Code rule-based hostile attack detection method and device, equipment and medium

Abstract

The invention discloses a malicious attack detection method and device based on code rules, equipment and a medium, and relates to the field of network security. The method comprises the steps of obtaining a source code of a target program, and extracting a target program code; constructing a control flow diagram based on the target program code, and detecting whether a potential malicious behavior exists or not by analyzing a data flow in combination with a predefined rule set; simulating runtime behaviors of the programs with potential malicious behaviors, setting monitoring points to monitor resource access, network behaviors and file operation behaviors of the programs, and detecting whether abnormal behaviors occur or not; constructing a hostile attack model, training by using a known malicious code sample, extracting code features from a program with an abnormal behavior, and inputting the model to classify the program as a hostile attack program or a normal program; and in the actual execution process of the target program, monitoring the execution path and the external behavior of the code, and through comparison with the hostile attack model, identifying the hostile attack and triggering an alarm. According to the invention, the hostile attack detection accuracy is obviously improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular, to a malicious attack detection method, device, equipment and medium based on code rules. Background Art

[0002] With the continuous evolution of network attack means, the monitoring and detection technologies for malicious behaviors during program execution have exposed some limitations or deficiencies.

[0003] In related technologies, the malicious attack detection method based on code rules relies on a set of predefined rule sets to identify malicious behaviors. On the one hand, since its rules are usually generated based on the characteristics of known attack patterns and vulnerabilities, it cannot cover new or unknown attack forms, resulting in false negatives in the system. On the other hand, in some complex systems, different code patterns and behaviors may accidentally trigger certain rules, resulting in false positives, that is, misjudging normal program behaviors as malicious behaviors.

[0004] In addition, since the rule set is usually fixed when the rules are written and cannot be adaptively adjusted according to the dynamic behaviors of the program or changes in the environment, attackers may use new coding techniques, encryption methods or obfuscation techniques to avoid rule detection, making the traditional rule-based detection means unable to effectively and accurately identify the code of malicious behaviors. Summary of the Invention

[0005] The present invention provides a malicious attack detection method, device, equipment and medium based on code rules, and solves the problem of how to accurately identify the code of malicious behaviors.

[0006] To achieve the above object, the present application adopts the following technical solutions:

[0007] In a first aspect, a malicious attack detection method based on code rules is provided, including:

[0008] Obtain the source code of the target program, and extract the target program code from the source code;

[0009] Construct a control flow graph based on the target program code, and detect whether there are potential malicious behaviors by analyzing the data flow of the target program in combination with a predefined rule set;

[0010] Simulate the runtime behavior of the program with potential malicious behaviors, set monitoring points to monitor the resource access, network behavior and file operation behavior of the program, and detect whether abnormal behaviors occur;

[0011] Build a malicious attack model and train it using known malicious code samples. Extract code features from programs with abnormal behaviors and input them into the trained machine learning model to classify the programs as malicious attacks or normal programs;

[0012] During the actual execution of the target program, monitor the execution path and external behaviors of the code. By comparing with the malicious attack model, identify malicious attacks and trigger an anomaly alert.

[0013] In the first possible implementation manner of the first aspect, build a control flow graph based on the code of the target program, and detect whether there are potential malicious behaviors by analyzing the data flow of the target program in combination with a predefined rule set, including:

[0014] Divide the program into multiple basic blocks that are executed sequentially;

[0015] Generate control flow edges between the basic blocks through conditional statements, loop statements, and function calls;

[0016] Define a control flow graph G=(V,E), where V is the set of basic blocks and E is the set of control flow edges;

[0017] Trace the data flow from input variables to output variables based on the control flow graph. If unvalidated inputs are passed to sensitive functions, mark them as potential vulnerabilities;

[0018] Check specific function calls, variable assignments, and control flow structures through regular expressions. Once a matching rule is found, mark the matching code snippet as a potential vulnerability;

[0019] For potential vulnerabilities, identify whether there are backdoor functions or code that bypasses security controls through special mechanisms through rule matching, and detect whether there is code that bypasses authentication and permission control.

[0020] In the second possible implementation manner of the first aspect, simulate the runtime behavior of the program with potential malicious behaviors, set monitoring points to monitor the program's resource access, network behaviors, and file operation behaviors, and detect whether abnormal behaviors occur, including:

[0021] If the program accesses an unauthorized memory location, trigger an alert;

[0022] If the program accesses an unauthorized file or performs an unauthorized operation on a file, trigger an alert;

[0023] If the program initiates an unauthorized network request, trigger an alert.

[0024] Based on any possible implementation manner of the first aspect, in the third possible implementation manner of the first aspect, the code features include the structural features of the code itself and its runtime features.

[0025] In a second aspect, a malicious attack detection device based on code rules is provided, including:

[0026] A target program code extraction module, configured to obtain the source code of a target program and extract the target program code from the source code;

[0027] A static analysis module, configured to construct a control flow graph based on the target program code, and detect whether there is a potential malicious behavior by analyzing the data flow of the target program in combination with a predefined rule set;

[0028] A dynamic analysis module, configured to simulate the runtime behavior of a program with potential malicious behavior, set monitoring points to monitor the program's resource access, network behavior, and file operation behavior, and detect whether abnormal behavior occurs;

[0029] A model construction module, configured to construct a malicious attack model and train it using known malicious code samples, extract code features from programs with abnormal behavior, and input the trained machine learning model to classify the programs as malicious attacks or normal programs;

[0030] A monitoring and feedback module, configured to monitor the execution path and external behavior of the code during the actual execution of the target program, identify malicious attacks by comparing with the malicious attack model, and trigger an anomaly alarm.

[0031] In a first possible implementation manner of the second aspect, the static analysis module is specifically configured to:

[0032] Divide the program into multiple basic blocks that are sequentially executed;

[0033] Generate control flow edges between the basic blocks through conditional statements, loop statements, and function calls;

[0034] Define a control flow graph G=(V,E), where V is a set of basic blocks and E is a set of control flow edges;

[0035] Trace the data flow of input variables to output variables based on the control flow graph. If an unvalidated input is passed to a sensitive function, mark it as a potential vulnerability;

[0036] Check specific function calls, variable assignments, and control flow structures through regular expressions. Once a matching rule is found, mark the matching code snippet as a potential vulnerability;

[0037] For potential vulnerabilities, identify whether there is a backdoor function or code that bypasses security controls through a special mechanism by rule matching, and detect whether there is code that bypasses authentication and permission control.

[0038] In the second possible implementation of the second aspect, the dynamic analysis module is specifically configured to:

[0039] If the program accesses an unauthorized memory location, trigger an alarm;

[0040] If the program accesses an unauthorized file or performs an unauthorized operation on a file, trigger an alarm;

[0041] If the program initiates an unauthorized network request, trigger an alarm.

[0042] Based on any possible implementation of the second aspect, in the third possible implementation of the second aspect, the code features include the structural features of the code itself and its runtime features.

[0043] In a third aspect, an electronic device is provided, where the electronic device includes: a memory, a processor, and a computer program stored on the memory and executable on the processor. When the computer program is executed by the processor, the steps of the malicious attack detection method based on code rules as described in the first aspect are implemented.

[0044] In a fourth aspect, a readable storage medium is provided, where a program or instruction is stored on the readable storage medium. When the program or instruction is executed by a processor, the steps of the malicious attack detection method based on code rules as described in the first aspect are implemented.

[0045] The beneficial effects of the malicious attack detection method based on code rules of the present invention are as follows:

[0046] This application combines static and dynamic features, covering code structure and runtime behavior features; through a machine learning model, static-dynamic features are fused and jointly analyzed for joint determination of real attacks, avoiding false negatives and false positives in pure rule detection, and significantly improving the accuracy of malicious attack detection.

[0047] The device, electronic device, and readable storage medium corresponding to the malicious attack detection method based on code rules of the present invention can achieve the same technical effects. To avoid repetition, they are not elaborated here. Description of the Drawings

[0048] Figure 1 It is a schematic flowchart of a malicious attack detection method based on code rules provided by an embodiment of the present application;

[0049] Figure 2 It is a schematic structural diagram of a malicious attack detection device based on code rules provided by an embodiment of the present application;

[0050] Figure 3 It is a schematic structural diagram of an electronic device provided by an embodiment of the present application. Detailed Embodiments

[0051] To further elaborate on the technical means and effects adopted by the present invention to achieve the predetermined purpose, the technical solutions in the embodiments of the present application are clearly described. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art belong to the scope of protection of the present application.

[0052] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that such terms can be interchanged under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are usually of the same category, and the number of objects is not limited. For example, the first object can be one or multiple. In addition, "and / or" in the specification and claims means at least one of the connected objects, and the character " / " generally means an "or" relationship between the associated objects before and after.

[0053] In the description of the method flow in the specification of the present application and the steps in the flowcharts in the drawings of the present invention, it is not necessary to strictly execute according to the step numbers. The execution order of the method steps can be changed. Moreover, some steps can be omitted, multiple steps can be combined into one step for execution, and / or one step can be decomposed into multiple steps for execution.

[0054] The following will be a detailed description of the malicious attack detection method, device, equipment and medium based on code rules provided by the embodiments of the present application with reference to the accompanying drawings and preferred embodiments.

[0055] The defects of traditional rule sets lead to missed reports and false reports. False reports will waste a large amount of security analysis resources and may lead to a decrease in the trust in the system. As the techniques and strategies of malicious attacks continue to develop, it is difficult for detection methods based on fixed rules to cope with these constantly changing attack methods. Attackers may not only use new coding techniques, encryption methods or obfuscation techniques to avoid rule detection, but also usually adopt some anti-detection techniques to avoid rule-based detection. For example, code obfuscation is used to change the readability of the attack code, or anti-debugging techniques are used to avoid analysis tools. Such camouflage techniques make it impossible for rule-based detection methods to accurately identify malicious code, resulting in attacks bypassing detection.

[0056] To detect malicious behaviors in a program efficiently and accurately, this application provides a malicious attack detection method based on program behavior monitoring and dynamic comparison. By monitoring and analyzing behaviors such as file access, memory access, and network requests during the execution of the program, abnormal behaviors in the program can be detected efficiently and accurately, potential malicious attacks can be discovered in a timely manner, and the security of the program can be enhanced.

[0057] Please refer to Figure 1 , an embodiment of this application provides a malicious attack detection method based on code rules. As Figure 1 shown, it includes:

[0058] S1. Obtain the source code of the target program and extract the target program code from the source code.

[0059] Furthermore, the target program code consists of executable code and its corresponding necessary information. Specifically in implementation, preferably obtain the source code from the local file system or the source code management system, and preprocess the source code, including: cleaning to remove irrelevant information (such as comments, copyrights, and debugging information, etc.); for complex code or encrypted code, the identifiers can be replaced with a standardized format; and remove the parts of the code in the program that are not executed.

[0060] S2. Based on the target program code, construct a control flow graph, and detect whether there are potential malicious behaviors by analyzing the data flow of the target program in combination with a predefined rule set.

[0061] This step constructs the control flow graph of the program, analyzes the execution path of the program, identifies potential vulnerability points and attack paths, analyzes the data flow between program variables, judges whether there are unsafe operations by tracking input and output variables, and matches the target program code with a predefined rule set to detect potential malicious behaviors. Further, it includes:

[0062] S21. Divide the program into multiple basic blocks that are executed sequentially;

[0063] S22. Generate control flow edges between basic blocks through conditional statements, loop statements, and function calls;

[0064] S23. Define the control flow graph G = (V, E), where V is the set of basic blocks and E is the set of control flow edges;

[0065] S24. Based on the control flow graph, track the data flow from input variables to output variables. If unvalidated input is passed to a sensitive function, mark it as a potential vulnerability.

[0066] Specifically: The nodes of the control flow graph represent basic blocks, and the edges represent the transfer of control flow. The edges are constructed by analyzing conditional statements, loop statements, and function calls. Assume that the execution from basic block B1 to B2 is sequential, then an edge is formed:

[0067]

[0068] For if x > y, there will be two edges according to the truth or falsehood of the condition, pointing to B4 and B3 respectively:

[0069]

[0070] Through the basic blocks and edges, the control flow graph of the entire program is obtained;

[0071] The construction of the control flow graph is represented in the form of a graph. Assume that the program has n basic blocks B1, B2, …, Bn, and the control flow graph G = (V, E),

[0072] where: V is the set of basic blocks, V = {B1, B2, …, Bn}, and E is the set of control flow edges, E = {(Bi, Bj)};

[0073] Trace the data flow of the input variable x to the output variable y. Assume that there is a variable x in the program, which is defined in basic block B1 and used in basic block B2, then the calculation of the data flow is carried out through the following equation:

[0074]

[0075] Among them, In(B2) is the data flow entering basic block B2, Out(B1) is the data flow output from basic block B1, and In(B1) is the data flow entering basic block B1;

[0076] If an input variable x is directly passed to a sensitive function without verification, it indicates a potential malicious attack risk.

[0077] S25, Check specific function calls, variable assignments, and control flow structures through regular expressions. Once a matching rule is found, the matching code snippet is marked as a potential vulnerability.

[0078] S26, For potential vulnerabilities, identify whether there is a backdoor function or code that bypasses security controls through special mechanisms through rule matching, and detect whether there is code that bypasses authentication and permission control.

[0079] Exemplarily, taking the detection of SQL as an example to illustrate the implementation process of S21 - S26. Assume there is the following program snippet, where the program checks the username and password entered by the user and passes them to a database query:

[0080] / / User input

[0081] string user_input = get_user_input();

[0082] / / Basic block B1: Define user_input

[0083] string query = "SELECT * FROM users WHERE username = '" + user_input+ "'";

[0084] / / Basic block B2: Directly pass user_input to the database query

[0085] database.query(query);

[0086] Step 1, construct the control flow graph, obtain the user input user_input, construct the database query query, and execute the database query;

[0087] Step 2, in B1, user_input is defined as the input from the user and directly passed to B2 to construct the database query string. In B2, user_input is passed to the database query function by constructing an SQL query. At this time, if user_input contains malicious input (e.g.,'OR 1=1 --), it will cause an SQL injection vulnerability;

[0088] Step 3, detect potential malicious attacks. According to data flow analysis, trace the input variable user_input to the output variable query and find that user_input is directly passed to the sensitive function database.query without any validation. In this case, if user_input is manipulated by an attacker, the program will execute a malicious SQL query, resulting in information leakage or data corruption.

[0089] Furthermore, assume there is the following program where the user input will be directly passed to a system command, which may pose a security risk:

[0090] #include <iostream>

[0091] #include <cstdlib>

[0092] using namespace std;

[0093] void execute_command() {

[0094] string user_input;

[0095] cout << "Enter command: ";

[0096] cin >> user_input;

[0097] system(user_input.c_str()); / / There is a security vulnerability

[0098] }

[0099] Regular expression:

[0100] system\(\s*(\w+)\s*\);

[0101] This regular expression will match the line system(user_input.c_str()); and mark this code as a potential vulnerability point because user_input directly comes from user input without any filtering or validation, and attackers may use it to execute arbitrary commands;

[0102] Once the code is marked, the system will further analyze the source of user_input (i.e., obtaining user input through cin) and check if there are sufficient input validation measures. If not, the system will suggest that developers perform effective filtering and validation on the input.

[0103] #include <iostream>

[0104] #include <cstdlib>

[0105] #include <regex>

[0106] using namespace std;

[0107] void execute_command() {

[0108] string user_input;

[0109] cout << "Enter command: ";

[0110] cin >> user_input;

[0111] / / Input validation: Check for insecure characters

[0112] if (user_input.find(";") != string::npos || user_input.find("&")!= string::npos) {

[0113] cout << "Invalid input detected!" << endl;

[0114] return;

[0115] }

[0116] Check specific function calls, variable assignments, and control flow structures through regular expressions to effectively identify potential malicious behaviors such as backdoor functions, bypassing authentication, and privilege control security vulnerabilities.

[0117] In some embodiments, based on the detected vulnerabilities, the system can automatically repair or provide repair suggestions. For example, when using exec() or system(), avoid directly using user input. Appropriately filter user input, such as removing or escaping special characters. If system commands must be executed, consider using a sandbox mechanism to limit their permissions.

[0118] S3. Simulate the runtime behavior of the program with potential malicious behavior, set monitoring points to monitor the program's resource access, network behavior, and file operation behavior, and detect whether abnormal behaviors occur.

[0119] Specifically include:

[0120] S31. If the program accesses an unauthorized memory location, trigger an alarm.

[0121] Suppose that during the execution of program P, it accesses memory location M, and the system monitoring mechanism marks M. Define access(P, M) as the program's access to memory M, and allowed(P, M) as whether memory M is allowed to be accessed. The monitoring point determines whether there are the following abnormal situations:

[0122]

[0123] That is, if the program accesses a memory location that is not allowed to be accessed, an alarm is triggered.

[0124] S32. If the program accesses an unauthorized file or performs an unauthorized operation on a file, an alarm is triggered.

[0125] Suppose that program P performs a certain operation on file F. Define a ccess(P, F) as the operation of program P on file F, allowed a ccess(P, F) as whether program P has the right to access file F. The monitoring point determines whether the following conditions are met:

[0126]

[0127] That is, if the program accesses an unauthorized file or performs a non - allowed operation, an alarm is triggered.

[0128] S33. If the program initiates an unauthorized network request, an alarm is triggered.

[0129] Suppose that program P initiates a network request. Define n et a ccess(P, IP, port) as the network request initiated by program P, accessing the target IP and port, allowed n et a ccess(P,IP,port) as whether the program has the permission to access the IP and port. The monitoring point can determine whether the following conditions are met:

[0130]

[0131] That is, if the program accesses a non - allowed external network, an alarm is triggered.

[0132] Based on the runtime data collected by the monitoring point, it is possible to analyze whether there are abnormal patterns in the behavior of the program, including detecting whether the program accesses resources or initiates network connections multiple times in a short period and checking whether the program accesses sensitive data or memory areas.

[0133] Exemplarily: Assume that during the execution of program P, it attempts to access a sensitive memory area (such as a system configuration file or sensitive data), and this memory area has been marked as inaccessible. Assume that M is a sensitive area (for example, the memory location where a certain encryption key is stored), and program P is not authorized to access this area.

[0134] / / Memory location M is marked as a sensitive area and access is not allowed

[0135] if (allowed(P, M) == false) {

[0136] / / If program P attempts to access unauthorized memory M, trigger an alert

[0137] trigger_alert("Unauthorized memory access detected by Program Pat memory M.");

[0138] }

[0139] Assume that program P attempts to access a sensitive file F, such as a configuration file, password file, etc., and the program does not have permission to access this file.

[0140] / / File F is marked as a sensitive file and program P is not allowed to access it

[0141] if (allowed_access(P, F) == false) {

[0142] / / If program P attempts to access unauthorized file F, trigger an alert

[0143] trigger_alert("Unauthorized file access detected by Program P tofile F.");

[0144] }

[0145] Assume that program P attempts to access an unauthorized external network address for illegal data transfer or communication. At this time, the system will determine whether the program has permission to access the target IP and port.

[0146] / / Program P initiates a network request, the target IP is 192.168.1.100:80, and the program is not authorized to access this network

[0147] if (allowed_net_access(P, "192.168.1.100", 80) == false) {

[0148] / / If program P accesses a prohibited external network, trigger an alert

[0149] trigger_alert("Unauthorized network access detected by Program Pto IP 192.168.1.100:80.");

[0150] }

[0151] Use tcpdump or Wireshark to capture network traffic and combine it with an access control list to determine whether the program has the permission to access the specified IP and port. For unauthorized network requests, the system will generate an alert.

[0152] S4. Build a malicious attack model and train it using known malicious code samples. Extract code features from programs with abnormal behaviors and input the trained machine learning model to classify the programs as malicious attacks or normal programs.

[0153] Among them, the code features include the structural features of the code itself and its runtime features.

[0154] Exemplarily, assume there is a feature vector x=(x1,x2,…,xn), where xi is the i-th extracted feature. Assume the model uses a linear model such as logistic regression. The goal of logistic regression is to learn a weight vector w=(w1,w2,…,wn) and a bias term b such that for the input feature x, the predicted value is malicious or normal. The prediction function of logistic regression is:

[0155]

[0156] where is the sigmoid function:

[0157]

[0158] The goal of the training process is to minimize the loss function, and the loss function is binary cross-entropy:

[0159]

[0160] where m is the number of training samples, is the true label of the i-th sample, 1 represents malicious, 0 represents normal, is the predicted value of the model for the i-th sample;

[0161] The goal of training is to minimize the loss function through gradient descent or other optimization algorithms, so as to obtain the optimal model parameters w and b.

[0162] Furthermore, to optimize the model parameters w and b, we usually use the gradient descent algorithm. We calculate the gradient of the loss function with respect to each parameter through backpropagation, and then update the parameters. For the logistic regression model, the gradients of the loss function with respect to w and b are as follows:

[0163] For w j Gradient (weight of the j-th feature):

[0164]

[0165] where, represents the value of the j-th feature in the i-th sample;

[0166] For the gradient of b (bias term):

[0167]

[0168] Based on the above gradients, we can use gradient descent to update the parameters:

[0169]

[0170]

[0171] where, is the learning rate, which controls the size of the update step, is the weight of the j-th feature, and b is the bias term.

[0172] Furthermore, assume that a malicious attack detection system is designed, and the extracted features include the memory access pattern of the program, the system call frequency, the network connection behavior, etc. Each program is represented by forming these features into a feature vector x.

[0173] For example, assume the following features are extracted:

[0174] x1: The number of system calls initiated by the program

[0175] x2: The file types accessed by the program

[0176] x3: The memory usage of the program

[0177] x4: The number of network connections of the program

[0178] x5: Whether the program has performed abnormal behaviors (such as calling sensitive functions)

[0179] Suppose the training dataset contains 1000 program samples, each with 5 features, and a logistic regression model is used to predict whether a program is malicious.

[0180] Training data samples

[0181] Number of system calls File type Memory usage Number of network connections Abnormal behavior Malicious label 20 Executable High 2 Yes 1 5 Text Low 0 No 0 50 Executable Medium 10 Yes 1 3 Configuration Low 1 No 0

[0182] Initialize the weights w and the bias b to zero, and use the gradient descent algorithm to iteratively update w and b until the loss function converges.

[0183] After training is complete, use the test data (e.g., new program samples) for prediction:

[0184]

[0185] If is greater than 0.5, it is determined as a malicious attack; otherwise, it is determined as a normal program.

[0186] S5. During the actual execution of the target program, monitor the execution path and external behavior of the code, and identify malicious attacks and trigger an exception alert by comparing with the malicious attack model.

[0187] Exemplarily, assume that the operation sequence of a program accessing files is F1, F2,..., Fn, and each operation Fi is to read, write, or delete a file. If the number of file deletions Del(F) or the number of file creations Create(F) exceeds a certain threshold T file , then trigger an alert;

[0188]

[0189] By analyzing historical samples, construct a program behavior model, and continuously monitor the behavior of the program and compare it with this model to detect abnormal patterns.

[0190] Furthermore, assume the specific implementation process of a file access monitoring system:

[0191] Program P1 reads file F1 20 times, writes to a file 10 times, deletes a file 0 times, and creates a file 0 times within 1 hour.

[0192] Program P2 reads file F2 50 times, writes to a file 5 times, deletes a file 2 times, and creates a file 1 time within 1 hour.

[0193] Calculate the threshold:

[0194] T read = 30 (reading a file more than 30 times is considered abnormal)

[0195] T write = 10 (If the file is written more than 10 times, it is regarded as an exception)

[0196] T del = 1 (If the file is deleted more than 1 time, it is regarded as an exception)

[0197] T create = 1 (If the file is created more than 1 time, it is regarded as an exception)

[0198] Real-time monitoring:

[0199] During the execution of program P3, file F1 is accessed, the file is read 15 times, deleted 3 times, and created 2 times.

[0200] Since the deletion times Del(F1) = 3 exceed T del = 1, the system triggers an alarm;

[0201] In some possible implementation manners, after the alarm is triggered, the system can further analyze whether the program has malicious behaviors, such as whether it accesses sensitive data, or whether there are batch file deletion operations, etc.

[0202] Based on the above technical solution, this application combines static and dynamic features, covering code structure and runtime behavior features; through a machine learning model to fuse static-dynamic features and jointly analyze and determine real attacks, avoiding false negatives and false positives of pure rule detection, and significantly improving the accuracy of malicious attack detection.

[0203] See Figure 2 , corresponding to the above embodiment of the malicious attack detection method based on code rules, this application embodiment provides a malicious attack detection device based on code rules, including:

[0204] A target program code extraction module 1001, configured to obtain the source code of the target program and extract the target program code from the source code;

[0205] A static analysis module 1002, configured to construct a control flow graph based on the target program code, and detect whether there are potential malicious behaviors by analyzing the data flow of the target program in combination with a predefined rule set;

[0206] A dynamic analysis module 1003, configured to simulate the runtime behavior of a program with potential malicious behaviors, set monitoring points to monitor the resource access, network behavior, and file operation behavior of the program, and detect whether abnormal behaviors occur;

[0207] A model construction module 1004, configured to construct a malicious attack model and train it using known malicious code samples, extract code features from programs with abnormal behaviors, and input the trained machine learning model to classify the program as a malicious attack or a normal program;

[0208] The monitoring feedback module 1005 is used to monitor the execution path and external behavior of the code during the actual execution of the target program, identify malicious attacks by comparing with the malicious attack model, and trigger an exception alarm.

[0209] Furthermore, the static analysis module 1002 is specifically configured to:

[0210] Divide the program into multiple basic blocks that are executed sequentially;

[0211] Generate control flow edges between the basic blocks through conditional statements, loop statements, and function calls;

[0212] Define a control flow graph G=(V,E), where V is the set of basic blocks and E is the set of control flow edges;

[0213] Trace the data flow of input variables to output variables based on the control flow graph. If unvalidated input is passed to a sensitive function, it is marked as a potential vulnerability;

[0214] Check specific function calls, variable assignments, and control flow structures through regular expressions. Once a matching rule is found, the matching code snippet is marked as a potential vulnerability;

[0215] For potential vulnerabilities, identify whether there is a backdoor function or code that bypasses security controls through rule matching, and detect whether there is code that bypasses authentication and permission control.

[0216] Furthermore, the dynamic analysis module 1003 is specifically configured to:

[0217] If the program accesses an unauthorized memory location, trigger an alarm;

[0218] If the program accesses an unauthorized file or performs an unauthorized operation on a file, trigger an alarm;

[0219] If the program initiates an unauthorized network request, trigger an alarm.

[0220] Furthermore, the code features include the structural features of the code itself and its runtime features.

[0221] The above-mentioned malicious attack detection device based on code rules implements the steps and various processes of the above-mentioned malicious attack detection method embodiment based on code rules, and can achieve the same technical effects. To avoid repetition, it will not be elaborated here.

[0222] See Figure 3 , corresponding to the above embodiments of the malicious attack detection method based on code rules, an embodiment of the present application provides an electronic device, which includes: a memory, a processor, and a computer program stored on the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps and various processes of the above embodiments of the malicious attack detection method based on code rules, and can achieve the same technical effects. To avoid repetition, it will not be elaborated here.

[0223] The memory 1009 can be used to store software programs and various data. The memory 1009 mainly includes a first storage area for storing programs or instructions and a second storage area for storing data. Among them, the first storage area can store an operating system, applications or instructions required for at least one function (such as a sound playback function, an image playback function, etc.). In addition, the memory 1009 can include volatile memory or non-volatile memory, or the memory 1009 can include both volatile and non-volatile memory. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), a static random access memory (SRAM), a dynamic random access memory (DRAM), a synchronous dynamic random access memory (SDRAM), a double data rate synchronous dynamic random access memory (DDR SDRAM), an enhanced synchronous dynamic random access memory (ESDRAM), a synchronous link dynamic random access memory (SLDRAM), and a direct rambus random access memory (DRRAM). The memory 1009 in the embodiments of the present application includes but is not limited to these and any other suitable types of memory.

[0224] The processor 1010 may include one or more processing units; optionally, the processor 1010 integrates an application processor and a modem processor. Among them, the application processor mainly processes operations related to the operating system, user interface, and applications, etc., and the modem processor mainly processes wireless communication signals, such as a baseband processor. It can be understood that the above modem processor may not be integrated into the processor 1010.

[0225] Corresponding to the above embodiments of the malicious attack detection method based on code rules, an embodiment of the present application further provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps and various processes of the above embodiments of the malicious attack detection method based on code rules are implemented, and the same technical effects can be achieved. To avoid repetition, it will not be elaborated here.

[0226] Among them, the processor is the processor in the electronic device described in the above embodiments of the present application. The readable storage medium includes computer-readable storage media, such as computer read-only memory ROM, random access memory RAM, magnetic disks, or optical discs, etc.

[0227] It should be noted that in this article, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed, or further includes elements inherent to such process, method, article or device. Without more limitations, an element defined by the statement "including a..." does not exclude the existence of additional identical elements in the process, method, article or device including that element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the reverse order according to the functions involved. For example, the described methods may be performed in an order different from that described, and various steps may be added, omitted, or combined. Additionally, the features described with reference to certain examples may be combined in other examples.

[0228] Through the description of the above embodiments, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus a necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, can be embodied in the form of a computer software product. The computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disc), and includes several instructions for causing a terminal (which may be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in the various embodiments of the present application.

[0229] It can be understood that the embodiments of the present application have been described above in conjunction with the accompanying drawings. However, the present application is not limited to the above specific embodiments. The above specific embodiments are merely illustrative and not restrictive. As is known to those skilled in the art, without departing from the spirit and scope of the present invention, various changes or equivalent substitutions can be made to these features and embodiments. Additionally, those of ordinary skill in the art can, under the inspiration or teaching of the present application, modify these features and embodiments to adapt to specific circumstances and materials without departing from the spirit and scope of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed herein, and all embodiments falling within the scope of the claims of the present application belong to the scope protected by the present invention.< / regex> < / cstdlib> < / iostream> < / cstdlib> < / iostream>

Claims

1. A malicious attack detection method based on code rules, characterized in that Including: Obtain the source code of the target program, and extract the target program code from the source code; Based on the target program code, construct a control flow graph, and detect whether there are potential malicious behaviors by analyzing the data flow of the target program in combination with a predefined rule set; Simulate the runtime behavior of the program with potential malicious behaviors, set monitoring points to monitor the program's resource access, network behaviors, and file operation behaviors, and detect whether abnormal behaviors occur; Construct a malicious attack model and train it with known malicious code samples, extract code features from the program with abnormal behaviors, and input the trained machine learning model to classify the program as a malicious attack or a normal program; During the actual execution of the target program, monitor the execution path and external behaviors of the code, and identify malicious attacks and trigger abnormal alarms by comparing with the malicious attack model.

2. The malicious attack detection method based on code rules according to claim 1, characterized in that The constructing a control flow graph based on the target program code and detecting whether there are potential malicious behaviors by analyzing the data flow of the target program in combination with a predefined rule set includes: Divide the program into multiple basic blocks that are executed sequentially; Generate control flow edges between the basic blocks through conditional statements, loop statements, and function calls; Define a control flow graph G=(V, E), where V is the set of basic blocks and E is the set of control flow edges; Based on the control flow graph, trace the data flow from input variables to output variables. If unvalidated inputs are passed to sensitive functions, mark them as potential vulnerabilities; Check specific function calls, variable assignments, and control flow structures through regular expressions. Once a matching rule is found, mark the matching code segment as a potential vulnerability; For potential vulnerabilities, identify whether there are backdoor functions or code that bypasses security controls through special mechanisms through rule matching, and detect whether there is code that bypasses authentication and permission control.

3. The malicious attack detection method based on code rules according to claim 1, characterized in that The simulating the runtime behavior of the program with potential malicious behaviors, setting monitoring points to monitor the program's resource access, network behaviors, and file operation behaviors, and detecting whether abnormal behaviors occur includes: If the program accesses an unauthorized memory location, trigger an alarm; If the program accesses an unauthorized file or performs an unauthorized operation on a file, trigger an alarm; If the program initiates an unauthorized network request, trigger an alarm.

4. The malicious attack detection method based on code rules according to any one of claims 1-3, Characterized in that The code features include the structural features of the code itself and its runtime features.

5. The malicious attack detection device based on code rules is characterized in that, Including: A target program code extraction module for obtaining the source code of the target program and extracting the target program code from the source code; A static analysis module for constructing a control flow graph based on the target program code and detecting whether there are potential malicious behaviors by analyzing the data flow of the target program in combination with a predefined rule set; A dynamic analysis module for simulating the runtime behavior of the program with potential malicious behaviors, setting monitoring points to monitor the program's resource access, network behaviors, and file operation behaviors, and detecting whether abnormal behaviors occur; A model construction module, which is used to construct a malicious attack model and train it using known malicious code samples, extract code features from programs with abnormal behaviors, and input the trained machine learning model to classify the programs as malicious attacks or normal programs; A monitoring and feedback module, which is used to monitor the execution path and external behaviors of the code during the actual execution of the target program, identify malicious attacks and trigger abnormal alarms by comparing with the malicious attack model.

6. The malicious attack detection device based on code rules according to claim 5, wherein The static analysis module is specifically used for: Dividing the program into multiple basic blocks that are executed sequentially; Generating control flow edges between the basic blocks through conditional statements, loop statements, and function calls; Defining a control flow graph G=(V,E), where V is a set of basic blocks and E is a set of control flow edges; Tracking the data flow of input variables to output variables based on the control flow graph, and if an unvalidated input is passed to a sensitive function, marking it as a potential vulnerability; Checking specific function calls, variable assignments, and control flow structures through regular expressions, and once a matching rule is found, marking the matching code snippet as a potential vulnerability; For potential vulnerabilities, identifying whether there are backdoor functions or code that bypasses security controls through special mechanisms through rule matching, and detecting whether there is code that bypasses authentication and permission control.

7. The malicious attack detection device based on code rules according to claim 5, wherein The dynamic analysis module is specifically used for: If the program accesses an unauthorized memory location, triggering an alarm; If the program accesses an unauthorized file or performs an unauthorized operation on a file, triggering an alarm; If the program initiates an unauthorized network request, triggering an alarm.

8. The malicious attack detection device based on code rules according to any one of claims 5-7, It is characterized in that The code features include the structural features of the code itself and its runtime features.

9. An electronic device, characterized in that, The electronic device includes: a memory, a processor, and a computer program stored on the memory and executable on the processor. When the computer program is executed by the processor, the steps of the malicious attack detection method based on code rules according to any one of claims 1 to 4 are implemented.

10. A readable storage medium, characterized in that, A program or instruction is stored on the readable storage medium. When the program or instruction is executed by the processor, the steps of the malicious attack detection method based on code rules according to any one of claims 1 to 4 are implemented.

Images