A method, apparatus and storage medium for detecting and removing malicious code

Abstract

This invention proposes a method, apparatus, and storage medium for detecting and removing malicious code, relating to the field of computer system security technology. The method includes the following steps: merging a malicious code signature database with a first malicious code removal program to form a second malicious code removal program; reading malicious code signature data from the second malicious code removal program into memory; invoking the second malicious code removal program to traverse all files on the disk, comparing the files with the malicious code signature data in memory; if a file matches the malicious code signature data, it is determined to be malicious code; if a file does not match the malicious code signature data, it is determined to be non-malicious code. This method addresses the problem of malicious code signature database files stored separately on the disk being analyzed and reverse engineered. This invention also provides a malicious file removal apparatus and a computer-readable storage medium, both possessing the aforementioned beneficial effects.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer system security, in particular to a malicious code detection method, device and storage medium. BACKGROUND

[0002] With the rapid development of mobile Internet, various intelligent devices have gradually been popularized in people's life and work, and various threats have come along, among which malicious code is one of the common threats. At present, the mainstream methods for detecting malicious code include feature code method, checksum method, behavior monitoring method, software simulation method and heuristic scanning. These methods have different implementation costs and detection ranges according to different principles, and each has its own advantages. The feature code method is the simplest and most direct method for detecting known malicious code.

[0003] The traditional feature code method reads the known malicious code feature library file data collected in advance in a certain place in the disk into the memory every time the malicious code detection tool is run, and then opens the detected file. The feature code of the file is calculated based on certain rules. It is detected whether the feature code of the file is in the malicious code database. If the malicious code feature code is found, it can be determined that the detected file is infected with a certain malicious code, and the malicious code feature library file on the disk is updated and replaced when necessary. It can be seen that the malicious code detection tool and the malicious code feature library of the traditional feature code method are two independent files, and they are indispensable. The problem of this method is that the malicious code feature library file is on the disk, which has the risk of being analyzed and reverse cracked. Once the malicious code feature library is decrypted by a malicious program, it is difficult to scan out the malicious code when the malicious code detection tool is run again. Users mistakenly believe that the operating system is still safe, which poses a huge security risk. SUMMARY

[0004] The present application provides a malicious code detection method, device and storage medium, which fuses the malicious code feature library file and the malicious code detection tool file into a whole, increases the difficulty of exposing and cracking the malicious code feature library, and solves the problem of analyzing and reverse cracking the malicious code feature library file.

[0005] The embodiments of the present application are as follows:

[0006] The present application provides a malicious code detection method, device and storage medium, which fuses the malicious code feature library file and the malicious code detection tool file into a whole, increases the difficulty of exposing and cracking the malicious code feature library, and solves the problem of analyzing and reverse cracking the malicious code feature library file.

[0007] The malicious code feature library is fused with the first malicious code killer to form a second malicious code killer; the malicious code feature data in the second malicious code killer is read to the memory; the second malicious code killer is called to traverse the whole disk file, and the file is compared with the malicious code feature data on the memory; if the malicious code feature data is matched, it is determined as malicious code; if the malicious code feature data is not matched, it is determined as non-malicious code.

[0008] Further, the fusion of the malicious code feature library and the first malicious code killer includes the following steps: reading the malicious code feature library file data; calculating the malicious code feature library file size; creating a new PE (Portable Executable, Portable Executable) section of the first malicious code killer according to the malicious code feature library file size; writing the malicious code feature library into the new PE section to form the second malicious code killer.

[0009] Further, the malicious code feature library is encrypted before being written into the new PE section.

[0010] Further, after reading the malicious code feature data in the second malicious code killer, it is stored in the memory mapping table Map.

[0011] Further, the traversal of the whole disk file includes the following steps: creating a thread pool according to the maximum number of disk IO threads that can be supported by the device running the malicious code killer; creating a thread for traversing the disk, which is responsible for assigning tasks to the disk IO thread pool; waking up the idle threads in the thread pool to read the files in the disk in turn and calculate the corresponding feature code.

[0012] Further, before calculating the corresponding feature code, it is judged whether the data in the disk is a file, if not, the feature code is not calculated, and the next file is read.

[0013] The application provides a malicious code killer device, which includes: a malicious code feature library module for storing the malicious code feature library; a first malicious code killer module for storing a malicious code killer program; a program fusion module for fusing the malicious code feature library and the first malicious code killer program into a second malicious code killer program; a second malicious code killer module for killing the malicious code; and a disk traversal module for calling the second malicious code killer module to traverse the disk file.

[0014] Further, the program fusion module comprises: a malicious code feature library file processing submodule, configured to read the malicious code feature library file and calculate the size thereof; and a PE auxiliary tool submodule, configured to create a new PE section area of the second malicious code killing program, and write the malicious code feature library into the new PE section area.

[0015] Further, the disk traversal module comprises: a thread creation submodule, configured to calculate the maximum number of disk IO threads supported by the device, and create a thread pool; a task control submodule, configured to assign tasks to the disk IO thread pool; and a feature value calculation submodule, configured to calculate a file feature code.

[0016] The present application provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the malicious code killing method.

[0017] The malicious code killing method, device and storage medium provided by the present application fuse the malicious code feature library file and the malicious code killing tool program into one whole, for example, write the malicious code feature library into the newly added PE section area of the malicious code killing tool, so as to increase the difficulty of exposing and cracking the malicious code feature library, and solve the problem that the malicious code feature library file stored separately in the disk is analyzed and cracked reversely. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor.

[0019] Figure 1 The malicious code killing method flow chart in the embodiment of the present application;

[0020] Figure 2 The malicious code killing method flow chart in the preferred embodiment of the present application;

[0021] Figure 3 The malicious code killing method flow chart in the preferred embodiment of the present application;

[0022] Figure 4 The malicious code killing device schematic diagram in the embodiment of the present application. DETAILED DESCRIPTION

[0023] Clearly and completely, the technical solutions in the embodiments of the present application will be described below with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative work belong to the scope of protection of the present application.

[0024] According to the embodiments of the present application, a malicious code killing method is provided, Figure 1 The flowchart of the malicious code killing method comprises the following steps: fusing a malicious code feature library and a first malicious code killing program to form a second malicious code killing program; reading malicious code feature data in the second malicious code killing program to a memory; calling the second malicious code killing program, traversing all disk files, comparing the files with the malicious code feature data on the memory; if matching the malicious code feature data, determining as malicious code and taking killing measures; if not matching the malicious code feature data, determining as non-malicious code. The method of fusing the malicious code feature library and the first malicious code killing program has multiple kinds, such as copying the content of the malicious code feature library to the file of the first malicious code killing program, or adding a PE section in the first malicious code killing program.

[0025] Through the above method, the problem that the security of the malicious code feature library stored separately on the disk is not high and is easy to be reverse cracked can be solved, that is, the difficulty of exposing and cracking the malicious code feature library is increased, and the security of the computer system is enhanced.

[0026] In a preferred embodiment of the present application, as shown in Figure 2 The flowchart of the malicious code killing method comprises the following steps: reading file data of the malicious code feature library; calculating the size of the malicious code feature library file; creating a new PE section of the first malicious code killing program according to the size of the malicious code feature library file; encrypting the malicious code feature library and writing it into the new PE section to form the second malicious code killing program; reading malicious code feature data in the second malicious code killing program to a memory and storing it in a memory mapping table Map; calling the second malicious code killing program, traversing all disk files, comparing the files with the malicious code feature data on the memory; if matching the malicious code feature data, determining as malicious code and taking killing measures; if not matching the malicious code feature data, determining as non-malicious code. In this embodiment, the malicious code feature library is written into the new PE section of the killing program, so that the malicious code feature library and the killing program form a whole, the difficulty of cracking the malicious code feature library is increased, and the security is increased.

[0027] In a preferred embodiment of the present application, as shown in Figure 3 In the embodiment, the method comprises the following steps: reading the malicious code feature library file data; calculating the malicious code feature library file size; creating a new PE section area of the first malicious code killer according to the malicious code feature library file size; encrypting the malicious code feature library and writing it into the new PE section area to form the second malicious code killer; reading the malicious code feature data in the second malicious code killer into the memory and storing it in the memory mapping table Map; creating a thread pool according to the maximum thread quantity of the disk IO that can be supported by the device running the malicious code killer; creating a thread for traversing the disk, which is responsible for allocating tasks to the disk IO thread pool; waking up the idle threads in the thread pool to read the data in the disk in turn, judging whether the data is a file, calculating the corresponding feature code if it is a file, and continuing to read the next file if it is not a file; comparing the feature code of the file with the malicious code feature data in the memory; if it matches the malicious code feature data, it is determined to be malicious code and the killing measure is taken; if it does not match the malicious code feature data, it is determined to be non-malicious code. In the embodiment, the maximum thread parallel number of the disk I / O thread pool of the killing device is created according to the number of device computing kernels, and the thread pool is used to wait for the killing task request to process multiple file checkpoints and read requests at the same time to improve the reading speed. All files to be killed are read into the memory by traversing all files on the disk. The memory I / O is much faster than the disk I / O, so multi-core programming is needed for the disk I / O to improve the execution efficiency.

[0028] According to an embodiment of the present application, a malicious code killing device is provided, Figure 4 is a schematic diagram of the device, which comprises: a malicious code feature library module for storing the malicious code feature library; a first malicious code killing module for storing a malicious code killing program; a program fusion module for fusing the malicious code feature library and the first malicious code killing program into a second malicious code killing program; a second malicious code killing module for killing the malicious code; and a disk traversal module for calling the second malicious code killing module to traverse the disk files.

[0029] The program fusion module comprises a malicious code feature library file processing submodule, which is configured to read the malicious code feature library file and calculate the size thereof; and a PE auxiliary tool submodule, which is configured to create a new PE section area of the first malicious code killing program and write the malicious code feature library into the new PE section area. The disk traversal module comprises a thread creation submodule, which is configured to calculate the maximum number of disk IO threads supported by the device and create a thread pool; a task control submodule, which is configured to allocate tasks to the disk IO thread pool; and a feature code calculation submodule, which is configured to calculate a file feature code.

[0030] According to an embodiment of the present application, a computer readable storage medium is provided, which comprises a CD, a U disk, a hard disk, a random access memory (RAM), a read only memory (ROM), a programmable ROM, and any other form of storage medium known in the technical field. The computer readable storage medium is configured to store a computer program, which, when executed by a processor, implements any of the malicious code killing methods proposed by the present application.

[0031] The above merely provides the preferred embodiments of the present application but not for limiting the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A malicious code killing method, characterized by, The method comprises the following steps: The malicious code feature library is fused with the first malicious code killer to form a second malicious code killer, comprising the following steps: reading the malicious code feature library file data; calculating the malicious code feature library file size; creating a new PE section area of the first malicious code killer according to the file size; encrypting the malicious code feature library; writing the encrypted malicious code feature library into the new PE section area; reading the malicious code feature data in the second malicious code killer into the memory and storing it in the memory mapping table Map; calling the second malicious code killer to traverse the disk files, comprising: creating a thread pool according to the maximum number of disk IO threads supported by the device; creating a thread for traversing the disk, responsible for assigning tasks to the disk IO thread pool; waking up the idle threads in the thread pool, reading the files in the disk in turn and calculating the corresponding feature code; comparing the file feature code with the malicious code feature data in the memory; if matched, it is determined as malicious code, otherwise as non-malicious code.

2. The method of claim 1, wherein the malicious code detection method is characterized by, Before the corresponding feature code is calculated, it is judged whether the data in the disk is a file, if not, the feature code is not calculated.

3. A malicious code killing apparatus adapted to the method of claim 1, characterized in that, It comprises: a malicious code feature library module for storing the malicious code feature library; a first malicious code killing module for storing a malicious code killer; a program fusion module for fusing the malicious code feature library and the first malicious code killer into a second malicious code killer; a second malicious code killing module for killing the malicious code; a disk traversal module for calling the second malicious code killing module to traverse the disk files.

4. The malicious code killing apparatus according to claim 3, characterized by, The program fusion module comprises: a malicious code feature library file processing submodule for reading the malicious code feature library file and calculating its size; a PE auxiliary tool submodule for creating a new PE section area of the first malicious code killer and writing the malicious code feature library into the new PE section area.

5. The malicious code killing apparatus according to claim 3, characterized by, The disk traversal module comprises: a thread creation submodule for calculating the maximum number of disk IO threads supported by the device and creating a thread pool; a task control submodule for assigning tasks to the disk IO thread pool; a feature value calculation submodule for calculating the file feature code.

6. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to realize the malicious code killing method of any one of claims 1-2.

Images