Shellcode detection method based on virtual execution

Abstract

The invention discloses a Shellcode detection method based on virtual execution, which comprises the following steps of putting a network byte stream in a virtual machine to be subject to controlled execution, monitoring the execution process, and judging whether the Shellcode exists or not according to the characteristics existing in the execution process. For the Shellcode using polymorphic technology, a user can get good detection effect by using the method, and the information safety of the user can be ensured.

Description

technical field [0001] The invention relates to a network information security technology, in particular to a network attack code detection method. Background technique [0002] Buffer overflow attack is one of the most important security problems in recent years. Attackers use buffer overflow vulnerabilities to execute remote code to achieve the purpose of attack. [0003] Shellcode, as a piece of code sent to the target, is often the vector of buffer overflow attacks. Therefore, Shellcode detection is an effective means of buffer overflow attack detection. [0004] Traditional Shellcode detection technology can be divided into two types: static and dynamic. The static detection method is to extract features from the data stream, and then judge whether there is Shellcode according to the features, such as signature-based detection tools Snort and Bro, etc. The dynamic detection method generally adopts simulation execution. [0005] With the application of polymorphism te...

AI Technical Summary

Problems solved by technology

[0005] With the application of polymorphic technology in attack code, static detection technology gradually shows insufficient detection success rate

The dynamic virtual execution method has a good detection effect on Shellcode using polymorphic technology, but there are some shortcomings in the detection speed

Images