Detecting system and method for shellcode based on memory searching

Abstract

The invention discloses a detecting system for shellcode based on memory searching. The detecting system for shellcode includes a detected sample scheduling module, a memory searching algorithm module, a shellcode detecting module and a log module. A detecting method for shellcode includes the following steps: (1) the scheduling module schedules a tested application to open a detected document sample, (2) the memory searching algorithm module dumps memory of detected application to a file or performing memory searching directly, (3) shellcode detecting module scans the dumped file to find shellcode, and (4) the log output module outputs information related to shellcode. The detecting system and method for shellcode has the advantages of performing shellcode detection after being based on memory searching, being capable of detecting codes and encrypted and hidden shellcode of complicated application file formats so that a detection rate of malicious attack samples is raised greatly and an false positive rate and an false negative rate of malicious attack samples are lowered effectively.

Description

technical field [0001] The invention relates to the field of network security intrusion detection and defense, in particular to a shellcode detection system and method based on memory search. Background technique [0002] The use of buffer overflow security vulnerabilities and other memory memory security vulnerabilities is an important means to conduct network attacks and gain control of the system. Therefore, the defense technology against this type of vulnerability attack is an important content in the field of network security research. [0003] Since the implementation of the specific functions in the above-mentioned main vulnerability attacks must be completed through shellcode, the vulnerability carrier data generated by the attacker must protect the shellcode. Currently, detecting the existence of shellcode is the main means of judging the vulnerability attack. [0004] The current mainstream attack software carriers are mainly the most popular software such as micro...

AI Technical Summary

Problems solved by technology

[0008] At the same time, this type of technology has corresponding shortcomings: the mainstream document formats include office, pdf, flash and other document formats. Format parsing tools are very time-consuming and labor-intensive

However, the format analysis tools implemented by third parties based on this format document are often not well compatible with various non-standard format files, and have poor fault tolerance

As a result, gaps in vulnerability attacks are created. The attacker constructs a special format document so that the program triggered by the vulnerability can be parsed normally, but the third-party parsing tool cannot parse it, thereby bypassing various defense detections.

Images