Security guarantee method and system for Windows terminals based on auto white list

Abstract

The invention discloses a security guarantee system for Windows terminals based on an auto white list, comprising a white list module and a detection module connected with the white list module; the white list module is used for automatically creating and manually maintaining white list data information; and the detection module is used for detecting whether programs to be executed are legal or not. The invention can automatically generate a white list which is simple and easy for common users, guarantee the security of local files via the control of a server and also effectively prevent stealth Trojan.

Description

technical field [0001] The invention relates to the field of information security, and more particularly, to a Windows terminal security guarantee method and system based on an automatic white list. Background technique [0002] With the development of network and information technology, the dependence of modern social life on information technology continues to increase. Therefore, whether it is an enterprise, an organization or an individual, the security requirements for computer terminals are getting higher and higher. However, the technical level of virus, Trojan horse and malicious software production is constantly improving, resulting in the terminal security protection for Microsoft Windows-like operating systems is always in a passive state. [0003] The current working mode of antivirus, anti-Trojan and anti-malware software is to capture samples, analyze features, update feature database, analyze feature vectors, finally identify illegal target objects, and perfor...

AI Technical Summary

Problems solved by technology

The biggest defect of this method is: based on the existing knowledge base to prevent, which leads to 1) the size of the knowledge base determines the ability to prevent known illegal objects; 2) there is a lag time window for the prevention of new variants; 3) Requires frequent upgrades and high maintenance costs

[0004] After realizing that the existing general-purpose terminal security products and technologies cannot guarantee sufficient terminal security, people changed the entry point for dealing with the problem, from listing the characteristics of illegal objects to listing the characteristics of legal software lists, that is, white list technology

The change in methodology does provide very useful help for personal terminal security, but the current whitelist technology still has the following shortcomings: 1) The whitelist requires manual configuration and management, which is more suitable for enterprises, but for ordinary users , it is difficult to define the whitelist by yourself in many cases; 2) Even if there is a whitelist, you can also copy the whitelist file and steal the user name and password of others to elevate the authority on the local terminal; 3) It cannot be effectively prevented Invisible Trojan without process, port or file

Images