System security method and apparatus

A safeguarding apparatus, comprising a processor and a memory, the processor being capable of running a computer executable instruction in each function unit on the memory, and the functional unit on the memory comprising:

• a monitoring unit, configured to detect a program running on a terminal, and determine an object on which an operation is performed by the program;
• an interception unit, configured to intercept the operation performed by the program;
• a targeted monitoring determining unit, configured to obtain configuration information of a targeted monitored object in the terminal, and determine, based on the configuration information, that the object is the targeted monitored object;
• and
• a processing unit, configured to determining, based on the configuration information of the targeted monitored object, whether the operation performed by the program on the object is a legitimate operation,
• the interception unit canceling intercepting the operation if the operation is a legitimate operation, and continuously intercepting the operation if the operation is an illegitimate operation.

A non-transitory computer-readable storage medium storing computer program instructions executable by at least one processor to perform::

• detecting a program running on the terminal, and intercepting an operation performed by the program;
• determining an object on which the program performs the operation;
• obtaining configuration information of a targeted monitored object in the terminal, and determining, based on the configuration information, that the object is the targeted monitored object;
• determining, based on the configuration information of the targeted monitored object, whether the operation performed by the program on the object is a legitimate operation;
• and
• canceling intercepting the operation if the operation is a legitimate operation, and continuously intercepting the operation if the operation is an illegitimate operation.