Method, apparatus, storage medium and electronic device for detecting target malware

Abstract

The present invention relates to the field of data processing, and in particular, to a method, apparatus, storage medium, and electronic device for detecting a target malware. The method includes: regarding each kernel support function corresponding to a system call interface in the target operating system as a target kernel support function; obtaining the file path of the executable file corresponding to each target kernel support function; the executable file is stored in the storage memory of the electronic device where the target operating system is located; the target kernel support function is obtained by loading its corresponding executable file into the operating memory of the electronic device; if any file path does not meet the preset similarity condition with the kernel storage path, determining the target operating system as an operating system that has been attacked by the target malware; the kernel storage path is the storage path of the kernel of the target operating system in the storage memory of the electronic device. Thus, the accuracy of the detection result for detecting the target malware can be improved.

Description

Technical Field

[0001] The present invention relates to the field of information security, and particularly to a method, apparatus, storage medium, and electronic device for detecting a target malware. Background Art

[0002] A rootkit is a special malware that enables an attacker to access an electronic device as an administrator. Usually, a rootkit works in kernel mode and can perform attack behaviors such as modifying kernel data and hiding itself and related programs.

[0003] Currently, detecting whether an operating system has been attacked by a rootkit is generally achieved through security protection software in the operating system. The security protection software can detect whether the operating system has been attacked by a rootkit and display the detection result.

[0004] However, the security protection software is an executable file installed in the operating system. Even if the security protection software has a certain defense ability, some rootkits with stronger attack capabilities can still successfully attack the security protection software. At this time, the rootkit can tamper with the data related to the security protection software, and thus the rootkit detection method and even the detection result of the security protection software can be tampered with. Therefore, the accuracy of the detection result for detecting a rootkit is relatively low. Summary of the Invention

[0005] In view of the above technical problem of relatively low accuracy of the detection result for detecting a rootkit, the technical solution adopted by the present invention is as follows:

[0006] According to one aspect of the present disclosure, there is provided a method for detecting a target malware, including:

[0007] Regarding each kernel support function corresponding to a system call interface in the target operating system as a target kernel support function.

[0008] Obtaining the file path of the executable file corresponding to each target kernel support function; the executable file is stored in the storage memory of the electronic device where the target operating system is located; the target kernel support function is obtained by loading its corresponding executable file into the running memory of the electronic device.

[0009] If any file path does not meet the preset similarity condition with the kernel storage path, determining the target operating system as an operating system that has been attacked by the target malware; the kernel storage path is the storage path of the kernel of the target operating system in the storage memory of the electronic device.

[0010] According to another aspect of the present disclosure, there is also provided a device for detecting a target malware, including:

[0011] A target module, configured to use each kernel support function corresponding to a system call interface in a target operating system as a target kernel support function.

[0012] An acquisition module, configured to acquire a file path of an executable file corresponding to each target kernel support function; the executable file is stored in a storage memory of an electronic device where the target operating system is located; the target kernel support function is obtained by loading its corresponding executable file into a running memory of the electronic device.

[0013] A first determination module, configured to determine that the target operating system has been attacked by target malware when any file path does not meet a preset similarity condition with a kernel storage path; the kernel storage path is a storage path of a kernel of the target operating system in the storage memory of the electronic device.

[0014] According to another aspect of the present disclosure, there is also provided a non-transitory computer-readable storage medium, in which at least one instruction or at least one program segment is stored, and the at least one instruction or at least one program segment is loaded and executed by a processor to implement the method for detecting target malware described above.

[0015] According to another aspect of the present disclosure, there is also provided an electronic device, including a processor and the above-mentioned non-transitory computer-readable storage medium.

[0016] The technical solutions provided by the embodiments of the present disclosure may include the following beneficial effects:

[0017] In the present disclosure, by determining whether the file path of the executable file corresponding to each kernel support function of the target operating system satisfies a preset similarity condition with the kernel storage path, it is determined whether the target operating system has been attacked by the target malware. If any file path does not conform to the preset similarity condition with the kernel storage path, the target operating system is determined to be an operating system that has been attacked by the target malware. In the related art, it is detected by security protection software whether the operating system has been attacked by the target malware and the detection result is displayed. If the target malware tampers with the detection method or detection result of the security protection software, the accuracy of the detection result for detecting the target malware is relatively low. Compared with the related art, in the present disclosure, if the target malware successfully attacks the target operating system, the target malware has tampered with the executable files corresponding to at least one target kernel support function. At this time, by determining whether the file path of the executable file corresponding to each target kernel support function is the same as the kernel storage path, it can be determined that the target operating system has been attacked by the target malware. Furthermore, in the present disclosure, it is not necessary to resist the tampering of the executable files by the target malware, that is, even if the target malware has tampered with the executable files, it can still be detected that the target operating system has been attacked by the target malware, which can improve the accuracy of the detection result for detecting the target malware.

[0018] It should be understood that the above general description and the following detailed description are only exemplary and do not limit the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings; the drawings here are incorporated into the specification and form a part of this specification, showing embodiments consistent with the present invention, and are used together with the specification to explain the principles of the present invention.

[0020] Figure 1 is a flowchart of a method for detecting a target malware according to an exemplary embodiment.

[0021] Figure 2 is a schematic block diagram of a device for detecting a target malware according to an exemplary embodiment. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0022] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts belong to the protection scope of the present invention.

[0023] An embodiment of the present invention provides a method for detecting a target malicious software. Among them, this method can be completed by any one of the following or any combination thereof: a terminal, a server, and other devices with processing capabilities. The embodiments of the present invention do not limit this.

[0024] Next, reference will be made to Figure 1 the flowchart of the method for detecting a target malicious software shown below to introduce the method for detecting a target malicious software.

[0025] This method includes the following steps:

[0026] S100, regard each kernel support function corresponding to a system call interface in the target operating system as a target kernel support function.

[0027] Among them, the target kernel support function is stored in the running memory of the electronic device where the target operating system is located.

[0028] Specifically, the target operating system can be a Windows system or a Linux system, etc. The embodiments of the present disclosure do not limit this.

[0029] S200, obtain the file path of the executable file corresponding to each target kernel support function.

[0030] Among them, the executable file is stored in the storage memory of the electronic device where the target operating system is located; the target kernel support function is obtained by loading the corresponding executable file into the running memory of the electronic device.

[0031] S300, if any file path does not meet the preset similarity condition with the kernel storage path, determine the target operating system as an operating system that has been attacked by the target malicious software.

[0032] Among them, the kernel storage path is the storage path of the kernel corresponding to the target operating system in the storage memory of the above-mentioned electronic device. The target malicious software is a rootkit.

[0033] Specifically, for an operating system that has not been attacked by the target malicious software, the file path of the executable file corresponding to each target kernel support function is the same as the kernel storage path. Based on this:

[0034] A specific implementation manner of the above step S300 may be as follows: If any file path is different from the kernel storage path, it indicates that the executable file corresponding to the file path has been tampered with by the target malware. At this time, the target operating system can be determined as the operating system that has been attacked by the target malware.

[0035] Another specific implementation manner of the above step S300 may be as follows: If the first x-level paths of any file path are different from the first x-level paths of the kernel storage path, it indicates that the executable file corresponding to the file path has been tampered with by the target malware. At this time, the target operating system can be determined as the operating system that has been attacked by the target malware, where x is a preset number.

[0036] Among them, the kernel storage path is the storage path of the kernel of the target operating system in the storage memory of the electronic device.

[0037] It can be seen that in the present disclosure, by determining whether the file path of the executable file corresponding to each kernel support function of the target operating system satisfies a preset similarity condition with the kernel storage path, it is determined whether the target operating system has been attacked by the target malware. If any file path does not meet the preset similarity condition with the kernel storage path, the target operating system is determined as the operating system that has been attacked by the target malware. In the related art, it is detected by security protection software whether the operating system has been attacked by the target malware and the detection result is displayed. If the target malware tampers with the detection method or detection result of the security protection software, the accuracy of the detection result for detecting the target malware is relatively low. Compared with the related art, in the present disclosure, if the target malware successfully attacks the target operating system, the target malware has tampered with the executable files corresponding to at least one target kernel support function. At this time, by determining whether the file path of the executable file corresponding to each target kernel support function is the same as the kernel storage path, it can be determined that the target operating system has been attacked by the target malware. Furthermore, in the present disclosure, there is no need to resist the tampering of the executable files by the target malware, that is, even if the target malware has tampered with the executable files, it can still be detected that the target operating system has been attacked by the target malware, which can improve the accuracy of the detection result for detecting the target malware.

[0038] Optionally, the above step S200 includes the following steps:

[0039] S210, obtain the memory address of each target kernel support function.

[0040] S220, obtain the file path of the executable file corresponding to each memory address in the corresponding executable file, so as to obtain the file path of the executable file corresponding to each target kernel support function.

[0041] A specific implementation manner of step S210 may be as follows: If the target operating system is a Windows system, the SSDT (System Services Descriptor Table) corresponding to the target operating system can be obtained, and this table can be traversed to obtain the memory addresses of the kernel support functions corresponding to each system call interface in the target operating system. Among them, the SSDT can specifically adopt KeServiceDescriptorTable, and the embodiments of the present disclosure do not limit this. In addition, if the target operating system is a Windows x64 system, the memory addresses of each kernel support function can also be obtained by finding the string offsets of the kernel support functions corresponding to each system call interface in the target operating system and summing them up.

[0042] Another specific implementation manner of step S210 may be as follows: If the target operating system is a Linux system, the sys_call_table corresponding to the target operating system can be obtained, and this table can be traversed to obtain the memory addresses of the kernel support functions corresponding to each system call interface in the target operating system.

[0043] The above-mentioned SSDT or sys_call_table can be obtained by executing a driver inside the target operating system, or by obtaining the physical memory from the target operating system and parsing it. Specifically, the physical memory can be obtained by reading the computer's physical memory through the PCI Express bus, or by reading the physical memory through the IEEE 1394 interface, or by reading the physical memory in the form of software that loads a kernel module. Among them, the specific implementation manner of reading the physical memory in the form of software that loads a kernel module can be: reading the physical memory based on software such as Lime on a Linux system or reading the physical memory based on tools such as dumpit on a Windows system. After obtaining the physical memory, the volatility tool is used to obtain the memory addresses of each kernel support function or the memory addresses of the system data structures corresponding to each kernel support function, and parsing is performed to obtain the memory addresses of the kernel support functions corresponding to each system call interface in the target operating system.

[0044] A specific implementation of the above step S220 may be as follows: The registered module location list corresponding to the target operating system can be obtained, and then the file path of the executable file corresponding to each memory address can be found in the module location list to obtain the file path of the executable file corresponding to each target kernel support function. Among them, for the Linux system, the registered module location list preferably uses the mod_find binary tree instead of the module list modules as much as possible. The module location list can be a system call API (Application Programming Interface) list.

[0045] Optionally, before step S200, the method further includes the following steps:

[0046] S400, determining whether the executable files corresponding to each target kernel support function have been hidden.

[0047] Based on this, step S200 may include the following steps:

[0048] S230, if the executable files corresponding to each target kernel support function have not been hidden, then obtain the file path of the executable file corresponding to each target kernel support function.

[0049] A specific implementation of step S400 may be as follows: The registered module location list corresponding to the target operating system can be obtained, and it is determined that the file path of the executable file corresponding to each memory address can be found in the module location list. If so, it means that the executable files corresponding to each target kernel support function have not been hidden. Otherwise, it means that the executable files corresponding to at least one target kernel support function have been hidden.

[0050] A specific implementation of step S230 may be as follows: If the executable files corresponding to each target kernel support function have not been hidden, then steps S210 and S220 can be executed.

[0051] Optionally, after step S200, the method further includes the following steps:

[0052] S500, if any file path does not meet the preset similarity condition with the kernel storage path, then regard the executable files corresponding to each file path that does not meet the preset similarity condition with the kernel storage path as target executable files.

[0053] S600 displays the memory address of the target kernel support function corresponding to each target executable file, and / or the system call interface identifier corresponding to each target executable file, as well as the name, base address, offset address, data length of the file content data, and / or file path of each target executable file; the system call interface identifier is the name and / or system call interface number of the corresponding system call interface.

[0054] In addition, it can also display the system call interface identifier corresponding to each file path whose kernel storage path meets the preset similarity conditions, so as to make the displayed data more abundant and facilitate the subsequent repair of the target operating system that has been attacked by the target malware.

[0055] A specific implementation manner of the above step S500 can be as follows: If any file path does not meet the preset similarity conditions with the kernel storage path, the system call table of the target operating system can be obtained, and based on this system call table, the name, base address, offset address, data length of the file content data, and / or file path of each target executable file can be obtained, and the memory address of the target kernel support function corresponding to each target executable file, and / or the system call interface identifier corresponding to each target executable file, as well as the name, base address, offset address, data length of the file content data, and / or file path of the tampered executable file corresponding to the target identifier are displayed. Among them, the system call table can be a system call API list.

[0056] It can be seen from this that if it is detected through the fact that any file path does not meet the preset similarity conditions with the kernel storage path that the target operating system has been attacked by the target malware, the name, base address, offset address, data length of the file content data, and / or file path of the target executable file can be obtained and displayed to display more information about the target malware, which is convenient for the subsequent repair of the target operating system that has been attacked by the target malware.

[0057] Optionally, step S200 may further include the following steps:

[0058] S240, if the executable file corresponding to any target kernel support function has been hidden, determine the target operating system as the operating system attacked by the target malware.

[0059] It can be seen from this that if the executable file corresponding to any target kernel support function has been hidden, it means that the executable files corresponding to at least one target kernel support function have basically been hidden by the target malware. At this time, it can be directly determined that the target operating system is the operating system attacked by the target malware.

[0060] Optionally, after step S200, the method further includes the following steps:

[0061] S700. If the executable file corresponding to any target kernel support function has been hidden, display the memory address of each target kernel support function for which the corresponding executable file has been hidden, and / or the system call interface identifier corresponding to each target kernel support function for which the corresponding executable file has been hidden.

[0062] In addition, it is also possible to display the system call interface identifier corresponding to each target kernel support function that has not been hidden, so as to make the displayed data more abundant and facilitate subsequent repair of the target operating system that has been attacked by the target malware.

[0063] Optionally, after step S200, the method further includes the following steps:

[0064] S800. If each file path and the kernel storage path meet the preset similarity conditions, determine that the target operating system has not been attacked by the target malware.

[0065] Optionally, before any memory address and / or system call interface identifier, it is also possible to display the memory address of the kernel support function corresponding to each system call interface other than the system call interface corresponding to the target identifier. This can make the displayed data more abundant and facilitate subsequent repair of the target operating system that has been attacked by the target malware.

[0066] Optionally, if the executable file corresponding to any target kernel support function has been hidden, prompt whether to re-detect.

[0067] Furthermore, it is also possible to use detection processing to detect the target malware. This detection processing includes the following steps:

[0068] S900. Obtain the memory address of the kernel support function corresponding to each system call interface in the target operating system.

[0069] The memory address of the kernel support function is the address of the kernel support function in the running memory of the electronic device where the target operating system is located.

[0070] S1000. Determine the target category identifier from the first category identifier and the second category identifier according to the target processor architecture type, the number of system call interfaces, and a number of memory addresses, and determine the target identifier from the system call interface identifiers corresponding to a number of system call interfaces and the preset identifier.

[0071] Among them, the target processor architecture type is the type of the processor architecture corresponding to the target operating system; the first category identifier is used to indicate that the target operating system has been attacked by the target malware, and the second category identifier is used to indicate that the target operating system has not been attacked by the target malware; if the target category identifier is the first category identifier, the target identifier is the system call interface identifier of the system call interface that has been attacked by the target malware, and if the target category identifier is the second category identifier, the target identifier is a preset identifier, and the preset identifier is used to indicate that each system call interface has not been attacked by the target malware.

[0072] Specifically, the target malware is rootkit. Each kernel support function runs based on the processor architecture corresponding to the target operating system, and the processor architecture corresponding to the target operating system can be X86 architecture, ARM architecture, RISC-V architecture, MIPS architecture, etc. The target processor architecture type is the preset type of the processor architecture corresponding to the target operating system. For example, if the processor architecture corresponding to the target operating system is ARM architecture, the target processor architecture type is 1, and if the processor architecture corresponding to the target operating system is X86 architecture, the target processor architecture type is 2, etc. The first category identifier and the second category identifier are different, the preset identifier and the system call interface identifier corresponding to each system call interface are different, and the system call interface identifier is the name and / or number of the corresponding system call interface. The system call interface identifier can also be obtained by traversing the above SSDT or sys_call_table.

[0073] If the target category identifier is the first category identifier, the target identifier can be one or more, and each target identifier is the system call interface identifier of the system call interface that has been attacked by the target malware.

[0074] It can be seen from this that in the present disclosure, according to the target processor architecture type corresponding to the target operating system, the number of system call interfaces, and the memory address of each system call interface, the target category identifier and the target identifier can be determined. Among them, it can be determined whether the target operating system has been attacked by the target malware according to the target category identifier. If it is determined that the target operating system has been

[0075] attacked by the target malware, the system call interfaces in the target operating system that have been attacked by the target malware can also be determined according to the target identifier. In the related art, it is determined whether the target operating system has been attacked by the target malware by determining whether there is data in the target operating system that is the same as the known target malware. Furthermore, the detection of the target malware in the present disclosure takes into account the processor architecture type of the target operating system, the number of system call interfaces, and the memory address of each system call interface. Compared with the detection of the target malware in the related art that only considers the known target malware, the present disclosure

[0076] For at least partially unknown target malware, if it has attacked any system call interface in the target operating system and the kernel support function corresponding to the system call interface has been loaded and run in the running memory, it can be basically determined that the system call interface has been attacked by the target malware. That is, the present disclosure can detect the attack of at least partially unknown target malware on the target operating system. Therefore, the accuracy of the detection result for detecting the target malware can be improved.

[0077] Optionally, the above step S1000 includes the following steps:

[0078] S1010, obtain the trained classification model.

[0079] S1020, input the target processor architecture type, the number of system call interfaces, and several memory addresses into the trained classification model.

[0080] S1030, obtain the target class identifier and the target identifier output by the trained classification model.

[0081] A specific implementation manner of the above step S1010 may be as follows: several training samples can be obtained based on several target malware and several operating systems. Specifically, any target malware can be installed in any operating system, and then the target malware can be run based on a processor architecture corresponding to the operating system, so that the target malware attacks a system call interface of the operating system. At this time, the processor architecture type of the processor architecture, the number of system call interfaces of the operating system, the memory address corresponding to each system call interface, the first class identifier, and the system call interface identifier of the attacked system call interface can be obtained as a training sample. It is also possible to randomly run the operating system corresponding to a processor architecture of any operating system without installing the target malware, and obtain the processor architecture type of the processor architecture, the number of system call interfaces of the operating system, the memory address corresponding to each system call interface, the second class identifier, and the preset identifier as a training sample.

[0082] After obtaining several training samples, the several training samples can be randomly divided, so that a part of the training samples in the several training samples are used as a training set, and the other part of the training samples are used as a test set. Then, the initial classification model is trained based on the training set and the test set until the model converges to obtain the trained classification model. Among them, the initial classification model can be a model using neural network algorithms such as BP (BackPropagation, backpropagation algorithm). The present invention embodiment does not limit the specific model adopted by the initial classification model.

[0083] Exemplarily, when obtaining training samples, Windows systems with different kernel versions can be used. Then, after disabling the self - protection behavior in the Windows system, install a rootkit that attacks the SSDT table to obtain a number of training samples based on the Windows system that has been attacked by the rootkit. A number of training samples can also be obtained based on Windows systems with different kernel versions and without installing the rootkit.

[0084] When obtaining training samples, Linux systems with different kernel versions can also be used. Then, after disabling the self - protection behavior in the Linux system, install a rootkit that attacks the sys_call_table table to obtain a number of training samples based on the Linux system that has been attacked by the rootkit. A number of training samples can also be obtained based on Linux systems with different kernel versions and without installing the rootkit. Additionally, the random build method (such as using makerandconfig) is used for collection. In any case where a random configuration can be started, multiple re - boots are performed, and a training sample can be obtained after each boot.

[0085] The above - mentioned operating system can be the operating system of an electronic device or the operating system of a virtual machine. Among them, for the operating system of the virtual machine, the training samples can be obtained based on qemu. The operating system can be a Windows system with an ARM architecture or an X86 architecture, or a Linux system with an X86 architecture, an ARM architecture, a RISC - V architecture, or a MIPS architecture.

[0086] It can be seen from this that in the present disclosure, it is determined whether the target operating system has been attacked by the target malware through the trained classification model. Since the trained classification model is trained with data of operating systems attacked by the target malware and data of operating systems not attacked by the target malware, the trained classification model can relatively accurately master the data characteristics of operating systems attacked by the target malware and the data characteristics of operating systems not attacked by the target malware. Therefore, the present disclosure can further improve the accuracy of the detection result for detecting the target malware.

[0087] Optionally, step S1020 includes the following steps:

[0088] S1021, if the number of memory addresses is greater than the preset number, delete at least some of the memory addresses among the several memory addresses to obtain the preset number of processed memory addresses.

[0089] S1022, obtain an input vector according to the target processor architecture type, the number of system call interfaces, and the preset number of processed memory addresses.

[0090] S1023. Input the input vector into the trained classification model.

[0091] Specifically, the value range of the preset quantity can be from 100 to 1000. Preferably, the preset quantity is 512.

[0092] A specific implementation manner of step S1022 can be as follows: Take the target processor architecture type, the number of system call interfaces, and the preset number of processed memory addresses as the elements in the input vector in sequence to obtain the input vector. For example, if the target processor architecture type is 1, the number of system call interfaces is 512, and the preset number of processed memory addresses are 0x00000100, 0x00000101,..., 0x00000300 respectively, then the input vector is (1, 512, 0x00000100, 0x00000101,..., 0x00000300).

[0093] Optionally, before step S1022, the above step S1020 further includes the following steps:

[0094] S224. If the number of memory addresses is less than the preset quantity, take several memory addresses and at least one preset memory address with a value of 0 as the processed memory addresses to obtain the preset number of processed memory addresses.

[0095] For example, if the preset quantity is 512, and the number of system call interfaces of any Windows XP is 284, then take the memory addresses of the kernel support functions corresponding to the 284 system call interfaces of this Windows XP and 228 preset memory addresses with a value of 0 as 512 processed memory addresses. If the number of system call interfaces of any Windows 7 is 401, then take the memory addresses of the kernel support functions corresponding to the 401 system call interfaces of this Windows XP and 111 preset memory addresses with a value of 0 as 512 processed memory addresses. If the number of system call interfaces of any Linux 5.15 is 449, then take the memory addresses of the kernel support functions corresponding to the 449 system call interfaces of this Linux 5.15 and 63 preset memory addresses with a value of 0 as 512 processed memory addresses.

[0096] Optionally, before step S1022, the above step S1020 further includes the following steps:

[0097] S1025. If the number of memory addresses is equal to the preset quantity, take several memory addresses as the processed memory addresses to obtain the preset number of processed memory addresses.

[0098] Optionally, the system call interface attacked by the target malware is the system call interface corresponding to the executable file tampered with by the target malware; the executable file corresponding to the system call interface is stored in the storage memory of the electronic device where the target operating system is located, and the kernel support function corresponding to the system call interface is obtained by loading the executable file corresponding to the system call interface into the running memory of the electronic device.

[0099] Based on this, when obtaining training samples, attacking a system call interface of an operating system with a target malware can be to control the target malware to tamper with the executable file corresponding to a system call interface of the operating system.

[0100] Optionally, after step S1000, the detection process further includes the following steps:

[0101] S1100, if the target category identifier is the first category identifier, determine whether the tampered executable file corresponding to the target identifier has been hidden;

[0102] S1200, if the tampered executable file corresponding to the target identifier has not been hidden, display the memory address and / or the target identifier of the kernel support function corresponding to the target identifier, and the name, base address, offset address, data length of the file content data, and / or file path of the tampered executable file corresponding to the target identifier.

[0103] A specific implementation manner of the above step S1100 can be as follows: When the target category identifier is the first category identifier, it indicates that at least one system call interface of the target operating system has been attacked by the target malware, and the target identifier obtained at this time is the system call interface identifier of the system call interface attacked by the target malware. Therefore, when the target category identifier is the first category identifier, the system call table corresponding to the target operating system can be obtained from the preset database according to the target operating system, and then it is determined whether there is data information of the tampered executable file corresponding to the target identifier in the system call table based on the memory address of the kernel support function corresponding to the target identifier.

[0104] A specific implementation manner of the above step S1200 can be as follows: If the tampered executable file corresponding to the target identifier has not been hidden by the target malware, there is data information of the tampered executable file corresponding to the target identifier in the system call table. At this time, obtain the name, base address, offset address, data length of the file content data, and / or file path of the tampered executable file corresponding to the target identifier, and display the memory address and / or the target identifier of the kernel support function corresponding to the target identifier, and the name, base address, offset address, data length of the file content data, and / or file path of the tampered executable file corresponding to the target identifier.

[0105] It can be seen that after detecting that the target operating system has been attacked by the target malware, if the tampered executable file corresponding to the target identifier is not hidden, the name, base address, offset address, data length of the file content data, and / or file path of the tampered executable file corresponding to the target identifier can be obtained and displayed to display more information about the target malware, facilitating subsequent repair of the target operating system that has been attacked by the target malware.

[0106] After S1100, the detection process further includes the following steps:

[0107] S1300, if the tampered executable file corresponding to the target identifier has been hidden, display the memory address of the kernel support function corresponding to the target identifier and / or the target identifier.

[0108] If the tampered executable file corresponding to the target identifier has been hidden by the target malware, there is no data information of the tampered executable file corresponding to the target identifier in the system call table. At this time, the memory address of the kernel support function corresponding to the target identifier and / or the target identifier can be displayed.

[0109] Optionally, before displaying the memory address of the kernel support function corresponding to the target identifier and / or the target identifier, the memory address of the kernel support function corresponding to each system call interface other than the system call interface corresponding to the target identifier can also be displayed. To make the displayed data more abundant and facilitate subsequent repair of the target operating system that has been attacked by the target malware.

[0110] Optionally, if the tampered executable file corresponding to the target identifier has been hidden, prompt whether to re-detect.

[0111] The embodiment of the present invention also provides a device for detecting target malware, and this device is used to implement the method for detecting target malware described above. Refer to Figure 2 As shown in the schematic block diagram of the device for detecting target malware, the device 1400 for detecting target malware includes: a target module 1401, an acquisition module 1402, and a first determination module 1403.

[0112] The target module 1401 is used to regard the kernel support function corresponding to each system call interface in the target operating system as the target kernel support function;

[0113] The acquisition module 1402 is used to acquire the file path of the executable file corresponding to each target kernel support function; the executable file is stored in the storage memory of the electronic device where the target operating system is located; the target kernel support function is obtained by loading its corresponding executable file into the operating memory of the electronic device;

[0114] The first determination module 1403 is configured to determine the target operating system as the operating system that has been attacked by the target malware when any file path does not meet the preset similarity condition with the kernel storage path; the kernel storage path is the storage path of the kernel of the target operating system in the storage memory of the electronic device.

[0115] Optionally, the obtaining module 1402 is further configured to:

[0116] Obtain the memory address of each target kernel support function;

[0117] Obtain the file path of the executable file corresponding to each memory address in the corresponding executable file, so as to obtain the file path of the executable file corresponding to each target kernel support function.

[0118] Optionally, before obtaining the file path of the executable file corresponding to each target kernel support function, the device further includes a hiding module, configured to:

[0119] Determine whether the executable file corresponding to each target kernel support function has been hidden;

[0120] Based on this, the obtaining module 1402 is further configured to:

[0121] If the executable file corresponding to each target kernel support function has not been hidden, obtain the file path of the executable file corresponding to each target kernel support function.

[0122] Optionally, the device further includes a first display module, configured to:

[0123] If any file path does not meet the preset similarity condition with the kernel storage path, use the executable file corresponding to each file path that does not meet the preset similarity condition with the kernel storage path as the target executable file;

[0124] Display the memory address of the target kernel support function corresponding to each target executable file, and / or the system call interface identifier corresponding to each target executable file, and the name, base address, offset address, data length of the file content data, and / or file path of each target executable file; the system call interface identifier is the name and / or system call interface number of the corresponding system call interface.

[0125] Optionally, the device further includes a second determination module, configured to:

[0126] If the executable file corresponding to any target kernel support function has been hidden, determine the target operating system as the operating system that has been attacked by the target malware.

[0127] Optionally, the device further includes a second display module, configured to:

[0128] If the executable file corresponding to any target kernel support function has been hidden, then display the memory address of each target kernel support function for which the corresponding executable file has been hidden, and / or the system call interface identifier corresponding to each target kernel support function for which the corresponding executable file has been hidden.

[0129] Optionally, the device further includes a third determination module, configured to:

[0130] If each file path and the kernel storage path meet a preset similarity condition, then determine the target operating system as an operating system not attacked by the target malware.

[0131] Embodiments of the present invention further provide a non-transitory computer-readable storage medium, which can be disposed in an electronic device to store at least one instruction or at least one program related to a method in method embodiments. The at least one instruction or the at least one program is loaded and executed by the processor to implement the method provided in the above embodiments.

[0132] Embodiments of the present invention further provide an electronic device, including a processor and the foregoing non-transitory computer-readable storage medium.

[0133] Although some specific embodiments of the present invention have been described in detail by way of examples, those skilled in the art should understand that the above examples are only for illustration and not for limiting the scope of the present invention. Those skilled in the art should also understand that various modifications can be made to the embodiments without departing from the scope and spirit of the present invention. The scope of the present invention is defined by the appended claims.

Claims

1. A method for detecting a target malware, characterized in that, The method includes: Regarding each kernel support function corresponding to a system call interface in the target operating system as a target kernel support function; Obtaining the file path of the executable file corresponding to each of the target kernel support functions; the executable file is stored in the storage memory of the electronic device where the target operating system is located; the target kernel support function is obtained by loading its corresponding executable file into the running memory of the electronic device; If any of the file paths does not meet the preset similarity condition with the kernel storage path, determining that the target operating system has been attacked by a target malware; the kernel storage path is the storage path of the kernel of the target operating system in the storage memory of the electronic device; Before obtaining the file path of the executable file corresponding to each of the target kernel support functions, the method further includes: Determining whether the executable file corresponding to each of the target kernel support functions has been hidden; The obtaining the file path of the executable file corresponding to each of the target kernel support functions includes: If the executable file corresponding to each of the target kernel support functions has not been hidden, obtaining the file path of the executable file corresponding to each of the target kernel support functions; if the executable file corresponding to any of the target kernel support functions has been hidden, displaying the memory address of each target kernel support function for which the corresponding executable file has been hidden, and / or the system call interface identifier corresponding to each target kernel support function for which the corresponding executable file has been hidden.

2. The method according to claim 1, wherein The obtaining the file path of the executable file corresponding to each of the target kernel support functions includes: Obtaining the memory address of each of the target kernel support functions; Obtaining the file path of the executable file corresponding to each of the memory addresses to obtain the file path of the executable file corresponding to each of the target kernel support functions.

3. The method according to claim 1, characterized in that, The method further includes: If any of the file paths does not meet the preset similarity condition with the kernel storage path, regarding the executable file corresponding to each file path that does not meet the preset similarity condition with the kernel storage path as a target executable file; Displaying the memory address of the target kernel support function corresponding to each of the target executable files, and / or the system call interface identifier corresponding to each of the target executable files, as well as the name, base address, offset address, data length of the file content data, and / or file path of each of the target executable files; the system call interface identifier is the name and / or system call interface number of the corresponding system call interface.

4. The method according to claim 1, wherein The method further includes: If the executable file corresponding to any of the target kernel support functions has been hidden, determining that the target operating system has been attacked by a target malware.

5. The method according to claim 1, wherein The method further includes: If each of the file paths meets the preset similarity condition with the kernel storage path, determining that the target operating system has not been attacked by the target malware.

6. A device for detecting target malware, characterized in that, The device includes: A target module, configured to use each kernel support function corresponding to a system call interface in a target operating system as a target kernel support function; An obtaining module, configured to obtain a file path of an executable file corresponding to each of the target kernel support functions; the executable file is stored in a storage memory of an electronic device where the target operating system is located; the target kernel support function is obtained by loading its corresponding executable file into a running memory of the electronic device; A first determining module, configured to determine that the target operating system has been attacked by a target malware when any of the file paths does not meet a preset similarity condition with a kernel storage path; the kernel storage path is a storage path of a kernel of the target operating system in the storage memory of the electronic device; Before obtaining the file path of the executable file corresponding to each target kernel support function, the apparatus further includes a hiding module, configured to: Determine whether the executable file corresponding to each target kernel support function has been hidden; The obtaining the file path of the executable file corresponding to each of the target kernel support functions includes: If the executable file corresponding to each target kernel support function has not been hidden, obtain the file path of the executable file corresponding to each target kernel support function; if the executable file corresponding to any target kernel support function has been hidden, display a memory address of each target kernel support function for which the corresponding executable file has been hidden, and / or a system call interface identifier corresponding to each target kernel support function for which the corresponding executable file has been hidden.

7. A non-transitory computer-readable storage medium, in which at least one instruction or at least one program segment is stored, and the at least one instruction or the at least one program segment is loaded and executed by a processor to implement the method according to any one of claims 1-5.

8. An electronic device, characterized in that, Comprising a processor and the non-transitory computer-readable storage medium according to claim 7.

Images