CN112395613B - Static feature library loading method, device and equipment - Google Patents

Abstract

The application discloses a loading method, a loading device and loading equipment of a static feature library, relates to the technical field of network security, and can solve the problem that a large-capacity rule library occupies memory and CPU resources when a kernel is loaded. The method comprises the following steps: receiving a static feature library file to be loaded; extracting instruction execution sequence characteristics corresponding to the key process module information from the static characteristic library file; and loading the extracted instruction execution sequence characteristics into a memory corresponding to the kernel. The method and the device are suitable for loading processing of the static feature library.

Description

Loading method, device and device for static signature library

technical field

The present application relates to the technical field of network security, and in particular, to a method, apparatus and device for loading a static signature library.

Background technique

With the development of Internet informatization, there are more and more cyber hacker attacks, and hacker attack methods are constantly evolving. Hackers can use vulnerabilities to make software processes realize some attack events. Therefore, in order to better restrict the execution of legitimate events of software processes, the way of defining permission sets can be used to limit the events that software processes can execute.

At present, the static instruction execution sequence signature library can be loaded into the memory, and then the kernel obtains the corresponding instruction execution sequence when the program is executed, and matches it with the instruction execution sequence of the preset normal behavior in the static signature library, so as to find out whether there is in time. attack event. However, the system memory resources used by the kernel are limited, which cannot meet the loading requirements of large-capacity static feature libraries, and loading a large-capacity static feature library at one time will also occupy too much system resources such as memory and CPU.

SUMMARY OF THE INVENTION

In view of this, the present application provides a method, apparatus and device for loading a static signature library, which mainly aims to solve the technical problem of the memory and CPU resources occupied by a large-capacity static signature library when the kernel is loaded.

According to an aspect of the present application, a method for loading a static signature library is provided, the method comprising:

Receive the static signature library file to be loaded;

Extract the instruction execution sequence feature corresponding to the key process module information from the static feature library file;

Loading the extracted instruction execution sequence features into the memory corresponding to the kernel.

Optionally, before extracting the instruction execution sequence feature corresponding to the key process module information from the static feature library file, the method further includes:

If the static signature library file has been cached, cancel the repetitive caching of the static signature library file;

The extracting the instruction execution sequence feature corresponding to the key process module information from the static feature library file specifically includes:

If the static signature library file has not been cached, cache and parse the static signature library file to obtain structured data that can be identified by the kernel;

The instruction execution sequence feature is extracted from the structured data.

Optionally, the extracting the instruction execution sequence feature from the structured data specifically includes:

If the structured data exists in the memory, cancel loading the instruction execution sequence feature in the memory;

If the structured data does not exist in the memory, extract the instruction execution sequence feature from the structured data;

If part of the structured data exists in the memory, extracting the instruction execution sequence feature corresponding to the key process module information and not existing in the memory from the structured data.

Optionally, the static signature library file is parsed to obtain structured data that can be identified by the kernel, specifically including:

Decrypt and serialize the static signature library file to obtain the structured data.

Optionally, the method further includes:

Real-time monitoring of new key process module information;

The instruction execution sequence feature corresponding to the newly added key process module information is extracted from the static feature library file and loaded into the memory.

Optionally, the method further includes:

Record the timestamp when the instruction execution sequence feature loaded in the memory is called and matched;

Calculate, according to the timestamp, the characteristics of the execution sequence of the instructions loaded in the memory, and the number of calls within a preset statistical time period;

According to the number of calls and/or the timestamp of the last call corresponding to the instruction execution sequence feature loaded in the memory, the instruction execution sequence feature loaded in the memory is divided to obtain hot data and cold data ;

Delete the cold data from the memory.

Optionally, the loading of the extracted instruction execution sequence features into the memory corresponding to the kernel specifically includes:

The extracted instruction execution sequence features are organized in modules to form a tree structure, and are arranged in a memory block after being flattened, wherein a binary search is performed when the instruction execution sequence features corresponding to the module nodes are matched. The characteristics of the instruction execution sequence whose call times are greater than the preset threshold are managed in the form of a balanced tree.

Optionally, the method further includes:

receiving update data of the instruction execution sequence feature loaded in the memory;

According to the update data, the modules are organized into subtrees, and the corresponding module nodes in the global tree are replaced.

Optionally, the memory structure of the module node corresponding to the instruction execution sequence feature in the tree structure is linear, and the method further includes:

When it is necessary to perform instruction execution sequence feature matching on the target module, query the corresponding target module node in the tree structure according to the identifier of the target module;

Obtain the instruction execution sequence feature corresponding to the target module node for matching and identification.

According to another aspect of the present application, a device for loading a static signature library is provided, the device comprising:

The receiving module is used to receive the static signature library file to be loaded;

an extraction module for extracting the instruction execution sequence feature corresponding to the key process module information from the static feature library file;

The loading module is used for loading the extracted features of the instruction execution sequence into the memory corresponding to the kernel.

Optionally, the device further includes: a cache module;

The caching module is configured to cancel the repetitive caching of the static signature library file if the static signature library file has been cached;

The cache module is further configured to cache the static feature library file if the static feature library file has not been cached;

The extraction module is specifically configured to parse the static feature library file to obtain structured data that can be identified by the kernel;

The instruction execution sequence feature is extracted from the structured data.

Optionally, the extraction module is further configured to cancel loading the instruction execution sequence feature in the memory if the structured data exists in the memory;

If the structured data does not exist in the memory, extract the instruction execution sequence feature from the structured data;

If part of the structured data exists in the memory, extracting the instruction execution sequence feature corresponding to the key process module information and not existing in the memory from the structured data.

Optionally, the extraction module is further configured to decrypt and serialize the static signature library file to obtain the structured data.

Optionally, the device further includes:

Monitoring module for real-time monitoring of new key process module information;

The loading module is further configured to extract an instruction execution sequence feature corresponding to the newly added key process module information from the static feature library file and load it into the memory.

Optionally, the device further includes:

a recording module, configured to record the time stamp when the instruction execution sequence feature loaded in the memory is called and matched;

a calculation module, configured to calculate the execution sequence characteristics of the instructions loaded in the memory according to the time stamp, and the number of times of being called within a preset statistical duration;

A division module, configured to divide the instruction execution sequence features loaded in the memory according to the number of calls and/or the timestamp of the last call corresponding to the instruction execution sequence features loaded in the memory, to obtain Hot and cold data;

A deletion module is used to delete the cold data from the memory.

Optionally, the loading module is specifically used to organize the extracted instruction execution sequence features in units of modules to form a tree-like structure, and arrange them in a memory block after being leveled, wherein, in the corresponding module node When the instruction execution sequence features are matched, binary search is performed, and the instruction execution sequence features whose number of calls is greater than the preset threshold are managed in the form of a balanced tree.

Optionally, the receiving module is further configured to receive update data of the instruction execution sequence feature loaded in the memory;

The loading module is further configured to organize into subtrees in units of modules according to the update data, and replace corresponding module nodes in the global tree.

Optionally, the memory structure of the module node corresponding to the instruction execution sequence feature in the tree structure is linear, and the device further includes:

a matching module, configured to query the corresponding target module node in the tree structure according to the identifier of the target module when the target module needs to be matched with the instruction execution sequence feature;

Obtain the instruction execution sequence feature corresponding to the target module node for matching and identification.

According to yet another aspect of the present application, a storage medium is provided on which a computer program is stored, and when the program is executed by a processor, the above-mentioned method for loading a static signature library is implemented.

According to yet another aspect of the present application, an entity device for loading a static signature library is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, the processor executing the program When implementing the above-mentioned static signature library loading method.

With the above technical solutions, a method, device and device for loading a static signature library provided by the present application, compared with the current method of loading all the received static signature libraries into the memory, the present application uses a file to store the static signature library. , and then only load the instruction execution sequence feature corresponding to the key process module information in the memory corresponding to the kernel. Through this selective static instruction execution sequence feature loading method, there is no need to load all the instruction execution sequence features in the static signature library, which can solve the problem of memory and CPU resources occupied by the large-capacity static signature library when the kernel is loaded.

The above description is only an overview of the technical solution of the present application. In order to be able to understand the technical means of the present application more clearly, it can be implemented according to the content of the description, and in order to make the above-mentioned and other purposes, features and advantages of the present application more obvious and easy to understand , and the specific embodiments of the present application are listed below.

Description of drawings

The drawings described herein are used to provide further understanding of the present application and constitute a part of the present application. The schematic embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation of the present application. In the attached image:

1 shows a schematic flowchart of a method for loading a static signature library provided by an embodiment of the present application;

FIG. 2 shows a schematic flowchart of another method for loading a static signature library provided by an embodiment of the present application;

FIG. 3 shows a schematic diagram of a linear example of a memory structure of a module rule provided by an embodiment of the present application;

FIG. 4 shows a schematic diagram of the core data processing logic provided by the embodiment of the present application based on this solution;

FIG. 5 shows a schematic diagram of a loading rule invocation processing flow provided by an embodiment of the present application;

FIG. 6 shows a schematic diagram of a new module event processing flow diagram provided by an embodiment of the present application;

FIG. 7 shows a schematic diagram of the overall architecture based on this solution provided by an embodiment of the present application;

FIG. 8 shows a schematic structural diagram of a device for loading a static signature library provided by an embodiment of the present application.

Detailed ways

Hereinafter, the present application will be described in detail with reference to the accompanying drawings and in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features of the embodiments may be combined with each other in the case of no conflict.

It is aimed at solving the technical problem of the memory and CPU resources occupied by the large-capacity static signature library when the kernel is loaded. This embodiment provides a method for loading a static signature library, as shown in FIG. 1 , the method includes:

101. Receive a static signature library file to be loaded.

The static signature library may be a kernel static instruction execution sequence signature library. The static signature library file may contain the instruction execution sequence under normal circumstances for each behavior (such as creating a process, or loading a module, or reading and writing a file, or reading and writing a registry, or loading a driver, etc.). In order for the kernel to use the static signature library to perform instruction execution sequence matching for safe behaviors, the principle of "white or black" is adopted to detect abnormal behaviors in time. In addition, the static signature library file may also include instruction execution sequences in the case of abnormal behaviors, and then perform blacklist matching on the instruction execution sequences corresponding to the behaviors.

For this embodiment, the execution body may be an apparatus or device for loading a static signature library in the memory corresponding to the kernel, which may be configured on the client side or on the server side according to actual requirements, and the static signature library file may be Download from the server. In this embodiment, the received static signature library file can be cached first and not directly loaded into the memory, especially when the capacity of the static signature library file is large (for example, greater than a certain threshold), and then steps 102 to 103 are executed the process shown.

102. Extract the instruction execution sequence feature corresponding to the key process module information from the static feature library file.

Among them, the key process module information can be preset according to actual business requirements, which is equivalent to the process module that needs to be focused on. For example, a system process module, a browser process module, a document process module, etc. are used as key process modules.

103. Load the extracted instruction execution sequence feature into the memory corresponding to the kernel.

For example, the instruction execution sequence features corresponding to the system process module, browser process module, and document process module are extracted from the static feature library file, and then loaded into the memory corresponding to the kernel, so that the subsequent kernel can target the system process, browser process , document process and other processes, call the corresponding instruction execution sequence feature matching rules to detect behavior anomalies.

By applying the above loading method of the static feature library, the static feature library is stored in a file, and then only the instruction execution sequence feature corresponding to the currently running key process module information is loaded in the memory corresponding to the kernel. Through this selective static instruction execution sequence feature loading method, there is no need to load all the instruction execution sequence features in the static signature library, which can solve the problem of memory and CPU resources occupied by the large-capacity static signature library when the kernel is loaded.

Further, as a refinement and extension of the specific implementation manner of the above embodiment, in order to fully describe the implementation process of this embodiment, another method for loading a static signature library is provided, as shown in FIG. 2 , the method includes:

201. Receive a static signature library file to be loaded.

202. Determine whether the static signature library file has been cached.

203a. If the static signature library file has already been cached, cancel the repetitive caching of the static signature library file.

In this way, storage space can be saved so that more different static signature library files can be cached.

In step 203b parallel to step 203a, if the static signature library file has not been cached, the static signature library file is cached and parsed to obtain structured data that can be recognized by the kernel.

Optionally, in order to ensure the security of the static signature library file, the static signature library file can be encrypted in advance and then transmitted. Correspondingly, the process of parsing the file in step 203b may include: the received static signature library file. Decrypt and serialize to obtain structured data that the kernel can recognize.

204b. Extract the instruction execution sequence feature corresponding to the key process module information from the structured data.

As an optional method, in order to save the resources consumed when loading the rule feature, step 204b may specifically include: if the structured data already exists in the memory corresponding to the kernel, cancel loading the static feature library file in the memory in the memory. Instruction execution sequence feature; if the structured data does not exist in the memory corresponding to the kernel, extract the instruction execution sequence feature corresponding to the key process module information from the structured data; if there is part of the structured data in the memory corresponding to the kernel , the instruction execution sequence features corresponding to the key process module information and not existing in the memory are extracted from the structured data.

For this optional method, in order to avoid loading repetitive content, it is possible to determine whether the corresponding content of the static signature library already exists in the memory before the loading operation. The instructions in the signature library file execute the sequence signature, thereby reducing the system resources consumed by loading.

When it is determined that the instruction execution sequence features (ie, matching rules) in the static feature library need to be loaded, first determine the rules corresponding to the system process modules that need to be loaded; then identify the currently installed browser and document software through the client side, and then Determine the rules for documenting the corresponding version. After the corresponding software version instruction sequence signature library is loaded, the instruction sequence signature matching protection of the related software is performed.

205b. Load the extracted instruction execution sequence feature into the memory corresponding to the kernel.

Due to the limited memory space corresponding to the kernel, before loading the instruction execution sequence feature, it is necessary to periodically or irregularly delete the loaded cold data in the memory, so that as much as possible is retained in the memory with frequent access (frequently called) thermal data. Therefore, as an optional method, the method of this embodiment may further include: recording a timestamp when the instruction execution sequence feature loaded in the memory is called and matched; then calculating the instruction execution sequence feature loaded in the memory according to the timestamp, and Set the number of calls in the statistical time period; finally, according to the number of calls corresponding to the characteristics of the execution sequence of instructions loaded in the memory and/or the timestamp of the last call, the characteristics of the execution sequence of the instructions loaded in the memory are divided to obtain the heat. Data and cold data; in order to periodically or irregularly delete cold data from memory.

Based on the above-mentioned division method of hot and cold data, the full set of rules that can gradually evolve into a static signature library in subsequent operations and use are stored in the form of files. For performance optimization, hot data can be placed in memory as much as possible, while cold data can be placed in files to achieve on-demand acquisition. In addition, it is adjusted in real time according to the frequency of on-site visits during operation, and the fittest will be eliminated, ensuring that the hotspot rules must be visited the most frequently.

Further, in order to illustrate the specific implementation process of step 205b, exemplary, as an optional implementation manner, step 205b may specifically include: organizing the extracted instruction execution sequence features in modules to form a tree structure, After leveling, it is configured in the memory block, where binary search is performed when the instruction execution sequence features corresponding to the module nodes are matched, and the instruction execution sequence features whose number of calls is greater than the preset threshold are managed in the form of a balanced tree.

For example, the instruction execution sequence features (matching rules) in the static feature library are organized in units of modules. The modules are essentially tree-structured. After being flattened, they are placed in a unified memory block. When matching, binary search is performed. UHF access is managed in the form of a balanced tree. In this way, fast and accurate matching of rules can be achieved, thereby realizing fast and accurate security detection.

In order to meet the requirements of subsequent quick update rules, based on the above-mentioned optional manner, the method of this embodiment may further include: firstly receiving update data of the instruction execution sequence feature loaded in the memory; then according to the received update data, taking the module as the Units are organized into subtrees and replace corresponding module nodes in the global tree.

For example, the update of rules is also based on modules. After the application layer sends the static signature library to the kernel driver, the driver will first update the static signature library, which is logically organized into a subtree (in fact, it may point to a memory block), then the corresponding module node in the global tree will be replaced, and the addition of this node will have little effect on matching. The reference count of the freed module node will be reset to zero after all matching operations are completed, after which the memory can be freed to save memory space. If the node itself is cold data and is stored in a file, the corresponding memory map will be released, and the file will be closed after all maps are released.

Further optionally, the memory structure of the module node corresponding to the instruction execution sequence feature in the tree structure is linear. Query the corresponding target module node in the shape structure; obtain the instruction execution sequence feature corresponding to the target module node for matching and identification.

For example, the memory structure of module rules is linear, as shown in Figure 3. When a new module is found, the corresponding rules of the module can be quickly found according to the module name, and the original four-level index structure can be turned into a second-level index. Structure, and the address is continuous, the index number speed is increased several times.

206b. Real-time monitoring of new key process module information in the running process.

207b. Extract the instruction execution sequence feature corresponding to the newly added key process module information from the parsed structured data and load it into the memory corresponding to the kernel.

For example, if the instruction execution sequence feature corresponding to the newly added key process module exists in the cache file, the corresponding instruction execution sequence feature can be extracted from the structured data parsed from the file and loaded into the memory. However, if the instruction execution sequence feature corresponding to the newly added key process module does not exist in the cache file, the dynamic instruction sequence feature loading can be requested in real time or periodically, such as requesting the server to obtain it. After the rules are sent to the terminal and loaded by calling the interface, the file mapping is used internally for management, and the instruction sequence features requested by the new module are added to the corresponding file mapping.

Based on the methods provided by the above-mentioned embodiments, the processing logic for the core data of this solution may specifically be to decrypt the static signature library file to obtain each instruction execution sequence feature (matching rule), and then these instruction execution sequence features will be serialized and then cached. Copy to the cache file, each copy includes the module rule index header file and the instruction execution sequence feature data file, and the module rule index header file adopts symmetric encryption; the kernel can directly operate the cache file, and the module rule index header file needs to be decrypted after decryption. After the update is used, it is encrypted to the disk file, and the kernel completes the update of the cache file. The rules in the kernel memory can include three parts: the module instruction sequence feature hot index header table, the module instruction sequence feature cold index header table, the module instruction sequence feature hot data, and the matching rules of key process modules are in the module instruction sequence feature cold, In the hot index header, the cold data of the module instruction sequence feature can be stored in the cache file.

For example, as shown in Figure 4, first, the rule file (static signature library file) can be delivered to the kernel driver, and after decrypting the file, the rule node memory is allocated to the hot data, and the kernel module cold and hot index table and the kernel module cold index table are added. Add cache file index. Subsequent incremental rule files (update files) are serialized and sent to the kernel driver to update the kernel module hot index table and update related cache files. In addition, the kernel rule memory threshold is set to determine whether it is greater than this threshold when updating or adding rules; and according to the LRU algorithm, it will meet the conditions (such as the use count within a predetermined period of time is less than a certain threshold, or the distance from the last use time) Hot data whose current time is greater than a certain duration threshold, etc.) is switched to cold data to release memory.

Based on the implementation in FIG. 4 , the specific invocation processing flow of the loading rule (instruction execution sequence feature) may be as shown in FIG. 5 . First, call the loading rule interface to determine the type of the loading rule; if it is a loading rule file, check whether the file has been loaded. If the file has been loaded and cached, you can cancel the repeated cache loading of the file, and issue the cached rule file name To the kernel driver, the driver loads the corresponding rule file that has been cached, and loads the hot data rule to the memory according to the module index file.

If the file is not loaded, the file is decrypted and serialized into a linear structure, and then all key process modules are obtained, marked as hot data according to the index header and indexed by the encryption module rules. The files are cached respectively according to the module index and rule content, and finally the cached rule file name is sent to the kernel driver, the driver loads the corresponding rule file, and loads the hot data rule to the memory according to the module index file.

When judging the type of loading rule, if it is a new module rule, serialize the new module rule file into a linear structure, and find the cache file name of the corresponding rule; the incremental part and the corresponding rule file name are sent to the driver, and the driver obtains the download The rule data is sent, and then updated to the corresponding rule cache file, the driver loads the incremental rule file, and then implements the update data to the memory rule.

For the event processing flow of the newly added module, the specific process is shown in Figure 6. First, look up the cold data module index to determine whether the new module is in the cold data (cache file). If it is in the cold data, find the corresponding cache file, and then Use the found cache file to load the rules corresponding to the new module into the memory; if it is not in the cold data, it means that there is no local matching rule for the command execution sequence corresponding to the new module, and it can be asynchronously thrown to the application layer , in order to request from the server.

In order to further fully describe the specific implementation process of the method in this embodiment, a schematic diagram of the overall architecture as shown in FIG. 7 is given. When the client goes through the installation process, it will download the protection rules (static signature library) preset in the offline package or to the specified location. When the driver control module calls the startup interface, it will load the initial stack rules, deserialize them into structured objects, and start asynchronous threads to collect the module information list of all processes in the system, and then generate a minimum set of rules based on the module information and rule structured objects. It is sent to the kernel driver for use, and the kernel directly deserializes it into a kernel object after receiving the rules. After completing the rule initialization, the kernel starts the monitoring of new modules, and sends the new module events to the application layer to process the new module rule update process.

Since the system memory resources that can be used by the kernel are limited, and the library based on the characteristics of the instruction sequence is larger than the general traditional defense rules, the above solution of this embodiment is applied, through structured data, serialization, hot and cold data processing, caching and other means. It can solve the problem of memory and CPU resources occupied by the large-capacity rule base loaded in the kernel. Store all rules in files. For performance optimization, all hot data can be stored in memory, while cold data can be stored in files and obtained on demand.

Further, as a specific implementation of the method shown in FIG. 1 and FIG. 2 , this embodiment provides a loading device for a static signature library. As shown in FIG. 8 , the device includes: a receiving module 31 , an extraction module 32 , and a loading module 33.

The receiving module 31 can be used to receive the static feature library file that needs to be loaded;

The extraction module 32 can be used to extract the instruction execution sequence feature corresponding to the key process module information from the static feature library file;

The loading module 33 can be configured to load the extracted features of the instruction execution sequence into the memory corresponding to the kernel.

In a specific application scenario, the device may further include: a cache module 34;

The caching module 34 can be configured to cancel the repetitive caching of the static signature library file if the static signature library file has been cached;

The cache module 34 can also be used to cache the static feature library file if the static feature library file has not been cached;

The extraction module 32 can be specifically configured to parse the static feature library file to obtain structured data that can be recognized by the kernel; and extract the instruction execution sequence feature from the structured data.

In a specific application scenario, the extracting module 32 can also be specifically configured to cancel loading of the instruction execution sequence feature in the memory if the structured data exists in the memory; If the structured data exists, extract the instruction execution sequence feature from the structured data; if part of the structured data exists in the memory, extract the key process related to the structured data from the structured data The instruction execution sequence feature that corresponds to the module information and does not exist in the memory.

In a specific application scenario, the extraction module 32 may be further configured to decrypt and serialize the static signature library file to obtain the structured data.

In a specific application scenario, the device further includes: a monitoring module 35;

The monitoring module 35 can be used to monitor the newly added key process module information in real time;

The loading module 33 is further configured to extract the instruction execution sequence feature corresponding to the newly added key process module information from the static feature library file and load it into the memory.

In a specific application scenario, the device further includes: a recording module 36, a calculation module 37, a division module 38, and a deletion module 39;

A recording module 36, which can be used to record the time stamp when the instruction execution sequence feature loaded in the memory is called and matched;

A calculation module 37, which can be used to calculate the instruction execution sequence feature loaded in the memory according to the time stamp, and the number of times of being called within a preset statistical duration;

The division module 38 can be configured to divide the instruction execution sequence feature loaded in the memory according to the called times and/or the time stamp of the last call corresponding to the instruction execution sequence feature loaded in the memory, Get hot and cold data;

The deletion module 39 can be used to delete the cold data from the memory.

In a specific application scenario, the loading module 33 can specifically be used to organize the extracted instruction execution sequence features in units of modules to form a tree structure, flatten them, and arrange them in a memory block, where in the The binary search is performed when the instruction execution sequence features corresponding to the module nodes are matched, and the instruction execution sequence features whose number of calls is greater than the preset threshold are managed in the form of a balanced tree.

In a specific application scenario, the receiving module 31 may also be configured to receive update data of the instruction execution sequence feature loaded in the memory;

The loading module 33 can also be used to organize subtrees in modules according to the update data, and replace corresponding module nodes in the global tree.

In a specific application scenario, the memory structure of the module node corresponding to the instruction execution sequence feature in the tree structure is linear, and correspondingly, the device further includes: a matching module 310;

The matching module 310 can be used to query the corresponding target module node in the tree structure according to the identifier of the target module when the target module needs to perform instruction execution sequence feature matching; obtain the instruction execution corresponding to the target module node Sequence features for matching identification.

It should be noted that, for other corresponding descriptions of the functional units involved in the apparatus for loading a static signature library provided in this embodiment, reference may be made to the corresponding descriptions in FIG. 1 and FIG. 2 , which will not be repeated here.

Based on the above methods shown in FIGS. 1 and 2 , correspondingly, the present embodiment further provides a storage medium on which a computer program is stored, and when the program is executed by a processor, the above-mentioned methods shown in FIGS. 1 and 2 are implemented. The loading method of the static signature library.

Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, and the software product to be identified can be stored in a non-volatile storage medium (which can be a CD-ROM, U disk, mobile hard disk, etc.), Several instructions are included to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods described in various implementation scenarios of this application.

Based on the methods shown in FIG. 1 and FIG. 2 and the virtual device embodiment shown in FIG. 4 , in order to achieve the above purpose, this embodiment also provides an entity device for loading a static signature library, which may be a personal computer. , notebook computer, server, smart phone, tablet computer, or other network equipment, etc., the physical equipment includes a storage medium and a processor; a storage medium for storing computer programs; a processor for executing computer programs to achieve the above 1. The method shown in Figure 2.

Optionally, the physical device may further include a user interface, a network interface, a camera, a radio frequency (Radio Frequency, RF) circuit, a sensor, an audio circuit, a WI-FI module, and the like. The user interface may include a display screen (Display), an input unit such as a keyboard (Keyboard), etc., and the optional user interface may also include a USB interface, a card reader interface, and the like. Optional network interfaces may include standard wired interfaces, wireless interfaces (such as WI-FI interfaces), and the like.

Those skilled in the art can understand that the physical device structure loaded by a static signature library provided in this embodiment does not constitute a limitation on the physical device, and may include more or less components, or combine some components, or different component layout.

The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the above-mentioned physical device hardware and software resources to be identified, and supports the operation of information processing programs and other software and/or programs to be identified. The network communication module is used to realize the communication between various components in the storage medium, as well as the communication with other hardware and software in the information processing entity device.

From the description of the above embodiments, those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform, and can also be implemented by hardware. By applying the technical solution of the present application, the problems of memory and CPU resources required for loading a large-capacity rule base in the kernel can be solved by means of structured data, serialization, hot and cold data processing, and caching. Store all rules in files. For performance optimization, all hot data can be stored in memory, while cold data can be stored in files and obtained on demand.

Those skilled in the art can understand that the accompanying drawing is only a schematic diagram of a preferred implementation scenario, and the modules or processes in the accompanying drawing are not necessarily necessary to implement the present application. Those skilled in the art can understand that the modules in the device in the implementation scenario may be distributed in the device in the implementation scenario according to the description of the implementation scenario, or may be located in one or more devices different from the implementation scenario with corresponding changes. The modules of the above implementation scenarios may be combined into one module, or may be further split into multiple sub-modules.

The above serial numbers in the present application are only for description, and do not represent the pros and cons of the implementation scenarios. The above disclosures are only a few specific implementation scenarios of the present application, however, the present application is not limited thereto, and any changes that can be conceived by those skilled in the art should fall within the protection scope of the present application.

Claims (16)

1. A loading method of a static feature library is characterized by comprising the following steps:

receiving a static feature library file to be loaded;

extracting instruction execution sequence characteristics corresponding to the key process module information from the static characteristic library file;

loading the extracted instruction execution sequence characteristics into a memory corresponding to a kernel;

the loading the extracted instruction execution sequence features into a memory corresponding to a kernel specifically includes:

organizing the extracted instruction execution sequence features by taking modules as units to form a tree structure, and configuring the tree structure in a memory block after leveling, wherein binary search is carried out when the instruction execution sequence features corresponding to the module nodes are matched, and balanced tree type management is adopted for the instruction execution sequence features of which the called times are greater than a preset threshold value;

the memory structure of the instruction execution sequence characteristics corresponding to the module nodes in the tree structure is linear, and the method further comprises the following steps:

when the target module needs to be subjected to instruction execution sequence feature matching, inquiring a corresponding target module node in the tree structure according to the identification of the target module;

and acquiring the instruction execution sequence characteristics corresponding to the target module node for matching and identification.

2. The method of claim 1, wherein prior to extracting the instruction execution sequence features corresponding to the key process module information from the static feature library file, the method further comprises:

if the static characteristic library file is cached, the repeated caching of the static characteristic library file is cancelled;

the extracting of the instruction execution sequence feature corresponding to the key process module information from the static feature library file specifically includes:

if the static characteristic library file is not cached, caching and analyzing the static characteristic library file to obtain structured data which can be identified by a kernel;

and extracting the instruction execution sequence characteristics from the structured data.

3. The method according to claim 2, wherein the extracting the instruction execution sequence features from the structured data specifically comprises:

if the structured data exists in the memory, canceling the loading of the instruction execution sequence characteristics in the memory;

if the structured data does not exist in the memory, extracting the instruction execution sequence characteristics from the structured data;

and if part of the structured data exists in the memory, extracting instruction execution sequence characteristics which correspond to the key process module information and do not exist in the memory from the structured data.

4. The method according to claim 2, wherein parsing the static feature library file to obtain structured data that can be recognized by a kernel specifically comprises:

and decrypting and serializing the static feature library file to obtain the structured data.

5. The method of claim 1, further comprising:

monitoring newly added key process module information in real time;

and extracting instruction execution sequence characteristics corresponding to the newly added key process module information from the static characteristic library file and loading the instruction execution sequence characteristics into the memory.

6. The method of claim 1, further comprising:

recording a timestamp when the instruction execution sequence characteristics loaded in the memory are matched by calling;

calculating the instruction execution sequence characteristics loaded in the memory according to the timestamp, and the called times within a preset statistical time length;

dividing the instruction execution sequence characteristics loaded in the memory according to the called times and/or the last called timestamp corresponding to the instruction execution sequence characteristics loaded in the memory to obtain hot data and cold data;

and deleting the cold data from the memory.

7. The method of claim 1, further comprising:

receiving update data of the instruction execution sequence characteristics loaded in the memory;

and organizing a sub-tree by taking the module as a unit according to the updating data, and replacing the corresponding module node in the global tree.

8. An apparatus for loading a static feature library, comprising:

the receiving module is used for receiving the static feature library file needing to be loaded;

the extraction module is used for extracting instruction execution sequence characteristics corresponding to the key process module information from the static characteristic library file;

the loading module is used for loading the extracted instruction execution sequence characteristics into a memory corresponding to the kernel;

the loading module is specifically used for organizing the extracted instruction execution sequence features by taking the module as a unit to form a tree structure, and configuring the tree structure in a memory block after leveling, wherein binary search is performed when the instruction execution sequence features corresponding to the module nodes are matched, and balanced tree management is adopted for the instruction execution sequence features with the calling times larger than a preset threshold;

the memory structure of the module node corresponding to the instruction execution sequence feature in the tree structure is linear, the device further comprises:

the matching module is used for inquiring corresponding target module nodes in the tree structure according to the identification of the target module when the target module needs to be subjected to instruction execution sequence characteristic matching;

and acquiring the instruction execution sequence characteristics corresponding to the target module node for matching and identification.

9. The apparatus of claim 8, further comprising: a cache module;

the cache module is used for canceling repeated caching of the static characteristic library file if the static characteristic library file is cached;

the cache module is further configured to cache the static feature library file if the static feature library file is not cached;

the extraction module is specifically configured to analyze the static feature library file to obtain structured data that can be identified by the kernel;

and extracting the instruction execution sequence characteristics from the structured data.

10. The apparatus of claim 9,

the extracting module is specifically further configured to cancel loading of the instruction execution sequence feature in the memory if the structured data exists in the memory;

if the structured data does not exist in the memory, extracting the instruction execution sequence characteristics from the structured data;

and if part of the structured data exists in the memory, extracting instruction execution sequence characteristics which correspond to the key process module information and do not exist in the memory from the structured data.

11. The apparatus of claim 9,

the extraction module is specifically further configured to decrypt and serialize the static feature library file to obtain the structured data.

12. The apparatus of claim 8, further comprising:

the monitoring module is used for monitoring the information of the newly added key process module in real time;

and the loading module is further used for extracting the instruction execution sequence characteristics corresponding to the newly added key process module information from the static characteristic library file and loading the instruction execution sequence characteristics into the memory.

13. The apparatus of claim 8, further comprising:

the recording module is used for recording the timestamp when the instruction execution sequence characteristics loaded in the memory are called and matched;

the calculation module is used for calculating the called times of the instruction execution sequence characteristics loaded in the memory within the preset statistical duration according to the timestamp;

the dividing module is used for dividing the instruction execution sequence characteristics loaded in the memory according to the called times and/or the last called timestamp corresponding to the instruction execution sequence characteristics loaded in the memory to obtain hot data and cold data;

and the deleting module is used for deleting the cold data from the memory.

14. The apparatus of claim 8,

the receiving module is further configured to receive update data of the instruction execution sequence characteristics loaded in the memory;

and the loading module is also used for organizing a sub-tree by taking the module as a unit according to the updating data and replacing the corresponding module node in the global tree.

15. A storage medium on which a computer program is stored, which program, when being executed by a processor, is adapted to carry out the method of loading a static feature library according to any one of claims 1 to 7.

16. A loading device of a static feature library, comprising a storage medium, a processor and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the loading method of the static feature library according to any one of claims 1 to 7 when executing the program.

Images