# US 2019/0318089 A1 · System security method and apparatus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0318089 A1 - Document ID: US20190318089A1 - Status: Published application - Kind: A1 - Application number: 16/359,096 - Filed: 2019-03-20 - Published: 2019-10-17 - Earliest claimed: 2016-11-11 - Assignees: Tencent Technology (Shenzhen) Company Limited - Applicants: Tencent Technology (Shenzhen) Company Limited - Inventors: Lingling WANG - Web page: https://patentgrep.com/patent/US20190318089A1 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 18/214: Generating training patterns; Bootstrap methods, e.g. bagging or boosting - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/564: {by virus signature recognition} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06N 3/0499: Feedforward networks - G06N 3/09: Supervised learning - G06N 20/20: Ensemble learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract A safeguarding method, a safeguarding apparatus, and a computer storage medium are provided. The method includes detecting a program operating on a terminal, and intercepting an operation performed by the program; identifying an object on which the program performs the operation; obtaining configuration information of the object on the terminal, and determining, based on the configuration information, that the object is a targeted monitored object. The method further includes determining, based on the configuration information of the targeted monitored object, whether the operation performed by the program on the object is a legitimate operation; and canceling intercepting the operation if the operation is a legitimate operation, and continuously intercepting the operation if the operation is an illegitimate operation. ## Claims ### Claim 1 A system safeguarding method, comprising: detecting, by a computing terminal a program operating on a terminal, and intercepting an operation performed by the program; identifying, by the computing terminal, an object on which the program performs the operation; obtaining, by the computing terminal, configuration information of the object on the terminal, and determining, based on the configuration information, that the object is a targeted monitored object; determining, by the computing terminal based on the configuration information of the targeted monitored object, whether the operation performed by the program on the object is a legitimate operation; and canceling, by the computing terminal, intercepting the operation if the operation is a legitimate operation, and continuously intercepting the operation if the operation is an illegitimate operation. ### Claim 2 (depends on 1) The method according to claim 1, wherein the determining, based on the configuration information, that the object is the targeted monitored object comprises: determining that the object is the targeted monitored object if the object on which the program performs the operation matches the targeted monitored object based on the configuration information. ### Claim 3 (depends on 2) The method according to claim 2, wherein the determining that the object is the targeted monitored object if the object on which the program performs the operation matches the targeted monitored object based on the configuration information comprises: determining that the object is the targeted monitored object if the object on which the program performs the operation is a program based on the configuration information, and the program is in a foreground operating state. ### Claim 4 (depends on 1) The method according to claim 1, wherein determining, based on the configuration information of the targeted monitored object, whether the operation performed by the program on the object is a legitimate operation comprises: determining whether a pre-configured illegitimate operation in the configuration information of the targeted monitored object corresponds to the operation performed by the program on the object, and if yes, determining that the operation performed by the program on the object is an illegitimate operation; otherwise, determining that the operation is a legitimate operation. ### Claim 5 (depends on 1) The method according to claim 1, further comprising: detecting the program by matching a malicious program signature database of the terminal with an attribute of the program or running a malicious program detection service when it is determined that the object is a non-targeted monitored object; and performing a prompt operation based on a detection result. ### Claim 6 (depends on 5) The method according to claim 5, wherein the detecting the program by matching a malicious program signature database of the terminal with an attribute of the program and running a malicious program detection service comprises: matching an attribute comprised in the malicious program signature database of the terminal with the attribute of the program, and if the attributes are not matched, detecting the program by invoking a malicious program detection service in a cloud. ### Claim 7 (depends on 5) The method according to claim 5, wherein the detecting the program by matching a malicious program signature database of the terminal with an attribute of the program comprises: correspondingly matching attributes in at least two dimensions comprised in the malicious program signature database of the terminal with attributes in corresponding dimensions of the program, and determining that the program is a malicious program when attributes in at least one dimension are successfully matched. ### Claim 8 (depends on 5) The method according to claim 5, wherein the detecting the program by running a malicious program detection service comprises: determining weights corresponding to attributes in different dimensions of the program, matching the attributes in the different dimensions with an attribute of a prior malicious program in parallel, and determining, based on a weight corresponding to a successfully matched attribute, whether the detected program is a malicious program. ### Claim 9 (depends on 8) The method according to claim 8, wherein the determining, based on a weight corresponding to a successfully matched attribute, whether the detected program is a malicious program comprises: determining whether a sum of the weights corresponding to the successfully matched attributes is greater than a sum threshold, and if it is determined that the detected program is a malicious program, determining a corresponding threat level based on a value by which the sum exceeds the sum threshold; otherwise, determining that the detected program is a trusted program. ### Claim 10 (depends on 8) The method according to claim 8, wherein the determining weights corresponding to attributes in different dimensions of the program comprises: inputting the attributes in different dimensions of the program into a machine learning model used for weight distribution, and distributing, based on distribution of attributes in different dimensions of a prior malicious program, a weight for an attribute in a corresponding dimension of the program. ### Claim 11 (depends on 10) The method according to claim 10, further comprising: updating a training set of the machine learning model with a sample constructed based on the detection result of the program, training a multilayer feed-forward neural network in the machine learning model based on the training set, and correcting an error of the multilayer feed-forward neural network based on the multilayer feed-forward neural network. ### Claim 12 A safeguarding apparatus, comprising a processor and a memory, the processor being capable of running a computer executable instruction in each function unit on the memory, and the functional unit on the memory comprising: a monitoring unit, configured to detect a program running on a terminal, and determine an object on which an operation is performed by the program; an interception unit, configured to intercept the operation performed by the program; a targeted monitoring determining unit, configured to obtain configuration information of a targeted monitored object in the terminal, and determine, based on the configuration information, that the object is the targeted monitored object; and a processing unit, configured to determining, based on the configuration information of the targeted monitored object, whether the operation performed by the program on the object is a legitimate operation, the interception unit canceling intercepting the operation if the operation is a legitimate operation, and continuously intercepting the operation if the operation is an illegitimate operation. ### Claim 13 (depends on 12) The apparatus according to claim 12, wherein the targeted monitoring determining unit determines that the object is the targeted monitored object if the object on which the program performs the operation matches the targeted monitored object configured in the configuration information. ### Claim 14 (depends on 13) The apparatus according to claim 13, wherein the targeted monitoring determining unit determines that the object is the targeted monitored object if the object on which the program performs the operation is a program configured in the configuration information, and the program is in a foreground operating state. ### Claim 15 (depends on 12) The apparatus according to claim 12, wherein the processing unit determines whether a pre-configured illegitimate operation in the configuration information of the targeted monitored object comprises the operation performed by the program on the object, and if yes, determines that the operation performed by the program on the object is an illegitimate operation; otherwise, the operation is a legitimate operation. ### Claim 16 (depends on 12) The apparatus according to claim 12, wherein the processing unit detects the program by matching a malicious program signature database of the terminal with an attribute of the program when it is determined that the object is a non-targeted monitored object; and/or detects the program running a malicious program detection service and performs a prompt operation based on a detection result. ### Claim 17 (depends on 16) The apparatus according to claim 16, wherein the processing unit matches an attribute comprised in the malicious program signature database of the terminal with the attribute of the program, and if the attributes are not matched, detects the program by invoking the malicious program detection service in a cloud. ### Claim 18 (depends on 16) The apparatus according to claim 16, wherein the processing unit correspondingly matches attributes in at least two dimensions comprised in the malicious program signature database of the terminal with attributes in corresponding dimensions of the program, and determines that the program is a malicious program when attributes in at least one dimension are successfully matched. ### Claim 19 A non-transitory computer-readable storage medium storing computer program instructions executable by at least one processor to perform:: detecting a program running on the terminal, and intercepting an operation performed by the program; determining an object on which the program performs the operation; obtaining configuration information of a targeted monitored object in the terminal, and determining, based on the configuration information, that the object is the targeted monitored object; determining, based on the configuration information of the targeted monitored object, whether the operation performed by the program on the object is a legitimate operation; and canceling intercepting the operation if the operation is a legitimate operation, and continuously intercepting the operation if the operation is an illegitimate operation. ### Claim 20 (depends on 19) The storage medium according to claim 19, wherein the determining, based on the configuration information, that the object is the targeted monitored object comprises: determining that the object is the targeted monitored object if the object on which the program performs the operation matches the targeted monitored object configured in the configuration information.