Malware detection method and device

Abstract

The present invention provides a malware detection method and device, which relates to the field of mobile security technology. The method includes: reading a preset memory, which is a memory after inserting a binary file loaded by a program located based on memory mapping technology into a springboard memory and executing it; judging whether there is a malicious address in the memory segment of the preset memory, and determining whether there is a malicious operation based on the judgment result. The present invention executes the code in the springboard memory after inserting the target binary file loaded by the program located, so as to determine the impact of the execution code on the register by reading the register, thereby judging whether there is a malicious address, identifying the potential malicious behavior of the software, enhancing the understanding and response capabilities of complex malware attack patterns, especially for the situation where multi-threaded malicious behavior is dispersed to avoid detection, and greatly improving the accuracy and efficiency of malware detection.

Description

Technical Field

[0001] The present invention relates to the field of mobile security technology, and in particular to a malware detection method and device. Background Art

[0002] In today's information age, mobile terminals have penetrated into all aspects of society and become key nodes for information exchange. This brings with it severe challenges to the security of mobile terminals, especially the threat from malware. These malware are not only highly concealed and destructive, but also often evade traditional security detection technologies through self-protection mechanisms. This challenge is even more prominent in non-real-time multi-threaded terminal operating systems because the system's own multi-tasking execution environment provides malware with more potential execution and evasion paths.

[0003] Traditional malware analysis methods, such as static analysis and dynamic tracking, are effective in some scenarios, but are often helpless against advanced evasion techniques such as self-modification, code obfuscation, and polymorphic generation. In addition, modern malware often uses the multi-threading capabilities provided by the operating system to further evade detection by dispersing its behavior patterns. It is difficult to capture the activities and parameters of malware in real time without interfering with the normal use of users, resulting in the inability of traditional methods to effectively adapt to the rapid evolution of malware. Summary of the invention

[0004] The present invention provides a malware detection method and device to solve the defect in the prior art that malware evades detection based on multi-threaded distributed behavior patterns, enhance the understanding and response capabilities of complex malware attack patterns, and thus provide more comprehensive security protection for mobile devices.

[0005] The present invention provides a malware detection method, comprising: reading a preset memory, wherein the preset memory is a memory after a binary file loaded by a program located based on a memory mapping technology is inserted into a springboard memory and executed; judging whether there is a malicious address in a memory segment of the preset memory, and determining whether there is a malicious operation according to the judgment result.

[0006] According to a malware detection method provided by the present invention, before reading the preset memory, it includes: based on the memory mapping technology, locating the binary file loaded by the program to obtain the target binary file; according to the target binary file, obtaining the memory occupation size of the target binary file; according to the memory occupation size, applying for memory to insert the target binary file into the springboard memory and execute the code in the springboard memory.

[0007] According to a malware detection method provided by the present invention, after obtaining the target binary file, the method includes: reading the binary file, and judging the instruction set of the read codes one by one to determine the instruction type; parsing the corresponding instructions according to the instruction type, and correcting the parsed target instructions one by one; wherein the target instructions are used to represent the instructions that generate the offset.

[0008] According to a malware detection method provided by the present invention, the code includes a target binary file inserted into the springboard memory and a code previously stored in the springboard memory, and executing the code in the springboard memory includes: executing the code in the springboard memory, and the code previously stored in the springboard memory runs normally; or executing the code in the springboard memory, replacing the root route command of the code previously stored in the springboard memory with the target binary file inserted into the springboard memory.

[0009] According to a malware detection method provided by the present invention, executing the code in the springboard memory also includes: executing the code in the springboard memory to trigger the call of a target function, wherein the target function is used to characterize the function limited to be called in the code in the springboard memory; querying the relative address of the target function according to a key-value pair map set, wherein the map set includes at least one pair of key-value pairs stored according to a function and a relative address corresponding to the function, wherein the relative address is determined according to the absolute address of the function corresponding to the symbol table in the symbol library and the changed address of the function; and calling the target function according to the relative address.

[0010] According to a malware detection method provided by the present invention, after determining whether there is a malicious address in the memory segment of the preset memory, the method includes: according to the determination result, if it is determined that there is a malicious operation, printing the parameters of the preset register based on the parameter printing logic pre-stored in the springboard memory; and performing algorithmic restoration and tracing of the malware corresponding to the malicious operation based on the printed preset register parameters and the parameter change values ​​stored in the system preset directory previously acquired.

[0011] According to a malware detection method provided by the present invention, before performing algorithmic restoration and tracing of the malware corresponding to the malicious operation based on the printed preset register parameters and the parameter change values ​​stored in the system preset directory obtained in advance, the method includes: based on a preset hook function, obtaining parameters before and after the read and write operations on the target memory, wherein the read and write operations are triggered based on the execution of the code in the springboard memory; obtaining parameter change values ​​based on the parameters before and after the read and write operations on the target memory, and writing them into the system preset directory.

[0012] The present invention also provides a malware detection device, comprising: a register reading module, which reads a preset memory, wherein the preset memory is a memory after a binary file loaded by a program located based on a memory mapping technology is inserted into a springboard memory and executed; a malware detection module, which determines whether there is a malicious address in a memory segment of the preset memory, and determines whether there is a malicious operation based on the determination result.

[0013] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-mentioned malware detection methods are implemented.

[0014] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which implements the steps of any of the above-mentioned malware detection methods when executed by a processor.

[0015] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the steps of any of the above-mentioned malware detection methods are implemented.

[0016] The malware detection method and device provided by the present invention execute the code in the springboard memory after inserting and locating the target binary file loaded by the program, so as to determine the influence of the execution code on the register by reading the register, thereby judging whether there is a malicious address, so as to identify the potential malicious behavior of the software, enhance the understanding and response capabilities of complex malware attack modes, especially for the situation where multi-threaded malicious behavior is dispersed to evade detection, greatly improve the accuracy and efficiency of malware detection, improve the depth and breadth of security research, provide a scalable and in-depth solution for the field of mobile operating system security, and provide more comprehensive security protection for mobile devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 It is a schematic diagram of the process of the malware detection method provided by the present invention;

[0019] Figure 2 is a schematic diagram of the structure of a malware detection device provided by the present invention;

[0020] Figure 3It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] Figure 1 A schematic flow chart of a malware detection method of the present invention is described, wherein the device comprises:

[0023] S11, reading a preset memory, the preset memory is a memory after a binary file loaded by a program located based on a memory mapping technology is inserted into a springboard memory and executed;

[0024] S12, determining whether there is a malicious address in the memory segment of the preset memory, and determining whether there is a malicious operation according to the determination result.

[0025] It should be noted that the step numbers “S1N” in this specification do not represent the sequence of the malware detection method. The malware detection method of the present invention is described in detail below.

[0026] Step S11, reading a preset memory, the preset memory is a memory after the binary file loaded by the program located based on the memory mapping technology is inserted into the springboard memory and executed.

[0027] In an optional embodiment, before reading the preset register, it includes: locating the binary file loaded by the program based on the memory mapping technology to obtain the target binary file; inserting the target binary file into the springboard memory and executing the code in the springboard memory.

[0028] Furthermore, inserting the target binary file into the springboard memory includes: obtaining the memory occupied by the target binary file according to the target binary file; applying for memory according to the memory occupied size to insert the target binary file into the springboard memory and execute the code in the springboard memory.

[0029] It should be noted that when the springboard memory is a memory area allocated by a memory map (mmap) system call, the memory is requested from the mmap system according to the size of the memory occupied. In addition, the springboard memory is also used to store jump instructions, parameter printing logic and storage code, and the corresponding processing logic is written for a specific instruction set and the properties of the springboard memory are set so that the code can be executed. The instruction set can be ARMv7a or ARMv8a, which can be selected according to actual design requirements and is not further limited here.

[0030] In addition, a monitoring sandbox environment needs to be created to locate the binary files loaded by the application using memory mapping techniques in different instruction set architectures (such as ARMv7a and ARMv8a).

[0031] Specifically, after obtaining the target binary file, the process includes: reading the binary file, and judging the instruction set of the read codes one by one to determine the instruction type; parsing the corresponding instructions according to the instruction type, and correcting the parsed target instructions one by one; wherein the target instructions are used to represent the instructions that generate the offset.

[0032] It should be added that the target instruction can be determined based on the instruction that actually generates the offset, or it can be determined based on specific instructions in the instructions that generate the offset based on actual design requirements, such as unconditional jump instructions in instructions that affect the program counter (PC); the target binary file is located based on memory mapping technology when the application is loaded, and the relevant instructions in the binary file are offset when the program is loaded, so it is necessary to correct the target instruction to ensure that the corrected target instruction can correctly jump to the code previously stored in the springboard memory.

[0033] In this embodiment, the code includes the target binary file inserted into the springboard memory and the code previously stored in the springboard memory. It should be noted that the code previously stored in the springboard memory can be a code written based on assembly language, or a code written based on other programming languages, which is not further limited here.

[0034] Correspondingly, executing the code in the springboard memory includes: executing the code in the springboard memory, and the code previously stored in the springboard memory runs normally; or, executing the code in the springboard memory, replacing the root route command of the code previously stored in the springboard memory with the target binary file inserted into the springboard memory.

[0035] It should be noted that when the software corresponding to the target binary file is malware, the route of the code previously stored in the springboard memory will be replaced with the target binary file to maliciously modify the code previously stored in the springboard memory, causing it to perform malicious operations or unauthorized operations, thereby facilitating the subsequent judgment of whether there is a malicious address based on the read register, thereby achieving real-time malware detection.

[0036] In an optional embodiment, executing the code in the springboard memory also includes: executing the code in the springboard memory to trigger the call of a target function, the target function is used to represent the function limited to be called in the code in the springboard memory; querying the relative address of the target function according to a key-value pair map set, the map set is created according to the key-value pairs stored in the function and the relative address corresponding to the function, the relative address is determined according to the absolute address of the function corresponding to the symbol table in the symbol library and the changed address of the function; calling the target function according to the relative address.

[0037] For example, when the libart system library is used, the corresponding target function can be a class search function (FindClass), an array length and element number acquisition function (GetArryLength), a string creation function (NewString) and other system functions. When the libc system library is used, the corresponding target function can be a memory copy function (memcpy), a random function (rand), a memory move function (memove) and other system functions. The selection of the target function can be determined based on the code previously stored in the springboard memory, which will not be further explained here. It should be noted that FindClass searches for the Java category class by passing the complete class name in Java; the libart system library is a dynamic library used by Android's Art virtual machine; libc is the ANSI C function library under Linux.

[0038] Step S12, determining whether there is a malicious address in the memory segment of the preset memory, and determining whether there is a malicious operation according to the determination result.

[0039] In this embodiment, it is determined whether there is a malicious address in the memory segment of the preset memory, and whether there is a malicious operation is determined based on the judgment result, including: reading the register to determine whether there is a malicious address in the segment address of the register, if so, it is determined that there is a malicious operation; otherwise, there is no malicious operation; wherein the segment address is obtained based on the start address and end address of the register.

[0040] In an optional embodiment, after determining whether there is a malicious address in the memory segment of the preset memory, the method includes: if there is no malicious address in the segment address of the register, performing a read operation on the springboard memory, and when jumping back based on the preset jump instruction, accessing the memory of the preset memory; monitoring the instruction code svc instruction to obtain the function address; determining whether to call the svc instruction based on the function address to determine whether the system is interrupted, and determining the actual execution logic of the svc instruction.

[0041] In an optional embodiment, after determining whether the system is interrupted and determining the actual execution logic of the svc instruction, it also includes: based on the above method, generating logic code and packaging it into a dynamic link library; modifying the kernel and / or system logic code, so as to design and insert the dynamic link library on the basis of a comprehensive binary mapping analysis of the API in the system library and kernel file, to ensure that the dynamic link library is called first before the program starts, so that its corresponding malware detection logic takes effect first; modifying the kernel to compile or compile the system, specifically, the modification can be adapted according to the environment in which the dynamic link library actually needs to run, so that the dynamic link library is called first. It should be noted that by using kernel modification and code injection technology to dynamically and flexibly implement malware detection, not only the accuracy and efficiency of detection are improved, but also a scalable and in-depth solution is provided for the field of mobile operating system security.

[0042] In an optional embodiment, after determining whether there is a malicious address in the memory segment of the preset memory, it also includes: based on the judgment result, if it is determined that a malicious operation exists, printing the parameters of the preset register based on the parameter printing logic pre-stored in the springboard memory; based on the printed preset register parameters and the parameter change values ​​stored in the system preset directory previously obtained, algorithmically restoring and tracing the malware corresponding to the malicious operation.

[0043] It should be noted that the printed register parameters include function call details. After executing the code, the impact of the malicious behavior in the code on the registers can be restored and traced back to the algorithm of the malware corresponding to the malicious operation. The algorithm logic used by the malware can be analyzed without source code, so as to facilitate in-depth understanding of its evasion detection strategy. It can specifically see the intrusion caused by the API called by the malware, allowing reverse engineers to use more accurate and comprehensive methods when evaluating the security of the software.

[0044] In addition, after generating a dynamic link library in accordance with the above method, if malware detection is required for other software, the dynamic link library can be directly called. Alternatively, when it is determined that malware exists, the binary file of the malware is used as the target binary file and the above dynamic link library is called to capture the parameters of the malware, thereby facilitating the restoration and tracing of the algorithm used by the malware.

[0045] Specifically, before algorithmically restoring and tracing the malware corresponding to the malicious operation based on the printed preset register parameters and the parameter change values ​​stored in the previously acquired system preset directory, it includes: based on the preset hook function, obtaining the parameters before and after the read and write operations on the target memory, the read and write operations are triggered based on the code in the execution springboard memory; according to the parameters before and after the read and write operations on the target memory, obtaining the parameter change values, and writing them into the system preset directory.

[0046] It should be added that the target memory is the corresponding memory pre-defined in the executed code, which can be set based on actual design requirements; the system preset directory can be a private directory of the system, which is not further defined here.

[0047] In summary, the embodiments of the present invention execute the code in the springboard memory after inserting and locating the target binary file loaded by the program, so as to determine the impact of the execution code on the register by reading the register, thereby judging whether there is a malicious address, identifying the potential malicious behavior of the software, and enhancing the understanding and response capabilities of complex malware attack modes, especially for the situation where multi-threaded malicious behaviors are dispersed to evade detection, greatly improving the accuracy and efficiency of malware detection, and improving the depth and breadth of security research, providing a scalable and in-depth solution for the field of mobile operating system security, and providing more comprehensive security protection for mobile devices.

[0048] The malware detection device provided by the present invention is described below. The malware detection device described below and the malware detection method described above can be referenced to each other.

[0049] Figure 2 A schematic diagram of the structure of a malware detection device is shown, the device comprising:

[0050] The register reading module 21 reads a preset memory, which is a memory after a binary file loaded by a program located based on a memory mapping technology is inserted into a springboard memory and executed;

[0051] The malware detection module 22 determines whether there is a malicious address in the memory segment of the preset memory, and determines whether there is a malicious operation according to the determination result.

[0052] In an optional embodiment, the device further includes: a positioning module, which locates the binary file loaded by the program based on memory mapping technology before reading the preset register to obtain the target binary file; an insertion module, which inserts the target binary file into the springboard memory; and a code execution module, which executes the code in the springboard memory.

[0053] Furthermore, the insertion module includes: a memory calculation unit, which obtains the memory usage size of the target binary file according to the target binary file; an insertion unit, which applies for memory according to the memory usage size to insert the target binary file into the springboard memory and execute the code in the springboard memory.

[0054] Furthermore, the device also includes: an instruction type judgment module, which reads the binary file after obtaining the target binary file, and judges the instruction set of the read code one by one to determine the instruction type; an instruction correction module, which parses the corresponding instructions according to the instruction type, and corrects the parsed target instructions one by one; wherein the target instruction is used to represent the instruction that generates the offset.

[0055] In this embodiment, the code includes a target binary file inserted into the springboard memory and a code previously stored in the springboard memory. Accordingly, the code execution module is used to: execute the code in the springboard memory, and the code previously stored in the springboard memory runs normally; or, execute the code in the springboard memory, and replace the root route command of the code previously stored in the springboard memory with the target binary file inserted into the springboard memory.

[0056] In an optional embodiment, the code execution module also includes: a call trigger unit, which executes the code in the springboard memory to trigger the call of the target function, and the target function is used to represent the function limited to be called in the code in the springboard memory; an address acquisition unit, which queries the relative address of the target function according to the key-value pair map set, and the map set is created based on the key-value pairs stored in the function and the relative address corresponding to the function, and the relative address is determined based on the absolute address of the function corresponding to the symbol table in the symbol library and the change address of the function; a function calling unit, which calls the target function according to the relative address.

[0057] In this embodiment, the malware detection module 22 is used to: read the register to determine whether there is a malicious address in the segment address of the register, and if so, determine that there is a malicious operation; otherwise, there is no malicious operation; wherein the segment address is obtained based on the start address and end address of the register.

[0058] In an optional embodiment, the device further includes: a first processing module, after determining whether there is a malicious address in the memory segment of the preset memory, if there is no malicious address in the segment address of the register, then performing a read operation on the springboard memory, and when jumping back based on the preset jump instruction, accessing the memory of the preset memory; a monitoring module, monitoring the instruction code svc instruction, and obtaining the function address; a second processing module, judging whether to call the svc instruction according to the function address to determine whether the system is interrupted, and determining the actual execution logic of the svc instruction.

[0059] In an optional embodiment, the device also includes: a dynamic link library generation module, which generates logic code based on the above method and packages it into a dynamic link library after determining whether the system is interrupted and determining the actual execution logic of the svc instruction; an adjustment module, which modifies the kernel and / or system logic code, so as to design and insert the dynamic link library on the basis of a comprehensive binary mapping analysis of the API in the system library and kernel file to ensure that the dynamic link library is called first before the program starts, so that its corresponding malware detection logic takes effect first; modify the kernel for compilation or compilation system, and specifically can adapt the modification according to the environment in which the dynamic link library actually needs to run, so that the dynamic link library is called first.

[0060] In an optional embodiment, the device further includes: a printing module, after determining whether there is a malicious address in the memory segment of the preset memory, based on the determination result, if it is determined that there is a malicious operation, printing the parameters of the preset register based on the parameter printing logic pre-stored in the springboard memory; an algorithm restoration module, based on the printed preset register parameters and the parameter change values ​​stored in the previously acquired system preset directory, performing algorithm restoration and tracing of the malware corresponding to the malicious operation.

[0061] It should be noted that the printed register parameters include function call details. After executing the code, the impact of the malicious behavior in the code on the registers can be restored and traced back to the algorithm of the malware corresponding to the malicious operation. The algorithm logic used by the malware can be analyzed without source code, so as to facilitate in-depth understanding of its evasion detection strategy. It can specifically see the intrusion caused by the API called by the malware, allowing reverse engineers to use more accurate and comprehensive methods when evaluating the security of the software.

[0062] In addition, after generating a dynamic link library in accordance with the above method, if malware detection is required for other software, the dynamic link library can be directly called. Alternatively, when it is determined that malware exists, the binary file of the malware is used as the target binary file and the above dynamic link library is called to capture the parameters of the malware, thereby facilitating the restoration and tracing of the algorithm used by the malware.

[0063] Specifically, the device also includes: a parameter acquisition module, which obtains the parameters before and after the read and write operations on the target memory based on the preset hook function before performing algorithmic restoration and tracing of the malware corresponding to the malicious operation according to the printed preset register parameters and the parameter change values ​​stored in the system preset directory obtained previously, and the read and write operations are triggered based on the execution of the code in the springboard memory; a change recording module, which obtains the parameter change values ​​according to the parameters before and after the read and write operations on the target memory, and writes them into the system preset directory.

[0064] It should be added that the target memory is the corresponding memory pre-defined in the executed code, which can be set based on actual design requirements; the system preset directory can be a private directory of the system, which is not further defined here.

[0065] In summary, the embodiment of the present invention executes the code in the springboard memory after inserting and locating the target binary file loaded by the program, so as to read the register through the register reading module and determine the impact of the execution code on the register, thereby judging whether there is a malicious address through the malware detection module to identify the potential malicious behavior of the software, enhance the understanding of and response capabilities for complex malware attack patterns, especially for situations where multi-threaded malicious behaviors are dispersed to evade detection, greatly improves the accuracy and efficiency of malware detection, improves the depth and breadth of security research, and provides a scalable and in-depth solution for the field of mobile operating system security, providing more comprehensive security protection for mobile devices.

[0066] Figure 3 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 3 As shown, the electronic device may include: a processor 31, a communication interface 32, a memory 33 and a communication bus 34, wherein the processor 31, the communication interface 32 and the memory 33 communicate with each other through the communication bus 34. The processor 31 may call the logic instructions in the memory 33 to execute the malware detection method, which includes: reading a preset memory, which is a memory after inserting the binary file loaded by the program located based on the memory mapping technology into the springboard memory and executing it; judging whether there is a malicious address in the memory segment of the preset memory, and determining whether there is a malicious operation according to the judgment result.

[0067] In addition, the logic instructions in the above-mentioned memory 33 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0068] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the malware detection method provided by the above-mentioned methods, which includes: reading a preset memory, which is a memory after the binary file loaded by the program located based on the memory mapping technology is inserted into the springboard memory and executed; judging whether there is a malicious address in the memory segment of the preset memory, and determining whether there is a malicious operation based on the judgment result.

[0069] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the malware detection method provided by the above-mentioned methods. The method includes: reading a preset memory, which is a memory after inserting a binary file loaded by the program located based on memory mapping technology into a springboard memory and executing it; judging whether there is a malicious address in the memory segment of the preset memory, and determining whether there is a malicious operation based on the judgment result.

[0070] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0071] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0072] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A malware detection method, characterized in that: include: Reading a preset memory, wherein the preset memory is a memory after a binary file loaded by a program located based on a memory mapping technology is inserted into a springboard memory and executed; Determine whether there is a malicious address in the memory segment of the preset memory, and determine whether there is a malicious operation according to the determination result; Before reading the preset memory, the method includes: Based on memory mapping technology, locate the binary file loaded by the program and obtain the target binary file; According to the target binary file, obtaining the memory occupied size of the target binary file; Applying for memory according to the memory occupation size to insert the target binary file into the springboard memory and execute the code in the springboard memory; After obtaining the target binary file, the following steps are included: Read the binary file, and judge the instruction set of the read codes one by one to determine the instruction type; According to the instruction type, the corresponding instruction is parsed, and the parsed target instructions are corrected one by one; wherein the target instruction is used to represent the instruction that generates the offset; Determining whether there is a malicious address in the memory segment of the preset memory, and determining whether there is a malicious operation according to the determination result, includes: Reading a register to determine whether there is a malicious address in the segment address of the register, and if so, determining that a malicious operation has occurred; otherwise, determining that there is no malicious operation; wherein the segment address is obtained based on the start address and the end address of the register; After determining whether there is a malicious address in the memory segment of the preset memory, the method includes: According to the judgment result, if it is determined that there is a malicious operation, the parameters of the register are printed based on the parameter printing logic pre-stored in the springboard memory; According to the printed register parameters and the parameter change values ​​stored in the previously acquired system preset directory, the malware corresponding to the malicious operation is algorithmically restored and traced.

2. The malware detection method according to claim 1, characterized in that: The code includes a target binary file inserted into the springboard memory and a code previously stored in the springboard memory, and executing the code in the springboard memory includes: Execute the code in the springboard memory, and the code previously stored in the springboard memory runs normally; or, The code in the springboard memory is executed, and the root route command of the code previously stored in the springboard memory is replaced with the target binary file inserted into the springboard memory.

3. The malware detection method according to claim 1, characterized in that: Executing the code in the springboard memory also includes: Executing the code in the springboard memory to trigger the calling of a target function, wherein the target function is used to represent the function defined in the code in the springboard memory to be called; Querying the relative address of the target function according to a key-value pair map set, wherein the map set includes at least one key-value pair stored according to a function and a relative address corresponding to the function, wherein the relative address is determined according to an absolute address of the function corresponding to a symbol table in a symbol library and a changed address of the function; According to the relative address, the target function is called.

4. The malware detection method according to claim 3, characterized in that: Before performing algorithm restoration and tracing of the malware corresponding to the malicious operation according to the printed register parameters and the parameter change values ​​stored in the previously acquired system preset directory, the method includes: Based on a preset hook function, obtaining parameters before and after a read and write operation is performed on a target memory, wherein the read and write operation is triggered based on executing a code in the springboard memory; According to the parameters before and after the read and write operations are performed on the target memory, the parameter change values ​​are obtained and written into the system preset directory.

5. A malware detection device, characterized in that: include: A register reading module reads a preset memory, wherein the preset memory is a memory after a binary file loaded by a program located based on a memory mapping technology is inserted into a springboard memory and executed; A malware detection module, for determining whether there is a malicious address in the memory segment of the preset memory, and determining whether there is a malicious operation according to the determination result; The device further comprises: A positioning module, before reading the preset memory, based on the memory mapping technology, locates the binary file loaded by the program to obtain the target binary file; The plug-in module obtains the memory occupied size of the target binary file according to the target binary file; A code execution module applies for memory according to the memory occupation size, so as to insert the target binary file into the springboard memory and execute the code in the springboard memory; The device further comprises: An instruction type judgment module, after obtaining the target binary file, reads the binary file, and judges the instruction set of the read codes one by one to determine the instruction type; An instruction correction module, which parses the corresponding instruction according to the instruction type, and corrects the parsed target instructions one by one; wherein the target instruction is used to represent the instruction that generates the offset; The malware detection module is used to: Reading a register to determine whether there is a malicious address in the segment address of the register, and if so, determining that a malicious operation has occurred; otherwise, determining that there is no malicious operation; wherein the segment address is obtained based on the start address and the end address of the register; The device further comprises: A printing module, after determining whether there is a malicious address in the memory segment of the preset memory, if it is determined that there is a malicious operation, then printing the parameters of the register based on the parameter printing logic pre-stored in the springboard memory according to the determination result; The algorithm restoration module performs algorithm restoration tracing on the malware corresponding to the malicious operation according to the printed register parameters and the parameter change values ​​stored in the system preset directory obtained previously.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the malware detection method according to any one of claims 1 to 4 are implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the malware detection method according to any one of claims 1 to 4 are implemented.

Images