A detection method and device

Abstract

The embodiment of the present invention provides a detection method and device. The method includes: in response to detecting that a target module is called, detecting the target code in the target module and determining the address of the target function; according to the address of the target function, determining the name of the interface function to be loaded by the target function and the module information corresponding to the interface function through a hook program; according to preset rules, filtering the name of the interface function and the module information corresponding to the interface function to obtain sensitive names and sensitive module information. Through the hook program, before the macro code of the target software starts to execute any Win32API function, the WIndowsAPI called in this way can be accurately identified and monitored, so that the security impact generated is within a controllable range, which greatly improves the protection capability.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a detection method and device. Background Art

[0002] Generally, Office macro code supports declaring any Win32API function prototype and calling the function in the macro code, which also increases the risk of being exploited by malicious code, such as applying for memory and executing shellcode. Pass The macro code declares the calling method and calls high-risk Windows APIs, such as applying for memory, modifying memory attributes, creating threads, executing shellcode, etc. to call high-risk sensitive functions that are not supported by the default macro language. Existing security software is based on file detection technology. It parses the ole format, performs static feature matching on Excel document files containing macro codes, and violently removes macro codes in Excel files to resist macro virus attacks. This traditional detection method is based on file detection technology. It needs to parse the Office document format, extract all macro codes, and then perform feature matching. Since macro codes belong to scripting languages, it is easy to do code obfuscation to avoid feature detection, so it cannot be detected by traditional file feature matching detection technology. Summary of the invention

[0003] In view of the problems in the prior art, an embodiment of the present invention provides a detection method and device, which realizes that through a hook program, before the macro code of the Office software starts to execute any Win32API function, the WIndowsAPI called in this way can be accurately identified and monitored, so that the security impact generated is within a controllable range, greatly improving the protection capability.

[0004] Specifically, the embodiment of the present invention provides the following technical solutions:

[0005] In the first aspect, an embodiment of the present invention provides a detection method, comprising: in response to detecting that a target module is called, detecting the target code in the target module, and determining the address of the target function; according to the address of the target function, determining, through a hook program, the name of the interface function to be loaded by the target function and the module information corresponding to the interface function; according to preset rules, filtering the name of the interface function and the module information corresponding to the interface function to obtain sensitive names and sensitive module information.

[0006] Furthermore, filtering the name of the interface function and the module information corresponding to the interface function according to a preset rule includes: filtering the name of the interface function and the module information corresponding to the interface function through a preset proxy function.

[0007] Furthermore, according to the preset rules, after filtering the name of the interface function and the module information corresponding to the interface function to obtain the sensitive name and sensitive module information, it also includes: judging the state of the policy switch, and if it is in the on state, intercepting the sensitive name and sensitive module information.

[0008] Further, the target function includes a DllFunctionCall function, the target module includes a VBE module; and in response to detecting that the target module is called, detecting the target code in the target module, and determining the address of the target function, includes: in response to detecting that the VBE module is called, detecting the target code in the VBE module, and determining the address of the DllFunctionCall function in the DeclareProlog function.

[0009] Furthermore, before the response to detecting that the target module is called, it also includes detecting whether the LdrLoadDll function in the current process is the target software process, and if so, detecting whether the current process calls the target module.

[0010] Furthermore, in response to detecting that the target module is called, detecting the target code in the target module and determining the address of the target function includes: in response to detecting that the target module is called, detecting the target code in the target module and determining the address of the target function by searching for preset binary features, wherein the preset binary features represent features of the target code.

[0011] In the second aspect, an embodiment of the present invention also provides a detection device, comprising: a first processing module, for detecting the target code in the target module and determining the address of the target function in response to detecting that the target module is called; a second processing module, for determining, through a hook program, the name of the interface function to be loaded by the target function and the module information corresponding to the interface function according to the address of the target function; and a third processing module, for filtering the name of the interface function and the module information corresponding to the interface function according to preset rules to obtain sensitive names and sensitive module information.

[0012] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the detection method described in the first aspect are implemented.

[0013] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the detection method described in the first aspect.

[0014] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the detection steps described in the first aspect.

[0015] The detection method and device provided by the embodiment of the present invention detect the target code in the target module in response to detecting that the target module is called, and determine the address of the target function; according to the address of the target function, determine the name of the interface function to be loaded by the target function and the module information corresponding to the interface function through a hook program; according to preset rules, filter the name of the interface function and the module information corresponding to the interface function to obtain sensitive names and sensitive module information. Through the hook program, the behavior of macro code calling to execute any Windows API is accurately intercepted and identified, which can effectively defend against attacks that use macro code declarations to call sensitive functions, so that the threat is within a controllable range. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 This is a flow chart of an embodiment of the detection method of the present invention;

[0018] Figure 2 This is a schematic diagram of the application scenario of the VBE module calling the DllFunctionCall function in the Windows 32-bit operating system;

[0019] Figure 3 This is a schematic diagram of the application scenario of the VBE module calling the DllFunctionCall function in the Windows 64-bit operating system;

[0020] Figure 4 A flowchart of an application scenario of intercepting the DllFunctionCall of the VBE module to obtain the address of the target function called;

[0021] Figure 5 This is a schematic diagram of the structure of an embodiment of a detection device of the present invention;

[0022] Figure 6 It is a schematic diagram of the structure of an electronic device entity embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] Figure 1 This is a flow chart of an embodiment of the detection method of the present invention. Figure 1 As shown, the method of the embodiment of the present invention includes:

[0025] S101, in response to detecting that a target module is called, detecting the target code in the target module and determining the address of the target function.

[0026] In some embodiments, the target module may be a VBE (Visual Basic Editor) module, which is an editor provided by Excel (especially Microsoft Office software) specifically for editing and debugging VBA (Visual Basic for Applications) programs. VBA is a macro language of Visual Basic, a programming language developed by Microsoft to perform general automation (OLE) tasks in its desktop applications. It can be mainly used to expand the application functions of Windows, especially Microsoft Office software, and can also be said to be a basic script for visualizing application programs, that is, VBA programs can be used to implement Office macros. Office macros are translated from the English word Macro. Macros are an advanced scripting feature that comes with Office. Through VBA code, a specific task can be completed in Office without having to repeat the same action. The purpose is to automate some tasks in user documents. A macro virus is a computer virus that resides in a macro of a document or template. Once such a document is opened, the macro in it will be executed, so the macro virus will be activated, transferred to the computer, and reside on the Normal template. The code in the VBE module called by the process contains operating system functions or custom functions (such as Windows API functions) that need to be called. Since the DllFunctionCall function is not exported in the VBE6 and 7 series modules, you can choose to locate the DllFunctionCall function address by searching for binary features in the .text code segment of the vbe6 and 7 modules. Detect the target code in the VBE module and determine the address of the target function, that is, detect the .text code segment in the VBE module and find the address of the function in the specific code segment, such as Figure 2 As shown, it is a Windows 32-bit operating system, in which the target code is the .text code segment and the target function is the DllFunctionCall function.

[0027] In some optional implementations, the target function includes a DllFunctionCall function, and the target module includes a VBE module; and in response to detecting that the target module is called, detecting the target code in the target module, and determining the address of the target function, including: in response to detecting that the VBE module is called, detecting the target code in the VBE module, and determining the address of the DllFunctionCall function in the DeclareProlog function.

[0028] Since some VBE modules have stack frame optimization enabled, it is difficult to find features inside the DllFunctionCall function; therefore, the DeclareProlog function can be used to locate the DllFunctionCall function. For example, Figure 3 As shown, it is a Windows 64-bit operating system, wherein the target code is the .text code segment, and the target function is the DllFunctionCall function, wherein the DllFunctionCall function is called by the DeclareProlog function.

[0029] In some optional implementations, in response to detecting that the target module is called, the method further includes: detecting whether the LdrLoadDll function in the current process is the target software process, and if so, detecting whether the current process calls the target module.

[0030] As an example, the hook technology, also known as the hook function, captures the message before the system calls the function. The hook function gets control first. At this time, the hook function can process (change) the execution behavior of the function and force the end of the message transmission. You can first detect the export function LdrLoadDll of the Ntdll module by hooking. In the hook callback, determine whether the current process is an Office software process that supports macro codes, that is, the target software process, such as Winword.exe, Excel.exe, etc. Then determine whether the DLL module currently being loaded is the target module, such as VBE6 or VBE7 module. If the conditions are met, perform feature matching on the VBE6 or VBE7 module.

[0031] In some optional implementations, in response to detecting that a target module is called, detecting a target code in the target module and determining an address of a target function includes: in response to detecting that a target module is called, detecting a target code in the target module and determining an address of a target function by searching for preset binary features, wherein the preset binary features represent features of the target code.

[0032] As an example, Figure 2 As shown in the figure, the target code is the code of the .text file. Each line of code in the .text file has a binary feature code to represent each line of code. The target binary feature can be set in advance, and the address of the target function can be determined by matching the binary feature of each line of code in the .text file with the target binary feature, such as Figure 2 As shown, the binary feature can be 68111111111FFD0.

[0033] S102, according to the address of the target function, through the hook program, determine the name of the interface function to be loaded by the target function and the module information corresponding to the interface function.

[0034] In some embodiments, the hook procedure, such as hook technology. The target function can be a DllFunctionCall function, which has only one parameter, a DllTemplate structure, which contains the Win32API name to be obtained, the module name to which it belongs, and other information. The DllTemplate structure can refer to the following code.

[0035] typedef struct

[0036] {

[0037] ULONG ErrCode;

[0038] HMODULE hModule;

[0039] FARPROC pFunction;

[0040] }epiDllTemplateInfo,*PepiDllTemplateInfo;

[0041] typedef struct

[0042] {

[0043] LPCSTR ModuleName; / / dll name《=================Information to be obtained

[0044] LPCSTR FunctionName; / / Function name《==================Information to be obtained

[0045] union

[0046] {

[0047] UINT Ordinal; / / Import ordinal

[0048] BYTE Flag;

[0049] BYTE padding;

[0050] };

[0051] epiDllTemplateInfo*DllTemplateInfo;

[0052] }serDllTemplate,*PserDllTemplate;

[0053] S103, according to preset rules, filter the names of the interface functions and the module information corresponding to the interface functions to obtain sensitive names and sensitive module information.

[0054] In some embodiments, the names of the interface functions and the module information corresponding to the interface functions can be filtered in a list manner, that is, filtering can be performed by setting keywords.

[0055] In some optional implementations, the interface function name and the module information corresponding to the interface function are filtered according to preset rules, including: filtering the interface function name and the module information corresponding to the interface function through a preset proxy function.

[0056] As an example, filtering rules can be set in the proxy function.

[0057] In some optional implementations, the interface function name and the module information corresponding to the interface function are filtered according to preset rules to obtain the sensitive name and sensitive module information, and it also includes: judging the state of the policy switch, if it is on, intercepting the sensitive name and sensitive module information.

[0058] As an example, Figure 4 As shown, the policy switch is used to control the opening or closing of the function of macro code calling sensitive interface functions, considering that in special circumstances, the macro code may need to call the function of the operating system.

[0059] The detection method provided by the embodiment of the present invention detects the target code in the target module in response to detecting that the target module is called, and determines the address of the target function; according to the address of the target function, through a hook program, determines the name of the interface function to be loaded by the target function and the module information corresponding to the interface function; according to preset rules, the name of the interface function and the module information corresponding to the interface function are filtered to obtain sensitive names and sensitive module information. Through the hook program, the behavior of macro code calling to execute any Windows API is accurately intercepted and identified, which can effectively defend against attacks that use macro code declarations to call sensitive functions, so that the threat is within a controllable range.

[0060] Figure 5 FIG. 1 is a schematic diagram of the structure of an embodiment of the detection device of the present invention. Figure 5 As shown, the device comprises:

[0061] The first processing module 501 is used for detecting the target module being called, detecting the target code in the target module, and determining the address of the target function;

[0062] The second processing module 502 is used to determine the name of the interface function to be loaded by the target function and the module information corresponding to the interface function through the hook program according to the address of the target function;

[0063] The third processing module 503 is used to filter the name of the interface function and the module information corresponding to the interface function according to a preset rule to obtain a sensitive name and sensitive module information.

[0064] Optionally, the third processing module 503 is further used for:

[0065] Through the preset proxy function, the name of the interface function and the module information corresponding to the interface function are filtered.

[0066] Optionally, the apparatus 500 further includes:

[0067] The unit for judging the policy switch is used to judge the state of the policy switch. If it is turned on, sensitive names and sensitive module information are intercepted.

[0068] Optionally, the target function includes a DllFunctionCall function, and the target module includes a VBE module; and

[0069] The first processing module 501 is also used for:

[0070] In response to detecting that the VBE module is called, the object code in the VBE module is detected, and the address of the DllFunctionCall function in the DeclareProlog function is determined.

[0071] Optionally, the apparatus 500 further includes:

[0072] Check whether the LdrLoadDll function in the current process is the target software process. If so, check whether the current process calls the target module.

[0073] Optionally, the first processing module 501 is further used for:

[0074] In response to detecting that the target module is called, the target code in the target module is detected and the address of the target function is determined by searching for preset binary features, where the preset binary features represent features of the target code.

[0075] Here is an example:

[0076] Figure 6 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 6As shown, the electronic device may include: a processor (processor) 601, a communication interface (Communications Interface) 602, a memory (memory) 603 and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 complete mutual communication through the communication bus 604. The processor 601 may call the logic instructions in the memory 603 to execute the following method: in response to detecting that the target module is called, detecting the target code in the target module, and determining the address of the target function; according to the address of the target function, determining the name of the interface function to be loaded by the target function and the module information corresponding to the interface function through the hook program; according to the preset rules, filtering the name of the interface function and the module information corresponding to the interface function to obtain sensitive names and sensitive module information.

[0077] In addition, the logic instructions in the above-mentioned memory 603 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0078] On the other hand, an embodiment of the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the detection methods provided by the above embodiments, for example, including: in response to detecting that a target module is called, detecting the target code in the target module, and determining the address of the target function; according to the address of the target function, determining, through a hook program, the name of the interface function to be loaded by the target function and the module information corresponding to the interface function; according to preset rules, filtering the name of the interface function and the module information corresponding to the interface function to obtain sensitive names and sensitive module information.

[0079] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the detection method provided by the above-mentioned embodiments, for example, including: in response to detecting that the target module is called, detecting the target code in the target module, and determining the address of the target function; according to the address of the target function, determining the name of the interface function to be loaded by the target function and the module information corresponding to the interface function through a hook program; according to preset rules, filtering the name of the interface function and the module information corresponding to the interface function to obtain sensitive names and sensitive module information.

[0080] The device embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without paying creative labor.

[0081] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0082] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A detection method, characterized in that: The method comprises: In response to detecting that a target module is called, detecting a target code in the target module, and determining an address of a target function, wherein the target function includes a DllFunctionCall function, and the target module includes a VBE module; and In response to detecting that the target module is called, detecting the target code in the target module and determining the address of the target function include: In response to detecting that the VBE module is called, detecting the object code in the VBE module, and determining the address of the DllFunctionCall function in the DeclareProlog function; According to the address of the target function, through the hook program, determine the name of the interface function to be loaded by the target function and the module information corresponding to the interface function; According to preset rules, the name of the interface function and the module information corresponding to the interface function are filtered to obtain sensitive names and sensitive module information.

2. The detection method according to claim 1, characterized in that: The filtering of the name of the interface function and the module information corresponding to the interface function according to the preset rule includes: The name of the interface function and the module information corresponding to the interface function are filtered through a preset proxy function.

3. The detection method according to any one of claim 1, characterized in that: The method further comprises filtering the name of the interface function and the module information corresponding to the interface function according to the preset rules to obtain the sensitive name and the sensitive module information: The state of the policy switch is determined, and if it is turned on, the sensitive name and sensitive module information are intercepted.

4. The detection method according to claim 1, characterized in that: The step of responding to the detection of the target module being called also includes: Detect whether the LdrLoadDll function in the current process is the target software process, and if so, detect whether the current process calls the target module.

5. The detection method according to any one of claims 1 to 4, characterized in that: In response to detecting that the target module is called, detecting the target code in the target module and determining the address of the target function include: In response to detecting that a target module is called, the target code in the target module is detected and the address of the target function is determined by searching for a preset binary feature, wherein the preset binary feature represents a feature of the target code.

6. A detection device, characterized in that: The device is used to implement the detection method according to any one of claims 1 to 5, and the device comprises: A first processing module, configured to detect the target code in the target module and determine the address of the target function in response to detecting that the target module is called; A second processing module is used to determine, according to the address of the target function, through a hook program, the name of the interface function to be loaded by the target function and the module information corresponding to the interface function; The third processing module is used to filter the name of the interface function and the module information corresponding to the interface function according to preset rules to obtain sensitive names and sensitive module information.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the detection method according to any one of claims 1 to 5 are implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the detection method according to any one of claims 1 to 5 are implemented.

9. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor implements the steps of the detection method according to any one of claims 1 to 5.

Images