Parent process identification method, device, electronic device, storage medium and program

Abstract

The present invention provides a method, apparatus, electronic device, storage medium and program for identifying a parent process. The method includes: after detecting that a target process is created, determining the default parent process of the target process; when the default parent process is a system process, determining whether the target thread of the target process is a remote procedure call thread; and when the target thread of the target process is a remote procedure call thread, obtaining information about the real parent process from the thread environment block of the target thread. The method, apparatus, electronic device, storage medium and program for identifying a parent process provided by the present invention can identify a target process created by any process in a DCOM manner and obtain information about the real parent process corresponding to the target process, thereby improving the security defense ability.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular, to a method, device, electronic device, storage medium and program for identifying a parent process. Background Art

[0002] The Windows operating system supports creating a process in the way of DCOM (Distributed Component Object Model). For the process created by the DCOM way, the parent process is defaultly the system process Svchost.exe.

[0003] In the field of software security, the behavior of a child process is usually judged whether it is trustworthy according to the trustworthiness of the parent process. Since the system process Svchost.exe is defaultly considered trustworthy, the process created by the DCOM way can bypass the prior art that judges whether to intercept a child process based on checking the trustworthiness of the parent process.

[0004] There is no method in the prior art to find the real original parent process of the process created by the DCOM way. Summary of the Invention

[0005] Aiming at the problems existing in the prior art, the present invention provides a method, device, electronic device, storage medium and program for identifying a parent process.

[0006] The present invention provides a method for identifying a parent process, including:

[0007] After monitoring that a target process is created, determining the default parent process of the target process;

[0008] When the default parent process is a system process, judging whether the target thread of the target process is a remote procedure call thread; wherein, the target thread is the thread that creates the target process;

[0009] When the target thread of the target process is a remote procedure call thread, obtaining information of the real parent process from the thread environment block of the target thread.

[0010] According to the method for identifying a parent process provided by the present invention, the step of obtaining information of the real parent process from the thread environment block of the target thread when the target thread of the target process is a remote procedure call thread includes:

[0011] Taking the address of the ReservedForNtRpc field of the thread environment block of the target thread as the starting address, and combining with a first offset to obtain an RpcBinding handle;

[0012] Using the address of the RpcBinding handle as the starting address and combining it with a second offset to obtain a CLIENT_ID structure; the CLIENT_ID structure includes process identification number information and thread identification number information of the real parent process; wherein, the values of the first offset and the second offset are determined based on the type of operating system.

[0013] According to a method for identifying a parent process provided by the present invention, when the type of operating system is a 64-bit Windows 7 operating system, the first offset is 0x20 and the second offset is 0x1F0.

[0014] According to a method for identifying a parent process provided by the present invention, the step of determining whether the target thread of the target process is a remote procedure call thread includes:

[0015] Obtaining the ReservedForNtRpc field of the thread environment block of the target thread of the target process;

[0016] Determining whether the target thread of the target process is a remote procedure call thread according to the value of the ReservedForNtRpc field.

[0017] According to a method for identifying a parent process provided by the present invention, before the step of determining the default parent process of the target process after monitoring that the target process is created, the method further includes:

[0018] Registering a callback function in the driver, and the callback function is used to monitor the creation of the target process.

[0019] According to a method for identifying a parent process provided by the present invention, after the step of obtaining information of the real parent process from the thread environment block of the target thread when the target thread of the target process is a remote procedure call thread, the method further includes:

[0020] Judging whether the real parent process of the target process is trustworthy, and intercepting the target process when the real parent process of the target process is not trustworthy.

[0021] The present invention also provides a parent process identification device, including:

[0022] A default parent process determination module, configured to determine the default parent process of the target process after monitoring that the target process is created;

[0023] A remote procedure call thread judgment module, configured to judge whether the target thread of the target process is a remote procedure call thread when the default parent process is a system process;

[0024] The real parent process information acquisition module is used to obtain the information of the real parent process from the thread environment block of the target thread when the target thread of the target process is a remote procedure call thread.

[0025] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the steps of any one of the above-mentioned parent process identification methods are implemented.

[0026] The present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. The computer program, when executed by a processor, implements the steps of any one of the above-mentioned parent process identification methods.

[0027] The present invention also provides a computer program product, which includes computer-executable instructions that, when executed, are used to implement the steps of any one of the above-mentioned parent process identification methods.

[0028] The parent process identification method, device, electronic device, storage medium, and program provided by the present invention can identify the target process created by any process through the DCOM method and obtain the information of the real parent process corresponding to the target process, improving the security defense ability. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0030] Figure 1 is a schematic flowchart of the parent process identification method provided by the present invention;

[0031] Figure 2 is a schematic structural diagram of the parent process identification device provided by the present invention;

[0032] Figure 3 is a schematic structural diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0033] To make the objectives, technical solutions, and advantages of the present invention clearer, the following will clearly and completely describe the technical solutions in the present invention with reference to the accompanying drawings in the present invention. Apparently, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present invention without any creative efforts shall fall within the protection scope of the present invention.

[0034] The following will describe Figures 1-3 the method, device, electronic device, storage medium, and program for identifying the parent process of the present invention.

[0035] Existing mainstream security software will maintain a process list in which the parent-child process relationship is identified. When a child process performs an illegal act, it is necessary to find the information of the parent process for verification at the same time. As long as the parent process is trusted, the behavior of the child process is considered to be trusted.

[0036] However, for a child process created by the DCOM method, its parent process is not the process that actually created it, but is defaulted to the system process Svchost.exe. Since system processes are defaulted to be trusted, for a child process created by the DCOM method, it is impossible to determine whether the behavior of the child process is trusted based on whether the parent process is trusted.

[0037] The objective of the method for identifying the parent process of the present invention is to identify the true parent process of a child process created by the DCOM method.

[0038] Figure 1 As shown in Figure 1 the flowchart of the method for identifying the parent process of the present invention, the method for identifying the parent process of the present invention includes:

[0039] Step 101: After detecting that a target process is created, detect the default parent process of the target process.

[0040] In this embodiment, the target process refers to a process for which the method for identifying the parent process of the present invention needs to be used to identify the parent process.

[0041] The default parent process refers to the default parent process of the operating system. Generally speaking, if process A is created by process B, then the default parent process of process A is process B. However, if process A is created by process C through the DCOM method, then the default parent process of process A is the system process Svchost.exe, rather than process C.

[0042] The concept corresponding to the default parent process is the real parent process. The real parent process refers to the process that creates a child process through DCOM. For example, if process A is created by process C through DCOM, then the default parent process of process A is the system process Svchost.exe, and the real parent process of process A is process C.

[0043] In this embodiment, the creation of a process can be monitored by registering a callback function in the driver. After the target process is created and before the functional code of the target process runs, the callback function sends a notification that the target process has been created, thereby starting the work of detecting the default parent process of the target process. In other embodiments, other types of methods can also be used to monitor the creation of the target process, such as using a technology based on VT (Virtualization Technology) virtualization to implement a Hook on the process creation function.

[0044] The corresponding relationship between the child process and the parent process can be stored in the process list. Therefore, querying the process list can obtain the default parent process of the target process.

[0045] Step 102, when the default parent process is a system process, determine whether the target thread of the target process is a remote procedure call thread.

[0046] In this embodiment, the target thread is the thread that creates the target process.

[0047] Judge the type of the default parent process of the target process. When the default parent process is the system process Svchost.exe, in this embodiment, by obtaining the ReservedForNtRpc field of the TEB (Thread Environment Block) structure of the target thread of the target process, it is determined whether the target thread is an RPC (Remote Procedure Call) thread.

[0048] TEB is used to save thread-related data frequently used in the system. There are multiple fields in TEB. The applicant found through research that the ReservedForNtRpc field can determine whether the target thread is an RPC thread. Specifically, if the target thread is an RPC thread, the ReservedForNtRpc field is filled with a value, and if the target thread is not an RPC thread, the ReservedForNtRpc field is empty.

[0049] Step 103, when the target thread of the target process is a remote procedure call thread, obtain the information of the real parent process from the thread environment block of the target thread.

[0050] Since the thread to which the behavior of creating a process belongs must be an RPC thread in order to obtain information about the real parent process. Therefore, in the previous steps, the type of the target thread of the target process is judged. Only when the target thread is an RPC thread can the information about the real parent process be obtained through subsequent operations.

[0051] In this embodiment, if the target thread is an RPC thread, then starting from the address of the ReservedForNtRpc field of the thread environment block, the RpcBinding handle is obtained according to the first offset; then starting from the address of the RpcBinding handle, the CLIENT_ID structure is obtained according to the second offset.

[0052] The CLIENT_ID structure stores the process ID and thread ID information of the real parent process. Thus, the information about the real parent process of the target process can be obtained.

[0053] Since there is a hierarchical relationship in the thread environment block (TEB), the CLIENT_ID structure can only be obtained by first finding the RpcBinding handle and then finding the CLIENT_ID structure based on the RpcBinding handle, and finally obtaining the process ID and thread ID information of the real parent process.

[0054] The first offset and the second offset are determined according to the type of the operating system. More specifically, for the same type of operating system, when the version of the operating system is different, the first offset and the second offset can also be set to different values.

[0055] For example, in the Win7x64 (64-bit Windows 7) version of the operating system, the size of the first offset is 0x20, and the size of the second offset is 0x1F0. If the version of the operating system changes, the values of the first offset and the second offset will also change correspondingly.

[0056] For example, in the Win10x32 (32-bit Windows 10) version of the operating system, the size of the first offset is 0x14, and the size of the second offset is 0x110; in the Server2003x64 version of the operating system, the size of the first offset is 0x18, and the size of the second offset is 0x128; in the Server2003x32 version of the operating system, the size of the first offset is 0x10, and the size of the second offset is 0XB4.

[0057] The method for identifying a parent process provided by the present invention can identify a target process created by any process through the DCOM method and obtain the information about the real parent process corresponding to the target process, improving the security defense ability.

[0058] Based on any of the above embodiments, in an embodiment of the present invention, before the step of determining the default parent process of the target process after the target process is monitored and created, the method further includes:

[0059] Register a callback function in the driver, and the callback function is used to monitor the creation of the target process.

[0060] In this embodiment, the creation of the target process can be monitored by registering a callback function in the driver.

[0061] After the target process is created and before the functional code of the target process runs, the callback function issues a notification that the target process has been created, thereby starting the work of detecting the default parent process of the target process.

[0062] In other embodiments, other types of methods can also be used to monitor the creation of the target process, such as using a technology based on VT (Virtualization Technology) virtualization to implement Hook on the process creation function.

[0063] The parent process identification method provided by the present invention monitors the creation of the target process by registering a callback function in the driver, so that newly created target processes can be discovered in time, and then it can be judged whether the target process is trustworthy, which helps to improve the security defense ability.

[0064] Based on any of the above embodiments, in an embodiment of the present invention, after the step of obtaining the information of the real parent process from the thread environment block of the target thread when the target thread of the target process is a remote procedure call thread, the method further includes:

[0065] Judge whether the real parent process of the target process is trustworthy. When the real parent process of the target process is not trustworthy, intercept the target process.

[0066] According to the principle of network security, when the parent process is trustworthy, its child process is considered to be trustworthy. On the contrary, when the parent process is not trustworthy, then its child process is also considered to be untrustworthy.

[0067] Therefore, in this embodiment, it is determined whether to intercept the target process by judging whether the real parent process of the target process is trustworthy.

[0068] When the real parent process is trustworthy, the target process is trustworthy and can be released; when the real parent process is not trustworthy, the target process is not trustworthy and the target process needs to be intercepted.

[0069] After the target process is intercepted, the functional code of the target process will not be able to run.

[0070] The parent process identification method provided by the present invention determines whether the real parent process of the target process is trustworthy. When it is not trustworthy, the target process is intercepted, which helps to improve the security defense ability.

[0071] The parent process identification device provided by the present invention will be described below. The parent process identification device described below can be correspondingly referred to the parent process identification method described above.

[0072] Based on any of the above embodiments, Figure 2 is a schematic diagram of the parent process identification device provided by the present invention. As Figure 2 shown, the parent process identification device provided by the present invention includes:

[0073] A default parent process determination module 201, configured to determine the default parent process of the target process after monitoring that the target process is created;

[0074] A remote procedure call thread determination module 202, configured to determine whether the target thread of the target process is a remote procedure call thread when the default parent process is a system process;

[0075] A real parent process information acquisition module 203, configured to acquire the information of the real parent process from the thread environment block of the target thread when the target thread of the target process is a remote procedure call thread.

[0076] The parent process identification device provided by the present invention can identify the target process created by any process through the DCOM method and obtain the information of the real parent process corresponding to the target process, improving the security defense ability.

[0077] Figure 3 is a schematic diagram of the electronic device provided by the present invention. As Figure 3 shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330, and a communication bus 340. Among them, the processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 can call the logical instructions in the memory 330 to execute the parent process identification method, and the method includes:

[0078] After monitoring that the target process is created, determine the default parent process of the target process;

[0079] When the default parent process is a system process, determine whether the target thread of the target process is a remote procedure call thread;

[0080] When the target thread of the target process is a remote procedure call thread, obtain information about the real parent process from the thread environment block of the target thread.

[0081] In addition, when the logical instructions in the above-mentioned memory 330 are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical discs that can store program codes.

[0082] On the other hand, the present invention also provides a computer program product. The computer program product includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the parent process identification method provided by the above-mentioned various methods. The method includes:

[0083] After monitoring that a target process is created, determine the default parent process of the target process;

[0084] When the default parent process is a system process, determine whether the target thread of the target process is a remote procedure call thread;

[0085] When the target thread of the target process is a remote procedure call thread, obtain information about the real parent process from the thread environment block of the target thread.

[0086] On another aspect, the present invention also provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it is implemented to execute the parent process identification method provided by the above-mentioned various methods. The method includes:

[0087] After monitoring that a target process is created, determine the default parent process of the target process;

[0088] When the default parent process is a system process, determine whether the target thread of the target process is a remote procedure call thread;

[0089] When the target thread of the target process is a remote procedure call thread, obtain information about the real parent process from the thread environment block of the target thread.

[0090] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative efforts.

[0091] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution, in essence, or the part that contributes to the prior art can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0092] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments or perform equivalent replacements for some of the technical features. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of each embodiment of the present invention.

Claims

1. A method for identifying a parent process, characterized in that, Including: After detecting that a target process is created, determine the default parent process of the target process; When the default parent process is a system process, determine whether the target thread of the target process is a remote procedure call thread; wherein, the target thread is the thread that creates the target process; When the target thread of the target process is a remote procedure call thread, obtain information about the real parent process from the thread environment block of the target thread; The step of obtaining information about the real parent process from the thread environment block of the target thread when the target thread of the target process is a remote procedure call thread includes: Use the address of the ReservedForNtRpc field in the thread environment block of the target thread as the starting address, and combine it with a first offset to obtain an RpcBinding handle; Use the address of the RpcBinding handle as the starting address, and combine it with a second offset to obtain a CLIENT_ID structure; the CLIENT_ID structure includes process identification number information and thread identification number information of the real parent process; wherein, the values of the first offset and the second offset are determined based on the type of the operating system.

2. The parent process identification method according to claim 1, characterized in that, When the type of the operating system is a 64-bit Windows 7 operating system, the first offset is 0x20 and the second offset is 0x1F0.

3. The parent process identification method according to claim 1, wherein The step of determining whether the target thread of the target process is a remote procedure call thread includes: Obtain the ReservedForNtRpc field in the thread environment block of the target thread of the target process; Determine whether the target thread of the target process is a remote procedure call thread according to the value of the ReservedForNtRpc field.

4. The parent process identification method according to any one of claims 1 to 3, characterized in that Before the step of determining the default parent process of the target process after detecting that the target process is created, the method further includes: Register a callback function in the driver, and the callback function is used to monitor the creation of the target process.

5. The parent process identification method according to any one of claims 1 to 3, characterized in that After the step of obtaining information about the real parent process from the thread environment block of the target thread when the target thread of the target process is a remote procedure call thread, the method further includes: Determine whether the real parent process of the target process is trustworthy, and when the real parent process of the target process is not trustworthy, intercept the target process.

6. A parent process identification device, characterized in that, Including: A default parent process determination module, configured to determine the default parent process of the target process after detecting that the target process is created; A remote procedure call thread determination module, configured to determine whether the target thread of the target process is a remote procedure call thread when the default parent process is a system process; A real parent process information acquisition module, configured to obtain information about the real parent process from the thread environment block of the target thread when the target thread of the target process is a remote procedure call thread; The step of obtaining information about the real parent process from the thread environment block of the target thread when the target thread of the target process is a remote procedure call thread includes: Using the address of the ReservedForNtRpc field in the thread environment block of the target thread as the starting address, combine it with the first offset to obtain the RpcBinding handle; Using the address of the RpcBinding handle as the starting address, combine it with the second offset to obtain the CLIENT_ID structure; the CLIENT_ID structure includes the process identification number information and thread identification number information of the real parent process; wherein, the values of the first offset and the second offset are determined based on the type of the operating system.

7. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the parent process identification method according to any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the parent process identification method according to any one of claims 1 to 5.

9. A computer program product, the computer program product comprising computer-executable instructions, characterized in that, When the instruction is executed, it is used to implement the steps of the parent process identification method according to any one of claims 1 to 5.

Images