 401, a memory (memory) 402 and a bus 403;

in,

The processor 401 and the memory 402 communicate with each other through the bus 403;

The processor 401 is configured to call program instructions in the memory 402 to execute the methods provided by the above method embodiments.

This embodiment discloses a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, and when the program instructions are executed by a computer, the computer program The methods provided by the above method embodiments can be executed.

This embodiment provides a non-transitory computer-readable storage medium, where the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions cause the computer to execute the methods provided by the above method embodiments.

The device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

It should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still be used for The technical solutions described in the foregoing embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (6)

1. a tracking processing method of an installation process, is characterized in that, comprises: If the process start information is received, determine whether the started second target process is an installation tracking process according to the process start information; If it is determined that the second target process is an installation tracking process, adding the second target process to the process tracking list; Monitoring the release file generated during the running process of the second target process, and adding the generated release file to the release file list; the installation tracking process is predetermined according to the software tracking requirements; the installation tracking process includes the user adding the installer process and its subprocesses; If the process exit information is received, then according to the process exit information, determine whether the exited first target process is in the process tracking list of the installation process; the process tracking list is a list of all processes being tracked by the system; If it is determined that the first target process is in the process tracking list, the release file of the release file list is obtained; If it is determined that the release file conforms to the whitelist feature, the release file is added to the whitelist; the whitelist feature is a predetermined and safe feature of the release file. 2. The method according to claim 1, wherein the method further comprises: The first target process is deleted from the process tracking list, and the release files in the release file list are deleted. 3. A tracking processing device for an installation process, characterized in that, comprising: a startup judging module, configured to determine whether the started second target process is an installation tracking process according to the process startup information if the process startup information is received; a process adding module, configured to add the second target process to the process tracking list if it is determined that the second target process is an installation tracking process; a file adding module for monitoring the release file generated during the running of the second target process, and adding the generated release file to the release file list; the installation tracking process is predetermined according to software tracking requirements; the The installation tracking process includes the installation program process added by the user and its children; The process judgment module is used to judge whether the exited first target process is in the process tracking list of the installation process according to the process exit information if the process exit information is received; the process tracking list is a list of all processes being tracked by the system. list; A file acquisition module, configured to acquire the release file of the release file list if it is judged that the first target process is in the process tracking list; The whitelist judging module is configured to add the released file to the whitelist if it is determined that the release file conforms to the whitelist feature; the whitelist feature is a predetermined safe release file feature. 4. The apparatus according to claim 3, wherein the apparatus further comprises: A process deletion module, configured to delete the first target process from the process tracking list, and delete the release files in the release file list. 5. An electronic device, characterized in that, comprising: at least one processor; and at least one memory communicatively coupled to the processor, wherein: The memory stores program instructions executable by the processor, and the processor invokes the program instructions to be able to perform the method as claimed in any one of claims 1 to 2. 6. A non-transitory computer-readable storage medium, characterized in that, the non-transitory computer-readable storage medium stores a computer program, and the computer program causes the computer to execute any one of claims 1 to 2. Methods.

Images