Detection method for code injection attacks based on return-oriented programming
Through automated detection of system processes, analyzing the call relationship between shared sections and function routines, and building a code injection attack chain, the problem of code injection attack detection for return programming implementation is solved, and efficient detection of the hidden behavior of malware is achieved.
Patent Information
- Application Number
- CN202210387152.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-04-13
- Publication Date
- 2024-12-10
- Estimated Expiration
- 2042-04-13
AI Technical Summary
The prior art is difficult to automatically detect code injection attacks based on return programming implementations. Attackers use code snippets of system processes to implement hidden malicious functions, resulting in difficulty in detection.
By enumerating the system process list, analyzing the address allocation and content copying operations in the shared section, determining whether the call address of the return instruction is within the address range, building a code injection attack chain, determining the calling relationship of the function routine, and determining whether the return address exceeds the return address Process space, implements automated detection of code injection attacks for return programming.
It realizes efficient and accurate automated detection of new malicious code injection attacks, and can detect hidden behaviors of malware in the process address space, avoiding the dependence of manual analysis.
Smart Images
Figure CN115017503B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of malicious code injection detection, and in particular to a detection method for code injection attacks based on return-oriented programming. Background Art
[0002] In the process of network attacks, attackers often first gain initial access to the target system by exploiting vulnerabilities or using social engineering attacks. After gaining an initial foothold in the attacked system, the attacker will further implant malware into the target system to gain persistent and covert control of the system, and establish command and control communications between the remote control server and the attacked system to achieve remote control of the target system.
[0003] In the process of implanting malware, in order to avoid detection by anti-virus software, attackers often do not implant the malware as a whole into the target system at one time. Instead, they divide the functional modules of the malware into different malicious code fragments, and then use relevant code injection methods to inject these code fragments into the normally running process modules of the target system, and then execute these malicious program fragments through remote calls. These normally running processes with injected codes are usually called target processes. When selecting the target process to inject code into, malware often deliberately selects some "trusted" processes. The so-called "trusted" process refers to the process that is defaulted to normal by the operating system. For example, csrss.exe, explorer.exe, lsass.exe, smss.exe, etc. Because these processes are usually modules that come with the operating system itself, it is not easy for anti-virus software to detect when malicious code fragments are injected into these processes.
[0004] Generally, the basic process of malware injecting code snippets is, first, to allocate address space in the target process; then, to create a thread in the target process; and finally, to copy the code snippet to the allocated address space. When the injected code snippet needs to be executed, the malware can execute the code by calling the address of the injected code snippet through address calling. The basic implementation principle of the above code injection process is as follows: Figure 1 As shown in the figure. For this code injection attack, anti-virus software usually first enumerates the list of processes running in the current system, and then checks whether there are address allocation, code copying and other behaviors in a process address space, so as to find suspicious process address operation behaviors and send alarm information to users to remind them to check the possible hidden malicious process behaviors.
[0005] In view of the characteristics of the above code injection methods, in order to more covertly avoid anti-virus software detection, some new malware has adopted a new malicious code injection method, that is, by adopting a return-oriented programming method, directly borrowing the original code fragments in the target process to implement the predetermined malicious functions, and these code fragments are called each other through return calls, thereby building a complete malicious attack behavior chain. The basic principle of this new code injection attack is to achieve the effect of code injection attack by adopting a return-oriented programming method and borrowing the code fragments of the system process itself. At present, for this new type of malicious code injection method, detection personnel usually analyze it manually, and there is no automated detection method yet. Summary of the invention
[0006] In view of this, the present invention proposes a detection method for code injection attacks based on return-oriented programming, which can realize efficient and accurate automatic detection of new attack methods.
[0007] To achieve the above object, the present invention is directed to a method for detecting code injection attacks based on return-oriented programming, comprising the following steps:
[0008] Step 1, enumerate the current process list of the system;
[0009] Step 2: for each currently running process, analyze the shared section of the process;
[0010] Step 3: for each shared section, check whether address allocation and content copy operations have occurred therein;
[0011] If the above operation process does not occur, the detection ends; if the above operation process occurs, the address range of the process shared section is further analyzed, and then step 4 is executed;
[0012] Step 4, analyzing the call address of the return instruction in the embedded code in the shared section, and determining whether the address is within the address range of the shared section;
[0013] If the address range of the shared section is not exceeded, the function routine of the call address is further analyzed, and the attack chain of this code injection attack is constructed, and the detection ends;
[0014] If the address range of the shared section is exceeded, execute step 5;
[0015] Step 5, based on the calling address of the code, determine the process to which the calling address belongs and the function routine specifically corresponding to the address;
[0016] Step 6: Analyze whether there is a return address call in the current function routine; if so, execute step 7; otherwise, build the attack chain of this code injection attack and end the detection;
[0017] Step 7, analyzing the process and function routine corresponding to the function return address artificially set in step 6;
[0018] Step 8, determining whether the return address exceeds the address space range of the current process;
[0019] If it exceeds the address space range of the current process, the function routine corresponding to the artificially set function return address is used as the current function routine, and the process returns to step 6;
[0020] If it does not exceed the address space range of the current process, the function routine of the call address is analyzed, and the attack chain of this code injection attack is constructed to end the detection.
[0021] In step 3, for each shared section, the specific method of checking whether address allocation and content copy operations have occurred therein is to check whether the following operations have been performed:
[0022] ①AllocateMemory;
[0023] ②Create thread CreateRemoteThread;
[0024] ③Implant the code WriteProcessMemory.
[0025] Wherein, in step 3, the method of analyzing the address range of the process shared section is: by parsing the structure of the process, obtaining the address range of the process shared section.
[0026] Wherein, in step 6, whether there is a return address call is determined by analyzing whether there is any behavior of modifying the register address in the function routine.
[0027] Among them, in step 8, the specific method of analyzing the function routine of the call address and constructing the attack chain of this code injection attack is: find the code fragment in the current process called according to the address, and build a code injection attack chain oriented to return programming based on the processes and function routines involved in the aforementioned process.
[0028] Beneficial effects:
[0029] The present invention is for: the code fragments implementing malicious functions in malware may be distributed in different locations of the same process address space, or distributed in the address space of different processes; these program fragments are connected through address calling to realize the connection of execution flow, thereby forming a complete attack process; the malware will carefully modify the return address (i.e., return address) of each program fragment to realize the control of program execution flow; in order to conceal its initial program fragment, the malware will also carefully select a trusted process, and then conceal its initial program fragment in the shared address space of the trusted process. The above key links are monitored and analyzed to discover its hidden malicious attack behaviors, and realize the automatic detection of code injection attacks using return-oriented programming. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] Figure 1 Schematic diagram of the process of injecting malicious code by allocating address space in the target process.
[0031] Figure 2 This is a schematic diagram of a code injection attack using return-oriented programming.
[0032] Figure 3 The figure is a schematic diagram of the detection principle of the present invention for code injection attacks implemented in return-oriented programming.
[0033] Figure 4 Flowchart for automated detection of code injection based on return-oriented programming. DETAILED DESCRIPTION
[0034] The present invention is described in detail below with reference to the accompanying drawings and embodiments.
[0035] Return-Oriented Programming (ROP) is a computer security attack technique in which the attacker hijacks the program control flow and executes machine language instruction sequence fragments (called gadgets) by controlling the stack call. Each program fragment gadget usually ends with a return instruction and is located in a subroutine in memory.
[0036] The basic principle and process of implementing code injection attacks through return-oriented programming are as follows: malware selects code snippets in the trusted target process according to its own malicious function requirements, and sets the return address after the code snippet is executed to further execute other code snippets, thereby indirectly calling the code snippets in these trusted target processes through address calls, and connecting these code snippets to run, building a code execution chain, thereby realizing its own predetermined malicious functions. Its basic principle and process are as follows Figure 2 As shown. Figure 2As can be seen from the figure, the process of implementing code injection attacks using return-oriented programming has the following characteristics:
[0037] (1) The code fragments that implement malicious functions in malware may be distributed in different locations in the address space of the same process, or in the address spaces of different processes;
[0038] (2) These program fragments are connected through address calls to achieve execution flow, thus forming a complete attack process;
[0039] (3) The malware will carefully modify the return address of each program fragment (i.e., the return address) to control the program execution process;
[0040] (4) In order to conceal its initial program fragment, malware will also carefully select a trusted process and then conceal its initial program fragment in the shared address space of the trusted process.
[0041] Therefore, in order to realize the automatic detection of code injection attacks using return-oriented programming, it is necessary to monitor and analyze these key links in the above process to discover its hidden malicious attack behaviors. The following problems need to be solved:
[0042] (1) Within a process, is new code copied into its shared space through address allocation?
[0043] (2) Is a certain program in a process called by other processes? Does it call function routines in other processes?
[0044] (3) For a function routine in a process address space, is the return address modified manually after execution? This phenomenon can prove that the program execution process is controlled manually.
[0045] (4) For a function routine in a process address space, how can we find out whether its execution scope exceeds the address space of the current process? In other words, does the execution process of the current process call function routines in other processes?
[0046] (5) Based on the above analysis factors, is there any cross-call behavior between the system analysis processes? In other words, is there an attack process that implements a code injection attack chain by setting the function return address?
[0047] If the above representative events occur, it can be determined that a return-oriented code injection attack has occurred. The detection principle of the above process is as follows: Figure 3 shown.
[0048] based on Figure 3The detection principle shown in the figure is as follows: Figure 4 As shown, the specific steps are as follows:
[0049] Step 1, enumerate the current process list of the system;
[0050] Step 2, for each currently running process, analyze the shared section BaseNamedObjects of the process;
[0051] Step 3: For each shared section, check whether address allocation and content copy operations have occurred. That is, check whether the following operations have been performed:
[0052] ①AllocateMemory;
[0053] ②Create thread CreateRemoteThread;
[0054] ③Implant the code WriteProcessMemory.
[0055] If the above operation process does not occur, it proves that there is no attack behavior and the detection ends. If the above operation process occurs, it proves that the code has been implanted in the shared section of the process, and the address range of the shared section of the process is further analyzed, and then step 4 is executed;
[0056] For the initial code implanted in the process shared section, analyze whether it subsequently executes other code. Because the security attribute of the shared section is set to Data Execution Protection (DEP), if the implanted code wants to continue the subsequent malicious operation, it must call the code beyond the address range of the shared section. By parsing the structure of the process, the address range of the shared section of the process is obtained.
[0057] Step 4, analyzing the call address of the return instruction in the embedded code in the shared section, and determining whether the address is within the address range of the shared section;
[0058] If the address range of the shared section is not exceeded, it proves that this call process only occurs inside the process. Therefore, the function routine of the call address is further analyzed, and the attack chain of this code injection attack is constructed, and the detection ends.
[0059] If it exceeds the address range of the shared section, it proves that the code implanted in the shared section calls the code in other process spaces, and it also proves that the code fragment implanted in the shared section is malicious, and then go to step 5;
[0060] Step 5, based on the calling address of the code, determine the process to which the calling address belongs and the function routine specifically corresponding to the address;
[0061] Step 6: Analyze whether there is a return address call in the current function routine. Usually, the attacker calls the specific code by manually modifying the value of the address register of the specified return address, that is, calls the return address of the predetermined address. Therefore, it is necessary to analyze whether there is a behavior of modifying the register address in the function routine to determine whether there is a return address call. If it occurs, it proves that the function return address is manually set in the function routine, and execute step 7. Otherwise, the attack chain of this code injection attack is constructed and the detection ends.
[0062] Step 7, analyzing the process and function routine corresponding to the function return address artificially set in step 6;
[0063] Step 8, determining whether the return address exceeds the address space range of the current process;
[0064] If it exceeds the address space range of the current process, the function routine corresponding to the artificially set function return address is used as the current function routine, and the process returns to step 6;
[0065] If the address space of the current process is within the range, the function routine of the call address is analyzed, and the attack chain of this code injection attack is constructed, and the detection ends. The specific method of analyzing the function routine of the call address and constructing the attack chain of this code injection attack is as follows: find the code fragment in the current process called according to the address, and construct a code injection attack chain for return programming based on the processes and function routines involved in the above process.
[0066] During this detection process, there will be no dead loop caused by continuous cross-calls between processes. This is because: (1) the process of manually modifying the function return address by modifying the value of the function address register is difficult to implement and needs to avoid the monitoring of the operating system's security protection mechanism; (2) the process space corresponding to the manually set return address is usually a program fragment carefully designed by the attacker, and the execution of this program fragment also needs to avoid the monitoring of the operating system's security protection mechanism. To achieve the above two points, the attacker needs to have a high level of technology and the security protection of the target system needs to have loopholes. Therefore, in actual situations, there will be no continuous examples of code injection attacks by modifying the return address.
[0067] In this way, a complete attack chain of code injection attacks based on return-oriented programming can be constructed, and ultimately the automatic detection of code injection attacks based on return-oriented programming can be achieved.
[0068] In summary, the above are only preferred embodiments of the present invention and are not intended to limit the protection scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.
Claims
1. A detection method for code injection attacks based on return-oriented programming, characterized in that: The steps include: Step 1, enumerate the current process list of the system; Step 2: for each currently running process, analyze the shared section of the process; Step 3: for each shared section, check whether address allocation and content copy operations have occurred therein; If the above operation process does not occur, the detection ends; if the above operation process occurs, the address range of the process shared section is further analyzed, and then step 4 is executed; Step 4, analyzing the call address of the return instruction in the embedded code in the shared section, and determining whether the address is within the address range of the shared section; If the address range of the shared section is not exceeded, the function routine of the call address is further analyzed, and the attack chain of this code injection attack is constructed, and the detection ends; If the address range of the shared section is exceeded, execute step 5; Step 5, based on the calling address of the code, determine the process to which the calling address belongs and the function routine specifically corresponding to the address; Step 6: Analyze whether there is a return address call in the current function routine; if so, execute step 7; otherwise, build the attack chain of this code injection attack and end the detection; Step 7, analyzing the process and function routine corresponding to the function return address artificially set in step 6; Step 8, determining whether the return address exceeds the address space range of the current process; If it exceeds the address space range of the current process, the function routine corresponding to the artificially set function return address is used as the current function routine, and the process returns to step 6; If it does not exceed the address space range of the current process, the function routine of the call address is analyzed, and the attack chain of this code injection attack is constructed to end the detection.
2. The method according to claim 1, characterized in that In step 3, for each shared section, the specific method of checking whether the address allocation and content copy operations have occurred therein is to check whether the following operations have been performed: ①AllocateMemory; ②Create thread CreateRemoteThread; ③Implant the code WriteProcessMemory.
3. The method according to claim 1, characterized in that In step 3, the address range of the shared section of the process is analyzed by parsing the structure of the process to obtain the address range of the shared section of the process.
4. The method according to claim 1, characterized in that In step 6, whether there is a return address call is determined by analyzing whether there is any behavior of modifying the register address in the function routine.
5. The method according to any one of claims 1 to 4, characterized in that: In step 8, the specific method of analyzing the function routine of the calling address and constructing the attack chain of this code injection attack is as follows: find the code fragment in the current process called according to the address, and build a code injection attack chain oriented to return programming based on the processes and function routines involved in the aforementioned process.