Vulnerability detection method and device, computer equipment and storage medium

Abstract

The invention relates to a vulnerability detection method and device, computer equipment and a storage medium. The method comprises the following steps: identifying a target process running in an operating system, and injecting a preset library file into the target process; wherein the preset library file is used for performing explicit calling on a running target process; obtaining system attribute information and a target detection code, and constructing a callback function corresponding to the target process by utilizing a preset callback function according to the system attribute information and the target detection code; performing callback configuration on the target process by utilizing a preset process function and a callback function; returning the system call of the target process from the operating system through the callback function, obtaining the returned system call, and analyzing a return address corresponding to the system call by utilizing the callback function; and when the return address is not matched with the offset address of the target process, determining that the system call corresponding to the return address has security vulnerabilities. By adopting the method, the vulnerability detection efficiency and accuracy can be effectively improved.

Description

technical field [0001] The present application relates to the technical field of computer security, in particular to a vulnerability detection method, device, computer equipment and storage medium. Background technique [0002] With the rapid development of Internet technology, information networks are widely involved in various fields, which also leads to the risks of network information networks being attacked and data stolen. Network information security has become a concern. Therefore, some vulnerability detection methods based on network information security have emerged. Usually, the global hook set in the driver layer is used to intercept the calls of all processes in the operating system, and then based on the system call identification of the function hook, the call address is screened and judged, thereby identifying unsafe system calls. [0003] However, the current hook identification method based on the driver layer is easily detected by common tools, and the gl...

AI Technical Summary

Problems solved by technology

[0003] However, the current hook identification method based on the driver layer is easily detected by common tools, and the global interception method needs to intercept the system calls of all processes. The system runs slowly, resulting in less efficient vulnerability detection

Images