A data processing method and device
By obtaining and reorganizing the code blocks of the target program, inserting callback instructions, and monitoring API calls, the problem of incomplete malware monitoring in the existing technology is solved, and detailed analysis and accurate monitoring of malware behavior are achieved.
Patent Information
- Application Number
- CN202010966830.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2020-09-15
- Publication Date
- 2025-01-07
- Estimated Expiration
- 2041-01-07
AI Technical Summary
Existing malware monitoring methods, such as sandboxes and Process Monitor, cannot effectively monitor all API calls, and are easily detected by malware, cannot detect spontaneous system calls, and rely on the operating system interface, and the monitoring behavior is limited and cannot be meticulous. Analyze malware behavior.
By obtaining the target code block of the target program in a running state, generating reorganized code blocks, inserting callback instructions, monitoring API calls, obtaining scheduling data, determining malicious behavior, and achieving detailed monitoring of malware behavior, without relying on hooked APIs or Operating system interface.
Improves the accuracy of analysis of malware behavior, can monitor all API calls, avoids the limitations of hooked APIs and the dependence of operating system interfaces, and enhances the comprehensiveness and accuracy of monitoring.
Smart Images
Figure CN112100622B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of Internet technology, and in particular to a data processing method and device. Background Art
[0002] With the advent of the mobile Internet era, the Internet has penetrated into all aspects of life. There are many types of applications on the Internet, and various malware have also increased. How to monitor malware is also a major problem. At present, the main methods are sandbox and Process Monitor. Sandbox is based on hooking technology, monitoring the API calls of malware and then analyzing its behavior. It usually hooks system dlls, such as ntdll.dll and kernel32.dll. However, this method must specifically hook the API, and unhooked APIs cannot be monitored. At the same time, since the hooking technology itself will modify the memory, it is easy to be detected by malware, and it is impossible to detect APIs that initiate system calls by themselves. Process Monitor is based on the kernel-level callback provided by the Windows system to monitor the registry, files, network, process / thread and other behaviors of malware. However, this method relies on the interface provided by the operating system, and the monitored behavior is very limited, which is not enough to analyze the behavior of malware in detail. Summary of the invention
[0003] The embodiments of the present application provide a data processing method and device, which can improve the accuracy of analyzing malware behavior.
[0004] On the one hand, an embodiment of the present application provides a data processing method, which may include:
[0005] Acquire a target code block of a target program in a running state; the target program includes at least one code block, and the target code block is any code block in the target program;
[0006] Obtaining a reorganized code block corresponding to the target code block, wherein the reorganized code block is a code block generated by inserting callback instructions using binary stubs according to code instructions in the target code block;
[0007] The reorganized code block corresponding to the target code block is run, scheduling data of the reorganized code block is obtained, and malicious behavior of the target program is determined according to the scheduling data.
[0008] The step of obtaining the target code block of the target program in the running state includes:
[0009] Determine a target code block of a target program, insert an interrupt program into the target program according to the target code block, and respond to the interrupt program for the target code block when the target program is in a running state;
[0010] The target code block is obtained according to the interrupt program.
[0011] Wherein, the obtaining of the reorganized code block corresponding to the target code block includes:
[0012] Obtaining a label of the target code block, matching the label of the target code block with the label of the code block in the reorganized code block set, and generating a matching result; the reorganized code block set is used to store the reorganized code block corresponding to the code block of the target program;
[0013] When the matching result is a successful match, a code block having the same label as the target code block is obtained from the reorganized code block set, and the code block having the same label as the target code block is determined as a reorganized code block corresponding to the target code block;
[0014] When the matching result is a match failure, the code instructions in the target code block are rewritten to generate rewrite code instructions, callback instructions are inserted into the rewrite code instructions, and a reorganized code block corresponding to the target code block is generated according to the rewrite code instructions and the callback instructions.
[0015] The step of obtaining the label of the target code block, matching the label of the target code block with the labels of the code blocks in the reorganized code block set, and generating a matching result includes:
[0016] Obtaining a label of the target code block, and matching the label of the target code block with labels of code blocks in the reorganized code block set;
[0017] When there is a code block having the same label as the target code block in the reorganized code block set, determining the matching result as a passed match;
[0018] When there is no code block having the same label as the target code block in the reorganized code block set, it is determined that the matching result is a match failure.
[0019] Wherein, when the matching result is that the matching fails, the code instructions in the target code block are rewritten to generate rewrite code instructions, a callback instruction is inserted into the rewrite code instruction, and a reorganized code block corresponding to the target code block is generated according to the rewrite code instruction and the callback instruction, further comprising:
[0020] Acquire the label of the target code block, and set the label of the target code block as the label of the reorganized code block; the reorganized code block corresponding to the target code block has the same label as the target code block;
[0021] The reorganized code block corresponding to the target code block is stored in a reorganized code block set.
[0022] The step of rewriting the code instructions in the target code block to generate rewrite code instructions, inserting callback instructions into the rewrite code instructions, and generating a reorganized code block corresponding to the target code block according to the rewrite code instructions and the callback instructions includes:
[0023] Parsing the target code block to generate code instructions of the target code block, and rewriting the code instructions to generate rewrite code instructions;
[0024] Writing the rewrite code instruction into a target memory address;
[0025] Inserting a callback instruction into the rewriting code instruction, compiling the rewriting code instruction and the callback instruction to generate a reorganized code block.
[0026] The step of running the reorganized code block corresponding to the target code block, obtaining the scheduling data of the reorganized code block, and determining the malicious behavior of the target program according to the scheduling data includes:
[0027] Parsing the reorganized code block, and executing the code instructions and callback instructions in the reorganized code block in the target memory address corresponding to the reorganized code block;
[0028] The interface call data and address access data of the reorganized code block are obtained, and the interface call data and the address access data are compared with standard data to generate a comparison result. When the comparison result is abnormal, the malicious behavior of the target program is determined; the standard data is the interface call data and address access data of the target program when there is no malicious behavior.
[0029] On the one hand, an embodiment of the present application provides a data processing device, which may include:
[0030] A target code block acquisition unit, used to acquire a target code block of a target program in a running state; the target program includes at least one code block, and the target code block is any code block in the target program;
[0031] A reorganized code block acquisition unit, used to acquire a reorganized code block corresponding to the target code block, wherein the reorganized code block is a code block generated by inserting callback instructions using binary plug-ins according to code instructions in the target code block;
[0032] The code block running unit is used to run the reorganized code block corresponding to the target code block, obtain the scheduling data of the reorganized code block, and determine the malicious behavior of the target program according to the scheduling data.
[0033] Wherein, the target code block acquisition unit is specifically used for:
[0034] Determine a target code block of a target program, insert an interrupt program into the target program according to the target code block, and respond to the interrupt program for the target code block when the target program is in a running state;
[0035] The target code block is obtained according to the interrupt program.
[0036] Wherein, the reorganized code block acquisition unit includes:
[0037] a label matching subunit, used to obtain the label of the target code block, match the label of the target code block with the label of the code block in the reorganized code block set, and generate a matching result; the reorganized code block set is used to store the reorganized code block corresponding to the code block of the target program;
[0038] a code block acquisition subunit, configured to, when the matching result is a passing match, acquire a code block having the same label as the target code block from the reorganized code block set, and determine the code block having the same label as the target code block as the reorganized code block corresponding to the target code block;
[0039] The code block generation subunit is used to rewrite the code instructions in the target code block to generate rewrite code instructions when the matching result is a match failure, insert a callback instruction into the rewrite code instruction, and generate a reorganized code block corresponding to the target code block according to the rewrite code instruction and the callback instruction.
[0040] The tag matching subunit is specifically used for:
[0041] Obtaining a label of the target code block, and matching the label of the target code block with labels of code blocks in the reorganized code block set;
[0042] When there is a code block having the same label as the target code block in the reorganized code block set, determining the matching result as a passed match;
[0043] When there is no code block having the same label as the target code block in the reorganized code block set, it is determined that the matching result is a match failure.
[0044] Among them, it also includes:
[0045] A code block storage unit, used for obtaining a label of the target code block, and setting the label of the target code block as the label of the reorganized code block; the reorganized code block corresponding to the target code block has the same label as the target code block;
[0046] The reorganized code block corresponding to the target code block is stored in a reorganized code block set.
[0047] Wherein, the code block generation subunit is specifically used for:
[0048] Parsing the target code block to generate code instructions of the target code block, and rewriting the code instructions to generate rewrite code instructions;
[0049] Writing the rewrite code instruction into a target memory address;
[0050] Inserting a callback instruction into the rewriting code instruction, compiling the rewriting code instruction and the callback instruction to generate a reorganized code block.
[0051] The code block execution unit is specifically used for:
[0052] Parsing the reorganized code block, and executing the code instructions and callback instructions in the reorganized code block in the target memory address corresponding to the reorganized code block;
[0053] The interface call data and address access data of the reorganized code block are obtained, and the interface call data and the address access data are compared with standard data to generate a comparison result. When the comparison result is abnormal, the malicious behavior of the target program is determined; the standard data is the interface call data and address access data of the target program when there is no malicious behavior.
[0054] On one hand, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.
[0055] On the one hand, an embodiment of the present application provides a computer device, including a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.
[0056] In one aspect, the present application provides a computer program product or a computer program, wherein the computer program product or the computer program includes computer instructions, and the computer instructions are stored in a computer storage medium. A processor of a computer device reads the computer instructions from the computer storage medium, and the processor executes the computer instructions, so that the computer device performs the above method steps.
[0057] In an embodiment of the present application, by obtaining a target code block of a target program in a running state, the target program includes at least one code block, and the target code block is any code block in the target program, and further obtaining a reorganized code block corresponding to the target code block, the reorganized code block is a code block generated by inserting callback instructions using binary plug-ins according to the code instructions in the target code block, and finally running the reorganized code block corresponding to the target code block, obtaining the scheduling data of the reorganized code block, and determining the malicious behavior of the target program according to the scheduling data. The malicious behavior of the target program can be determined by the scheduling data of the reorganized code block corresponding to the target code block, and all API calls can be monitored without hooking the API. At the same time, it does not rely on the interface provided by the operating system, which improves the accuracy of analyzing malware behavior. BRIEF DESCRIPTION OF THE DRAWINGS
[0058] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0059] Figure 1a It is a system architecture diagram of data processing provided by an embodiment of the present application;
[0060] Figure 1b is an example schematic diagram of a data processing method provided in an embodiment of the present application;
[0061] Figure 2 It is a flowchart of a data processing method provided in an embodiment of the present application;
[0062] Figure 3 It is a flowchart of a data processing method provided in an embodiment of the present application;
[0063] Figure 4 is a structural schematic diagram of a data processing device provided in an embodiment of the present application;
[0064] Figure 5 It is a structural diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0065] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0066] See also Figure 1a , is a system architecture diagram of data processing provided by an embodiment of the present invention. Server 10b is connected to user terminal 10a via a switch and a communication bus. Server 10b obtains a target code block of a target program in operation; the target program includes at least one code block, and the target code block is any code block in the target program; server 10b obtains a reorganized code block corresponding to the target code block, and the reorganized code block is a code block generated by inserting a callback instruction using binary plug-in according to the code instruction in the target code block; server 10b runs the reorganized code block corresponding to the target code block, obtains the scheduling data of the reorganized code block, and determines the malicious behavior of the target program according to the scheduling data. Database 10c and server 10b store multiple reorganized code blocks corresponding to the target program, and the reorganized code block is generated by server 10b rewriting the code instruction in the target code block to generate a rewrite code instruction, inserting a callback instruction into the rewrite code instruction, and generating a reorganized code block corresponding to the target code block according to the rewrite code instruction and the callback instruction.
[0067] The user terminals involved in the embodiments of the present application include: tablet computers, smart phones, personal computers (PCs), laptop computers, PDAs and other terminal devices.
[0068] The following will be combined Figure 1b , to illustrate the specific implementation scenario provided by the embodiment of the present application, such as Figure 1b shown.
[0069] In the process of analyzing the behavior of malware, there are three states of software during operation, including native state, translation state, and simulation state;
[0070] Native state: The state in which the malware is running its own code. In the native state of the malware, the execution of the malware is hijacked by creating an exception, so that it enters the translation state. The specific method is generally to remove the executable permission of the malicious code, or the access permission to sensitive memory within some of its own business. Then take over the exception and enter the translation state. Specifically, it can target the target code block in the malicious code.
[0071] Translation state: hijacks the execution of malware and generates the state of the reorganized code block. In the translation state of the malware, by parsing the instructions of the target code block that the malware was originally going to execute, it is rewritten to a new memory address to generate a rewrite code instruction, and a callback instruction is inserted into the rewrite code instruction. According to the rewrite code instruction and the callback instruction, a reorganized code block corresponding to the target code block is generated. Then, the reorganized code block will be scheduled for execution. Since the callback instruction is inserted into the rewrite code instruction, its behavior can be monitored while the reorganized code block is executing normally. In the callback instruction, the runtime state of the malware is recorded, including: register environment, memory environment.
[0072] Simulation state: the state of executing the code instructions in the reorganized code block. The code instructions in the reorganized code block include the malware code instructions and the inserted callback instructions. The callback instructions will save the current running environment. The specific callback instructions include: code block scheduling callback instructions, instruction monitoring callback instructions, and return address monitoring callback instructions. The code block scheduling callback instructions are used to monitor cross-module calls and all APIs. The instruction monitoring callback instructions are used to monitor memory and register access. The return address monitoring callback instructions are used to modify the return address in the stack when monitoring the API, and change it to its own callback, so as to continue to obtain execution permissions after the API is executed.
[0073] After the execution is completed, it will return to the translation state to determine whether to continue translating other code blocks. This cycle will continue until the translation state determines that it is time to exit to the Native state, after which the original code will be executed and the entire process will exit.
[0074] See also Figure 2 , which is a flow chart of a data processing method provided in an embodiment of the present application. Figure 2 As shown, the method in the embodiment of the present application may include the following steps S101 to S103.
[0075] S101, obtaining a target code block of a target program in a running state; the target program includes at least one code block, and the target code block is any code block in the target program;
[0076] Specifically, the data processing device obtains the target code block of the target program in the running state. It can be understood that the data processing device can be Figure 1aIn the server 10b shown, the target program is an application in a terminal device, or an application in a monitored state. For example, the target program may be a malicious plug-in software in a game platform. The target program includes at least one code block. The target program is executed in units of code blocks during operation. Specifically, when implementing a certain function in the target program, multiple code blocks need to be executed in sequence to complete it. When implementing a certain function, the target program may only execute part of the code blocks in the target program. The target code block is any code block in the target program.
[0077] S102, obtaining a reorganized code block corresponding to the target code block, wherein the reorganized code block is a code block generated by inserting callback instructions using binary instrumentation according to code instructions in the target code block;
[0078] Specifically, the data processing device obtains the reorganized code block corresponding to the target code block. It can be understood that the target code block includes code instructions, and the reorganized code block is generated according to the code instructions in the target code block and by inserting callback instructions in a binary plug-in manner. Specifically, the code instructions in the target code block are rewritten to generate rewrite code instructions, and callback instructions are inserted into the rewrite code instructions. The callback instructions are used to obtain the running environment of the code instructions in the target code block. The reorganized code block corresponding to the target code block is generated according to the rewrite code instructions and the callback instructions. The reorganized code block can execute the code instructions in the target code block normally, and the behavior of the reorganized code block is in a monitoring state.
[0079] S103, running the reorganized code block corresponding to the target code block, obtaining scheduling data of the reorganized code block, and determining the malicious behavior of the target program according to the scheduling data.
[0080] Specifically, the data processing device runs the reorganized code block corresponding to the target code block, obtains the scheduling data of the reorganized code block, and determines the malicious behavior of the target program according to the scheduling data. It can be understood that the reorganized code block includes the code instructions and the inserted callback instructions in the target code block. According to the code instructions and the callback instructions, the scheduling data of the reorganized code block is obtained, and the scheduling data includes the scheduling data of the target module and the data in the memory and the register. The specific callback instructions include: code block scheduling callback instructions, instruction monitoring callback instructions, and return address monitoring callback instructions. The code block scheduling callback instructions are used to monitor cross-module calls and all application programming interfaces (Application Programming Interface, API). The instruction monitoring callback instructions are used for memory and register access monitoring. The return address monitoring callback instructions are used to modify the return address in the stack when monitoring the API, and change it to its own callback, so as to continue to obtain execution permissions after the API is executed. The data processing device determines the malicious behavior of the target program based on the scheduling data. Specifically, taking malicious plug-in software as an example, by running the reorganized code block and monitoring the access to the memory and registers, the access result to the memory corresponding to the game character parameters can be obtained. According to the access result, it can be determined that the malicious plug-in software has tampered with the parameters of the game character.
[0081] In an embodiment of the present application, by obtaining a target code block of a target program in a running state, the target program includes at least one code block, and the target code block is any code block in the target program, and further obtaining a reorganized code block corresponding to the target code block, the reorganized code block is a code block generated by inserting callback instructions using binary plug-ins according to the code instructions in the target code block, and finally running the reorganized code block corresponding to the target code block, obtaining the scheduling data of the reorganized code block, and determining the malicious behavior of the target program according to the scheduling data. The malicious behavior of the target program can be determined by the scheduling data of the reorganized code block corresponding to the target code block, and all API calls can be monitored without hooking the API. At the same time, it does not rely on the interface provided by the operating system, which improves the accuracy of analyzing malware behavior.
[0082] See also Figure 3 , which is a flow chart of a data processing method provided in an embodiment of the present application. Figure 3 As shown, the method of the embodiment of the present application may include the following steps S201-S206.
[0083] S201, determining a target code block of a target program, inserting an interruption program into the target program according to the target code block, responding to the interruption program for the target code block when the target program is in a running state; and acquiring the target code block according to the interruption program.
[0084] Specifically, the data processing device determines the target code block of the target program, inserts an interrupt program in the target program according to the target code block, and responds to the interrupt program for the target code block when the target program is in a running state; obtains the target code block according to the interrupt program. It can be understood that the target code block is any code block in the target program. For example, the target program is a malicious plug-in software in a monitoring state, and the user needs to detect the running state of one of the code blocks in the malicious plug-in software, and the code block can be determined as the target code block; in order to realize the monitoring of the target program, the target program can be hijacked. Specifically, an interrupt program can be inserted into the target code block of the target program. When the target program is in a running state, before running the target code block, the interrupt program of the target code block will be executed to stop running the target code block, and the target program can be hijacked. The executable permission of the target code block can also be obtained. When the target program runs to the target code block, the running will be interrupted. After stopping running the target code block, the target code block in the target program is obtained.
[0085] S202, obtaining a label of the target code block, matching the label of the target code block with the label of the code block in the reorganized code block set, and generating a matching result; the reorganized code block set is used to store the reorganized code block corresponding to the code block of the target program;
[0086] Specifically, the data processing device obtains the label of the target code block, matches the label of the target code block with the label of the code block in the reorganized code block set, and generates a matching result. It can be understood that the label of the target code block is obtained, and the label of the code block is a unique identifier of the code block. Specifically, the name of the code block can be used as the label of the code block, or the code block can be labeled according to letters and numbers. The reorganized code block set is used to store the reorganized code blocks corresponding to the code blocks of the target program. The label of the reorganized code block is the same as the label of the target code block corresponding to the reorganized code block. The label of the target code block is matched with the label of the code block in the reorganized code block set. When there is a code block with the same label as the target code block in the reorganized code block set, it is determined that the matching result is a pass; when there is no code block with the same label as the target code block in the reorganized code block set, it is determined that the matching result is a fail.
[0087] S203, when the matching result is a successful match, a code block having the same label as the target code block is obtained from the reorganized code block set, and the code block having the same label as the target code block is determined as a reorganized code block corresponding to the target code block;
[0088] Specifically, it can be understood that when the matching result is a passed match, it is determined that a reorganized code block corresponding to the target code block exists in the reorganized code block set, and the data processing device obtains a code block having the same label as the target code block from the reorganized code block set, and determines the code block having the same label as the target code block as the reorganized code block corresponding to the target code block.
[0089] S204, when the matching result is a match failure, rewrite the code instructions in the target code block to generate rewrite code instructions, insert callback instructions into the rewrite code instructions, and generate a reorganized code block corresponding to the target code block according to the rewrite code instructions and the callback instructions.
[0090] Specifically, it can be understood that when the matching result is that the match fails, it is determined that there is no reorganized code block corresponding to the target code block in the reorganized code block set, and the data processing device rewrites the code instructions in the target code block to generate rewrite code instructions, inserts callback instructions into the rewrite code instructions, and generates a reorganized code block corresponding to the target code block according to the rewrite code instructions and the callback instructions;
[0091] The specific process of generating the reorganized code block is as follows:
[0092] The data processing device parses the target code block, generates code instructions of the target code block, rewrites the code instructions according to the running environment of the code instructions to generate rewrite code instructions, writes the rewrite code instructions into a target memory address, which is a memory address different from the memory address of the target code block, inserts a callback instruction into the rewrite code instruction, compiles the rewrite code instruction and the callback instruction, and generates a reorganized code block.
[0093] S205, obtaining a label of the target code block, setting the label of the target code block as the label of the reorganized code block; the reorganized code block corresponding to the target code block has the same label as the target code block; and storing the reorganized code block corresponding to the target code block into a reorganized code block set.
[0094] Specifically, the data processing device obtains the label of the target code block, sets the label of the target code block as the label of the reorganized code block, and stores the reorganized code block corresponding to the target code block in the reorganized code block set. It can be understood that by storing the reorganized code block corresponding to the target code block in the reorganized code block set and setting the label of the reorganized code block to be the same as the label of the target code block corresponding to the reorganized code block, the reorganized code block can be reused. When the target code block is executed again, the corresponding reorganized code block can be obtained from the reorganized code block set according to the label, thereby improving the efficiency of generating the reorganized code block.
[0095] S206, running the reorganized code block corresponding to the target code block, obtaining scheduling data of the reorganized code block, and determining the malicious behavior of the target program according to the scheduling data.
[0096] Specifically, the data processing device runs the reorganized code block corresponding to the target code block, obtains the scheduling data of the reorganized code block, and determines the malicious behavior of the target program according to the scheduling data. It can be understood that the data processing device parses the reorganized code block, the reorganized code block includes the code instructions in the target code block and the inserted callback instructions, and runs the code instructions and callback instructions in the reorganized code block in the target memory address corresponding to the reorganized code block. The specific callback instructions include: code block scheduling callback instructions, instruction monitoring callback instructions, and return address monitoring callback instructions. The code block scheduling callback instructions are used to monitor cross-module calls and all APIs. The instruction monitoring callback instructions are used for memory and register access monitoring. The return address monitoring callback instructions are used to modify the return address in the stack when monitoring the API, and change it to its own callback, so as to continue to obtain execution permissions after the API is executed. The data processing device obtains the interface call data and address access data of the reorganized code block, the interface call data is the scheduling data of the API, and the address access data is the access data of the memory and the register, and compares the interface call data and the address access data with the standard data to generate a comparison result, the standard data is the interface call data and address access data of the target program when there is no malicious behavior, and when the comparison result is abnormal, the malicious behavior of the target program is determined.
[0097] In an embodiment of the present application, by obtaining a target code block of a target program in a running state, the target program includes at least one code block, and the target code block is any code block in the target program, and further obtaining a reorganized code block corresponding to the target code block, the reorganized code block is a code block generated by inserting callback instructions using binary plug-ins according to the code instructions in the target code block, and finally running the reorganized code block corresponding to the target code block, obtaining the scheduling data of the reorganized code block, and determining the malicious behavior of the target program according to the scheduling data. The malicious behavior of the target program can be determined by the scheduling data of the reorganized code block corresponding to the target code block, and all API calls can be monitored without hooking the API. At the same time, it does not rely on the interface provided by the operating system, which improves the accuracy of analyzing malware behavior.
[0098] See also Figure 4 , which is a schematic diagram of the structure of a data processing device provided in an embodiment of the present application. The data processing device may be a computer program (including program code) running in a computer device, for example, the data processing device is an application software; the device may be used to execute the corresponding steps in the method provided in an embodiment of the present application. Figure 4 As shown, the data processing device 1 of the embodiment of the present application may include: a target code block acquisition unit 11, a reorganized code block acquisition unit 12, and a code block execution unit 13.
[0099] The target code block acquisition unit 11 is used to acquire a target code block of a target program in a running state; the target program includes at least one code block, and the target code block is any code block in the target program;
[0100] The reorganized code block acquisition unit 12 is used to acquire the reorganized code block corresponding to the target code block, wherein the reorganized code block is a code block generated by inserting callback instructions using binary plug-ins according to code instructions in the target code block;
[0101] The code block running unit 13 is used to run the reorganized code block corresponding to the target code block, obtain the scheduling data of the reorganized code block, and determine the malicious behavior of the target program according to the scheduling data.
[0102] The target code block acquisition unit is specifically used for:
[0103] Determine a target code block of a target program, insert an interrupt program into the target program according to the target code block, and respond to the interrupt program for the target code block when the target program is in a running state;
[0104] The target code block is obtained according to the interrupt program.
[0105] See also Figure 4 The reorganized code block acquisition unit 12 in the embodiment of the present application may include: a label matching subunit 121, a code block acquisition subunit 122, and a code block generation subunit 123.
[0106] The label matching subunit 121 is used to obtain the label of the target code block, match the label of the target code block with the label of the code block in the reorganized code block set, and generate a matching result; the reorganized code block set is used to store the reorganized code block corresponding to the code block of the target program;
[0107] A code block acquisition subunit 122 is configured to acquire a code block having the same label as the target code block from the reorganized code block set when the matching result is a match passed, and determine the code block having the same label as the target code block as the reorganized code block corresponding to the target code block;
[0108] The code block generation subunit 123 is used to rewrite the code instructions in the target code block to generate rewrite code instructions when the matching result is a match failure, insert a callback instruction into the rewrite code instruction, and generate a reorganized code block corresponding to the target code block according to the rewrite code instruction and the callback instruction.
[0109] The tag matching subunit 121 is specifically used for:
[0110] Obtaining a label of the target code block, and matching the label of the target code block with labels of code blocks in the reorganized code block set;
[0111] When there is a code block having the same label as the target code block in the reorganized code block set, determining the matching result as a passed match;
[0112] When there is no code block having the same label as the target code block in the reorganized code block set, it is determined that the matching result is a match failure.
[0113] See also Figure 4 , the data processing device 1 of the embodiment of the present application may also include: a code block storage unit 14.
[0114] A code block storage unit 14 is used to obtain a label of the target code block, and set the label of the target code block to be the label of the reorganized code block; the reorganized code block corresponding to the target code block has the same label as the target code block;
[0115] The reorganized code block corresponding to the target code block is stored in a reorganized code block set.
[0116] The code block generation subunit 123 is specifically used for:
[0117] Parsing the target code block to generate code instructions of the target code block, and rewriting the code instructions to generate rewrite code instructions;
[0118] Writing the rewrite code instruction into a target memory address;
[0119] Inserting a callback instruction into the rewriting code instruction, compiling the rewriting code instruction and the callback instruction to generate a reorganized code block.
[0120] The code block execution unit 13 is specifically used for:
[0121] Parsing the reorganized code block, and executing the code instructions and callback instructions in the reorganized code block in the target memory address corresponding to the reorganized code block;
[0122] The interface call data and address access data of the reorganized code block are obtained, and the interface call data and the address access data are compared with standard data to generate a comparison result. When the comparison result is abnormal, the malicious behavior of the target program is determined; the standard data is the interface call data and address access data of the target program when there is no malicious behavior.
[0123] In an embodiment of the present application, by obtaining a target code block of a target program in a running state, the target program includes at least one code block, and the target code block is any code block in the target program, and further obtaining a reorganized code block corresponding to the target code block, the reorganized code block is a code block generated by inserting callback instructions using binary plug-ins according to the code instructions in the target code block, and finally running the reorganized code block corresponding to the target code block, obtaining the scheduling data of the reorganized code block, and determining the malicious behavior of the target program according to the scheduling data. The malicious behavior of the target program can be determined by the scheduling data of the reorganized code block corresponding to the target code block, and all API calls can be monitored without hooking the API. At the same time, it does not rely on the interface provided by the operating system, which improves the accuracy of analyzing malware behavior.
[0124] See also Figure 5 , which is a schematic diagram of the structure of a computer device according to an embodiment of the present application. Figure 5As shown, the computer device 1000 may include: at least one processor 1001, such as a CPU, at least one network interface 1004, a user interface 1003, a memory 1005, and at least one communication bus 1002. The communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), and the user interface 1003 may optionally include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a random access memory (Random Access Memory, RAM) or a non-volatile memory (non-volatile memory, NVM), such as at least one disk storage. The memory 1005 may optionally be at least one storage device located away from the aforementioned processor 1001. As Figure 5 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a data processing application program.
[0125] exist Figure 5 In the computer device 1000 shown in the figure, the network interface 1004 can provide a network communication function, the user interface 1003 is mainly used to provide an input interface for the user; and the processor 1001 can be used to call the data processing application stored in the memory 1005 to implement the above Figure 2-Figure 3 The description of the data processing method in any corresponding embodiment will not be repeated here.
[0126] It should be understood that the computer device 1000 described in the embodiment of the present application can execute the above Figure 2-Figure 3 The description of the data processing method in any corresponding embodiment can also be performed as described above. Figure 4 The description of the data processing device in the corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated here.
[0127] In addition, it should be pointed out here that: the embodiment of the present application also provides a computer storage medium, and the computer storage medium stores a computer program executed by the data processing device mentioned above, and the computer program includes program instructions. When the processor executes the program instructions, it can execute the above-mentioned Figure 2-Figure 3The description of the data processing method in any corresponding embodiment will not be repeated here. In addition, the description of the beneficial effects of the same method will not be repeated. For technical details not disclosed in the computer storage medium embodiment involved in this application, please refer to the description of the method embodiment of this application. As an example, program instructions may be deployed to be executed on one computing device, or on multiple computing devices located at one location, or on multiple computing devices distributed at multiple locations and interconnected by a communication network. Multiple computing devices distributed at multiple locations and interconnected by a communication network can constitute a blockchain system.
[0128] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, an NVM or a RAM, etc.
[0129] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.
Claims
1. A data processing method, characterized in that: include: Get the target code block of the target program in running state; The target program includes at least one code block, and the target code block is any code block in the target program; Obtaining a reorganized code block corresponding to the target code block, wherein the reorganized code block is a code block generated by inserting callback instructions using binary stubs according to code instructions in the target code block; Running the reorganized code block corresponding to the target code block, obtaining scheduling data of the reorganized code block, and determining the malicious behavior of the target program according to the scheduling data; The generation of the reorganized code block includes: parsing the target code block to generate code instructions of the target code block, rewriting the code instructions to generate rewrite code instructions, writing the rewrite code instructions into the target memory address, inserting the callback instructions into the rewrite code instructions, and compiling the rewrite code instructions and the callback instructions to generate the reorganized code block; The running of the reorganized code block corresponding to the target code block, obtaining the scheduling data of the reorganized code block, and determining the malicious behavior of the target program according to the scheduling data includes: parsing the reorganized code block, running the code instructions and callback instructions in the reorganized code block in the target memory address corresponding to the reorganized code block; obtaining the interface call data and address access data of the reorganized code block, comparing the interface call data and the address access data with standard data to generate a comparison result, and when the comparison result is abnormal, determining the malicious behavior of the target program; the standard data is the interface call data and address access data of the target program when there is no malicious behavior.
2. The method according to claim 1, characterized in that The step of obtaining a target code block of a target program in a running state includes: Determine a target code block of a target program, insert an interrupt program into the target program according to the target code block, and respond to the interrupt program for the target code block when the target program is in a running state; The target code block is obtained according to the interrupt program.
3. The method according to claim 1, characterized in that The obtaining of the reorganized code block corresponding to the target code block includes: Obtaining a label of the target code block, matching the label of the target code block with the label of the code block in the reorganized code block set, and generating a matching result; the reorganized code block set is used to store the reorganized code block corresponding to the code block of the target program; When the matching result is a successful match, a code block having the same label as the target code block is obtained from the reorganized code block set, and the code block having the same label as the target code block is determined as a reorganized code block corresponding to the target code block; When the matching result is a match failure, the code instructions in the target code block are rewritten to generate rewrite code instructions, callback instructions are inserted into the rewrite code instructions, and a reorganized code block corresponding to the target code block is generated according to the rewrite code instructions and the callback instructions.
4. The method according to claim 3, characterized in that The step of obtaining the label of the target code block, matching the label of the target code block with the labels of the code blocks in the reorganized code block set, and generating a matching result includes: Obtaining a label of the target code block, and matching the label of the target code block with labels of code blocks in the reorganized code block set; When there is a code block having the same label as the target code block in the reorganized code block set, determining the matching result as a passed match; When there is no code block having the same label as the target code block in the reorganized code block set, it is determined that the matching result is a match failure.
5. The method according to claim 3, characterized in that: When the matching result is that the match fails, rewriting the code instructions in the target code block to generate rewriting code instructions, inserting callback instructions into the rewriting code instructions, and generating a reorganized code block corresponding to the target code block according to the rewriting code instructions and the callback instructions, further comprising: Acquire the label of the target code block, and set the label of the target code block as the label of the reorganized code block; the reorganized code block corresponding to the target code block has the same label as the target code block; The reorganized code block corresponding to the target code block is stored in a reorganized code block set.
6. A data processing device, characterized in that: include: The target code block acquisition unit is used to acquire the target code block of the target program in the running state; The target program includes at least one code block, and the target code block is any code block in the target program; A reorganized code block acquisition unit, used to acquire a reorganized code block corresponding to the target code block, wherein the reorganized code block is a code block generated by inserting a callback instruction using a binary plug-in according to the code instruction in the target code block; A code block running unit, used to run the reorganized code block corresponding to the target code block, obtain the scheduling data of the reorganized code block, and determine the malicious behavior of the target program according to the scheduling data; The reorganized code block acquisition unit includes a code block generation subunit, which is used to parse the target code block, generate code instructions of the target code block, rewrite the code instructions to generate rewrite code instructions, write the rewrite code instructions into the target memory address, insert the callback instructions into the rewrite code instructions, compile the rewrite code instructions and the callback instructions to generate the reorganized code block; The code block running unit is specifically used to parse the reorganized code block, run the code instructions and callback instructions in the reorganized code block in the target memory address corresponding to the reorganized code block; obtain the interface call data and address access data of the reorganized code block, compare the interface call data and the address access data with standard data to generate a comparison result, and when the comparison result is abnormal, determine the malicious behavior of the target program; the standard data is the interface call data and address access data of the target program when there is no malicious behavior.
7. A computer storage medium, characterized in that: The computer storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the method according to any one of claims 1 to 5 is executed.
8. A computer device, characterized in that: It is characterized in that it comprises: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method as claimed in any one of claims 1 to 5.
Citation Information
Patent Citations
Dynamic taint analysis device and application thereof to document format reverse analysis
CN103440201A