Method and device for detecting malicious code contained in non-executable file

Abstract

The invention discloses a method and device for detecting a malicious code contained in a non-executable file. The method comprises the following steps: opening a file to be checked, and reading and decoding effective content data to a memory; starting to check the data from the very beginning, and determining that the file contains a malicious code if a certain amount of data in the current position can conform to the form of an effective CPU (Central Processing Unit) instruction code block; if the data in the position does not conform to the form of the effective CPU instruction code block,moving to the next data position, and checking; and if the effective CPU instruction code block is not found after checking all the data, determining that the file does not contain a malicious code. The invention judges whether a non-executable file is injected with a malicious code by searching the non-executable file for an executable instruction code block. Compared with other detection methods, the detection method provided by the invention has higher recognition rate, can not be easily modified and bypassed by anti-antivirus and can find out the malicious code bound in a non-executable file using unknown vulnerabilities or vulnerabilities which can not be triggered, thereby being capable of acting as an effective complement to the existing detection methods.

Description

technical field [0001] The invention relates to a method for detecting computer security, in particular to a method for detecting malicious code contained in a non-executable file and a device thereof. Background technique [0002] The development of Internet security technology has greatly reduced direct remote attacks. And by sending some files containing malicious codes, the indirect attack behavior of tricking the attack target to open for intrusion has become a main form of attack. Both network and computer security have become increasingly serious problems. Due to the development of existing technologies and the improvement of network user awareness, it is basically impossible to directly use executable files containing malicious codes to conduct indirect attacks. However, in computers, systems and various application software, there are unknown security vulnerabilities, such as unknown overflow vulnerabilities, etc. These vulnerabilities often allow malicious codes ...

AI Technical Summary

Problems solved by technology

The traditional method of scanning and killing based on signatures can easily be bypassed by modifying the signatures

The behavior-based detection method will also fail when the vulnerability has been fixed or the system environment on which the vulnerability depends is not satisfied and cannot be triggered.

Images