Malicious drive detection method, device, equipment and medium
A detection method and malicious technology, applied in the field of network security, can solve the problem that malicious drivers cannot be obtained, and achieve the effect of low false positives and stable performance.
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
Method used
Image
Examples
Embodiment 1
[0050] This embodiment provides a malicious driver detection method, which aims to filter malicious drivers by extracting driver objects from various aspects, and can effectively avoid manipulation of the corresponding data structure, so that the traditional two-way linked list cannot traverse malicious drivers and global variables. Defects that are accurately screened by addresses can comprehensively detect and locate drive objects based on SSDT, system global variable addresses, and memory addresses, and can also extract maliciously hidden drive objects, providing a comprehensive data basis for subsequent screening and filtering of malicious drivers. The extracted malicious drivers are more accurate, effectively avoiding false negatives and false negatives.
[0051] According to the above principles, the malicious driver detection method is introduced, such as figure 1 As shown, the malicious driver detection method specifically includes the following steps:
[0052] S1: De...
Embodiment 2
[0083] This embodiment discloses a device corresponding to the malicious drive detection method in Embodiment 1, please refer to Figure 5 shown, including:
[0084] The malicious driving object detection module 510 is used to detect the intercepted function pointer in the SSDT, locate the first driving object that intercepts the function pointer through the function pointer, and then actively intercept the unintercepted function pointer in the SSDT To detect the second driving object hidden by Rootkit technology, merge the first driving object and the second driving object, and obtain the driving object set P1;
[0085] A normal driving object detection module 520, configured to traverse the operating system to obtain normal driving objects, and merge the normal driving objects to establish the driving object set P2;
[0086] The memory drive object detection module 530 is used to traverse and analyze the memory structure data by double pointer dereferencing to obtain the driv...
Embodiment 3
[0091] Figure 6 A schematic structural diagram of an electronic device provided by Embodiment 3 of the present invention, such as Figure 6 As shown, the electronic device includes a processor 610, a memory 620, an input device 630, and an output device 640; the number of processors 610 in a computer device may be one or more, Figure 6 A processor 610 is used as an example; the processor 610, memory 620, input device 630 and output device 640 in the electronic device can be connected through a bus or other methods, Figure 6 Take connection via bus as an example.
[0092] The memory 620, as a computer-readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the malicious drive detection method in the embodiment of the present invention (for example, the malicious drive detection device in the Malicious drive object detection module 510, normal drive object detection modu...
PUM
Login to View More Abstract
Description
Claims
Application Information
Login to View More