Process behavior control method and device

Abstract

The invention discloses a process behavior control method and a process behavior control device. The method comprises the following steps that: when detecting a keyboard input or key input behavior, an underlying driver intercepts the calling of a callback function by a message hook, wherein the message hook is associated with a process for triggering the current keyboard input or key input behavior; the underlying driver sends information of the process associated with the message hook to an application layer; the underlying driver stops or allows the behavior triggered by the process associated with the message hook; the application layer judges whether the behavior triggered by the corresponding process is stopped or allowed or not according to the information of the process associated with the message hook, and informs the underlying driver of a judgment result; and the underlying driver performs the corresponding operation of stopping or allowing the behavior triggered by the corresponding process according to the judgment result of the application layer. By the method and the device, the calling of the callback function by the message hook can be intercepted, and the stability of a system is ensured.

Description

technical field [0001] The present invention relates to the field of computer equipment security, in particular to a process behavior control method, a process behavior control device, and a process behavior control bottom drive system. Background technique [0002] The wide application of Windows operating system makes it become the operating system most severely attacked by malicious software, and its security issues have become the focus of attention of users and computer security researchers. [0003] Malware refers to viruses, worms, and Trojan horses that perform malicious tasks on computer systems. The most commonly used implementation technology of malware is hook technology. By using hook technology, malware can change the normal execution path of the operating system, thereby destroying the system or stealing user information. [0004] At present, a commonly used protection method is to realize the protection design for malicious software by detecting hooks under ...

AI Technical Summary

Problems solved by technology

The hook under the Windows operating system completes the callback to the system by calling the callback function. Therefore, the process information of the hook can be obtained by intercepting the call to the callback function. Stuck

Images