A method, device, equipment and storage medium for detecting executable file injection

Abstract

The present application discloses a detection method, device, equipment and storage medium for executable file injection, the method comprising: searching the memory information of the target process; detecting whether there is information of two or more dynamic linkers in the memory information of the target process; when the information of two or more dynamic linkers is detected, determining that the target process has been infected with a Trojan virus injected by a dynamically linked executable file. The above detection method provided by the present invention can detect in real time whether the memory of the target process has been injected with a Trojan virus of a "dynamically linked executable file", has strong pertinence for such Trojan viruses, does not require feature code data of the Trojan virus, has wide adaptability and high detection efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of system security detection, and in particular to a detection method, device, equipment and storage medium for executable file injection. Background Art

[0002] At present, Linux systems are facing various threats. Many criminals use various means to attack the system and obtain user information. System administrators usually scan the files on the system to detect problematic executable files and remove them. However, some Trojan viruses do not exist in the file system, so it is not possible to detect them through traditional file scanning methods. These Trojan viruses may take advantage of system or application software vulnerabilities and directly inject Trojan viruses into the memory of the target process and run them in parallel with the target process. In this way, the Trojan binary files are not stored on the disk and are completely in the memory, making it difficult for system administrators to detect the existence of Trojans.

[0003] The existing technology generally matches the signature code of known Trojan viruses, searches the signature code library to see if the target process memory has the signature code, and thus determines whether the target process is infected with the Trojan virus. However, its disadvantage is that it requires a sample of the Trojan virus before it can be detected, and it cannot detect newly emerging Trojan viruses. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a method, device, equipment and storage medium for detecting executable file injection, which can detect in real time whether the memory of the target process is infected with a Trojan virus, has wide adaptability and high detection efficiency. The specific scheme is as follows:

[0005] A method for detecting executable file injection, comprising:

[0006] Search the memory information of the target process;

[0007] Detecting whether there are more than two dynamic linker information in the memory information of the target process;

[0008] When information of more than two dynamic linkers is detected, it is determined that the target process has been infected with a Trojan virus injected into the dynamically linked executable file.

[0009] Preferably, in the above-mentioned executable file injection detection method provided by the embodiment of the present invention, the searching of the memory information of the target process includes:

[0010] Traverse the / proc directory; the subdirectories named with numbers in the directory are the pids of the processes currently running in the system;

[0011] Check / proc / <pid> / maps file exists;

[0012] If it exists, read / proc / <pid>The memory information of the target process recorded in the / maps file.

[0013] Preferably, in the above-mentioned executable file injection detection method provided by the embodiment of the present invention, the detecting whether there is information of more than two dynamic linkers in the memory information of the target process includes:

[0014] Detecting whether the total number of lines corresponding to information ending with a dynamic linker file path displayed in the last column of the memory information of the target process exceeds 1;

[0015] If it exceeds 1, it is determined that information of two or more dynamic linkers is detected.

[0016] Preferably, in the above-mentioned executable file injection detection method provided by the embodiment of the present invention, it also includes:

[0017] If it does not exceed 1, the memory intervals specified by all rows whose last column in the memory information of the target process is empty are searched to find out whether there is information of the so dynamic library, so as to detect whether there is information of more than two dynamic linkers.

[0018] Preferably, in the above-mentioned executable file injection detection method provided by the embodiment of the present invention, after searching for information about whether there is a so dynamic library, it also includes:

[0019] If the information of the so dynamic library is found, the file information of the dynamic linker is read from the disk, the elf file is parsed, and the installable segment data with execution permission is saved to the memory and recorded as the first variable;

[0020] Read each row of data whose last column in the memory information of the target process is empty, and check whether the buffer memory contains the data specified by the first variable;

[0021] If the data specified by the first variable is included, information indicating that two or more dynamic linkers are detected is determined.

[0022] Preferably, in the above-mentioned executable file injection detection method provided by the embodiment of the present invention, the step of reading the installation segment data with execution permission into the memory includes:

[0023] Determine whether the executable attribute of the dynamic linker is the data of the PT_LOAD segment;

[0024] If so, the installable segment data with execution permission in the dynamic linker is saved to the memory.

[0025] Preferably, in the above-mentioned executable file injection detection method provided by the embodiment of the present invention, it also includes:

[0026] All processes are processed in a loop, and after all processes are detected, the detection result information is output.

[0027] The embodiment of the present invention further provides a detection device for executable file injection, comprising:

[0028] Memory information search module, used to search the memory information of the target process;

[0029] A dynamic linker detection module, used to detect whether there is information of more than two dynamic linkers in the memory information of the target process;

[0030] The determination module is used to determine that the target process has been infected with a Trojan virus injected into a dynamically linked executable file when information of more than two dynamic linkers is detected.

[0031] An embodiment of the present invention further provides an executable file injection detection device, comprising a processor and a memory, wherein the processor implements the above-mentioned executable file injection detection method provided by the embodiment of the present invention when executing a computer program stored in the memory.

[0032] An embodiment of the present invention further provides a computer-readable storage medium for storing a computer program, wherein when the computer program is executed by a processor, the above-mentioned executable file injection detection method provided by the embodiment of the present invention is implemented.

[0033] It can be seen from the above technical scheme that the present invention provides a method for detecting executable file injection, including: searching the memory information of the target process; detecting whether there is information of more than two dynamic linkers in the memory information of the target process; when information of more than two dynamic linkers is detected, determining that the target process has been infected with a Trojan virus injected by a dynamically linked executable file.

[0034] The above detection method provided by the present invention can scan the system process in real time and instantly detect whether the memory of the target process has been injected with a Trojan virus of a "dynamically linked executable file". It is highly targeted at such Trojan viruses, does not require feature code data of the Trojan virus, has wide adaptability and high detection efficiency.

[0035] In addition, the present invention also provides corresponding devices, equipment and computer-readable storage media for the detection method of executable file injection, which further makes the above method more practical. The device, equipment and computer-readable storage medium have corresponding advantages. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0037] Figure 1 A flowchart of a method for detecting executable file injection provided by an embodiment of the present invention;

[0038] Figure 2 A schematic diagram of the structure of an executable file injection detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0039] There are many methods in the prior art that can infect the memory of a running process, and put a Trojan virus into the target process for covert operation, such as injecting a so dynamic library into the process, injecting a shellcode into the process, injecting a dynamically linked executable file into the process, etc. The detection technology for each infection method is different. The embodiment of the present invention provides a method for real-time detection of whether a process in a Linux system is infected with "dynamically linked executable file injection".

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] The present invention provides a method for detecting executable file injection, such as Figure 1 As shown, the following steps are included:

[0042] S101, running the target process;

[0043] S102, searching memory information of the target process;

[0044] S103, detecting whether there is information of more than two dynamic linkers in the memory information of the target process;

[0045] If information of more than two dynamic linkers is detected, step S104 is executed;

[0046] S104: Determine that the target process has been infected with a Trojan virus injected into a dynamically linked executable file.

[0047] In actual applications, the dynamic linker is responsible for loading the dynamic libraries required by the executable file, relocating them, and handing over control to the entry address of the executable file to complete the startup of the executable file. A dynamically linked executable file means that the executable file depends on other dynamic libraries, such as ld.so, libc.so, etc. The dependent dynamic libraries will be loaded when the executable file is started.

[0048] It is important to understand that the way attackers inject dynamically linked executable files into the target process's memory and run them is usually to execute a shellcode in the target process through system vulnerabilities or the ptrace method. The main functions of this shellcode are as follows:

[0049] First, load the dynamic linker into the target process memory; for example: / lib64 / ld-linux-x86-64.so.2;

[0050] Then, the Trojan virus is written into the target process memory; the Trojan virus can be downloaded from the Internet and written directly into the memory after downloading; the Trojan virus can also be part of the shellcode, and the Trojan virus can be decrypted in the memory;

[0051] After that, create a stack (using mmap); prepare stack-related information (argc, argv, envp, auxiliary vector, etc.), and write the Trojan’s related information in memory into the auxiliary vector (including the Trojan’s address in memory, the program segment header address, the number of program segments, the Trojan’s running entry address, etc.);

[0052] Finally, the control is handed over to the entry point of the dynamic linker; then the dynamic linker will load other so libraries required by the Trojan, and then hand over the control to the entry address of the Trojan. During the whole process, the Trojan is in the memory and there will be no information on the file system.

[0053] Since the above-mentioned method requires a dynamic linker, such as " / lib64 / ld-linux-x86-64.so.2", to inject a dynamically linked executable file, the target process will have an additional dynamic linker memory information, while a normal program will only have one dynamic linker information after startup. Therefore, the detection method provided by the present invention first searches the memory information of the target process. If more than two dynamic linkers are found, it indicates that there is an abnormal injection situation, thereby judging that the target process is infected with a Trojan virus.

[0054] In the above-mentioned executable file injection detection method provided in the embodiment of the present invention, the system process can be scanned in real time, and whether the memory of the target process is injected with a Trojan virus of a "dynamically linked executable file" can be immediately detected. It is highly targeted at such Trojan viruses, does not require the feature code data of the Trojan virus, has wide adaptability, and high detection efficiency.

[0055] Furthermore, in a specific implementation, in the above-mentioned executable file injection detection method provided in an embodiment of the present invention, step S102 searches for memory information of the target process, which may specifically include:

[0056] Traverse the / proc directory; the subdirectories named with numbers in this directory are the pids of the processes currently running in the system;

[0057] Check / proc / <pid> / maps file exists;

[0058] If it exists, read / proc / <pid>The memory information of the target process recorded in the / maps file.

[0059] That is to say, after the process runs, it will be in " / proc / process <pid>The " / maps" file records the memory loading information of the process. By analyzing this file, we can find out whether there is any executable file injection.

[0060] Specifically, read / proc / <pid>The memory information of the target process recorded in the / maps file can include:

[0061] Find the line whose second column is rwxp or r-xp (x means executable) and whose last column is blank, record it as maps_a.

[0062] Find the line whose second column is rwxp or r-xp (x means executable) and ends with something like "ld-2.27.so" and record it as maps_b.

[0063] That is, the second column contains executable data, and the last column is empty or displays a message ending with the dynamic linker file path, which are recorded separately.

[0064] The " / lib / x86_64-linux-gnu / ld-2.27.so" displayed is the location of the dynamic linker file used by the current system. You can use the command: ls -lh / lib64 / ld-linux-x86-64.so.2 to get the actual dynamic linker location.

[0065] The above maps_a and maps_b information is the memory information that may exist in the dynamic linker.

[0066] In specific implementation, in the above-mentioned executable file injection detection method provided by the embodiment of the present invention, step S103 detects whether there is information of more than two dynamic linkers in the memory information of the target process, which may specifically include:

[0067] Check whether the total number of lines corresponding to the information ending with the dynamic linker file path in the last column of the memory information of the target process exceeds 1; that is, determine whether the number of lines of maps_b found is greater than 1;

[0068] If it exceeds 1, it is determined that information of two or more dynamic linkers is detected.

[0069] It should be noted that, if a Trojan is injected, a dynamic linker loaded in a file mapping manner will display a message ending with the dynamic linker file path in the last column, and it can be determined that a Trojan is injected. After detecting information of more than two dynamic linkers, this detection ends, and the process returns to step S101 to start detecting the next process.

[0070] If it does not exceed 1, the memory range specified by all rows whose last column in the target process's memory information is empty is searched to find out whether there is information about the so dynamic library, so as to detect whether there are more than two dynamic linker information.

[0071] It should be noted that if the number of rows in maps_b is <= 1, it is necessary to search the memory range specified by the rows in maps_a to find out whether there is information such as the ld.so library. Because when injecting the Trojan, if the dynamic linker is anonymously mapped to the memory, the last column will be empty.

[0072] Furthermore, in a specific implementation, in the above-mentioned executable file injection detection method provided in the embodiment of the present invention, after searching for information about whether there is a so dynamic library, the following may also be included:

[0073] First, if the information of the so dynamic library is found, the file information of the dynamic linker ( / lib64 / ld-linux-x86-64.so.2) is read from the disk, the elf file is parsed, and the installable segment data with execution permission is saved to the memory, recorded as the first variable, such as ld_flag_data. Specifically, reading the installable segment data with execution permission into the memory can include: determining whether the executable attribute of the dynamic linker is the data of the PT_LOAD segment; if so, saving the installable segment data with execution permission in the dynamic linker to the memory. The pseudo code is as follows:

[0074]

[0075] Then, each row of data whose last column in the memory information of the target process is empty is read to find out whether the buffer memory contains the data specified by the first variable; if it contains the data specified by the first variable, it is determined that information of more than two dynamic linkers is detected.

[0076] Specifically, read the data of each line of maps_a, such as reading the data in the memory address range of "7fc2981c0000-7fc2981c2000". Use the process_vm_readv function to read the memory data of the specified process. The pseudo code is as follows:

[0077]

[0078] void*address=0x7fc2981c0000;

[0079] size_t len=0x7fc2981c2000-0x7fc2981c0000;

[0080] uint8_t*buffer=malloc(len);

[0081] remote_process_vm_readv(5484,address,buffer,len);

[0082] Check whether the buffer memory contains the data specified by the ld_flag_data variable; if it contains the data of the ld_flag_data variable, it means that this memory segment is the memory segment of the dynamic linker, and is the memory information of an illegally loaded dynamic link. Thus, the information of more than two dynamic linkers is detected, and it is determined that this process has been injected with a Trojan virus. This detection is completed, and the process returns to step S101 to start detecting the next process.

[0083] Finally, all processes are processed in a loop, and after all processes are detected, the detection result information is output.

[0084] Based on the same inventive concept, an embodiment of the present invention also provides a detection device for executable file injection. Since the principle of solving the problem by the device is similar to that of the aforementioned detection method for executable file injection, the implementation of the device can refer to the implementation of the detection method for executable file injection, and the repeated parts will not be repeated.

[0085] In a specific implementation, the detection device for executable file injection provided by the embodiment of the present invention is as follows: Figure 2 As shown, specifically including:

[0086] A memory information search module 11, used to search the memory information of the target process;

[0087] A dynamic linker detection module 12 is used to detect whether there is information of more than two dynamic linkers in the memory information of the target process;

[0088] The determination module 13 is used to determine that the target process has been infected with a Trojan virus injected into the dynamically linked executable file when information of more than two dynamic linkers is detected.

[0089] In the above-mentioned executable file injection detection device provided in the embodiment of the present invention, the system process can be scanned in real time through the interaction of the above-mentioned three modules, and whether the memory of the target process is injected with a Trojan virus of a "dynamically linked executable file" can be immediately detected. It is highly targeted at such Trojan viruses, does not require the feature code data of the Trojan virus, has wide adaptability, and high detection efficiency.

[0090] For more specific working processes of the above modules, please refer to the corresponding contents disclosed in the above embodiments, which will not be repeated here.

[0091] Correspondingly, an embodiment of the present invention further discloses an executable file injection detection device, comprising a processor and a memory; wherein the executable file injection detection method disclosed in the above embodiment is implemented when the processor executes a computer program stored in the memory.

[0092] For more specific processes of the above method, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0093] Furthermore, the present invention also discloses a computer-readable storage medium for storing a computer program; when the computer program is executed by a processor, the above-disclosed method for detecting injection of executable files is implemented.

[0094] For more specific processes of the above method, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0095] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the devices, equipment, and storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part.

[0096] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0097] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0098] In summary, an embodiment of the present invention provides a method for detecting executable file injection, comprising: searching the memory information of the target process; detecting whether there is information of more than two dynamic linkers in the memory information of the target process; when information of more than two dynamic linkers is detected, determining that the target process has been infected with a Trojan virus injected by a dynamically linked executable file. The above detection method can scan the system process in real time, and instantly detect whether the memory of the target process has been injected with a Trojan virus of a "dynamically linked executable file". It has strong pertinence for such Trojan viruses, does not require feature code data of the Trojan virus, has wide adaptability, and has high detection efficiency. In addition, the present invention also provides a corresponding device, equipment, and computer-readable storage medium for the detection method of executable file injection, which further makes the above method more practical, and the device, equipment, and computer-readable storage medium have corresponding advantages.

[0099] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0100] The above is a detailed introduction to the detection method, device, equipment and storage medium for executable file injection provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.< / pid> < / pid> < / pid> < / pid> < / pid> < / pid>

Claims

1. A method for detecting executable file injection, characterized in that: include: Traverse the / proc directory; The subdirectories named with numbers in the directory are the pids of the processes currently running in the system; Check / proc / <pid> / maps file exists; if it exists, read / proc / <pid> / maps The memory information of the target process recorded in the file;< / pid> < / pid> Detecting whether the total number of lines corresponding to information ending with a dynamic linker file path displayed in the last column of the memory information of the target process exceeds 1; If it exceeds 1, it is determined that information of more than two dynamic linkers is detected; When information of more than two dynamic linkers is detected, it is determined that the target process has been infected with a Trojan virus injected into the dynamically linked executable file; If it does not exceed 1, then search the memory intervals specified by all rows whose last column in the memory information of the target process is empty to find out whether there is information of the so dynamic library, so as to detect whether there are information of more than two dynamic linkers; If the information of the so dynamic library is found, the file information of the dynamic linker is read from the disk, the elf file is parsed, and the installable segment data with execution permission is saved to the memory and recorded as the first variable; Read each row of data whose last column in the memory information of the target process is empty, and check whether the buffer memory contains the data specified by the first variable; If the data specified by the first variable is included, information indicating that two or more dynamic linkers are detected is determined.

2. The method for detecting executable file injection according to claim 1, characterized in that: The step of saving the installable segment data with execution permission to the memory includes: Determine whether the executable attribute of the dynamic linker is the data of the PT_LOAD segment; If so, the installable segment data with execution permission in the dynamic linker is saved to the memory.

3. The method for detecting executable file injection according to claim 2, characterized in that: Also includes: All processes are processed in a loop, and after all processes are detected, the detection result information is output.

4. A detection device for executable file injection, characterized in that: include: Memory information search module, used to traverse the / proc directory; The subdirectories named with numbers in the directory are the pids of the processes currently running in the system; check / proc / <pid> / maps file exists; if it exists, read / proc / <pid> / maps The memory information of the target process recorded in the file;< / pid> < / pid> A dynamic linker detection module, used to detect whether the total number of lines corresponding to the information ending with the dynamic linker file path displayed in the last column of the memory information of the target process exceeds 1; If it exceeds 1, it is determined that information of more than two dynamic linkers is detected; If it does not exceed 1, then search the memory intervals specified by all the rows whose last column in the memory information of the target process is empty to find out whether there is information about the so dynamic library, so as to detect whether there is information about more than two dynamic linkers; if the information about the so dynamic library is found, read the file information of the dynamic linker from the disk, parse the elf file, save the installable segment data with execution permission to the memory, and record it as the first variable; read each row of data whose last column in the memory information of the target process is empty, and find out whether the buffer memory contains the data specified by the first variable; if it contains the data specified by the first variable, it is determined that the information of more than two dynamic linkers is detected; The determination module is used to determine that the target process has been infected with a Trojan virus injected into a dynamically linked executable file when information of more than two dynamic linkers is detected.

5. A detection device for executable file injection, characterized in that: The method comprises a processor and a memory, wherein the processor implements the method for detecting executable file injection as claimed in any one of claims 1 to 3 when executing a computer program stored in the memory.

6. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the method for detecting executable file injection according to any one of claims 1 to 3 is implemented.

Images