A malware identification method, device, terminal device and storage medium
By marking and filtering the processing functions and resources of the target files, identifying malware, the problems of large resource consumption and difficulty in integration in the existing technology are solved, and efficient malware identification is achieved.
Patent Information
- Application Number
- CN202111288895.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-11-02
- Publication Date
- 2024-12-27
- Estimated Expiration
- 2041-11-02
AI Technical Summary
Existing malware identification methods consume too much computer resources and are not easy to integrate into security products such as antivirus software.
By marking the processing functions in the import table of the target file, identify suspicious functions, and filter out malicious resources from the target resources, and combining static analysis and preset processing, determine the malware.
A malware identification method that occupies few computer resources, is highly detectable and is easy to integrate into antivirus software is realized.
Smart Images
Figure CN113961924B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of software technology, and in particular to a malware identification method, apparatus, terminal device and storage medium. Background Art
[0002] Currently, in the software field, steganography is often used to hide malicious machine code (such as shellcode) in the resources of Portable Executable (PE) files, bypassing corresponding security defense measures, and then stealing user information, publishing forced advertisements, etc.
[0003] The existing malware identification methods integrated into security products such as antivirus software usually include steganographic software writing identification algorithms (identification algorithms written based on manual analysis of steganographic software on the market), machine learning model analysis methods, etc. Among them, the steganographic software writing identification algorithms requires a lot of manpower to analyze a variety of steganographic software and then write the identification algorithms; the machine learning model analysis method requires learning and analyzing a large number of samples, and then training the model based on the samples. Therefore, no matter which of the above methods is integrated into security products such as antivirus software, there is a problem of consuming too many computer resources.
[0004] Therefore, there is an urgent need for a malware identification method that occupies less computer resources and is easy to integrate into security products such as antivirus software. Summary of the invention
[0005] The embodiments of the present application provide a malware identification method, apparatus, terminal device and storage medium to solve or partially solve the problem that the existing technology of identifying malware consumes too much computer resources and is not easy to be integrated into security products such as antivirus software.
[0006] According to a first aspect of an embodiment of the present application, a method for identifying malware is provided, the method comprising: marking N processing functions in an import table of a target file, where the target file is a PE file that has undergone static analysis and has resources, and N is a positive integer; determining at least one first function from the N processing functions, each first function being a suspicious function in the context of the system of the target file; determining malicious resources from the target resources, the target resources including resources corresponding to each first function and having undergone preset processing; and determining the target file corresponding to the malicious resource as malware.
[0007] Optionally, each processing function is a resource processing function or a loading function.
[0008] Optionally, the suspicious function includes at least one of the following: a functional function that is unrelated to the resource corresponding to the corresponding first function, and a function of a preset type.
[0009] Optionally, the suspicious function includes a preset type of function, and the preset type of function includes at least one of the following: a memory space application function, a thread creation function, an encryption and decryption function, and a loop XOR processing function.
[0010] Optionally, determining malicious resources from the target resources includes: determining a first resource from the target resources, each resource in the first resource is inconsistent with a corresponding original resource, and the original resource is obtained based on the resources in the resource table of the target file; and determining the resources in the first resource that are identical to the resources in the malicious code database as malicious resources.
[0011] Optionally, after determining the first resource from the target resources, the method also includes: determining a resource in the first resource that is different from a resource in a malicious code database as a second resource; determining a resource in the second resource that satisfies the first condition by comparing it with a hard-coded table as a third resource; for each resource in the third resource, executing the following step S1 multiple times to determine the resource that satisfies the second condition as a malicious resource; wherein step S1 is: modifying any one of the first M bits of the resource to an interrupt instruction; executing the modified resource; determining the resource interrupt position; wherein M is an integer greater than 1, and the first condition includes at least one of the following: the format of the resource complies with the hard-coded writing specification, and the content of the resource is all located in the hard-coded table; the second condition is: each time step S1 is executed, the interrupt position is the position modified to the interrupt instruction.
[0012] Optionally, determining malicious resources from the target resources includes: determining a first resource from the target resources, each resource in the first resource is inconsistent with the corresponding original resource, and the original resource is obtained according to the resource in the resource table of the target file; comparing the first resource with the hard-coded table to determine the resource that meets the first condition as the fourth resource; for each resource in the fourth resource, executing the following step S1 multiple times to determine the resource that meets the second condition as a malicious resource; wherein step S1 is: modifying any one of the first M bits of the resource to an interrupt instruction; executing the modified resource; determining the resource interrupt position; wherein M is an integer greater than 1, and the first condition includes at least one of the following: the format of the resource complies with the hard-coded writing specifications, and the content of the resource is all located in the hard-coded table; the second condition is: each time step S1 is executed, the interrupt position is the position modified to the interrupt instruction.
[0013] According to a second aspect of an embodiment of the present application, a malware identification device is provided, which includes: a marking module and a determination module; the marking module is used to mark N processing functions in an import table of a target file, where the target file is a portable executable PE file that has undergone static analysis and has resources, and N is a positive integer; the determination module is used to determine at least one first function from the N processing functions, each first function being a suspicious function in the context of the target file's system; determining malicious resources from the target resources, where the target resources include resources corresponding to each first function and having undergone preset processing; and determining the target file corresponding to the malicious resource as malware.
[0014] Optionally, each processing function is a resource processing function or a loading function.
[0015] Optionally, the suspicious function includes at least one of the following: a functional function that is unrelated to the resource corresponding to the corresponding first function, and a function of a preset type.
[0016] Optionally, the suspicious function includes a preset type of function, and the preset type of function includes at least one of the following: a memory space application function, a thread creation function, an encryption and decryption function, and a loop XOR processing function.
[0017] Optionally, the determination module is specifically used to determine a first resource from the target resources, each resource in the first resource is inconsistent with the corresponding original resource, and the original resource is obtained based on the resource in the resource table of the target file; the resources in the first resource that are identical to the resources in the malicious code database are determined as malicious resources.
[0018] Optionally, the determination module is also used to, after determining the first resource in the target resource, determine the resource in the first resource that is different from the resource in the malicious code database as the second resource; determine the resource in the second resource that satisfies the first condition by comparing it with the hard-coded table as the third resource; for each resource in the third resource, execute the following step S1 multiple times to determine the resource that satisfies the second condition as a malicious resource; wherein step S1 is: modify any one of the first M bits of the resource to an interrupt instruction; execute the modified resource; determine the resource interrupt position; wherein M is an integer greater than 1, and the first condition includes at least one of the following: the format of the resource conforms to the hard-coded writing specification, and the content of the resource is all located in the hard-coded table; the second condition is: each time step S1 is executed, the interrupt position is the position modified to the interrupt instruction.
[0019] Optionally, the determination module is specifically used to determine a first resource from the target resources, each resource in the first resource is inconsistent with the corresponding original resource, and the original resource is obtained according to the resource in the resource table of the target file; the resource in the first resource is compared with the hard-coded table and the resource that meets the first condition is determined as a fourth resource; for each resource in the fourth resource, the following step S1 is executed multiple times to determine the resource that meets the second condition as a malicious resource; wherein step S1 is: modify any one of the first M bits of the resource to an interrupt instruction; execute the modified resource; determine the resource interrupt position; wherein M is an integer greater than 1, and the first condition includes at least one of the following: the format of the resource conforms to the hard-coded writing specification, and the content of the resource is all located in the hard-coded table; the second condition is: each time step S1 is executed, the interrupt position is the position modified to the interrupt instruction.
[0020] According to a third aspect of an embodiment of the present application, a terminal device is provided, which includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the malware identification method of the first aspect.
[0021] According to a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the malware identification method according to the first aspect are implemented.
[0022] According to a fifth aspect of an embodiment of the present application, a chip is provided, which includes a processor and a communication interface, wherein the communication interface is coupled to the processor, and the processor is used to run program instructions to implement the malware identification method as in the first aspect.
[0023] In the embodiment of the present application, the resources in the resource table of the target file can be saved as original resources by marking N (positive integer) processing functions in the import table of the target file (PE file with resources after static analysis); at least one first function is determined from the N processing functions, and each first function has a suspicious function in the context of the system of the target file (based on the context of the system of the target file, the suspicious functions (at least one first function) in the target file are screened out); malicious resources are determined from the target resources (the target resources include the resources corresponding to each first function and processed by the preset process) (the suspicious resources (target resources) in the target file are determined according to the suspicious functions, and the malicious resources are further screened out from the suspicious resources); the target file corresponding to the malicious resource is determined as malware. In this scheme, by processing and analyzing the processing functions and resources in the PE file, it is determined whether the PE file is malware. In this method, it is not necessary to process and analyze other PE files, and only the target file to be detected needs to be processed and analyzed, so it can be determined whether the target file is malware. The operation process is simple, less computer resources are occupied, the detection efficiency is high, and it is easy to integrate into security products such as antivirus software. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments and the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application, and other drawings can be obtained based on these drawings.
[0025] Figure 1 One of the flowcharts of the malware identification method provided in the embodiment of the present application;
[0026] Figure 2 A second flowchart of the malware identification method provided in an embodiment of the present application;
[0027] Figure 3 The third flowchart of the malware identification method provided in the embodiment of the present application;
[0028] Figure 4 A fourth flowchart of a malware identification method provided in an embodiment of the present application;
[0029] Figure 5 A structural block diagram of a malware identification device provided in an embodiment of the present application;
[0030] Figure 6 A structural block diagram of a terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0031] The following will be combined with the drawings in the embodiments of the present application to clearly describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the present application belong to the scope of protection of this application.
[0032] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.
[0033] In the embodiment of the present application, the resources in the resource table of the target file can be saved as original resources by marking N (positive integer) processing functions in the import table of the target file (PE file with resources after static analysis); at least one first function is determined from the N processing functions, and each first function has a suspicious function in the context of the system of the target file (based on the context of the system of the target file, the suspicious functions (at least one first function) in the target file are screened out); malicious resources are determined from the target resources (the target resources include the resources corresponding to each first function and processed by the preset process) (the suspicious resources (target resources) in the target file are determined according to the suspicious functions, and the malicious resources are further screened out from the suspicious resources); the target file corresponding to the malicious resource is determined as malware. In this scheme, by processing and analyzing the processing functions and resources in the PE file, it is determined whether the PE file is malware. In this method, it is not necessary to process and analyze other PE files, and only the target file to be detected needs to be processed and analyzed, so it can be determined whether the target file is malware. The operation process is simple, less computer resources are occupied, the detection efficiency is high, and it is easy to integrate into security products such as antivirus software.
[0034] The terminal device in the embodiment of the present application may be a mobile terminal device or a non-mobile terminal device. The mobile terminal device may be a mobile phone, a tablet computer, a laptop computer, a PDA, a vehicle-mounted terminal device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA); the non-mobile terminal device may be a personal computer (PC), a television (TV), a teller machine, or a self-service machine; the embodiment of the present application does not specifically limit the above.
[0035] The executor of the malware identification method provided in the embodiment of the present application can be the above-mentioned terminal device (including mobile terminal devices and non-mobile terminal devices), or it can be a functional module and / or functional entity in the terminal device that can implement the malware identification method. The specific execution subject can be determined according to actual usage requirements, and the embodiment of the present application is not limited.
[0036] The malware identification method provided by the embodiment of the present application is described in detail below through specific embodiments and their application scenarios in conjunction with the accompanying drawings.
[0037] like Figure 1 As shown, the embodiment of the present application provides a malware identification method, and the malware identification method provided by the embodiment of the present application is exemplarily described below by taking the execution subject as a terminal device as an example. The method may include the following steps 101 to 104.
[0038] 101. The terminal device marks N processing functions in the import table of the target file.
[0039] Among them, the target file is a PE file that has been statically analyzed and has resources, and N is a positive integer.
[0040] Among them, static analysis refers to a code analysis technology that scans program code through lexical analysis, syntax analysis, control flow, data flow analysis and other technologies without running the code to verify whether the code meets indicators such as standardization, security, reliability, and maintainability. It includes code inspection, static structural analysis, code quality measurement, etc. For example, it can find structural errors, security vulnerabilities and other problems in the code.
[0041] Among them, resources can refer to officially defined resources, such as pictures, videos, audio and other resources, or they can be custom resources. The specific resources can be determined based on actual usage and are not limited in the embodiments of this application.
[0042] Among them, common PE files include EXE, DLL, OCX, SYS, COM, etc. PE files are program files on Microsoft Windows operating system (may be executed indirectly, such as DLL).
[0043] The import table refers to a function directory table in the target file, and the import table stores the functions corresponding to the resources in the target file and the corresponding positions of the functions in the system of the target file.
[0044] The import table includes all functions corresponding to each resource in the target file. Since each resource requires a load function, the import table includes a load function corresponding to each resource in the target file.
[0045] Exemplarily, the target file includes an image resource, and the functions corresponding to the image resource are an open function and a display function. The import table includes: the open function corresponding to the image resource and the location of the open function in the system of the target file, as well as the display function and the location of the display function in the system of the target file.
[0046] Optionally, each processing function is a resource processing function or a Load function in an import table.
[0047] The resource processing function is the processing function corresponding to the resource, and the N processing functions are all processing functions corresponding to each resource in the PE file.
[0048] The Load function may be a Load function corresponding to a resource, and the N processing functions are Load functions corresponding to each resource in the PE file. For example, the Load function may be LoadImage(), LoadResource(), etc.
[0049] In an embodiment of the present application, since the import table records the functions corresponding to the resources in the target file, marking the N processing functions in the import table of the target file can exclude some functions that are not related to the resources in the target file, thereby saving computer resources and improving the computer's processing efficiency.
[0050] 102. The terminal device determines at least one first function from N processing functions.
[0051] Each first function is a suspicious function in the context of the target file system.
[0052] It can be understood that the terminal device checks whether there is a suspicious function in the context of each of the N processing functions in the system. If there is a suspicious function, it is the first function, otherwise it is not the first function.
[0053] Among them, the context of a processing function in the system of the target file can be understood as follows: First, for different types of resources, there will be corresponding resource processing functions in the system (such as: functions for loading, opening, closing, etc. of image resources; functions for loading, opening, playing, closing, etc. of audio resources). First, determine whether the processing function is the functional function of the corresponding resource, and then check whether the functions related to the functional function (other functions at the same level as the functional function, functions that directly or indirectly call the functional function, and other functions at the same level) are suspicious functions; Second, determine the suspicious function for the Load function, because no matter what function is implemented, it is necessary to load, so you can check whether the functions related to the Load function (other functions after the Load function at the same level as the Load function, functions that directly or indirectly call the Load function, and other functions at the same level) are suspicious functions.
[0054] Moreover, because no matter what function is to be implemented, it needs to be loaded through the load function, and each processing function is a load function, it can not only judge each resource, but also reduce the subsequent workload of judging whether the processing function is the first function, which can further save computer resources and improve computer processing efficiency.
[0055] Optionally, the suspicious function includes at least one of the following: a functional function that is unrelated to the resource corresponding to the corresponding first function, and a function of a preset type.
[0056] Among them, functional functions refer to different functions that exist in different resources to implement certain functions, such as: the functional functions of image resources can include loading, opening, displaying, closing, etc.; video resources can include loading, opening, playing, closing, etc.; audio resources can include loading, opening, playing, closing, etc.
[0057] Among them, the functional function that is not related to the resource corresponding to the corresponding first function can be understood as, assuming that the N processing functions include an open function, the resource corresponding to the first function is an image, and the image-related functional functions include loading, opening, displaying, closing and other functions, when the play function is not included, if the play function exists in the context of the open function in the system, then the play function is a functional function that is not related to the image, then the play function is a suspicious function, and the open function is a first function among the N processing functions.
[0058] Optionally, the preset type of function includes at least one of the following: a memory space application function, a thread creation function, an encryption and decryption function, and a loop XOR processing function; the preset type of function may also include other feasibility functions, which are not limited in the embodiments of the present application.
[0059] Wherein, the application memory space function may include malloc, realloc, free, etc., which are not limited in the embodiments of the present application. The creation thread function may include CreadThread, AfxBeginThread, _beginthread, _beginthreadex, etc., which are not limited in the embodiments of the present application. The encryption and decryption function may include URL encryption and decryption, sha1 encryption and decryption, des encryption and decryption, etc., which are not limited in the embodiments of the present application. The circular XOR processing function may be a circular XOR processing function similar to the resource size, etc., which are not limited in the embodiments of the present application. Wherein, the circular XOR processing function similar to the resource size can be understood as, each character of the resource is XOR-processed, for example, the resource has 100 characters, that is, the resource is XOR-processed from the 1st character to the 100th character.
[0060] Exemplarily, if the resource is an image resource, and the processing function of the image resource marked in step 101 contains complex functions such as a function for applying for memory space and a function for creating a thread in the context of the system, or there are functional functions unrelated to the image resource, such as RegConnectRegistry, RegEnumKey, SetVolumeLabel, WNetAddConnection function, etc., then the processing function is the first function filtered out, and other functions marked in step 101 are also filtered accordingly to determine whether they are the first function.
[0061] In an embodiment of the present application, by searching for suspicious functions in the context of the system of the target file from the N processing functions in the import table, the occupancy of computer resources is reduced and the detection efficiency is improved compared to searching for suspicious functions in all functions in the system; and by screening out at least one first function from the marked N processing functions, suspicious resources are further screened out from the resources of the target file, that is, the resources corresponding to each first function. In this way, a part of normal resources are excluded, which can reduce the workload of subsequent judgment on whether the resources are malicious resources, save computer resources, and improve processing efficiency.
[0062] 103. The terminal device determines malicious resources from the target resources.
[0063] The target resources include resources corresponding to each first function and having undergone preset processing.
[0064] The preset processing may include: functions for processing resources, such as decryption.
[0065] It can be understood that the preset processing is to perform a decryption operation on the resource, and the process is to first apply for memory space, then decrypt the resource and put it into the memory space.
[0066] The malicious resource in the embodiment of the present application can be a malicious machine code (such as shellcode), which is a code executed by exploiting a software vulnerability and can generally obtain permissions. The malicious resource can also be other malicious codes, which are not limited in the embodiment of the present application.
[0067] 104. The terminal device determines the target file corresponding to the malicious resource as malware.
[0068] It can be understood that the terminal device obtains the target resource by performing preset processing on the resource corresponding to each first function, and then performs certain processing on each resource in the target resource to determine the malicious resource in the target resource, and finally determines the target file corresponding to the malicious resource as malware.
[0069] In an embodiment of the present application, each PE file that needs to be judged whether it is malware is processed according to the above steps 101 to 104. If there are malicious resources in the PE file, the PE file is malware; if there are no malicious resources in the PE file, the PE file is normal software.
[0070] In the embodiment of the present application, by processing and analyzing the processing functions and resources in the PE file, it is determined whether the PE file is malware. In this method, there is no need to process and analyze other PE files, only the PE file to be detected needs to be processed and analyzed, so as to determine whether the target file is malware. The operation process is simple, takes up less computer resources, has high detection efficiency, and is easy to be integrated into security products such as antivirus software.
[0071] Optionally, combined Figure 1 ,like Figure 2 As shown, the above step 103 can be specifically implemented through the following steps 103a to 103b.
[0072] 103a. The terminal device determines a first resource from target resources.
[0073] Among them, each resource in the first resource is inconsistent with the corresponding original resource; the original resource is obtained according to the resources in the resource table of the target file.
[0074] The resource table records all resources existing in the target file, such as image resources, video resources, audio resources, etc.
[0075] The original resource is obtained according to the resource in the resource table of the target file. Specifically, the terminal device saves each resource in the resource table as an original resource in a binary manner.
[0076] Among them, the specific operation of determining the first resource is: using the hook technology (HOOK) to change the process for each resource corresponding to the first function. The original process is to apply for memory space first, then put the resources into the memory space after preset processing, and then other processes. The embodiment of the present application uses the hook technology (HOOK) to change the process specifically, after the resources are put into the memory space after preset processing, a process is added using the HOOK technology. The content of the added process is: first check whether the preset processed resources placed in the memory space are consistent with the original resources. If they are consistent with the original resources, it means that there is no abnormality; if they are inconsistent with the original resources, then detect the data structure format of the preset processed resources. If the preset processed resources are PE files, perform static analysis on the preset processed resources and re-execute the above steps 101 to 104 to further determine whether it is malware; if the preset processed resources are not PE files, then determine that the resource corresponding to the first function is the first resource.
[0077] It can be understood that the system's resource processing flow is: apply for memory space, then perform preset processing (such as decryption) on the resources and put them into the memory space, followed by other processes; if it is a normal resource, there is generally no encryption operation, so decryption is not required; but if it is a malicious resource, the decrypted resource will be inconsistent with the original, so it is determined that it may be a malicious resource.
[0078] Among them, HOOK is a special message processing mechanism, which can monitor various event messages in the system or process, intercept and process messages sent to the target window, so you can customize HOOK in the system to monitor the occurrence of specific events in the system and complete specific functions, such as screen capture, log monitoring, keyboard and mouse input, etc.
[0079] 103b. The terminal device determines the resources in the first resource that are identical to the resources in the malicious code database as malicious resources.
[0080] Among them, the malicious code library stores known malicious code (such as shellcode), which can be malicious code segments manually extracted by researchers or malicious code in malicious resources determined by the malware identification method provided in the embodiment of the present application.
[0081] Optionally, after step 103b, the terminal device may extract malicious code (such as shellcode) corresponding to the malicious resource determined in step 103b and store it in a malicious code library, thereby enriching the malicious code library and improving the detection efficiency of subsequent malware identification.
[0082] Optionally, combined Figure 2 ,like Figure 3As shown, after the above step 103a, the method for determining a malicious resource provided by the embodiment of the present application may further include the following steps 103c to 103e.
[0083] 103c. The terminal device determines a resource in the first resource that is different from a resource in the malicious code database as a second resource.
[0084] 103d. The terminal device compares the second resource with the hard-coded table and determines the resource that meets the first condition as the third resource.
[0085] Among them, the hard-coded table records the machine instructions of the Intel processor (Intel CPU, Intel Central Processing Unit) based on the P6 microarchitecture.
[0086] Optionally, the first condition includes at least one of the following: the format of the resource complies with the hard-coded writing specification, and the content of the resource is all located in the hard-coded table. The first condition may also include other feasibility conditions, which are not limited in the embodiment of the present application.
[0087] Among them, the specific content of the hard-coded table and the hard-coded writing specifications can refer to the existing related technologies and will not be described in detail here.
[0088] In the embodiment of the present application, the data is first compared with the data in the malicious code library and then compared with the hard-coded table, which can improve the accuracy of detection and prevent malicious programs from escaping.
[0089] 103e. The terminal device executes the following step S1 multiple times for each resource in the third resources, and determines the resources that meet the second condition as malicious resources.
[0090] Wherein, step S1 includes the following steps S11 to S13.
[0091] S11. The terminal device modifies any one of the first M bits of the resource into an interrupt instruction.
[0092] Wherein, M is an integer greater than 1.
[0093] Optionally, M is less than the number of bits of the corresponding resource.
[0094] For example, a resource contains 100 bits, and the range of M is: 1 <M<100。
[0095] S12. The terminal device executes the modified resources.
[0096] S13. The terminal device determines the resource interruption location.
[0097] Exemplarily, M is 20, and the above step S1 may specifically be: for each resource in the third resource, any hexadecimal data in the first 20 bits may be modified to 0xCC, the modified resource may be executed, and the interrupt position of each modified resource may be determined, wherein 0xCC is an interrupt instruction in the assembly instruction.
[0098] In the embodiment of the present application, M is less than the number of bits of the corresponding resource, that is, the last bit (last bit) in the resource will not be modified as a terminal instruction, for example, any bit in the first 20 bits of the resource is modified, the resource is executed, and the terminal position is determined. In this way, before the resource is executed, an interruption occurs at or before the modification bit, and the resource will not be executed completely, which can avoid the risk of contaminating the computer environment and infecting the virus after the resource is executed when there is malicious code (such as shellcode) hidden in the resource, and the malicious code contains undisclosed technologies and methods, or the problem of network behavior causing the malware author to receive information can be avoided; and relative to the complete operation of the resource, only the front part (the first M bits) is modified and then executed, the interruption position can be quickly determined, thereby saving computer resources and improving the detection efficiency of malware.
[0099] The second condition is that each time step S1 is executed, the interrupt position is modified to be the position of the interrupt instruction.
[0100] If the resource is a normal resource, when the modified resource is executed, the interrupt position may be located before the modification to the interrupt instruction, or it may be located at the position modified to the interrupt instruction, that is, the interrupt position may be inconsistent with the position modified to the interrupt instruction. For example, if the 20th bit is modified to the interrupt instruction, when executed, it may be interrupted before the 20th bit, or it may be interrupted at the 20th bit.
[0101] However, if the resource is a malicious resource, when the modified resource is executed, the interrupt position is always located at the position modified to the interrupt instruction, that is, the interrupt position is always consistent with the position modified to the interrupt instruction. For example, if the 20th bit is modified, the interrupt will be at the 20th bit, and if the 16th bit is modified, the interrupt will be at the 16th bit.
[0102] Therefore, the purpose of executing S1 multiple times is to determine whether each interrupt position is modified to the position of the interrupt instruction. Then, it can be determined whether it is a malicious resource based on whether the interrupt position is consistent with the position modified to the interrupt instruction. In this way, malicious resources can be quickly identified, and then malware can be quickly identified, which can improve identification efficiency.
[0103] Optionally, after the above step 103e, the terminal device can extract the malicious code (such as shellcode) corresponding to the malicious resource determined in step 103e, and store it in a malicious code library. In this way, the malicious code library can be enriched and the detection efficiency can be improved.
[0104] Optionally, combined Figure 2 ,like Figure 4 As shown, after the above step 103a, the method for determining a malicious resource provided in the embodiment of the present application may further include the following steps 103f to 103g.
[0105] 103f. The terminal device compares the first resource with the hard-coded table, and determines the resource satisfying the first condition as the fourth resource.
[0106] The first condition includes at least one of the following: the format of the resource complies with the hard-coded writing specification, and the content of the resource is all located in the hard-coded table.
[0107] For the description of the hard-coded table and the first condition, please refer to the description of the hard-coded table and the first condition in the above step 103d, which will not be repeated here.
[0108] 103g. The terminal device executes the following step S1 multiple times for each resource in the fourth resources, and determines the resources that meet the second condition as malicious resources.
[0109] Wherein, step S1 is: modify any one of the first M bits of the resource into an interrupt instruction; execute the modified resource; determine the resource interrupt position; M is an integer greater than 1.
[0110] The second condition is that each time step S1 is executed, the interrupt position is modified to be the position of the interrupt instruction.
[0111] For the description of step S1 and the second condition, please refer to the relevant description of step S1 and the second condition in the above step 103e, which will not be repeated here.
[0112] Optionally, after the above step 103g, the terminal device can extract the malicious resources (such as shellcode) determined in step 103g and store them in a malicious code library, which can enrich the malicious code library and improve detection efficiency.
[0113] In the embodiments of the present application, a variety of methods for determining malicious resources from target resources are provided, which can be determined according to actual use requirements, and are not limited in the embodiments of the present application. Moreover, the malware identification method provided in the embodiments of the present application determines whether the PE file is malware by processing and analyzing the processing functions and resources in the PE file. In this method, there is no need to process and analyze other PE files, and only the target file to be detected needs to be processed and analyzed, so as to determine whether the target file is malware. The operation process is simple, less computer resources are occupied, the detection efficiency is high, and it is easy to be integrated into security products such as antivirus software.
[0114] Figure 5 This is a structural block diagram of a malware identification device shown in an embodiment of the present application. Figure 5 As shown, it includes: a marking module 501 and a determination module 502; the marking module 501 is used to mark N processing functions in the import table of the target file, the target file is a portable executable PE file that has undergone static analysis and has resources, and N is a positive integer; the determination module 502 is used to determine at least one first function from the N processing functions, each first function has a suspicious function in the context of the system of the target file; determine malicious resources from the target resources, the target resources include resources corresponding to each first function and having undergone preset processing; and determine the target file corresponding to the malicious resource as malware.
[0115] Optionally, each processing function is a resource processing function or a loading function.
[0116] Optionally, the suspicious function includes at least one of the following: a functional function that is unrelated to the resource corresponding to the corresponding first function, and a function of a preset type.
[0117] Optionally, the suspicious function includes a preset type of function, and the preset type of function includes at least one of the following: a memory space application function, a thread creation function, an encryption and decryption function, and a loop XOR processing function.
[0118] Optionally, the determination module 502 is specifically used to determine a first resource from the target resources, each resource in the first resource is inconsistent with the corresponding original resource, wherein the original resource is obtained based on the resource in the resource table of the target file; and the resources in the first resource that are identical to the resources in the malicious code database are determined as malicious resources.
[0119] Optionally, the determination module 502 is also used to, after determining the first resource from the target resources, determine the resources in the first resource that are different from the resources in the malicious code database as the second resource; determine the resources in the second resource that meet the first condition by comparing with the hard-coded table as the third resource; for each resource in the third resource, execute the following step S1 multiple times to determine the resources that meet the second condition as malicious resources; wherein step S1 is: modify any one of the first M bits of the resource to an interrupt instruction; execute the modified resource; determine the resource interrupt position; wherein M is an integer greater than 1, and the first condition includes at least one of the following: the format of the resource conforms to the hard-coded writing specification, and the content of the resource is all located in the hard-coded table; the second condition is: each time step S1 is executed, the interrupt position is the position modified to the interrupt instruction.
[0120] Optionally, the determination module 502 is specifically used to determine a first resource from the target resources, each resource in the first resource is inconsistent with the corresponding original resource, and the original resource is obtained according to the resource in the resource table of the target file; the resource in the first resource is compared with the hard-coded table and the resource that meets the first condition is determined as a fourth resource; for each resource in the fourth resource, the following step S1 is executed multiple times to determine the resource that meets the second condition as a malicious resource; wherein step S1 is: modify any one of the first M bits of the resource to an interrupt instruction; execute the modified resource; determine the resource interrupt position; wherein M is an integer greater than 1, and the first condition includes at least one of the following: the format of the resource conforms to the hard-coded writing specification, and the content of the resource is all located in the hard-coded table; the second condition is: each time step S1 is executed, the interrupt position is the position modified to the interrupt instruction.
[0121] In the embodiments of the present application, each module can implement the malware identification method provided in the above method embodiments and can achieve the same technical effect. To avoid repetition, it will not be described here.
[0122] The present application also provides a terminal device, such as Figure 6 As shown, the terminal device may include: a processor 601, a memory 602, and a computer program stored in the memory 602 and executable on the processor 601. When the computer program is executed by the processor 601, each process of the malware identification method provided in the above method embodiment can be implemented, and the same technical effect can be achieved. To avoid repetition, it will not be described here.
[0123] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the various processes of the malware identification method provided in the above method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.
[0124] An embodiment of the present application also provides a computer program product, wherein the computer program product includes computer instructions. When the computer program product runs on a processor, the processor executes the computer instructions to implement the various processes of malware identification provided by the above method embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0125] An embodiment of the present application further provides a chip, which includes a processor and a communication interface, wherein the communication interface and the processor are coupled, and the processor is used to run programs or instructions to implement the various processes of the above-mentioned malware identification embodiment, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.
[0126] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.
[0127] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices, servers and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.
[0128] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0129] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
[0130] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.
[0131] As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.
Claims
1. A method for identifying malware, characterized in that: include: Mark N processing functions in the import table of the target file, where the target file is a portable executable PE file with resources that has been statically analyzed, and N is a positive integer; Determine at least one first function from the N processing functions, each of the first functions having a suspicious function in the context of the system of the target file; Determine a first resource from the target resources, each resource in the first resource is inconsistent with the corresponding original resource, the target resource includes a resource corresponding to each first function and having undergone preset processing, and the original resource is obtained according to the resource in the resource table of the target file; Determine the resources in the first resource that are the same as the resources in the malicious code database as malicious resources; determine the resources in the first resource that are different from the resources in the malicious code database as second resources; determine the resources in the second resource that meet the first condition after comparison with the hard-coded table as third resources; for each resource in the third resource, perform the following step S1 multiple times to determine the resources that meet the second condition as the malicious resources; or, Determine the resource in the first resource that satisfies the first condition by comparing it with the hard-coded table as the fourth resource; for each resource in the fourth resource, perform the following step S1 multiple times to determine the resource that satisfies the second condition as the malicious resource; Determining the target file corresponding to the malicious resource as malware; Wherein, the step S1 is: Modify any of the first M bits of the resource to an interrupt instruction; Execute the modified resource; Determine where the resource is out of service; Wherein, M is an integer greater than 1, and the first condition includes at least one of the following: The format of the resource complies with the hard-coded writing specification, and the content of the resource is all located in the hard-coded table; The second condition is: Each time step S1 is executed, the interruption position is modified to be the position of the interruption instruction.
2. The method according to claim 1, characterized in that Each processing function is a resource processing function or a loading function.
3. The method according to claim 1, characterized in that The suspicious function includes at least one of the following: A functional function that is not related to the resources corresponding to the corresponding first function, and a function of a preset type.
4. The method according to claim 3, characterized in that The suspicious function includes the function of the preset type, and the function of the preset type includes at least one of the following: Functions for applying for memory space, creating threads, encryption and decryption, and loop XOR processing.
5. A malware identification device, characterized in that: The device comprises: a marking module and a determination module; The marking module is used to mark N processing functions in the import table of the target file, where the target file is a portable executable PE file with resources that has been statically analyzed, and N is a positive integer; The determination module is used to determine at least one first function from the N processing functions, each of which has a suspicious function in the context of the target file system; Determine a first resource from the target resources, each resource in the first resource is inconsistent with the corresponding original resource, the target resource includes a resource corresponding to each first function and having undergone preset processing, and the original resource is obtained according to the resource in the resource table of the target file; Determine the resources in the first resource that are the same as the resources in the malicious code database as malicious resources; determine the resources in the first resource that are different from the resources in the malicious code database as second resources; determine the resources in the second resource that meet the first condition after comparison with the hard-coded table as third resources; for each resource in the third resource, perform the following step S1 multiple times to determine the resources that meet the second condition as the malicious resources; or, Determine the resource in the first resource that satisfies the first condition by comparing it with the hard-coded table as the fourth resource; for each resource in the fourth resource, perform the following step S1 multiple times to determine the resource that satisfies the second condition as the malicious resource; Determining the target file corresponding to the malicious resource as malware; Wherein, the step S1 is: Modify any of the first M bits of the resource to an interrupt instruction; Execute the modified resource; Determine where the resource is out of service; Wherein, M is an integer greater than 1, and the first condition includes at least one of the following: The format of the resource complies with the hard-coded writing specification, and the content of the resource is all located in the hard-coded table; The second condition is: Each time step S1 is executed, the interruption position is modified to be the position of the interruption instruction.
6. A terminal device, characterized in that: The method comprises a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the malware identification method as claimed in any one of claims 1 to 4.
7. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by a processor, the steps of the malware identification method according to any one of claims 1 to 4 are implemented.