Kernel hook based process behavior monitoring method

Abstract

The invention relates to a kernel hook based process behavior monitoring method. Firstly a monitoring program is started and whether a user loads a driving program is judged, if the user does not load the driving program, the user is prompted to load the driving program, then initialization operation is performed, and the monitoring program sends a process ID of the monitoring program to the driving program through DeviceIoControl and performs process protection; the monitoring program selects a monitored process and creates a message receiving thread for receiving a message of the driving program; the driving program monitors behaviors of the monitored process and sub-processes, and sends a monitoring result to the monitoring program; the message receiving thread of the monitoring program displays and records the received monitoring result; and when the monitored process and the sub-processes are all exited or the monitoring program selects stopping of monitoring, the monitored process and the sub-processes are ended, the message receiving thread of the monitoring program is exited, the current monitoring is ended, and the steps are repeated for performing a new round of monitoring. According to the method, the occurrence of malicious process behaviors can be effectively prevented.

Description

technical field [0001] The invention relates to the software technical field of system security, in particular to a kernel hook-based process behavior monitoring method. Background technique [0002] During the continuous development of the Internet, while surfing the Internet, netizens are always at risk of being attacked by malicious programs. Malware emerges in an endless stream, which seriously threatens the security of Internet users' host systems. The traditional signature scanning technology urgently needs to be improved due to its lag and high false positive rate, while the behavior monitoring technology is widely used in various host defense systems for its effective identification and accuracy of unknown malicious programs. [0003] The well-known Kaspersky and 360 Security Guard of the domestic security company 360 have added active defense functions. When malicious programs produce suspicious behaviors such as remote thread injection and adding users, they will ...

AI Technical Summary

Problems solved by technology

The common methods of file security protection are information encryption and setting access rights. However, due to the loopholes of application software and the infringement of viruses, these methods cannot achieve satisfactory results in file security protection.

Some malicious applications mostly use the way of loading drivers for intrusive access operations, and the protection of ordinary user layers is difficult to achieve the purpose of file security protection

Images