Malicious code detection method and device based on JAVA program and storage medium

Abstract

The invention discloses a malicious code detection method and device based on a JAVA program and a storage medium. The method comprises the steps that firstly, a JVM code segment memory is detected in a target process; when it is detected that the memory of the JVM code segment is modified, obtaining a JIT permission; under the JIT permission, all CLASS package names loaded by the JVM are obtained, classes loaded by the JVM are filtered, filtered CLASS original data are obtained through a JIT interface, and original data scanning is carried out through YARA; and finally, the scanned abnormal CLASS data is obtained and extracted, and it can be seen that the malicious codes of the JAVA program are detected by bypassing a JVM layer module anti-loading mechanism in a system-level module injection mode.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a JAVA program-based malicious code detection method, device and storage medium. Background technique [0002] The memory horse is a fileless Trojan. After running successfully, there is no related file to associate, and it is attached to the system or security application software process. Generally, the memory Trojan is parasitic in the host process in the form of shellcode, and the size can be smaller than KB, so it is difficult to correlate Check. [0003] JAVA memory Trojan refers to the Trojan program running in the JAVA / JVM process. It belongs to a container Trojan. Unlike the traditional system-level memory Trojan, the bytecode it runs has nothing to do with the CPU and operating system. All action capabilities (ie API calls) are relayed and triggered by the host JVM. The memory horse itself is difficult to detect by traditional antivirus software. [0004...

AI Technical Summary

Problems solved by technology

The memory horse itself is difficult to detect by traditional antivirus software

[0004] At present, JAVA memory horse detection is detected through the Agent plug-in method, which has great resistance to the agent injection method. Once the Trojan horse program first enters the JVM, the Trojan horse program will delete the relevant API loaded by the Agent, and the subsequent security software will use the Agent technology. Doing detection will not be able to attach to the target JVM process

Images