局域网电脑监控软件的 Python 布隆过滤器进程监测算法

import math
import hashlib
class ProcessBloomFilter:
    def __init__(self, expected_items, false_positive_rate):
        # 计算位数组大小和哈希函数个数
        self.n = expected_items
        self.p = false_positive_rate
        self.m = int(-(self.n * math.log(self.p)) / (math.log(2) ** 2))
        self.k = int(-math.log(self.p) / math.log(2))
        # 初始化位数组（用bytearray节省空间）
        self.bit_array = bytearray(math.ceil(self.m / 8))
    def _hash(self, process_name, seed):
        # 结合种子生成不同哈希值，模拟多个哈希函数
        hash_obj = hashlib.sha256((process_name + str(seed)).encode('utf-8'))
        hash_val = int(hash_obj.hexdigest(), 16)
        return hash_val % self.m
    def add_legal_process(self, process_name):
        # 插入合法进程名到布隆过滤器
        for seed in range(self.k):
            idx = self._hash(process_name, seed)
            byte_idx = idx // 8
            bit_idx = idx % 8
            self.bit_array[byte_idx] |= 1 << bit_idx
    def is_legal_process(self, process_name):
        # 判断进程是否为合法进程（局域网电脑监控软件核心查询方法）
        for seed in range(self.k):
            idx = self._hash(process_name, seed)
            byte_idx = idx // 8
            bit_idx = idx % 8
            if not (self.bit_array[byte_idx] & (1 << bit_idx)):
                return False
        return True
# 局域网电脑监控软件进程监测示例
def lan_monitor_demo():
    # 初始化：预期存储10000个合法进程，误判率0.1%
    bloom_filter = ProcessBloomFilter(10000, 0.001)
    # 1. 导入合法进程列表（模拟局域网电脑监控软件预设的合法进程库）
    legal_processes = [
        "chrome.exe", "notepad.exe", "excel.exe", "winword.exe",
        "taskmgr.exe", "explorer.exe"  # 系统及办公常用合法进程
        # ... 省略更多合法进程
    ]
    for process in legal_processes:
        bloom_filter.add_legal_process(process)
    print("局域网电脑监控软件合法进程库导入完成")
    # 2. 模拟监测终端进程（局域网电脑监控软件实时采集的进程数据）
    monitored_processes = [
        "chrome.exe",  # 合法进程
        "malware.exe", # 异常进程
        "excel.exe",   # 合法进程
        "hacktool.exe" # 异常进程
    ]
    print("\n局域网电脑监控软件进程监测结果：")
    for process in monitored_processes:
        if bloom_filter.is_legal_process(process):
            print(f"进程[{process}]：合法进程，无需干预")
        else:
            print(f"进程[{process}]：异常进程，局域网电脑监控软件触发预警")
# 执行示例
if __name__ == "__main__":
    lan_monitor_demo()