A Puppet Process Detection Method, Device, Readable Storage Medium, and Computing Equipment

Abstract

The embodiment of the invention provides a puppet process detection method and device, a readable storage medium and computing equipment. The invariant feature values of the OEP of the memory main module is compared with the invariant feature values of the OEP of the PE file through a disassembling technology and an assembling instruction queue comparison technology, so as to determine a puppet process. The puppet process detection method and device improve the accuracy and efficiency of puppet process detection, and are suitable for different technical platforms. The method comprise the stepsof determining a first original entry point OEP of a main module of a memory corresponding to a target process; disassembling the memory content pointed by the first OEP to obtain a first instructionqueue; determining a second OEP of a transplantable executable PE file corresponding to the target process; disassembling the file content pointed by the second OEP to obtain a second instruction queue; and determining whether the target process is a puppet process or not according to a comparison result of the first instruction queue and the second instruction queue.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a puppet process detection method, device, readable storage medium and computing equipment. Background technique [0002] A puppet process is a way of hiding a process. From the outside, it looks like a process started by a normal file, but it is actually replaced by a running process with a malicious target file. It seems normal from the name and path of the process, but the file actually executed in memory has been replaced. [0003] Process Hollowing (Process Hollowing) technology is a process creation technique commonly used by malware, and it is a method to realize a puppet process. Processes created using Process Hollowing technology look normal when viewed with tools such as Task Manager, but the code contained in such processes is actually malicious code. The implementation method of process hole technology is as follows: [0004] 1. Create a process through ...

AI Technical Summary

Problems solved by technology

[0011] The method of monitoring using the kernel Hook is no longer available on 64-bit operating systems

The detection method using the handle table file has a certain degree of false positives, because there are the following situations: 1) the handle table of the process cannot be obtained; 2) the obtained handle table information is incomplete; 3) there is no relevant content in the handle table; these cases Both lead to the inability to judge whether it is a puppet process

Images