Method and system for determining malicious execution of shellcode

Abstract

The present invention provides a method for determining whether shellcode is maliciously executed, the method comprising: detecting a behavior event on a preset path; when the behavior event is detected, performing a stack backtrace on the current thread to obtain a function call instruction sequence of the application layer; identifying the shellcode according to the function call instruction sequence; and determining whether the shellcode is maliciously executed according to a memory chain, wherein the memory chain is constructed according to the legality of the memory operation behavior. The present invention does not rely on feature codes to identify shellcodes, but rather identifies shellcodes based on stack backtrace, and can effectively and qualitatively identify shellcodes, so it can be applied to determine various frequently changing shellcodes, and will not mistake similar codes for shellcodes. And further determining whether the shellcode is maliciously executed through the memory chain can protect against Shellcode attacks of unknown vulnerabilities. It can be seen that the present invention provides a new means for vulnerability protection and improves the ability of device security protection.

Description

Technical Field

[0001] The present invention relates to the field of computer security, and in particular to a method, system, computer equipment and computer-readable storage medium for determining malicious execution of shellcode. Background Art

[0002] Shellcode refers to a piece of binary code that is executed to exploit software vulnerabilities. It can use software vulnerabilities to establish a shell with higher permissions. Shellcode is the core of overflow programs and worm viruses. It is usually sent as malicious data to vulnerable applications in target devices to change the execution process of vulnerable applications, thereby gaining control of the target device and carrying out hacking activities. However, if shellcode can be detected in advance, corresponding preventive measures can be deployed to avoid security incidents.

[0003] In the prior art, signature detection technology is generally used to detect shellcode. And the research and development direction tends to study how to extract and match shellcode malicious signatures. However, signature detection technology has the following problems: it cannot cope with frequent and changing shellcode attacks; it is easy to misjudge when operating systems or applications generally use similar shellcodes to complete legal tasks; and it cannot protect against shellcode attacks with unknown vulnerabilities. Summary of the invention

[0004] The purpose of the present invention is to provide a method, system, computer device and computer-readable storage medium for determining malicious execution of shellcode, so as to solve the problems that the existing shellcode detection based on feature code detection cannot cope with frequent and changeable shellcode attacks, is prone to misjudgment, and cannot protect against Shellcode attacks with unknown vulnerabilities.

[0005] An aspect of an embodiment of the present invention provides a method for determining whether shellcode is maliciously executed, the method comprising: detecting a behavior event on a preset path; when the behavior event is detected, performing a stack backtrace on the current thread to obtain a function call instruction sequence of the application layer; identifying shellcode according to the function call instruction sequence; and determining whether the shellcode is maliciously executed according to a memory chain, wherein the memory chain is constructed according to the legitimacy of the memory operation behavior.

[0006] Optionally, identifying shellcode according to the function call instruction sequence includes: determining whether a memory execution address of each function call instruction in the function call instruction sequence is located in any module of the current process; and if the memory execution address of one of the function call instructions is not located in any module of the current process, determining whether a memory address segment where the memory execution address of the function call instruction is located has an executable identifier; and if the memory address segment has the executable identifier, determining that the code in the memory address segment is the shellcode.

[0007] Optionally, identifying the shellcode according to the function call instruction sequence includes: determining whether the memory execution address of each function call instruction in the function call instruction sequence is within a stack memory range; if the memory execution address of one of the function call instructions is within the stack memory range, determining that the code within the stack memory range is the shellcode.

[0008] Optionally, the memory chain includes a white memory chain and a black memory chain; the method includes: monitoring each memory operation behavior to obtain memory operation behavior information corresponding to each memory operation behavior, the memory operation behavior information including a memory address and a memory size; detecting the legality of each memory operation behavior; when the memory operation behavior is legal, adding the corresponding memory address and memory size to the white memory chain; and when the memory operation behavior is illegal, adding the corresponding memory address and memory size to the black memory chain.

[0009] Optionally, the detection of the legality of each memory operation behavior includes: when one of the memory operation behaviors is one of the following situations, the memory operation behavior is judged to be illegal: (1) a memory operation behavior applied for shellcode; (2) an illegal calling sequence of a memory instruction set; (3) a memory operation behavior based on stack memory; (4) a memory operation behavior based on a preset script.

[0010] Optionally, judging whether the shellcode is maliciously executed according to the memory chain includes: judging whether the memory address of the shellcode is located in the white memory chain; if the memory address of the shellcode is not located in the white memory chain, determining that the shellcode is maliciously executed.

[0011] Optionally, judging whether the shellcode is executed maliciously according to the memory chain includes: judging whether the memory address of the shellcode is located in the black memory chain; if the memory address of the shellcode is not located in the black memory chain, determining that the shellcode is not executed maliciously.

[0012] One aspect of an embodiment of the present invention provides a system for determining malicious execution of shellcode, including: a detection module, used to detect behavioral events on a preset path; a backtracking module, used to perform stack backtracking on a current thread when the behavioral event is detected to obtain a function call instruction sequence of an application layer; an identification module, used to identify shellcode according to the function call instruction sequence; and a judgment module, used to determine whether the shellcode is maliciously executed according to a memory chain, wherein the memory chain is constructed according to the legitimacy of the memory operation behavior.

[0013] One aspect of an embodiment of the present invention provides a computer device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method for determining malicious execution of shellcode as described above when executing the computer program.

[0014] One aspect of an embodiment of the present invention provides a computer-readable storage medium, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and when the processor executes the computer program, the steps of the method for determining malicious execution of shellcode as described above are implemented.

[0015] The method, system, device and computer-readable storage medium for determining malicious execution of shellcode provided by the embodiments of the present invention do not rely on feature codes to identify shellcode, but instead identify shellcode based on stack backtracing. The function call instruction sequence obtained based on stack backtracing can effectively and qualitatively identify shellcode, so it can be applied to determine various frequently changing shellcodes, and will not mistake similar codes for shellcodes. And by further determining whether the shellcode is maliciously executed through the memory chain, it can protect against Shellcode attacks of unknown vulnerabilities. It can be seen that the present invention provides a new means for vulnerability protection and improves the ability of device security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A diagram schematically shows an application environment of a method for determining malicious execution of shellcode according to an embodiment of the present invention;

[0017] Figure 2 The flowchart of the method for determining malicious execution of shellcode according to the first embodiment of the present invention is schematically shown;

[0018] Figure 3 for Figure 2Flow chart of sub-steps of step S204;

[0019] Figure 4 for Figure 2 Another sub-step flow chart of step S204;

[0020] Figure 5 for Figure 2 Flow chart of sub-steps of step S206;

[0021] Figure 6 for Figure 2 Another sub-step flow chart of step S206;

[0022] Figure 7 A flowchart of newly added steps of a method for determining malicious execution of shellcode according to Embodiment 1 of the present invention is schematically shown;

[0023] Figure 8 A block diagram schematically shows a system for determining malicious execution of shellcode according to a second embodiment of the present invention; and

[0024] Fig. 9 The hardware architecture diagram of a computer device suitable for implementing a method for determining malicious execution of shellcode according to Embodiment 3 of the present invention is schematically shown. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical scheme and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0026] It should be noted that the descriptions involving "first", "second", etc. in the embodiments of the present invention are only for descriptive purposes and cannot be understood as indicating or suggesting their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in the field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such a combination of technical solutions does not exist and is not within the scope of protection required by the present invention.

[0027] In the description of the present invention, it should be understood that the numerical labels before the steps do not identify the order of executing the steps, but are only used to facilitate the description of the present invention and distinguish each step, and therefore cannot be understood as a limitation of the present invention.

[0028] The following is an explanation of the terms involved in the present invention:

[0029] Memory, also known as internal storage and main memory, is used to load and run software, temporarily store processor computing data, etc.

[0030] API: It is the abbreviation of Application Programming Interface, which is the "interface between program and operating system" provided by the operating system to programmers.

[0031] Key functions: Each behavioral event can be implemented by calling API functions in the operating system. These API functions can be called key functions.

[0032] Thread: Behavior events are executed through threads, and CPU resources and memory resources are scheduled on a thread basis.

[0033] A process is the smallest unit that owns resources and runs independently, and is also the smallest unit of program execution.

[0034] The modules of a process are the modules (files) loaded by the process, such as many dll files loaded in the process.

[0035] Function call instruction sequence: also called the function call path and the function memory instruction sequence, refers to the set of functions called by the function, which corresponds to the memory address of the function called by the function.

[0036] Function stack: refers to the area in the memory used to store function call information, including key functions and call sequences of behavioral events.

[0037] Stack backtracking refers to the process of deducing the hierarchical relationship between function calls.

[0038] Memory operation behaviors may include memory modification and memory allocation.

[0039] Figure 1 The following is a schematic diagram of an environment application of a method for determining malicious execution of shellcode according to an embodiment of the present invention. Figure 1 As shown, the determination method may be executed in the server 10 or the terminal 12 .

[0040] (1) Shellcode is a piece of code (or filler data) that can be sent to the server 10 to cause an overflow through a specific vulnerability that already exists in the server 10. Among them, this code can also be used to delete important files, steal data, upload Trojan viruses and run them, or even format the hard disk for destructive purposes.

[0041] The server 10 may be composed of a single computer device or multiple computer devices, such as a rack server, a blade server, a tower server or a cabinet server (including an independent server or a server cluster composed of multiple servers).

[0042] (2) Shellcode can also be sent to terminal 12, allowing terminal 12 to execute any instructions of the attacker.

[0043] Terminal 12 can be a mobile device, a tablet device, a laptop computer, a smart device (e.g., smart clothing, smart watch, smart speaker, smart glasses), a virtual reality headset, a gaming device, a set-top box, a digital streaming device, a robot, a vehicle-mounted terminal, a smart TV, a TV box, an e-book reader, an MP3 (Moving Picture Experts Group Audio Layer III) player, an MP4 (Moving Picture Experts Group Audio Layer IV) player, etc.

[0044] The present invention provides a method for determining malicious execution of shellcode, which can accurately discover and identify shellcode without relying on specific shellcode features, and flexibly determine whether shellcode is maliciously executed from a more fine-grained API call instruction sequence and according to different protection levels. A plurality of embodiments will be provided below, and each of the embodiments provided below can be used to implement the method for determining malicious execution of shellcode described above. For ease of understanding, a computer device is described as an execution subject in an exemplary manner below. The computer device can be a server 10, a terminal 12, or other electronic device that may run shellcode.

[0045] Embodiment 1

[0046] Figure 2 The flowchart of the method for determining malicious execution of shellcode according to the first embodiment of the present invention is schematically shown. Figure 2 As shown, the method for determining whether shellcode is maliciously executed may include steps S200 to S206, wherein:

[0047] Step S200, detecting a behavior event on a preset path.

[0048] The preset path may be a necessary path for shellcode to execute malicious attacks. The behavior events include, but are not limited to, file opening events, registry modification events, memory operation behavior events, process creation events, and dynamic library loading events.

[0049] When shellcode maliciously executes an attack, it must execute some key behaviors on the preset path. When some key behaviors are monitored, these key behaviors may be behaviors including malicious attacks. Therefore, when the behavior events of these key behaviors are monitored, subsequent judgment operations need to be performed. In the present embodiment, these key behaviors can be monitored by the kernel layer, and the possible existence of shellcode can be determined based on the behavior events of the monitored key behaviors.

[0050] As an example, to increase monitoring efficiency, when detecting registry modification events, only registry modification events within a preset range may be detected, for example, only registry modification events involving "auto-startup items" and "changing security attributes" may be detected.

[0051] Step S202: When the behavior event is detected, a stack backtrace is performed on the current thread to obtain a function call instruction sequence of the application layer.

[0052] As an example, the computer device may perform stack backtracing from bottom to top, traverse the function stack of the current thread, and obtain the key function related to the behavior event and the function call instruction sequence of the key function.

[0053] Among them, the function call instruction sequence is also called the calling path of the key function and the memory instruction sequence of the key function, which refers to the function set called by the key function, corresponding to the memory address of the function called by the key function.

[0054] Step S204, identifying shellcode according to the function call instruction sequence.

[0055] The shellcode has the following specific features: it has executable properties, the corresponding memory is dynamically requested, and it does not fall into a certain module.

[0056] The above characteristics can be used for shellcode identification operations.

[0057] In an exemplary embodiment, if Figure 3 As shown, the step S204 may include steps S300 to S304, wherein, in step S300, it is determined whether the memory execution address of each function call instruction in the function call instruction sequence is located in any module of the current process; in step S302, if the memory execution address of one of the function call instructions is not located in any module of the current process, it is determined whether the memory address segment where the memory execution address of the function call instruction is located has an executable identifier; in step S304, if the memory address segment has the executable identifier, it is determined that the code in the memory address segment is the Shellcode.

[0058] The executable identification is to determine whether there is executable code in the memory address segment. In the above embodiment, based on the characteristics of shellcode, first determine that the memory execution address is not located in any module of the current thread, and then determine the executable property of the code in the memory address segment, so that shellcode can be identified.

[0059] In addition, the applicant has found that when the code is executed on the stack, it can be directly considered as shellcode.

[0060] In another exemplary embodiment, Figure 4 As shown, the step S204 may include steps S400 to S404, wherein: step S400, determining whether the memory execution address of each function call instruction in the function call instruction sequence is located within the stack memory range; step S402, if the memory execution address of one of the function call instructions is located within the stack memory range, determining that the code within the stack memory range is the Shellcode.

[0061] The above are two examples of identifying shellcode. It should be understood that the above examples do not limit the present invention to using other methods to identify shellcode.

[0062] Step S206, judging whether the shellcode is executed maliciously according to the memory chain, wherein the memory chain is constructed according to the legitimacy of the memory operation behavior.

[0063] Memory operation behavior information may include memory address (memory start address) and memory size.

[0064] Whether the shellcode is executed maliciously can be determined based on whether the memory address of the shellcode is within the memory range recorded in the memory chain. In specific operations, different determination methods can be implemented according to different protection strategies.

[0065] For example, the memory chain is divided into a black memory chain and a white memory chain. Among them, the advanced protection strategy can be to use the white memory chain to determine whether the shellcode is maliciously executed, and the intermediate protection strategy can be to use the black memory chain to determine whether the shellcode is maliciously executed.

[0066] The black memory chain stores memory operation behavior information (e.g., memory address and memory size) obtained by illegal memory operation behaviors.

[0067] The white memory chain stores memory operation behavior information (such as memory address and memory size) obtained by legal memory operation behaviors.

[0068] In an exemplary embodiment, if Figure 5As shown, the step S206 may include steps S500 to S502, wherein, in step S500, it is determined whether the memory address of the shellcode is located in the white memory chain; and in step S502, if the memory address of the shellcode is not located in the white memory chain, it is determined that the shellcode is maliciously executed. In this way, malicious attacks of various known or unknown vulnerabilities can be found.

[0069] In an exemplary embodiment, if Figure 6 As shown, the step S206 may include steps S600 to S602, wherein, in step S600, it is determined whether the memory address of the shellcode is located in the black memory chain; and in step S602, if the memory address of the shellcode is not located in the black memory chain, it is determined that the shellcode is not maliciously executed. In this way, malicious attacks of various known vulnerabilities can be found.

[0070] As an example, in order to implement different protection strategies, it is necessary to perform differentiated operations on the white memory chain and the black memory chain. For example, according to the legality or illegality of the memory operation behavior, the relevant memory operation behavior information is recorded in the white memory chain or the black memory chain respectively. Figure 7 As shown, the method may include steps S700 to S706: step S700, monitoring each memory operation behavior to obtain memory operation behavior information corresponding to each memory operation behavior, the memory operation behavior information including memory address and memory size; step S702, detecting the legality of each memory operation behavior; step S704, when the memory operation behavior is legal, adding the corresponding memory address and memory size to the white memory chain; and step S706, when the memory operation behavior is illegal, adding the corresponding memory address and memory size to the black memory chain.

[0071] As an example, to effectively determine the legality of each memory operation behavior, the following operations can be used:

[0072] If one of the memory operation behaviors is one of the following, the memory operation behavior is considered illegal:

[0073] (1) Memory operation behavior requested by shellcode;

[0074] (2) The calling sequence of the memory instruction set is illegal;

[0075] (3) Memory operation behavior based on stack memory;

[0076] (4) Memory operation behaviors based on preset scripts, for example, memory operation behaviors based on high-risk scripts.

[0077] It can be understood that memory operation behaviors other than the above-mentioned situations can be assumed to be legal memory operation behaviors.

[0078] For ease of understanding, the following is a specific example of a method for determining malicious execution of shellcode.

[0079] Step S1, monitor the memory operation behavior in the system, and record the memory address and memory size after the memory operation behavior is successful into the memory chain.

[0080] The memory chain includes a white memory chain and a black memory chain. The memory address and memory size of a legal memory operation behavior are recorded in the white memory chain, and the memory address and memory size of an illegal memory operation behavior are recorded in the black memory chain.

[0081] Step S2, detecting the behavior events on the path that must be taken when the shellcode maliciously executes the attack. The behavior events include file opening events, registry modification events, memory operation behavior events, process creation events, and dynamic library loading events.

[0082] Step S3, when the behavior event is detected, backtrack from bottom to top, traverse the function stack of the current thread, and obtain the key function related to the behavior event and the function call instruction sequence of the key function.

[0083] Step S4, determining whether the memory execution address of each function call instruction in the function call instruction sequence is located in any module of the current process or within the stack memory range.

[0084] Step S5, if the memory execution address of one of the function call instructions is not located in any module of the current process, determine whether the memory address segment where the memory execution address of the function call instruction is located has an executable identifier; if the memory address segment has an executable identifier, determine the code in the memory address segment as shellcode; if the memory execution address of one of the function call instructions is located in the stack memory range, determine the code in the stack memory range as shellcode.

[0085] Step S6, determining whether the memory address of the shellcode is located in the white memory chain.

[0086] Step S7: If the memory address of the shellcode is not located in the white memory chain, it is determined that the shellcode is being executed maliciously.

[0087] Embodiment 2

[0088] like Figure 8 As shown, Figure 8A block diagram of a shellcode malicious execution determination system 800 (hereinafter referred to as "determination system") according to Embodiment 2 of the present invention is schematically shown. The determination system can be divided into one or more program modules, and one or more program modules are stored in a storage medium and executed by one or more processors to complete the embodiment of the present invention. The program module referred to in the embodiment of the present invention refers to a series of computer program instruction segments that can complete specific functions. The following description will specifically introduce the functions of each program module in this embodiment.

[0089] A detection module 810 is used to detect behavior events on a preset path;

[0090] The backtracking module 820 is used to perform stack backtracking on the current thread to obtain a function call instruction sequence of the application layer when the behavior event is detected;

[0091] An identification module 830, configured to identify shellcode according to the function call instruction sequence; and

[0092] The judgment module 840 is used to judge whether the shellcode is executed maliciously according to the memory chain, and the memory chain is constructed according to the legitimacy of the memory operation behavior.

[0093] Optionally, the identification module 830 is further used to: determine whether the memory execution address of each function call instruction in the function call instruction sequence is located in any module of the current process; if the memory execution address of one of the function call instructions is not located in any module of the current process, determine whether the memory address segment where the memory execution address of the function call instruction is located has an executable identifier; and if the memory address segment has the executable identifier, determine that the code in the memory address segment is the Shellcode.

[0094] Optionally, the identification module 830 is further used to: determine whether the memory execution address of each function call instruction in the function call instruction sequence is within the stack memory range; if the memory execution address of one of the function call instructions is within the stack memory range, determine that the code within the stack memory range is the Shellcode.

[0095] Optionally, the memory chain includes a white memory chain and a black memory chain; the system also includes a memory chain acquisition module (unidentified), which is used to: monitor each memory operation behavior to obtain memory operation behavior information corresponding to each memory operation behavior, and the memory operation behavior information includes a memory address and a memory size; detect the legality of each memory operation behavior; when the memory operation behavior is legal, the corresponding memory address and memory size are added to the white memory chain; and when the memory operation behavior is illegal, the corresponding memory address and memory size are added to the black memory chain.

[0096] Optionally, the detection of the legality of each memory operation behavior includes: when one of the memory operation behaviors is one of the following situations, the memory operation behavior is judged to be illegal: (1) a memory operation behavior applied for shellcode; (2) an illegal calling sequence of a memory instruction set; (3) a memory operation behavior based on stack memory; (4) a memory operation behavior based on a preset script.

[0097] Optionally, the judging module 840 is further configured to: judge whether the memory address of the shellcode is located in the white memory chain; if the memory address of the shellcode is not located in the white memory chain, determine that the shellcode is being maliciously executed.

[0098] Optionally, the judgment module 840 is further used to: judge whether the memory address of the shellcode is located in the black memory chain; if the memory address of the shellcode is not located in the black memory chain, determine that the shellcode is not maliciously executed.

[0099] Embodiment 3

[0100] like Fig. 9 As shown, Fig. 9 The hardware architecture diagram of a computer device 900 suitable for implementing a method for determining malicious execution of shellcode according to Embodiment 3 of the present invention is schematically shown. In this embodiment, the computer device 900 is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions. For example, it can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a rack server, a blade server, a tower server or a cabinet server (including an independent server, or a server cluster composed of multiple servers), a gateway, etc. Fig. 9 As shown, the computer device 900 includes at least but is not limited to: a memory 910, a processor 920, and a network interface 930 that can communicate with each other through a system bus. Among them:

[0101] The memory 910 includes at least one type of computer-readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 910 can be an internal storage module of the computer device 900, such as a hard disk or memory of the computer device 900. In other embodiments, the memory 910 can also be an external storage device of the computer device 900, such as a plug-in hard disk equipped on the computer device 900, a smart memory card (Smart Media Card, referred to as SMC), a secure digital (Secure Digital, referred to as SD) card, a flash card, etc. Of course, the memory 910 can also include both the internal storage module of the computer device 900 and its external storage device. In this embodiment, the memory 910 is usually used to store the operating system and various application software installed in the computer device 900, such as the program code of the shellcode malicious execution determination method, etc. In addition, the memory 910 can also be used to temporarily store various data that have been output or will be output.

[0102] In some embodiments, the processor 920 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 920 is generally used to control the overall operation of the computer device 900, such as performing control and processing related to data interaction or communication with the computer device 900. In this embodiment, the processor 920 is used to run the program code stored in the memory 910 or process data.

[0103] The network interface 930 may include a wireless network interface or a wired network interface, and the network interface 930 is generally used to establish a communication link between the computer device 900 and other computer devices. For example, the network interface 930 is used to connect the computer device 900 to an external terminal through a network, and to establish a data transmission channel and a communication link between the computer device 900 and the external terminal. The network may be a wireless or wired network such as an intranet, the Internet, the Global System of Mobile communication (GSM), Wideband Code Division Multiple Access (WCDMA), 4G network, 5G network, Bluetooth, Wi-Fi, etc.

[0104] It should be pointed out that Fig. 9 Only a computer device having components 910 - 930 is shown, but it should be understood that implementing all of the components shown is not a requirement, and more or fewer components may alternatively be implemented.

[0105] In this embodiment, the method for determining malicious execution of shellcode stored in the memory 910 may also be divided into one or more program modules and executed by one or more processors (processor 920 in this embodiment) to complete the embodiment of the present invention.

[0106] Embodiment 4

[0107] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method for determining malicious execution of shellcode in the embodiment are implemented.

[0108] In this embodiment, the computer-readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the computer-readable storage medium can be an internal storage unit of a computer device, such as a hard disk or memory of the computer device. In other embodiments, the computer-readable storage medium can also be an external storage device of a computer device, such as a plug-in hard disk equipped on the computer device, a smart memory card (Smart Media Card, referred to as SMC), a secure digital (Secure Digital, referred to as SD) card, a flash card, etc. Of course, the computer-readable storage medium can also include both the internal storage unit of the computer device and its external storage device. In this embodiment, the computer-readable storage medium is generally used to store the operating system and various application software installed on the computer device, such as the program code of the method for determining the malicious execution of shellcode in the embodiment, etc. In addition, the computer-readable storage medium can also be used to temporarily store various types of data that have been output or are to be output.

[0109] Obviously, those skilled in the art should understand that the modules or steps of the above-mentioned embodiments of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. In this way, the embodiments of the present invention are not limited to any specific combination of hardware and software.

[0110] The above are only preferred embodiments of the present invention, and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A method for determining malicious execution of shellcode, characterized in that: The method comprises: Detect behavioral events on a preset path; When the behavior event is detected, a stack backtrace is performed on the current thread to obtain a function call instruction sequence of the application layer; Identify shellcode according to the function call instruction sequence; and Determining whether the shellcode is maliciously executed according to a memory chain, wherein the memory chain is constructed according to the legitimacy of the memory operation behavior; Wherein, identifying the shellcode according to the function call instruction sequence includes: Determine whether the memory execution address of each function call instruction in the function call instruction sequence is located in any module of the current process; If the memory execution address of one of the function call instructions is not located in any module of the current process, determining whether the memory address segment where the memory execution address of the function call instruction is located has an executable identifier; and If the memory address segment has the executable identifier, determining that the code in the memory address segment is the shellcode; Among them, the preset path is the necessary path for shellcode to maliciously execute attacks, and the behavior events include file opening events, registry modification events, memory operation behavior events, process creation events and dynamic library loading events; whether the shellcode is maliciously executed is determined based on whether the memory address of shellcode is located within the memory range recorded in the memory chain.

2. The determination method according to claim 1, characterized in that: The step of identifying the shellcode according to the function call instruction sequence further comprises: Determining whether the memory execution address of each function call instruction in the function call instruction sequence is within the stack memory range; If the memory execution address of one of the function call instructions is within the stack memory range, it is determined that the code within the stack memory range is the shellcode.

3. The determination method according to claim 1, characterized in that: The memory chain includes a white memory chain and a black memory chain; the method includes: Monitor each memory operation behavior to obtain memory operation behavior information corresponding to each memory operation behavior, wherein the memory operation behavior information includes a memory address and a memory size; Check the legality of each memory operation; When the memory operation behavior is legal, the corresponding memory address and memory size are added to the white memory chain; and When the memory operation behavior is illegal, the corresponding memory address and memory size are added to the black memory chain.

4. The determination method according to claim 3, characterized in that: The detection of the legitimacy of each memory operation behavior includes: If one of the memory operation behaviors is one of the following, the memory operation behavior is considered illegal: (1) Memory operation behavior requested by shellcode; (2) The calling sequence of the memory instruction set is illegal; (3) Memory operation behavior based on stack memory; (4) Memory operation behavior based on preset scripts.

5. The determination method according to claim 3, characterized in that: The determining whether the shellcode is maliciously executed according to the memory chain includes: Determine whether the memory address of the shellcode is located in the white memory chain; If the memory address of the shellcode is not located in the white memory chain, it is determined that the shellcode is being executed maliciously.

6. The determination method according to claim 3, characterized in that: The determining whether the shellcode is maliciously executed according to the memory chain includes: Determine whether the memory address of the shellcode is located in the black memory chain; If the memory address of the shellcode is not located in the black memory chain, it is determined that the shellcode is not maliciously executed.

7. A system for determining malicious execution of shellcode, characterized in that: include: A detection module, used to detect behavioral events on a preset path; A backtracking module is used to perform stack backtracking on the current thread to obtain a function call instruction sequence of the application layer when the behavior event is detected; An identification module, used for identifying shellcode according to the function call instruction sequence; and A judgment module, used to judge whether the shellcode is executed maliciously according to a memory chain, wherein the memory chain is constructed according to the legitimacy of the memory operation behavior; Wherein, identifying the shellcode according to the function call instruction sequence includes: Determine whether the memory execution address of each function call instruction in the function call instruction sequence is located in any module of the current process; If the memory execution address of one of the function call instructions is not located in any module of the current process, determining whether the memory address segment where the memory execution address of the function call instruction is located has an executable identifier; and If the memory address segment has the executable identifier, determining that the code in the memory address segment is the shellcode; Among them, the preset path is the necessary path for shellcode to maliciously execute attacks, and the behavior events include file opening events, registry modification events, memory operation behavior events, process creation events and dynamic library loading events; whether the shellcode is maliciously executed is determined based on whether the memory address of shellcode is located within the memory range recorded in the memory chain.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the processor is used to implement the steps of the method for determining malicious execution of shellcode according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program can be executed by at least one processor to enable the at least one processor to perform the steps of the method for determining malicious execution of shellcode according to any one of claims 1 to 6.

Images