Security control method and computer system

A security control method for a computer system in which a first domain and a second domain are deployed, the security control method comprising:

• obtaining a process identification of a current process from the first domain before a tracer collects a to-be-audited information;
• obtaining the to-be-audited information in the second domain using the tracer when a program in the first domain is executed, the to-be-audited information comprising control flow information of the program;
• using the process identification together with the control flow information as the to-be-audited information;
• searching the second domain for an audit rule that matches the process identification;
• auditing, in the second domain, the to-be-audited information according to an audit rule;
• and
• determining that the audit succeeds and allowing access to the second domain when the to-be-audited information matches the audit rule.

A non-transitory computer readable storage medium, comprising a computer readable instruction, wherein when the computer readable instruction is executed by one or more processors to perform:

• obtaining a process identification of a current process from the first domain before a tracer collects a to-be-audited information;
• obtaining the to-be-audited information in a second domain using the tracer when a program in a first domain is executed, the to-be-audited information comprising control flow information of the program;
• using the process identification together with the control flow information as the to-be-audited information;
• searching the second domain for an audit rule that matches the process identification;
• auditing, in the second domain, the to-be-audited information according to an audit rule;
• and
• determining that the audit succeeds and allowing access to the second domain when the to-be-audited information matches the audit rule.