Memory malicious code detection method based on processor tracking

Abstract

The invention discloses a memory malicious code detection method based on processor tracking, which belongs to the technical field of information security, and is characterized by comprising the following steps that: a, a driving module initializes an Intel processor tracking function; b, monitoring a code execution path of a target process; c, decoding a buffer area to obtain a complete virtual address of the execution path; d, carrying out malicious code detection on a memory page; e, judging whether the code belongs to a trusted memory code or not; and f, detecting a memory code API calling record and a COM interface calling record, and matching the memory code API calling record and the COM interface calling record with an abnormal behavior knowledge base. Common scenes such as memory codes, shelled malicious codes, encrypted malicious code viruses and Trojan horses used in file-free attacks can be detected, meanwhile, the method also has a detection effect on execution of shellcode codes in the vulnerability utilization process, the detection effect is good, and good universality is achieved.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a memory malicious code detection method based on processor tracking. Background technique [0002] The malicious code detection mechanism of traditional terminal security detection software usually mainly detects the physical content of files, but the "fileless attack" and "shellcode separation and anti-kill" technologies that have emerged in recent years will not directly generate physical files in the system, making traditional The detection methods of security detection software are completely ineffective. For example, the malware "Poison IVY" Trojan horse provides a similar capability, which can directly generate a Trojan horse in the form of shellcode. Users can embed the Trojan horse in the form of shellcode into various carriers for spreading. At the same time, it combines code encryption and runtime decryption to bypass the detection of security defense soft...

AI Technical Summary

Problems solved by technology

The implementation of control flow integrity technology requires pre-offline training to prepare a trusted control flow graph for all codes of the target process, which makes it unable to function on new unadapted applications; in addition, the acquisition of trusted control flow graph Binary static analysis or dynamic fuzzing at runtime is required for the target process. Static analysis cannot analyze polymorphism at runtime, dynamic API calls, and other forms of dynamic code execution at runtime, while dynamic fuzzing at runtime is limited by code coverage rate limitation, it is impossible to achieve 100% code path coverage, and it is impossible to fully analyze all the behaviors of the program. Neither of these two methods can guarantee to obtain a credible control flow graph of the complete target code. In terms of the effect achieved by the final technology, the control flow Integrity defense is mainly aimed at the control flow hijacking behavior in the process of exploiting the target program, such as return-oriented programming, jump-oriented programming, and returning to the C standard library, which cannot be directly used in the memory commonly used for Trojan horse viruses Directly execute the detection of malicious code attack scenarios

Images