IP address tracing method and device

Abstract

The present application discloses an IP address tracing method and device, and relates to the technical field of terminal equipment. The method of the present application includes: according to the target process start request, determining the target process that responds to the target process start request; when it is detected that the target process triggers a preset sensitive behavior operation, obtaining the memory address of the thread environment information block TEB corresponding to the target thread, wherein the target thread is the currently executed thread in the target process; according to the memory address corresponding to the TEB, identifying whether the target process start request is a remote procedure call protocol request; if so, searching for the IP address information and port number information corresponding to the target process start request based on the memory address corresponding to the TEB.

Description

Technical Field

[0001] The present application relates to the technical field of terminal equipment, and in particular to an IP address tracing method and device. Background Art

[0002] At present, process legitimacy detection is usually based on whitelist technology and parent-child process relationship chain. That is, when a process is detected to trigger a preset sensitive behavior operation, the whitelist is used to determine whether the process contains whitelist process characteristics. If the process is determined not to contain whitelist process characteristics, the process is determined to be an illegal process. If the process is determined to contain whitelist process characteristics, the parent process of the process is searched according to the parent-child process relationship chain, and the whitelist is used to determine whether the parent process of the process contains whitelist process characteristics. If the parent process of the process is determined not to contain whitelist process characteristics, the process is determined to be an illegal process. If the parent process of the process is determined to contain whitelist process characteristics, the process is determined to be a legal process and released.

[0003] However, when the terminal device responds to a remote RPC request and starts an existing process or creates and starts a new process, the existing process or new process started is specifically a child process of the DCOM service process, which belongs to the system process. Since the whitelist technology assumes that the system process is a legitimate process by default, when the existing process or new process started by the remote RPC request triggers a preset sensitive behavior operation, the process that triggers the preset sensitive behavior operation will be directly released, making it impossible to trace the IP address information and port number information of the sender of the remote RPC request. Summary of the invention

[0004] An embodiment of the present application provides an IP address tracing method and device, the main purpose of which is to find the IP address information and port number information of the sender of the remote RPC request when it is determined that the process that triggers the preset sensitive behavior operation is a process started in response to a remote RPC request.

[0005] In order to solve the above technical problems, the embodiments of the present application provide the following technical solutions:

[0006] In a first aspect, the present application provides an IP address tracing method, the method comprising:

[0007] Determine, according to the target process start request, a target process that responds to the target process start request;

[0008] When it is detected that the target process triggers a preset sensitive behavior operation, the memory address of the thread environment information block TEB corresponding to the target thread is obtained, wherein the target thread is the thread currently executed in the target process;

[0009] Identify whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB;

[0010] If so, the IP address information and port number information corresponding to the target process startup request are searched based on the memory address corresponding to the TEB.

[0011] Optionally, before identifying whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB, the method further includes:

[0012] Obtaining a preset offset group corresponding to the current operating system, wherein the preset offset group includes a plurality of offsets and target field names, and the plurality of offsets and the target field names are used to determine whether the target process start request is a remote procedure call protocol request, and when it is determined that the target process start request is a remote procedure call protocol request, determine the IP address information and port number information corresponding to the target process start request;

[0013] The identifying, according to the memory address corresponding to the TEB, whether the target process start request is a remote procedure call protocol request includes:

[0014] Identify whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB and the preset offset group;

[0015] The searching for the IP address information and port number information corresponding to the target process startup request based on the memory address corresponding to the TEB includes:

[0016] The IP address information and port number information corresponding to the target process start request are searched based on the memory address corresponding to the TEB and the preset offset group.

[0017] Optionally, the preset offset group includes a target field name and a first offset; and identifying whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB and the preset offset group includes:

[0018] Searching the TEB in the memory according to the memory address corresponding to the TEB;

[0019] Searching for a target field in the TEB according to the target field name to obtain a memory address corresponding to the target field;

[0020] According to the memory address corresponding to the target field and the first offset, determining whether the object stored at the first memory address is the first object, wherein the first memory address is equal to the memory address corresponding to the target field plus the first offset;

[0021] If yes, determining that the target process start request is a remote procedure call protocol request;

[0022] If not, it is determined that the target process start request is a local procedure call protocol request.

[0023] Optionally, the preset offset group further includes a second offset, a third offset, a fourth offset, and a fifth offset; searching for the IP address information and the port number information corresponding to the target process startup request based on the memory address corresponding to the TEB and the preset offset group includes:

[0024] searching for a second object in the memory according to the first memory address and the second offset, wherein the memory address corresponding to the second object is equal to the first memory address plus the second offset;

[0025] When it is determined that the object stored at the second memory address is the third object according to the memory address corresponding to the second object and the third offset, searching for the IP address information and port number information corresponding to the target process start request according to the second memory address, the fourth offset and the first preset rule, wherein the second memory address is equal to the memory address corresponding to the second object plus the third offset;

[0026] When it is determined that the object stored at the second memory address is the fourth object based on the memory address corresponding to the second object and the third offset distance, the IP address information and port number information corresponding to the target process startup request are searched based on the second memory address, the fifth offset and the second preset rule.

[0027] Optionally, the first preset rule is: searching for a target structure in the memory according to the second memory address and the fourth offset, wherein the memory address corresponding to the target structure is equal to the second memory address plus the fourth offset; and searching for IP address information and port number information corresponding to the target process startup request in the target structure.

[0028] Optionally, the second preset rule is: searching for the target pipe handle in the memory according to the second memory address and the fifth offset, generating an IOCTL command according to the value of the target pipe handle and the preset value of the target parameter, and sending the IOCTL command to the named pipe file system by calling the target API function, so that the named pipe file system feeds back the IP address information and port number information corresponding to the target process start request, wherein the memory address corresponding to the target pipe handle is equal to the second memory address plus the fifth offset.

[0029] Optionally, after searching for the IP address information and port number information corresponding to the target process start request based on the memory address corresponding to the TEB, the method further includes:

[0030] Determine whether the target process is a legitimate process based on the IP address information, port number information and preset blacklist corresponding to the target process startup request; and / or determine whether the target process is a legitimate process based on the IP address information, port number information and preset whitelist corresponding to the target process startup request;

[0031] If the target process is determined to be a legitimate process, the target process is released;

[0032] If the target process is determined to be an illegal process, a preset prompt statement is output and displayed.

[0033] In a second aspect, the present application also provides an IP address tracing device, the device comprising:

[0034] A determination unit, configured to determine, according to the target process start request, a target process that responds to the target process start request;

[0035] A first acquisition unit is configured to acquire a memory address of a thread environment information block TEB corresponding to a target thread when it is detected that the target process triggers a preset sensitive behavior operation, wherein the target thread is a thread currently executed in the target process;

[0036] an identification unit, configured to identify whether the target process start request is a remote procedure call protocol request according to a memory address corresponding to the TEB;

[0037] A search unit is used to search for IP address information and port number information corresponding to the target process startup request based on a memory address corresponding to the TEB when the identification unit identifies that the target process startup request is a remote procedure call protocol request.

[0038] Optionally, the device further comprises:

[0039] a second acquisition unit, configured to acquire a preset offset group corresponding to the current operating system before the identification unit identifies whether the target process startup request is a remote procedure call protocol request according to the memory address corresponding to the TEB, wherein the preset offset group includes a plurality of offsets and target field names, and the plurality of offsets and the target field names are used to determine whether the target process startup request is a remote procedure call protocol request, and to determine IP address information and port number information corresponding to the target process startup request when it is determined that the target process startup request is a remote procedure call protocol request;

[0040] The identification unit is specifically used to identify whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB and the preset offset group;

[0041] The search unit is specifically used to search for the IP address information and port number information corresponding to the target process startup request based on the memory address corresponding to the TEB and the preset offset group.

[0042] Optionally, the preset offset group includes a target field name and a first offset; and the identification unit includes:

[0043] A first search module, configured to search the TEB in the memory according to the memory address corresponding to the TEB;

[0044] A second search module is used to search the target field in the TEB according to the target field name to obtain a memory address corresponding to the target field;

[0045] a judgment module, configured to judge whether the object stored at the first memory address is the first object according to the memory address corresponding to the target field and the first offset, wherein the first memory address is equal to the memory address corresponding to the target field plus the first offset;

[0046] a first determining module, configured to determine that the target process start request is a remote procedure call protocol request when the judging module determines that the object stored at the first memory address is a first object;

[0047] The second determination module is used to determine that the target process start request is a local procedure call protocol request when the judgment module determines that the object stored at the first memory address is not the first object.

[0048] Optionally, the preset offset group further includes a second offset, a third offset, a fourth offset and a fifth offset; and the search unit includes:

[0049] a third search module, configured to search for a second object in the memory according to the first memory address and the second offset, wherein the memory address corresponding to the second object is equal to the first memory address plus the second offset;

[0050] a fourth search module, configured to search for the IP address information and port number information corresponding to the target process startup request according to the second memory address, the fourth offset and the first preset rule when it is determined that the object stored at the second memory address is the third object according to the memory address corresponding to the second object and the third offset, wherein the second memory address is equal to the memory address corresponding to the second object plus the third offset;

[0051] The fifth search module is used to search for the IP address information and port number information corresponding to the target process startup request according to the second memory address, the fifth offset and the second preset rule when it is determined that the object stored at the second memory address is the fourth object according to the memory address corresponding to the second object and the third offset distance.

[0052] Optionally, the first preset rule is: searching for a target structure in the memory according to the second memory address and the fourth offset, wherein the memory address corresponding to the target structure is equal to the second memory address plus the fourth offset; and searching for IP address information and port number information corresponding to the target process startup request in the target structure.

[0053] Optionally, the second preset rule is: searching for the target pipe handle in the memory according to the second memory address and the fifth offset, generating an IOCTL command according to the value of the target pipe handle and the preset value of the target parameter, and sending the IOCTL command to the named pipe file system by calling the target API function, so that the named pipe file system feeds back the IP address information and port number information corresponding to the target process start request, wherein the memory address corresponding to the target pipe handle is equal to the second memory address plus the fifth offset.

[0054] Optionally, the device further comprises:

[0055] a judging unit, configured to judge whether the target process is a legitimate process according to the IP address information, port number information and a preset blacklist corresponding to the target process startup request after the searching unit searches for the IP address information and port number information corresponding to the target process startup request based on the memory address corresponding to the TEB; and / or judge whether the target process is a legitimate process according to the IP address information, port number information and a preset whitelist corresponding to the target process startup request;

[0056] a release unit, configured to release the target process when the determination unit determines that the target process is a legitimate process;

[0057] The output unit is used to output and display a preset prompt statement when the judgment unit determines that the target process is an illegal process.

[0058] In a third aspect, an embodiment of the present application provides a storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the IP address tracing method described in the first aspect.

[0059] In a fourth aspect, an embodiment of the present application provides an IP address tracing device, which includes a storage medium; and one or more processors, wherein the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the IP address tracing method described in the first aspect is executed.

[0060] By means of the above technical solution, the technical solution provided by this application has at least the following advantages:

[0061] The present application provides an IP address tracing method and device. The present application can monitor in real time whether the target process triggers a preset sensitive behavior operation after the IP address tracing application determines that the process started by the target terminal device in response to the target process start request is specifically the target process; when it is detected that the target process triggers the preset sensitive behavior operation, the memory address of the TEB corresponding to the target thread is obtained, and according to the memory address of the TEB corresponding to the target thread, it is identified whether the target process start request is a remote RPC request; and when it is identified that the target process start request is a remote RPC request, the IP address information and port number information corresponding to the target process start request are searched based on the memory address of the TEB corresponding to the target thread, so that when it is determined that the process that triggers the preset sensitive behavior operation is a process started in response to the remote RPC request, the IP address information and port number information of the sender of the remote RPC request can be traced.

[0062] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] By reading the detailed description below with reference to the accompanying drawings, the above and other purposes, features and advantages of the exemplary embodiments of the present application will become easy to understand. In the accompanying drawings, several embodiments of the present application are shown in an exemplary and non-limiting manner, and the same or corresponding reference numerals represent the same or corresponding parts, wherein:

[0064] Figure 1 A flow chart of an IP address tracing method provided in an embodiment of the present application is shown;

[0065] Figure 2 Another method flow chart of tracing the source of an IP address provided by an embodiment of the present application is shown;

[0066] Figure 3 A block diagram showing the composition of an IP address tracing device provided in an embodiment of the present application is shown;

[0067] Figure 4A block diagram showing the composition of another IP address tracing device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0068] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0069] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in this application should have the common meanings understood by technicians in the field to which this application belongs.

[0070] The present application embodiment provides an IP address tracing method, such as Figure 1 As shown, the method includes:

[0071] 101. According to the target process start request, determine a target process that responds to the target process start request.

[0072] In the embodiment of the present application, the execution subject in each step is an IP address tracing application running in the target terminal device, wherein the target terminal device can be but is not limited to: a computer, a server, etc.

[0073] In the embodiment of the present application, when the target process has been created in the target terminal device, the target terminal device will directly start the target process after responding to the target process start request; when the target process has not been created in the target terminal device, the target terminal device will create the target process and start the target process after responding to the target process start request. Therefore, the IP address tracing application can determine that the process started by the target terminal device in response to the target process start request is specifically the target process according to the target process start request.

[0074] 102. When it is detected that the target process triggers a preset sensitive behavior operation, the memory address of the thread environment information block corresponding to the target thread is obtained.

[0075] The preset sensitive behavior operation may include but is not limited to: creating a process, creating a file, modifying a registry, etc.; wherein the target thread is the currently executing thread in the target process.

[0076] In an embodiment of the present application, when the IP address tracing application determines that the target terminal device responds to the target process start request and the started process is specifically the target process, it is necessary to monitor in real time whether the target process triggers preset sensitive behavior operations; when it is detected that the target process triggers preset sensitive behavior operations, the IP address tracing application needs to obtain the memory address of the thread environment information block (TEB, Thread Environment Block) corresponding to the target thread.

[0077] 103. Identify whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB.

[0078] In an embodiment of the present application, after obtaining the memory address of the TEB corresponding to the target thread, the IP address tracing application can identify whether the target process startup request is a Remote Procedure Call Protocol (RPC) request based on the memory address of the TEB corresponding to the target thread.

[0079] 104. If yes, search the IP address information and port number information corresponding to the target process startup request based on the memory address corresponding to the TEB.

[0080] In an embodiment of the present application, when the target process startup request is identified as a remote RPC request, the IP address tracing application needs to find the IP address information and port number information corresponding to the target process startup request based on the memory address of the TEB corresponding to the target thread.

[0081] An embodiment of the present application provides an IP address tracing method. When an IP address tracing application determines that the process started by a target terminal device in response to a target process start request is specifically the target process, the embodiment of the present application can monitor in real time whether the target process triggers a preset sensitive behavior operation; when it is detected that the target process triggers a preset sensitive behavior operation, the memory address of the TEB corresponding to the target thread is obtained, and according to the memory address of the TEB corresponding to the target thread, it is identified whether the target process start request is a remote RPC request; and when it is identified that the target process start request is a remote RPC request, the IP address information and port number information corresponding to the target process start request are searched based on the memory address of the TEB corresponding to the target thread, so that when it is determined that the process triggering the preset sensitive behavior operation is a process started in response to a remote RPC request, the IP address information and port number information of the sender of the remote RPC request can be traced.

[0082] To explain in more detail below, the present application embodiment provides another IP address tracing method, as follows Figure 2 As shown, the method includes:

[0083] 201. According to the target process start request, determine a target process that responds to the target process start request.

[0084] Regarding step 201, determining a target process that responds to the target process start request according to the target process start request, reference may be made to Figure 1 The description of the corresponding parts will not be repeated here in the embodiments of the present application.

[0085] 202. When it is detected that the target process triggers a preset sensitive behavior operation, the memory address of the thread environment information block corresponding to the target thread is obtained.

[0086] Among them, regarding step 202, when it is detected that the target process triggers a preset sensitive behavior operation, the memory address of the thread environment information block corresponding to the target thread is obtained, which can be referred to Figure 1 The description of the corresponding parts will not be repeated here in the embodiments of the present application.

[0087] 203. Obtain a preset offset group corresponding to the current operating system.

[0088] Among them, the preset offset group includes multiple offsets and target field names, the target field name is specifically: ReserveForNtRpc, and the multiple offsets specifically include: a first offset, a second offset, a third offset, a fourth offset, a fifth offset and a sixth offset; the multiple offsets and target field names are used to determine whether the target process startup request is a remote procedure call protocol request, and when it is determined that the target process startup request is a remote procedure call protocol request, determine the IP address information and port number information corresponding to the target process startup request.

[0089] In an embodiment of the present application, the preset offset groups corresponding to different operating systems are not the same; the IP address tracing application needs to obtain the preset offset group corresponding to the operating system currently running on the target terminal device (i.e., the current operating system), so as to subsequently identify whether the target process startup request is a remote RPC request based on the preset offset group corresponding to the current operating system of the target terminal device, and after identifying that the target process startup request is a remote RPC request, based on the preset offset group corresponding to the current operating system of the target terminal device, search for the IP address information and port number information corresponding to the target process startup request.

[0090] 204. Identify whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB and the preset offset group.

[0091] In an embodiment of the present application, after obtaining the preset offset group corresponding to the current operating system of the target terminal device, the IP address tracing application can identify whether the target process startup request is a remote RPC request based on the memory address of the TEB corresponding to the target thread and the preset offset group corresponding to the current operating system of the target terminal device.

[0092] Specifically, in this step, the IP address tracing application can identify whether the target process start request is a remote RPC request according to the memory address of the TEB corresponding to the target thread and the preset offset group corresponding to the current operating system of the target terminal device in the following manner:

[0093] First, according to the memory address of the TEB corresponding to the target thread, the TEB corresponding to the target thread is searched in the memory; secondly, according to the target field name, the target field is searched in the TEB corresponding to the target thread to obtain the memory address corresponding to the target field, wherein the memory address where the target field is stored is the memory address corresponding to the target field; thirdly, according to the memory address corresponding to the target field and the first offset, it is determined whether the object stored at the first memory address is the first object, wherein the first memory address is equal to the memory address corresponding to the target field plus the first offset, and the first object is specifically: OSF_SCALL object; when it is determined that the object stored at the first memory address is the first object, it is determined that the target process start request is a remote RPC request; when it is determined that the object stored at the first memory address is not the first object but an LRPC_CCALL object, it is determined that the target process start request is a local RPC request.

[0094] It should be noted that, in actual application, when it is determined that the target process startup request is a local RPC request, the CLIENT_ID structure can be first searched in the memory according to the first memory address and the sixth offset (that is, the memory address corresponding to the CLIENT_ID structure is first determined according to the first memory address and the sixth offset, and then the CLIENT_ID structure is searched in the memory according to the memory address corresponding to the CLIENT_ID structure, wherein the memory address corresponding to the CLIENT_ID structure is equal to the first memory address plus the sixth offset, and the memory address where the CLIENT_ID structure is stored is the memory address corresponding to the CLIENT_ID structure); then the process ID information and thread ID corresponding to the target process startup request are searched in the CLIENT_ID structure, wherein the CLIENT_ID structure only stores the process ID information and thread ID corresponding to the target process startup request.

[0095] 205. If yes, search for the IP address information and port number information corresponding to the target process startup request based on the memory address corresponding to the TEB and the preset offset group.

[0096] In an embodiment of the present application, when the target process startup request is identified as a remote RPC request, the IP address tracing application needs to search for the IP address information and port number information corresponding to the target process startup request based on the memory address of the TEB corresponding to the target thread and the preset offset group corresponding to the current operating system of the target terminal device.

[0097] Specifically, in this step, the IP address tracing application can use the following method to find the IP address information and port number information corresponding to the target process startup request based on the memory address of the TEB corresponding to the target thread and the preset offset group corresponding to the current operating system of the target terminal device:

[0098] 1. Search for a second object in memory according to the first memory address and the second offset.

[0099] Among them, the first memory address is determined by the IP address tracing application in step 204 according to the memory address of the TEB corresponding to the target thread; the memory address corresponding to the second object is equal to the first memory address plus the second offset, and the memory address where the second object is stored is the memory address corresponding to the second object; the second object is specifically: SFSCONN object.

[0100] In the embodiment of the present application, the memory address corresponding to the second object is first determined according to the first memory address and the second offset, and then the second object is searched in the memory according to the memory address corresponding to the second object.

[0101] 2a. When it is determined that the object stored at the second memory address is the third object according to the memory address corresponding to the second object and the third offset, the IP address information and port number information corresponding to the target process startup request are searched according to the second memory address, the fourth offset and the first preset rule, wherein the third object is specifically: OSFSCONNADDRESS object, and the second memory address is equal to the memory address corresponding to the second object plus the third offset; the first preset rule is specifically: first, the target structure is searched in the memory according to the second memory address and the fourth offset, that is, the memory address corresponding to the target structure is first determined according to the second memory address and the fourth offset, and then the target structure is searched in the memory according to the memory address corresponding to the target structure, wherein the target structure is specifically a sockaddr_in structure, the memory address corresponding to the target structure is equal to the second memory address plus the fourth offset, and the memory address where the target structure is stored is the memory address corresponding to the target structure; secondly, the IP address information and port number information corresponding to the target process startup request are searched in the target structure, wherein the IP address information and port number information corresponding to the target process startup request are stored at a fixed position in the target structure.

[0102] 2b. When it is determined that the object stored at the second memory address is the fourth object according to the memory address corresponding to the second object and the third offset distance, the IP address information and port number information corresponding to the target process startup request are searched according to the second memory address, the fifth offset and the second preset rule, wherein the fourth object is specifically: NMP_CONNECTION object; the second preset rule is specifically: first, the target pipe handle is searched in the memory according to the second memory address and the fifth offset, that is, the memory address corresponding to the target pipe handle is first determined according to the second memory address and the fifth offset, and then the target pipe handle is searched in the memory according to the memory address corresponding to the target pipe handle, wherein the memory address corresponding to the target pipe handle is equal to the second memory address plus the fifth offset, and the memory address where the target pipe handle is stored is the memory address corresponding to the target pipe handle; secondly, an IOCTL command is generated according to the value of the target pipe handle and the preset value of the target parameter, and the generated IOCTL command is sent to the named pipe file system by calling the target API function, so that the named pipe file system feeds back the IP address information and port number information corresponding to the target process startup request, wherein the target parameter is specifically: AttributeName, and the preset value of the target parameter is specifically: Client ComputerName, the target API function is: NtFsControlFile function.

[0103] Furthermore, in an embodiment of the present application, after the IP address tracing application program finds the IP address information and port number information corresponding to the target process startup request based on the memory address of the TEB corresponding to the target thread and the preset offset group corresponding to the current operating system of the target terminal device, it can also determine whether the target process is a legitimate process based on the IP address information, port number information and preset blacklist corresponding to the target process startup request, and / or determine whether the target process is a legitimate process based on the IP address information, port number information and preset whitelist corresponding to the target process startup request, wherein the preset whitelist stores multiple legitimate IP addresses and the port number corresponding to each legitimate IP address. When the IP address information, port number information and preset blacklist corresponding to the target process startup request are When the slogan information matches a legal IP address in the preset whitelist and the port number corresponding to the legal IP address, the target process is determined to be a legal process. The preset blacklist stores multiple illegal IP addresses and the port number corresponding to each illegal IP address. When the IP address information and port number information corresponding to the target process startup request match an illegal IP address in the preset blacklist and the port number corresponding to the illegal IP address, the target process is determined to be an illegal process. When the target process is determined to be a legal process, the IP address tracing application can release the target process. When the target process is determined to be an illegal process, the IP address tracing application needs to output and display a preset prompt statement, and the preset prompt statement is used to prompt the user that the target process is an illegal process.

[0104] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an embodiment of the present application further provides a storage medium, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned IP address tracing method.

[0105] In order to achieve the above-mentioned purpose, according to another aspect of the present application, an embodiment of the present application also provides an IP address tracing device, which includes a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the above-mentioned IP address tracing method is executed.

[0106] Furthermore, as a response to the above Figure 1 and Figure 2 In order to realize the method shown, another embodiment of the present application further provides an IP address tracing device. This device embodiment corresponds to the aforementioned method embodiment. For ease of reading, this device embodiment will no longer repeat the details of the aforementioned method embodiment, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. This device is used to find the IP address information and port number information of the sender of the remote RPC request when it is determined that the process that triggers the preset sensitive behavior operation is a process started in response to a remote RPC request. Specifically, Figure 3 As shown, the device comprises:

[0107] A determination unit 31 is used to determine a target process that responds to the target process start request according to the target process start request;

[0108] A first acquisition unit 32 is configured to acquire a memory address of a thread environment information block TEB corresponding to a target thread when it is detected that the target process triggers a preset sensitive behavior operation, wherein the target thread is a thread currently executed in the target process;

[0109] An identification unit 33, configured to identify whether the target process start request is a remote procedure call protocol request according to a memory address corresponding to the TEB;

[0110] The searching unit 34 is used to search for the IP address information and port number information corresponding to the target process startup request based on the memory address corresponding to the TEB when the identifying unit 33 identifies that the target process startup request is a remote procedure call protocol request.

[0111] Further, such as Figure 4 As shown, the device also includes:

[0112] a second acquisition unit 35, configured to acquire a preset offset group corresponding to the current operating system before the identification unit 33 identifies whether the target process startup request is a remote procedure call protocol request according to the memory address corresponding to the TEB, wherein the preset offset group includes a plurality of offsets and target field names, and the plurality of offsets and the target field names are used to determine whether the target process startup request is a remote procedure call protocol request, and to determine the IP address information and port number information corresponding to the target process startup request when it is determined that the target process startup request is a remote procedure call protocol request;

[0113] An identification unit 33, specifically configured to identify whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB and the preset offset group;

[0114] The search unit 34 is specifically configured to search for the IP address information and port number information corresponding to the target process start request based on the memory address corresponding to the TEB and the preset offset group.

[0115] Further, such as Figure 4 As shown, the preset offset group includes a target field name and a first offset; the identification unit 33 includes:

[0116] A first search module 331, configured to search the TEB in the memory according to the memory address corresponding to the TEB;

[0117] A second search module 332 is used to search the target field in the TEB according to the target field name to obtain a memory address corresponding to the target field;

[0118] A judgment module 333, configured to judge whether the object stored at the first memory address is the first object according to the memory address corresponding to the target field and the first offset, wherein the first memory address is equal to the memory address corresponding to the target field plus the first offset;

[0119] A first determination module 334, configured to determine that the target process start request is a remote procedure call protocol request when the determination module 333 determines that the object stored at the first memory address is the first object;

[0120] The second determination module 335 is used to determine that the target process start request is a local procedure call protocol request when the judgment module 333 determines that the object stored at the first memory address is not the first object.

[0121] Further, such as Figure 4 As shown, the preset offset group further includes a second offset, a third offset, a fourth offset and a fifth offset; the search unit 34 includes:

[0122] A third search module 341, configured to search for a second object in the memory according to the first memory address and the second offset, wherein the memory address corresponding to the second object is equal to the first memory address plus the second offset;

[0123] a fourth search module 342, configured to search for the IP address information and port number information corresponding to the target process start request according to the second memory address, the fourth offset, and the first preset rule when it is determined that the object stored at the second memory address is the third object according to the memory address corresponding to the second object and the third offset, wherein the second memory address is equal to the memory address corresponding to the second object plus the third offset;

[0124] The fifth search module 343 is used to search for the IP address information and port number information corresponding to the target process startup request according to the second memory address, the fifth offset and the second preset rule when it is determined that the object stored at the second memory address is the fourth object according to the memory address corresponding to the second object and the third offset distance.

[0125] Further, such as Figure 4 As shown, the first preset rule is: searching for a target structure in the memory according to the second memory address and the fourth offset, wherein the memory address corresponding to the target structure is equal to the second memory address plus the fourth offset; searching for IP address information and port number information corresponding to the target process startup request in the target structure.

[0126] Further, such as Figure 4 As shown, the second preset rule is: searching for the target pipe handle in the memory according to the second memory address and the fifth offset, generating an IOCTL command according to the value of the target pipe handle and the preset value of the target parameter, and sending the IOCTL command to the named pipe file system by calling the target API function, so that the named pipe file system feeds back the IP address information and port number information corresponding to the target process start request, wherein the memory address corresponding to the target pipe handle is equal to the second memory address plus the fifth offset.

[0127] Further, such as Figure 4 As shown, the device also includes:

[0128] A judging unit 36 ​​is configured to judge whether the target process is a legitimate process according to the IP address information, port number information and a preset blacklist corresponding to the target process startup request after the searching unit 34 searches for the IP address information and port number information corresponding to the target process startup request based on the memory address corresponding to the TEB; and / or judge whether the target process is a legitimate process according to the IP address information, port number information and a preset whitelist corresponding to the target process startup request;

[0129] A release unit 37, configured to release the target process when the determination unit 36 ​​determines that the target process is a legitimate process;

[0130] The output unit 38 is used to output and display a preset prompt statement when the determination unit 36 ​​determines that the target process is an illegal process.

[0131] An embodiment of the present application provides an IP address tracing method and device. The embodiment of the present application can monitor in real time whether the target process triggers a preset sensitive behavior operation after the IP address tracing application determines that the process started by the target terminal device in response to the target process start request is specifically the target process; when it is detected that the target process triggers the preset sensitive behavior operation, the memory address of the TEB corresponding to the target thread is obtained, and according to the memory address of the TEB corresponding to the target thread, it is identified whether the target process start request is a remote RPC request; and when it is identified that the target process start request is a remote RPC request, the IP address information and port number information corresponding to the target process start request are searched based on the memory address of the TEB corresponding to the target thread, so that when it is determined that the process triggering the preset sensitive behavior operation is a process started in response to the remote RPC request, the IP address information and port number information of the sender of the remote RPC request can be traced.

[0132] The IP address tracing device includes a processor and a memory. The above-mentioned determination unit, first acquisition unit, identification unit and search unit are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0133] The processor includes a kernel, which calls the corresponding program unit from the memory. The kernel can be set to one or more, and when it is determined that the process that triggers the preset sensitive behavior operation is a process started in response to a remote RPC request, by adjusting the kernel parameters, the IP address information and port number information of the sender of the remote RPC request are found.

[0134] An embodiment of the present application provides a storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned IP address tracing method.

[0135] The storage medium may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0136] An embodiment of the present application also provides an IP address tracing device, which includes a storage medium; and one or more processors, wherein the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the above-mentioned IP address tracing method is executed.

[0137] The embodiment of the present application provides a device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented:

[0138] Determine, according to the target process start request, a target process that responds to the target process start request;

[0139] When it is detected that the target process triggers a preset sensitive behavior operation, the memory address of the thread environment information block TEB corresponding to the target thread is obtained, wherein the target thread is the thread currently executed in the target process;

[0140] Identify whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB;

[0141] If so, the IP address information and port number information corresponding to the target process start request are searched based on the memory address corresponding to the TEB.

[0142] Furthermore, before identifying whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB, the method further includes:

[0143] Obtaining a preset offset group corresponding to the current operating system, wherein the preset offset group includes a plurality of offsets and target field names, and the plurality of offsets and the target field names are used to determine whether the target process start request is a remote procedure call protocol request, and when it is determined that the target process start request is a remote procedure call protocol request, determine the IP address information and port number information corresponding to the target process start request;

[0144] The step of identifying whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB includes:

[0145] Identify whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB and the preset offset group;

[0146] The searching for the IP address information and port number information corresponding to the target process startup request based on the memory address corresponding to the TEB includes:

[0147] The IP address information and port number information corresponding to the target process start request are searched based on the memory address corresponding to the TEB and the preset offset group.

[0148] Further, the preset offset group includes a target field name and a first offset; and identifying whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB and the preset offset group includes:

[0149] Searching the TEB in the memory according to the memory address corresponding to the TEB;

[0150] Searching for a target field in the TEB according to the target field name to obtain a memory address corresponding to the target field;

[0151] According to the memory address corresponding to the target field and the first offset, determining whether the object stored at the first memory address is the first object, wherein the first memory address is equal to the memory address corresponding to the target field plus the first offset;

[0152] If yes, determining that the target process start request is a remote procedure call protocol request;

[0153] If not, it is determined that the target process start request is a local procedure call protocol request.

[0154] Further, the preset offset group further includes a second offset, a third offset, a fourth offset and a fifth offset; the searching for the IP address information and the port number information corresponding to the target process startup request based on the memory address corresponding to the TEB and the preset offset group includes:

[0155] searching for a second object in the memory according to the first memory address and the second offset, wherein the memory address corresponding to the second object is equal to the first memory address plus the second offset;

[0156] When it is determined that the object stored at the second memory address is the third object according to the memory address corresponding to the second object and the third offset, searching for the IP address information and port number information corresponding to the target process start request according to the second memory address, the fourth offset and the first preset rule, wherein the second memory address is equal to the memory address corresponding to the second object plus the third offset;

[0157] When it is determined that the object stored at the second memory address is the fourth object based on the memory address corresponding to the second object and the third offset distance, the IP address information and port number information corresponding to the target process startup request are searched based on the second memory address, the fifth offset and the second preset rule.

[0158] Furthermore, the first preset rule is: searching for a target structure in the memory according to the second memory address and the fourth offset, wherein the memory address corresponding to the target structure is equal to the second memory address plus the fourth offset; searching for IP address information and port number information corresponding to the target process startup request in the target structure.

[0159] Furthermore, the second preset rule is: searching for the target pipe handle in the memory according to the second memory address and the fifth offset, generating an IOCTL command according to the value of the target pipe handle and the preset value of the target parameter, and sending the IOCTL command to the named pipe file system by calling the target API function, so that the named pipe file system feeds back the IP address information and port number information corresponding to the target process startup request, wherein the memory address corresponding to the target pipe handle is equal to the second memory address plus the fifth offset.

[0160] Further, after searching the IP address information and port number information corresponding to the target process start request based on the memory address corresponding to the TEB, the method further includes:

[0161] Determine whether the target process is a legitimate process based on the IP address information, port number information and preset blacklist corresponding to the target process startup request; and / or determine whether the target process is a legitimate process based on the IP address information, port number information and preset whitelist corresponding to the target process startup request;

[0162] If the target process is determined to be a legitimate process, the target process is released;

[0163] If the target process is determined to be an illegal process, a preset prompt statement is output and displayed.

[0164] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing program code that initializes the following method steps: determining a target process that responds to a target process startup request based on a target process startup request; when it is detected that the target process triggers a preset sensitive behavior operation, obtaining a memory address of a thread environment information block TEB corresponding to a target thread, wherein the target thread is a currently executing thread in the target process; identifying whether the target process startup request is a remote procedure call protocol request based on the memory address corresponding to the TEB; if so, searching for IP address information and port number information corresponding to the target process startup request based on the memory address corresponding to the TEB.

[0165] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0166] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0167] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0168] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0169] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0170] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0171] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0172] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0173] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0174] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A method for tracing the source of an IP address. It is characterized in that The method comprises: Determine, according to the target process start request, a target process that responds to the target process start request; When it is detected that the target process triggers a preset sensitive behavior operation, the memory address of the thread environment information block TEB corresponding to the target thread is obtained, wherein the target thread is the thread currently executed in the target process; Identify whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB; If so, searching for the IP address information and port number information corresponding to the target process startup request based on the memory address corresponding to the TEB; Before identifying whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB, the method further includes: Obtaining a preset offset group corresponding to the current operating system, wherein the preset offset group includes a plurality of offsets and target field names, and the plurality of offsets and the target field names are used to determine whether the target process start request is a remote procedure call protocol request, and when it is determined that the target process start request is a remote procedure call protocol request, determine the IP address information and port number information corresponding to the target process start request; The identifying, according to the memory address corresponding to the TEB, whether the target process start request is a remote procedure call protocol request includes: Identify whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB and the preset offset group; The searching for the IP address information and port number information corresponding to the target process startup request based on the memory address corresponding to the TEB includes: The IP address information and port number information corresponding to the target process start request are searched based on the memory address corresponding to the TEB and the preset offset group.

2. The method according to claim 1, It is characterized in that The preset offset group includes a target field name and a first offset; and the identifying whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB and the preset offset group includes: Searching the TEB in the memory according to the memory address corresponding to the TEB; Searching for a target field in the TEB according to the target field name to obtain a memory address corresponding to the target field; According to the memory address corresponding to the target field and the first offset, determining whether the object stored at the first memory address is the first object, wherein the first memory address is equal to the memory address corresponding to the target field plus the first offset; If yes, determining that the target process start request is a remote procedure call protocol request; If not, it is determined that the target process start request is a local procedure call protocol request.

3. The method according to claim 2, It is characterized in that The preset offset group further includes a second offset, a third offset, a fourth offset, and a fifth offset; searching for the IP address information and the port number information corresponding to the target process startup request based on the memory address corresponding to the TEB and the preset offset group includes: searching for a second object in the memory according to the first memory address and the second offset, wherein the memory address corresponding to the second object is equal to the first memory address plus the second offset; When it is determined that the object stored at the second memory address is the third object according to the memory address corresponding to the second object and the third offset, searching for the IP address information and port number information corresponding to the target process start request according to the second memory address, the fourth offset and the first preset rule, wherein the second memory address is equal to the memory address corresponding to the second object plus the third offset; When it is determined that the object stored at the second memory address is the fourth object based on the memory address corresponding to the second object and the third offset distance, the IP address information and port number information corresponding to the target process startup request are searched based on the second memory address, the fifth offset and the second preset rule.

4. The method according to claim 3, It is characterized in that The first preset rule is: searching for a target structure in the memory according to the second memory address and the fourth offset, wherein the memory address corresponding to the target structure is equal to the second memory address plus the fourth offset; searching for IP address information and port number information corresponding to the target process startup request in the target structure.

5. The method according to claim 3, It is characterized in that The second preset rule is: searching for the target pipe handle in the memory according to the second memory address and the fifth offset, generating an IOCTL command according to the value of the target pipe handle and the preset value of the target parameter, and sending the IOCTL command to the named pipe file system by calling the target API function, so that the named pipe file system feeds back the IP address information and port number information corresponding to the target process start request, wherein the memory address corresponding to the target pipe handle is equal to the second memory address plus the fifth offset.

6. The method according to claim 1, It is characterized in that After searching the IP address information and port number information corresponding to the target process start request based on the memory address corresponding to the TEB, the method further includes: Determine whether the target process is a legitimate process based on the IP address information, port number information and preset blacklist corresponding to the target process startup request; and / or determine whether the target process is a legitimate process based on the IP address information, port number information and preset whitelist corresponding to the target process startup request; If the target process is determined to be a legitimate process, the target process is released; If the target process is determined to be an illegal process, a preset prompt statement is output and displayed.

7. An IP address tracing device, It is characterized in that The device comprises: A determination unit, configured to determine, according to the target process start request, a target process that responds to the target process start request; A first acquisition unit is configured to acquire a memory address of a thread environment information block TEB corresponding to a target thread when it is detected that the target process triggers a preset sensitive behavior operation, wherein the target thread is a thread currently executed in the target process; an identification unit, configured to identify whether the target process start request is a remote procedure call protocol request according to a memory address corresponding to the TEB; a search unit, configured to search for IP address information and port number information corresponding to the target process start request based on a memory address corresponding to the TEB when the identification unit identifies that the target process start request is a remote procedure call protocol request; The device also includes: a second acquisition unit, configured to acquire a preset offset group corresponding to the current operating system before the identification unit identifies whether the target process startup request is a remote procedure call protocol request according to the memory address corresponding to the TEB, wherein the preset offset group includes a plurality of offsets and target field names, and the plurality of offsets and the target field names are used to determine whether the target process startup request is a remote procedure call protocol request, and to determine IP address information and port number information corresponding to the target process startup request when it is determined that the target process startup request is a remote procedure call protocol request; The identification unit is specifically used to identify whether the target process start request is a remote procedure call protocol request according to the memory address corresponding to the TEB and the preset offset group; The search unit is specifically used to search for the IP address information and port number information corresponding to the target process startup request based on the memory address corresponding to the TEB and the preset offset group.

8. A storage medium, It is characterized in that The storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the IP address tracing method described in any one of claims 1 to 6.

9. An IP address tracing device, It is characterized in that The device includes a storage medium; and one or more processors, the storage medium is coupled to the processor, and the processor is configured to execute program instructions stored in the storage medium; when the program instructions are executed, the IP address tracing method described in any one of claims 1 to 6 is executed.

Images