Instruction execution sequence processing method, device and equipment
A technology of instruction execution and processing method, which is applied in the field of instruction execution sequence processing, can solve the problems of incomplete acquisition of instruction execution sequence, inability to extract instruction execution sequence, and affect the accuracy of safety detection, so as to achieve the effect of improving accuracy
Pending Publication Date: 2021-02-23
QI AN XIN SECURITY TECH ZHUHAI CO LTD +1
View PDF13 Cites 0 Cited by
- Summary
- Abstract
- Description
- Claims
- Application Information
AI Technical Summary
Problems solved by technology
[0005] In view of this, the present application provides a processing method, device and equipment for an instruction execution sequence, the main purpose of which is to solve the situation that the obtained instruction execution sequence is incompletely obtained under abnormal circumstances, which will lead to failure to extract the complete instruction execution sequence A technical problem that affects the accuracy of security detection by matching sequences
Method used
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View moreImage
Smart Image Click on the blue labels to locate them in the text.
Smart ImageViewing Examples
Examples
Experimental program
Comparison scheme
Effect test
Embodiment Construction
[0048] Hereinafter, the present application will be described in detail with reference to the drawings and embodiments. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.
[0049] Aiming at solving the technical problem of incomplete acquisition of the acquired instruction execution sequence under abnormal circumstances, which will result in the inability to extract the complete instruction execution sequence for matching, thereby affecting the accuracy of security detection. This embodiment provides a method for processing instruction execution sequences, such as figure 1 As shown, the method includes:
[0050] 101. When the instruction execution sequence of the monitoring point event is incomplete, acquire the earliest instruction point in the instruction execution sequence.
[0051] Wherein, the monitoring point event may be an event such as creating a process...
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More PUM
Login to View More Abstract
The invention discloses an instruction execution sequence processing method, device and equipment, relates to the technical field of network security, and aims to effectively identify and repair incomplete instruction execution sequences and solve the problem that the instruction execution sequences cannot be completely acquired under abnormal conditions. The method comprises the following steps:when an instruction execution sequence of a monitoring point event is incomplete, obtaining an earliest instruction point in the instruction execution sequence; retrieving the instruction address of the earliest instruction point in an instruction execution sequence storage space, and performing validity verification on the retrieved storage address and the next stack base address corresponding tothe storage address according to the stack memory space range corresponding to the incomplete instruction execution sequence; and if the target storage address and the next stack base address corresponding to the target storage address respectively pass validity verification, repairing the incomplete instruction execution sequence according to the valid target storage address. The invention is suitable for recognition and repair processing of the instruction execution sequence.
Description
technical field [0001] The present application relates to the technical field of network security, in particular to a method, device and equipment for processing instruction execution sequences. Background technique [0002] With the development of Internet informatization, there are more and more cyber hacking incidents, and hacking methods are also constantly evolving. Hackers can use the loopholes to make the software process implement some attack events. Therefore, in order to better restrict the execution of legal events of the software process, the way of defining permission sets can be used to limit the events that the software process can execute. [0003] At present, the instruction execution sequence corresponding to the monitoring point (such as creating a process, reading and writing files / registry, etc.) can be matched with the instruction execution sequence of the preset normal behavior of the monitoring point, so as to find out whether there is an attack event...
Claims
the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to View More Application Information
Patent Timeline
Login to View More Patent Type & Authority Applications(China)
IPC IPC(8): G06F21/51G06F21/52
CPCG06F21/51G06F21/52
Inventor 杨晓东
Owner QI AN XIN SECURITY TECH ZHUHAI CO LTD