Malicious code tracking and recognizing method based on memory protection type monitoring

Abstract

A malicious code tracking and recognizing method based on memory protection type monitoring includes the following steps that 1, a developed dynamic link library is injected into a target process; 2, vectorization manipulation function take-over anomaly is applied and used for conducting abnormal segment static analysis and dynamic analysis; 3, the interface function of memory protection attribute is hijacked and modified; 4, whether each call is located in stack space or not is detected; 5, whether the parameter of each call includes an attribute tag or not is judged; 6, for the interface function call of modifying the memory protection attribute into an executable attribute, the executable protection tag location is eliminated; 7, the parameter environment called by the interface function this time is recorded; 8, the original interface function is called so that the program can operate normally; 9, vulnerability attack finding is reported. By means of the steps, the effect of recognizing malicious code (shellcode) in the vulnerability attack process is achieved, and the problems that in the prior art, protection coverage area is small, and compatibility is low are solved.

Description

[0001] 1. Technical field [0002] The invention provides a method for tracking and identifying malicious codes based on memory protection type monitoring, which relates to loophole defense, a method for detecting and identifying malicious codes, and belongs to the field of information security. [0003] 2. Background technology [0004] With the popularization of electronic equipment and the continuous development of computer technology, the entire society's dependence on the Internet and computers continues to grow. At this time, information security has become an issue that cannot be ignored, and the detection, identification and defense technology of software vulnerabilities is particularly important. According to the statistics of patent applicants, in recent years, among vulnerability attack technologies, code reuse attacks (code reuse attacks) play a dominant role. Vulnerability attackers usually modify the memory protection attributes of malicious codes by attacking virt...

AI Technical Summary

Problems solved by technology

According to the statistics of patent applicants, in recent years, among vulnerability attack technologies, code reuse attacks (code reuse attacks) play a dominant role. Vulnerability attackers usually modify the memory protection attributes of malicious codes by attacking virtual function tables or returning addresses to execute system interface functions. , and the existing protection methods against this attack method, such as the execution flow protection (CFG Control Flow Guard) provided by Microsoft, have the following disadvantages: the protection coverage area is small, the compatibility is low, and the development environment usually needs to provide support when the application program is compiled. And running on high-level system versions above Windows 10, the two conditions are indispensable, resulting in a large number of applications that cannot use this type of protection scheme

Images