Malicious code detection method and device

Abstract

The present application discloses a malicious code detection method and device, by obtaining the calling path of the sensitive function during the execution of the program of the Linux operating system, and determining whether the calling path is a sensitive path, when it is determined that the calling path is a sensitive path, that is It is determined that there is a threat of malicious code in the program of the Linux operating system. Different from the malicious code protection method in the prior art, the solution provided by the embodiment of the present application is to detect malicious code based on the function call relationship contained in the program of the operating system, and can detect unknown malicious code, and the existing Malicious code generated after malicious code transformation is known, and compared with the protection of malicious code by programs based on the Linux operating system, its protection granularity is finer, so that even if malicious code is implanted into a whitelist program, it can be effectively detected.

Description

technical field [0001] The present application relates to the technical field of network security protection, and more specifically, relates to a malicious code detection method and device. Background technique [0002] With the rapid development of network and computer technology, the Linux operating system is gradually used by more and more network users, and the network security issues under the Linux operating system are receiving more and more attention. At present, the network security problems under the Linux operating system are mostly caused by attackers implanting malicious codes (such as viruses, worms, backdoor programs, etc.) into the programs of the Linux operating system. Security poses a threat, and it is usually necessary to protect against malicious codes implanted in programs of the Linux operating system. [0003] In the prior art, there are mainly the following two protection methods for malicious codes commonly used: [0004] The first type detects ma...

AI Technical Summary

Problems solved by technology

However, for unknown malicious codes and malicious codes generated after known malicious codes are transformed, this detection method cannot detect, and thus cannot avoid malicious codes posing a threat to network security issues under the Linux operating system

[0005] The second is the preset whitelist program. If an attacker implants malicious code into programs other than the whitelist program, the malicious code will not be allowed to execute because these programs are not included in the whitelist program. Therefore, malicious code can be avoided. The code poses a threat to network security issues under the Linux operating system. However, if the attacker implants malicious code into the whitelist program, the malicious code will be allowed to execute. Security issues pose a threat

[0006] It can be seen that the existing malicious code protection methods cannot protect some malicious codes, resulting in low reliability of malicious code protection. Therefore, how to improve the reliability of malicious code protection has become a technical problem that needs to be solved by those skilled in the art.

Images