Remote call behavior identification method, device, equipment, medium and product

Abstract

The present invention provides a remote call behavior identification method, apparatus, device, medium, and product, comprising: executing a hook function pre-set at a target function when a target function is called; wherein the target function is a command execution function in a DCOM component; monitoring DCOM-based call behavior via the hook function; obtaining DCOM data, and determining whether the DCOM-based call behavior is a remote call behavior based on the DCOM data. By pre-setting a hook function at the command execution function in the DCOM component and monitoring DCOM-based call behavior via the pre-set hook function, remote DCOM-based call behavior can be effectively monitored and identified, laying the foundation for blocking DCOM-based lateral penetration.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a remote call behavior recognition method, device, equipment, medium and product. Background Art

[0002] In the complete network penetration attack chain, the remote lateral penetration stage of the intranet is when an attacker uses a compromised machine as a springboard to attack other machines on the same network, obtaining more valuable credentials and higher-level permissions, thereby expanding the attack surface and ultimately achieving control of the entire intranet and launching an advanced persistent threat (APT) attack.

[0003] Remote attacks leveraging the Microsoft Distributed Component Object Model (DCOM) are a common method for attackers to penetrate intranets laterally. For example, after compromising one computer and gaining access to it, an attacker can exploit the executable command interface within the DCOM interface to attack other computers, causing them to download and execute a Trojan horse, thereby gaining access to more information and higher permissions. Because this attack exploits the operating system's inherent mechanisms, traditional network attack detection methods are unable to effectively and accurately detect this type of attack. Summary of the Invention

[0004] The present invention provides a remote call behavior identification method, device, equipment, medium and product to solve the defects of the existing technology in the lack and weakness of protection against remote attacks using DCOM, and to realize the identification of remote call behaviors based on DCOM and perform security protection.

[0005] The present invention provides a remote call behavior identification method, comprising:

[0006] When a target function is called, executing a hook function pre-set at the target function; wherein the target function is a command execution function in a DCOM component;

[0007] The calling behavior based on DCOM is monitored through the hook function;

[0008] DCOM data is acquired, and whether the DCOM-based calling behavior is a remote calling behavior is determined according to the DCOM data.

[0009] According to a remote call behavior identification method provided by the present invention, when a target function is called, before executing a hook function pre-set at the target function, the method further includes:

[0010] When a preset process is created and started, a hook function is set for a target function in the preset process.

[0011] According to a remote call behavior identification method provided by the present invention, when a preset process is created and started, setting a hook function for a target function in the preset process includes:

[0012] In the case where the preset process is a file explorer process, a hook function is set at the Document.Application.ShellExecute function in the DCOM component whose class identifier of the DCOM interface is {C08AFD90-F2A1-11D1-8455-00A0C91F3880} and the Document.Application.ShellExecute function in the DCOM component whose class identifier is {9BA05972-F6A8-11CF-A442-00A0C90A8F39};

[0013] In the case that the preset process is a system management program process, a hook function is set at the Document.ActiveView.ExecuteShellCommand function in the DCOM component named MMC20.Application of the DCOM interface.

[0014] According to a remote call behavior identification method provided by the present invention, obtaining DCOM data includes:

[0015] Gets DCOM data from the thread environment block of the current thread.

[0016] According to a remote call behavior identification method provided by the present invention, after determining whether the DCOM-based call behavior is a remote call behavior according to the DCOM data, the method further includes:

[0017] In the case where the DCOM-based calling behavior is a remote calling behavior, obtaining address information of a remote terminal that initiates the remote calling behavior, and obtaining data of the remote calling behavior through the hook function;

[0018] The address information of the remote terminal that initiates the remote call behavior and the data of the remote call behavior are transmitted to the threat behavior engine to obtain a security identification result.

[0019] According to a remote call behavior identification method provided by the present invention, after obtaining the security identification result, the method further includes:

[0020] When the security assessment result indicates that a security threat exists, the remote call behavior is intercepted.

[0021] The present invention also provides a remote call behavior recognition device, comprising:

[0022] An execution module, configured to execute a hook function pre-set at a target function when the target function is called; wherein the target function is a command execution function in a DCOM component;

[0023] A monitoring module, used for monitoring the calling behavior based on DCOM through the hook function;

[0024] The processing module is used to obtain DCOM data and determine whether the DCOM-based calling behavior is a remote calling behavior according to the DCOM data.

[0025] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-described remote call behavior recognition methods are implemented.

[0026] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described remote call behavior identification methods.

[0027] The present invention also provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any of the above-mentioned remote call behavior identification methods.

[0028] The remote call behavior identification method, device, equipment, medium and product provided by the present invention preset a hook function at the command execution function in the DCOM component, monitor the DCOM-based call behavior through the preset hook function, and thus facilitate the effective monitoring and identification of DCOM-based remote call behavior, laying the foundation for blocking DCOM-based lateral penetration. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0030] Figure 1 This is one of the flow charts of the remote call behavior identification method provided by the present invention;

[0031] Figure 2 This is the second flow chart of the remote call behavior identification method provided by the present invention;

[0032] Figure 3 It is a structural diagram of the remote call behavior recognition device provided by the present invention;

[0033] Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0034] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0035] In order to facilitate understanding, the terms involved in the present invention are first explained.

[0036] (1) Advanced Persistent Threat (APT)

[0037] Advanced persistent threat attacks, also known as targeted threat attacks, refer to sustained and effective attack activities launched by an organization against a specific target.

[0038] (2)Win32 API

[0039] Win32 API is the application programming interface (API) for the Microsoft 32-bit platform. All applications running on the Win32 platform can call these functions.

[0040] (3)Hook function

[0041] The hook function can also be called a hook function. Before the system calls a target function, the hook function can preferentially capture the target function call, obtain control of the target function, and perform additional processing on the target function.

[0042] (4) Distributed Component Object Model (DCOM):

[0043] DCOM is a set of Microsoft concepts and program interfaces that allow client program objects to request server program objects from another computer on the network.

[0044] (5)Thread environment block (TEB)

[0045] TEB: Thread Environment Block, records and stores important information about the current thread.

[0046] (6) Class identifier (CLSID)

[0047] A class identifier, also known as a CLASSID or CLSID, is a unique identifier associated with a class object. A class object that is intended to create multiple objects should register its CLSID in the task table of the system registration database so that clients can locate and load the executable code associated with the object.

[0048] The following combination Figures 1-4 The present invention describes the remote call behavior identification method, device, equipment, medium and product provided by the present invention.

[0049] Figure 1 This is one of the flow charts of the remote call behavior identification method provided by the present invention. It can be understood that Figure 1 The method in can be executed by a monitoring module, which can be a module located in a computer system. Figure 1 As shown, the remote call behavior identification method provided by the present invention includes the following steps:

[0050] Step 110: When the target function is called, execute the hook function pre-set at the target function.

[0051] The target function is a command execution function in the DCOM component, which is used to execute any program in the system. The command execution function in the DCOM component can be, for example, the Document.Application.ShellExecute function and the Document.ActiveView.ExecuteShellCommand function.

[0052] The hook function is used to interrupt the execution of the target function and execute the preset function of the hook function itself.

[0053] It is understood that the command execution function in the DCOM component can request a server program object on another computer to perform a series of operations, which may include downloading and executing a Trojan horse. Therefore, when the target function is called, if the target function is executed, it will pose a threat to the computer's information security. Therefore, the hook function is used here to interrupt the execution of the target function, thereby eliminating the threat to the computer's information security.

[0054] Step 120: Monitor the DCOM-based calling behavior through the hook function.

[0055] The DCOM-based calling behavior may be a behavior of calling a DCOM command execution function in a computer.

[0056] It can be understood that when the DCOM command execution function is called, the hook function starts and feeds back a signal that monitors the DCOM-based calling behavior.

[0057] As previously mentioned, since the target function is a command execution function in the DCOM component, and the hook function pre-set at the target function is only executed when the target function is called, when the hook function begins to execute, it indicates that the command execution function in the DCOM component in the computer has been called, and thus the DCOM-based calling behavior can be monitored through the hook function.

[0058] Step 130: Acquire DCOM data, and determine whether the DCOM-based calling behavior is a remote calling behavior according to the DCOM data.

[0059] DCOM data refers to data transmitted through the DCOM interface, including the command to be executed, parameter data, and information related to the DCOM call type. The DCOM call type can be a local DCOM type or a remote DCOM type. For a local DCOM type, the corresponding information includes the local call source process identifier (ID) and thread ID. For a remote DCOM type, the corresponding information includes the address information of the remote terminal. Therefore, if the DCOM data includes the address information of the remote terminal, it can be determined that the DCOM-based call behavior is a remote call behavior.

[0060] The remote call behavior identification method provided by the present invention presets a hook function at the command execution function in the DCOM component, monitors the DCOM-based call behavior through the preset hook function, and thus facilitates the effective monitoring and identification of the DCOM-based remote call behavior, laying the foundation for blocking the lateral penetration based on DCOM.

[0061] Based on any of the above embodiments, in this embodiment, before executing the hook function pre-set at the target function when the target function is called, the method further includes:

[0062] When a preset process is created and started, a hook function is set for a target function in the preset process.

[0063] It should be noted that the preset process includes a target function, that is, a command execution function within a DCOM component. Therefore, in order to execute a hook function pre-set at the target function when the target function is called, it is necessary to first set a hook function at the target function within the preset process after the preset process is created and started. The specific types of preset processes will be described in subsequent embodiments.

[0064] The remote call behavior identification method provided by the present invention sets a hook function for the target function in the preset process when the preset process is created and started, so that when the target function is called, the hook function pre-set at the target function can be executed, and then the DCOM-based call behavior can be monitored through the preset hook function, thereby effectively monitoring and identifying the DCOM-based remote call behavior, laying the foundation for blocking DCOM-based lateral penetration.

[0065] Based on any of the above embodiments, in this embodiment, when a preset process is created and started, setting a hook function for a target function in the preset process includes:

[0066] In the case where the preset process is a file explorer process, a hook function is set at the Document.Application.ShellExecute function in the DCOM component whose class identifier of the DCOM interface is {C08AFD90-F2A1-11D1-8455-00A0C91F3880} and the Document.Application.ShellExecute function in the DCOM component whose class identifier is {9BA05972-F6A8-11CF-A442-00A0C90A8F39};

[0067] In the case that the preset process is a system management program process, a hook function is set at the Document.ActiveView.ExecuteShellCommand function in the DCOM component named MMC20.Application of the DCOM interface.

[0068] Typically, the processes corresponding to the DCOM component that provides the DCOM command execution function are the file explorer process Explorer.exe and the system management program process mmc.exe.

[0069] The DCOM command execution function is fixed. For the Explorer.exe process, the DCOM command execution functions are Document.Application.ShellExecute and Document.ActiveView.ExecuteShellCommand. These functions have class identifiers {C08AFD90-F2A1-11D1-8455-00A0C91F3880} and {9BA05972-F6A8-11CF-A442-00A0C90A8F39}, respectively. These two functions can be located using these class identifiers. For the mmc.exe process, the DCOM command execution function is Document.ActiveView.ExecuteShellCommand in the DCOM component named MMC20.Application.

[0070] The remote call behavior identification method provided by the present invention can comprehensively monitor DCOM-based call behaviors by presetting hook functions at the command execution functions in the file explorer process and the DCOM component corresponding to the system management program process involving the DCOM command execution function, thereby facilitating the effective monitoring and identification of DCOM-based remote call behaviors, and laying the foundation for blocking DCOM-based lateral penetration.

[0071] Based on any of the above embodiments, in this embodiment, obtaining DCOM data includes:

[0072] Gets DCOM data from the thread environment block of the current thread.

[0073] The remote call behavior identification method provided by the present invention obtains DCOM data from the thread environment block of the current thread, laying a foundation for determining and identifying DCOM-based remote call behavior based on DCOM data, thereby facilitating the effective blocking of DCOM-based lateral penetration.

[0074] Based on any of the above embodiments, in this embodiment, after determining whether the DCOM-based calling behavior is a remote calling behavior according to the DCOM data, the method further includes:

[0075] In the case where the DCOM-based calling behavior is a remote calling behavior, obtaining address information of a remote terminal that initiates the remote calling behavior, and obtaining data of the remote calling behavior through the hook function;

[0076] The address information of the remote terminal that initiates the remote call behavior and the data of the remote call behavior are transmitted to the threat behavior engine to obtain a security identification result.

[0077] The address information of the remote terminal that initiates the remote call behavior can be obtained from the aforementioned DCOM data.

[0078] The data of the remote call behavior that initiates the remote call behavior includes the command to be executed, parameter data, and address information of the remote terminal. It is understood that the data of the remote call behavior and the DCOM data come from the same source, but will be stored in two memory addresses respectively by the system. It is understood that the threat behavior engine determines whether the remote call behavior based on DCOM poses a security threat based on a preset judgment strategy. The security assessment result can be that a security threat exists or does not exist.

[0079] The preset judgment strategy can be a set of rules for matching and detecting remote call behavior data based on the experience of security operations experts. The threat behavior identification engine matches the monitored remote call behavior data according to the rules and returns a judgment result.

[0080] For example, the remote DCOM calls powershell.exe to download and execute a malicious script. The preset judgment strategy in the threat behavior identification engine matches the remote execution data containing powershell.exe and the data used to download and execute the malicious script, and returns a threat status, which requires interception and prevention of the behavior.

[0081] The remote call behavior identification method provided by the present invention, after determining whether the DCOM-based call behavior is a remote call behavior, further determines to transmit the remote call data to the threat behavior engine, and the threat behavior engine determines whether the DCOM-based remote call behavior poses a threat to the security of the computer, thereby laying the foundation for blocking DCOM-based lateral penetration.

[0082] Based on any of the above embodiments, in this embodiment, after obtaining the security identification result, the method further includes:

[0083] When the security assessment result indicates that a security threat exists, the remote call behavior is intercepted.

[0084] Specifically, if the threat behavior engine determines that the security identification result is that a security threat exists, a message can be fed back to the monitoring module. The monitoring module receives the signal and uses the function module preset in the hook function to intercept the remote call behavior.

[0085] The remote call behavior identification method provided by the present invention intercepts the remote call behavior based on DCOM when it is determined that the remote call behavior has a security threat, thereby blocking the lateral penetration based on DCOM.

[0086] Figure 2 This is the second flow chart of the remote call behavior identification method provided by the present invention. Figure 2 As shown, the remote call behavior identification method provided by the present invention is explained using the execution process within a computer system. Specifically, the following steps may be included:

[0087] Step 200: The monitoring process starts.

[0088] Step 2101: The file explorer process starts.

[0089] Step 2102: The system management program process starts.

[0090] It can be understood that there is no execution order relationship between step 2101 and step 2102.

[0091] Step 2201: When the file explorer process is started, the monitoring module is installed. Accordingly, step 2301 is continued.

[0092] Step 2202: When the system management program process is started, the monitoring module is installed. Accordingly, the process proceeds to step 2302.

[0093] Step 2301: When the file explorer process is started and the monitoring module is installed, the monitoring module sets a hook function at the Document.Application.ShellExecute function in the DCOM component whose class identifier of the DCOM interface is {C08AFD90-F2A1-11D1-8455-00A0C91F3880} and at the Document.Application.ShellExecute function in the DCOM component whose class identifier is {9BA05972-F6A8-11CF-A442-00A0C90A8F39}.

[0094] Step 2302: When the system management program process is started and the monitoring module is installed, the monitoring module sets a hook function at the Document.ActiveView.ExecuteShellCommand function in the DCOM component named MMC20.Application of the DCOM interface.

[0095] Step 240: Determine whether the DCOM-based call is a remote call behavior through a preset hook function.

[0096] Step 250: If the DCOM-based call is a remote call behavior, obtain the address information of the remote terminal that initiates the remote call behavior and the data of the remote call behavior, and send them to the threat behavior engine.

[0097] Step 260: The threat behavior engine determines a security assessment result, and intercepts the remote call behavior if the security assessment result indicates that a security threat exists.

[0098] The remote call behavior recognition device provided by the present invention is described below. The remote call behavior recognition device described below and the remote call behavior recognition method described above can be referenced to each other.

[0099] Figure 3 Schematic diagram of the remote call behavior recognition device provided by the present invention, such as Figure 3 As shown, the remote call behavior recognition device provided by the embodiment of the present invention includes:

[0100] The execution module 310 is configured to execute a hook function pre-set at a target function when the target function is called; wherein the target function is a command execution function in a DCOM component;

[0101] A monitoring module 320, configured to monitor DCOM-based calling behaviors through the hook function;

[0102] The processing module 330 is configured to obtain DCOM data and determine whether the DCOM-based calling behavior is a remote calling behavior according to the DCOM data.

[0103] The remote call behavior identification device provided by the present invention presets a hook function at the command execution function in the DCOM component, monitors the DCOM-based call behavior through the preset hook function, and thus facilitates the effective monitoring and identification of the DCOM-based remote call behavior, laying the foundation for blocking the lateral penetration based on DCOM.

[0104] Based on any of the above embodiments, in this embodiment, the device further includes:

[0105] The setting module is used to set a hook function for a target function in a preset process when the preset process is created and started.

[0106] The remote call behavior identification device provided by the present invention sets a hook function for the target function in the preset process when the preset process is created and started, so that when the target function is called, the hook function pre-set at the target function can be executed, and then the DCOM-based call behavior can be monitored through the preset hook function, thereby effectively monitoring and identifying the DCOM-based remote call behavior, laying the foundation for blocking DCOM-based lateral penetration.

[0107] Based on any of the above embodiments, in this embodiment, the setting module includes:

[0108] a first setting unit, configured to set a hook function at the Document.Application.ShellExecute function in the DCOM component whose class identifier of the DCOM interface is {C08AFD90-F2A1-11D1-8455-00A0C91F3880} and at the Document.Application.ShellExecute function in the DCOM component whose class identifier is {9BA05972-F6A8-11CF-A442-00A0C90A8F39}, when the preset process is a file explorer process;

[0109] The second setting unit is configured to set a hook function at the Document.ActiveView.ExecuteShellCommand function in the DCOM component named MMC20.Application of the DCOM interface when the preset process is a system management program process.

[0110] The remote call behavior identification device provided by the present invention can comprehensively monitor DCOM-based call behaviors by presetting hook functions at the command execution functions in the file explorer process and the system management program process corresponding to the DCOM command execution function, thereby facilitating the effective monitoring and identification of DCOM-based remote call behaviors, thereby laying the foundation for blocking DCOM-based lateral penetration.

[0111] Based on any of the above embodiments, in this embodiment, the processing module 330 includes:

[0112] Gets the DCOM data from the thread environment block of the current thread.

[0113] The remote call behavior identification device provided by the present invention obtains DCOM data from the thread environment block of the current thread, laying a foundation for determining and identifying DCOM-based remote call behavior based on DCOM data, thereby facilitating the effective blocking of DCOM-based lateral penetration.

[0114] Based on any of the above embodiments, in this embodiment, the device further includes:

[0115] An acquisition module, configured to acquire, when the DCOM-based calling behavior is a remote calling behavior, the address information of the remote terminal that initiates the remote calling behavior, and to acquire the data of the remote calling behavior through the hook function;

[0116] The transmission module is used to transmit the address information of the remote terminal that initiates the remote call behavior and the data of the remote call behavior to the threat behavior engine to obtain a security identification result.

[0117] The remote call behavior identification device provided by the present invention, after determining whether the DCOM-based call behavior is a remote call behavior, further determines to transmit the remote call data to the threat behavior engine, and the threat behavior engine determines whether the DCOM-based remote call behavior poses a threat to the security of the computer, thereby laying the foundation for blocking DCOM-based lateral penetration.

[0118] Based on any of the above embodiments, in this embodiment, the device further includes:

[0119] The interception module is used to intercept the remote call behavior when the security identification result shows that there is a security threat.

[0120] The remote call behavior identification device provided by the present invention intercepts the remote call behavior based on DCOM when it is determined that the remote call behavior has a security threat, thereby blocking the lateral penetration based on DCOM.

[0121] Figure 4 An example of a physical structure diagram of an electronic device is shown below. Figure 4As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other via the communication bus 440. The processor 410 may call logic instructions in the memory 430 to execute a remote call behavior identification method, which includes: when a target function is called, executing a hook function pre-set at the target function; wherein the target function is a command execution function in a DCOM component; monitoring DCOM-based call behavior through the hook function; obtaining DCOM data, and determining whether the DCOM-based call behavior is a remote call behavior based on the DCOM data.

[0122] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0123] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the remote call behavior identification method provided by the present invention, which includes: when the target function is called, executing a hook function pre-set at the target function; wherein the target function is a command execution function in the DCOM component; monitoring the DCOM-based call behavior through the hook function; obtaining DCOM data, and determining whether the DCOM-based call behavior is a remote call behavior based on the DCOM data.

[0124] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the remote call behavior identification method provided by the present invention. The method includes: when a target function is called, executing a hook function pre-set at the target function; wherein the target function is a command execution function in a DCOM component; monitoring DCOM-based call behavior through the hook function; obtaining DCOM data, and determining whether the DCOM-based call behavior is a remote call behavior based on the DCOM data.

[0125] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0126] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0127] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A remote call behavior identification method, characterized in that: include: When a target function is called, a hook function pre-set at the target function is executed; wherein the target function is a command execution function in a DCOM component; The calling behavior based on DCOM is monitored through the hook function; wherein the hook function is used to interrupt the execution of the target function; Acquire DCOM data, and determine whether the DCOM-based calling behavior is a remote calling behavior based on the DCOM data; wherein the DCOM data refers to data transmitted through the DCOM interface, and the DCOM data includes a command to be executed, parameter data, and a DCOM call type; The obtaining of DCOM data includes: obtaining DCOM data from a thread environment block of a current thread; After determining whether the DCOM-based calling behavior is a remote calling behavior according to the DCOM data, the method further includes: In the case where the DCOM-based calling behavior is a remote calling behavior, obtaining address information of a remote terminal that initiates the remote calling behavior, and obtaining data of the remote calling behavior through the hook function; The address information of the remote terminal that initiates the remote call behavior and the data of the remote call behavior are transmitted to the threat behavior engine to obtain a security identification result.

2. The remote call behavior identification method according to claim 1, characterized in that: In the case where the target function is called, before executing the hook function pre-set at the target function, the method further includes: When a preset process is created and started, a hook function is set for a target function in the preset process.

3. The remote call behavior identification method according to claim 2, characterized in that: When a preset process is created and started, setting a hook function for a target function in the preset process includes: In the case where the preset process is a file explorer process, a hook function is set at the Document.Application.ShellExecute function in the DCOM component whose class identifier of the DCOM interface is {C08AFD90-F2A1-11D1-8455-00A0C91F3880} and the Document.Application.ShellExecute function in the DCOM component whose class identifier is {9BA05972-F6A8-11CF-A442-00A0C90A8F39}; In the case that the preset process is a system management program process, a hook function is set at the Document.ActiveView.ExecuteShellCommand function in the DCOM component named MMC20.Application of the DCOM interface.

4. The remote call behavior identification method according to claim 1, characterized in that: After obtaining the safety identification result, the method further includes: When the security assessment result indicates that a security threat exists, the remote call behavior is intercepted.

5. A remote call behavior recognition device, characterized in that: include: An execution module, configured to execute a hook function pre-set at a target function when the target function is called; wherein the target function is a command execution function in a DCOM component; A monitoring module, configured to monitor DCOM-based calling behavior through the hook function; wherein the hook function is configured to interrupt execution of a target function; a processing module, configured to obtain DCOM data and determine whether the DCOM-based calling behavior is a remote calling behavior based on the DCOM data; wherein the DCOM data refers to data transmitted through the DCOM interface, and the DCOM data includes a command to be executed, parameter data, and a DCOM call type; The processing module includes: an acquisition unit, which acquires DCOM data from a thread environment block of a current thread; An acquisition module, configured to acquire, when the DCOM-based calling behavior is a remote calling behavior, the address information of the remote terminal that initiates the remote calling behavior, and to acquire the data of the remote calling behavior through the hook function; The transmission module is used to transmit the address information of the remote terminal that initiates the remote call behavior and the data of the remote call behavior to the threat behavior engine to obtain a security identification result.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the remote call behavior identification method according to any one of claims 1 to 4 are implemented.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the remote call behavior recognition method according to any one of claims 1 to 4 are implemented.

8. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the remote call behavior recognition method according to any one of claims 1 to 4 are implemented.

Images