White-box attack behavior detection method and device, electronic equipment and storage medium

Abstract

The application provides a white-box attack behavior detection method and device, electronic equipment and a storage medium, wherein the method comprises: when it is monitored that there is a trusted executable file loading behavior of a dynamic library file in a current host environment, the loading behavior is blocked; it is detected whether the dynamic library file has a legal signature, if yes, the loading behavior is released; if not, it is determined that the loading behavior is suspicious behavior; when it is determined that the loading behavior is suspicious behavior, the disk directory where the dynamic library file is located is determined, other files under the disk directory except the trusted executable file and the dynamic library file are traversed, and it is detected whether the traversed other files have a legal signature, so as to determine whether the loading behavior is a white-box attack behavior according to the detection result; when it is determined that the loading behavior is a white-box attack behavior, the white-box attack behavior is alarmed, otherwise, the loading behavior is released. The scheme can realize rapid identification of the white-box attack behavior.

Description

Technical Field

[0001] This invention relates to the field of network information security technology, and in particular to a method, apparatus, electronic device, and storage medium for detecting white-on-black attack behavior. Background Technology

[0002] The white-plus-black attack technique is an attack that uses a trusted white file to load a malicious black file, thereby evading detection by security software.

[0003] Existing white-plus-black attack detection methods mainly include two types: one relies on malware detection engines for malicious detection, and the other utilizes the proactive protection of security software to identify suspicious behavior. Because the black files in white-plus-black attack techniques often execute vulnerable code in memory, malware detection technologies struggle to effectively identify them, and proactive protection in security software often treats this operation of loading unknown dynamic libraries using trusted white files as normal operation.

[0004] How to detect white-on-black attacks has become a pressing technical problem that needs to be solved. Summary of the Invention

[0005] This invention provides a method, apparatus, electronic device, and storage medium for detecting white-on-black attacks, which can quickly identify white-on-black attacks.

[0006] In a first aspect, embodiments of the present invention provide a method for detecting white-on-black attack behavior, including:

[0007] When a trusted executable file is detected loading a dynamic library file in the current host environment, the loading behavior is blocked.

[0008] The system checks whether the dynamic library file has a valid signature. If it does, the loading behavior is allowed; otherwise, the loading behavior is determined to be suspicious.

[0009] When the loading behavior is determined to be suspicious, the disk directory where the dynamic library file is located is determined, and other files in the disk directory other than the trusted executable file and the dynamic library file are traversed. The presence of a legitimate signature in the other traversed files is checked to determine whether the loading behavior is a white-on-black attack based on the detection results.

[0010] If the loading behavior is determined to be a white-plus-black attack, an alarm is issued for the white-plus-black attack; otherwise, the loading behavior is allowed.

[0011] Secondly, embodiments of the present invention also provide a white-on-black attack behavior detection device, comprising:

[0012] The monitoring and blocking unit is used to block the loading behavior when it is detected that a trusted executable file is loading a dynamic library file in the current host environment.

[0013] The first detection unit is used to detect whether the dynamic library file has a valid signature. If it does, the loading behavior is allowed; if it does not, the loading behavior is determined to be suspicious.

[0014] The second detection unit is used to determine the disk directory where the dynamic library file is located when the loading behavior is determined to be suspicious, traverse the other files in the disk directory other than the trusted executable file and the dynamic library file, and detect whether the other files traversed have a legitimate signature, so as to determine whether the loading behavior is a white-on-black attack behavior based on the detection results.

[0015] The processing unit is configured to issue an alarm for the white-plus-black attack behavior when it is determined that the loading behavior is a white-plus-black attack behavior; otherwise, it allows the loading behavior to proceed.

[0016] Thirdly, embodiments of the present invention also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the method described in any embodiment of this specification.

[0017] Fourthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the methods described in any embodiment of this specification.

[0018] This invention provides a method, apparatus, electronic device, and storage medium for detecting white-plus-black attacks. When a trusted executable file is detected loading a dynamic library file in the current host environment, this loading behavior is blocked to further determine if it is suspicious. If the loading behavior is determined to be suspicious, other files in the disk directory where the loaded dynamic library file is located are traversed and checked to determine whether the loading behavior constitutes a white-plus-black attack based on the detection results of whether other files have valid signatures. Therefore, this solution achieves rapid identification of white-plus-black attacks simply by checking the signature status of other files in the loading directory during dynamic loading. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart of a white-on-black attack behavior detection method provided by an embodiment of the present invention;

[0021] Figure 2 This is a hardware architecture diagram of an electronic device provided in an embodiment of the present invention;

[0022] Figure 3 This is a structural diagram of a white-on-black attack behavior detection device provided in an embodiment of the present invention. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0024] To ensure software execution, files in the software installation directory typically have the vendor's legal signature. Only a very small number of open-source dynamic libraries may lack this signature. Security software's proactive protection features, designed to prevent false positives when unsigned dynamic library files are loaded, allow trusted executables to load these files. Attackers can exploit this vulnerability to place malicious files in the dynamic library directory and load them through trusted executables, thus evading detection by the security software's proactive protection features. Furthermore, malware detection engines require file content to determine if a file is malicious. However, malicious files are usually encrypted, and their vulnerable code only executes when the executable loads the dynamic library file into memory. Therefore, malware detection engines often fail to detect such malicious files.

[0025] To address the aforementioned issues, the inventive concept of this invention is as follows: Considering that most files in a normal dynamic library file directory have legitimate signatures, attackers place a large number of black files in the directory, increasing the number of files without legitimate signatures. Thus, when a trusted executable file loads a dynamic library file without a legitimate signature, the system can determine whether the loading behavior is a white-on-black attack by detecting whether other files in the disk directory where the dynamic library file is located have legitimate signatures.

[0026] The following describes the specific implementation of the above concept.

[0027] Please refer to Figure 1 This invention provides a method for detecting white-on-black attack behavior, the method comprising:

[0028] Step 100: When a trusted executable file is detected loading a dynamic library file in the current host environment, the loading behavior is blocked.

[0029] Step 102: Check if the dynamic library file has a valid signature. If it does, allow the loading behavior; if it does not, determine that the loading behavior is suspicious.

[0030] Step 104: When it is determined that the loading behavior is suspicious, determine the disk directory where the dynamic library file is located, traverse the other files in the disk directory other than the trusted executable file and the dynamic library file, and check whether the other files traversed have a legitimate signature, so as to determine whether the loading behavior is a white-on-black attack behavior based on the detection results.

[0031] Step 106: If it is determined that the loading behavior is a white-plus-black attack behavior, then an alarm is issued for the white-plus-black attack behavior; otherwise, the loading behavior is allowed.

[0032] In this embodiment of the invention, when a trusted executable file is detected loading a dynamic library file in the current host environment, the loading behavior is blocked to further determine whether it is suspicious. If the loading behavior is determined to be suspicious, it is necessary to traverse and detect other files in the disk directory where the loaded dynamic library file is located to ultimately determine whether the loading behavior is a white-on-black attack based on the detection results of whether other files have valid signatures. Therefore, this solution merely determines whether it is a white-on-black attack by checking the signature status of other files in the loading directory during dynamic loading, thus achieving rapid identification of white-on-black attacks.

[0033] The following description Figure 1 The execution method for each step is shown.

[0034] First, we will explain both step 100, "When a trusted executable file is detected loading a dynamic library file in the current host environment, the loading behavior is blocked," and step 102, "Detect whether the dynamic library file has a valid signature. If it does, the loading behavior is allowed; if it does not, the loading behavior is determined to be suspicious."

[0035] In this embodiment of the invention, monitoring instructions can be deployed on the host machine to monitor loading behavior in the current host environment. Specifically, this mainly involves monitoring the loading behavior of executable files (.exe files) on dynamic library files (.dll files). The executable file and the dynamic library file can be binary files.

[0036] The executable file is trusted and is on the security software's whitelist. Therefore, the security software will allow the loading of dynamic library files by this trusted executable file. The loading behavior monitored in this embodiment of the invention is a loading behavior allowed by the security software. This loading behavior is temporarily blocked to further detect whether it constitutes a white-to-black attack.

[0037] In this embodiment of the invention, the presence or absence of a valid signature on the loaded dynamic library file is used to determine whether the loading behavior is suspicious. Specifically, the suspicious behavior is first checked to see if the dynamic library file has a signature. If it does not exist, the loading behavior is determined to be suspicious. If it does exist, the integrity and validity of the signature are further determined to determine if it is a valid signature. If it is not a valid signature, the loading behavior is determined to be suspicious. If a valid signature exists, the loading behavior is determined not to be suspicious, and the suspicious behavior is allowed to proceed.

[0038] Then, regarding step 104, when it is determined that the loading behavior is suspicious, the disk directory where the dynamic library file is located is determined, and other files in the disk directory other than the trusted executable file and the dynamic library file are traversed. The presence of a legitimate signature is checked in the traversed files to determine whether the loading behavior is a white-on-black attack based on the detection results.

[0039] In this embodiment of the invention, by obtaining the disk directory where the dynamic library file is located, the other files in the disk directory other than the trusted executable file and the dynamic library file are traversed and detected one by one, to determine whether the other files traversed have a legitimate signature, so as to determine whether the loading behavior is a white-on-black attack behavior based on the detection result of the other files having a legitimate signature.

[0040] In one implementation, the other files can be executable files, or they can be known files and dynamic library files. Since an executable file is an executable program, its execution in the host environment can affect the security of the host environment. Therefore, the main focus can be on checking the legitimate signatures of other executable files in the disk directory. Additionally, dynamic library files can be loaded and run in memory, which also impacts the security of the host environment. Furthermore, dynamic library files require an executable file to load them for execution. Therefore, the legitimate signatures of executable files and dynamic library files can be combined for verification to determine whether the loading behavior constitutes a white-on-black attack.

[0041] Since trusted executable files may or may not have a valid signature, different methods can be used to determine whether a trusted executable file has a valid signature, thereby improving the speed of white-plus-black attack detection. Specifically, when determining whether a loading behavior is a white-plus-black attack based on the detection results, the following can be included:

[0042] Determine whether the trusted executable file has a valid signature. If it does, determine whether the loading behavior is a white-on-black attack based on the proportion of other files with valid signatures in the detection results. If it does not, determine whether the loading behavior is a white-on-black attack based on the number of other files without valid signatures in the detection results.

[0043] Scenario 1: If the trusted executable file has a valid signature, it means that a trusted executable file with a valid signature is loading a dynamic library file without a valid signature. In this case, under normal circumstances, most files in the disk directory where the dynamic library file is located have valid signatures. If this is not the case, it means that the loading behavior is likely a white-to-black attack. Therefore, the percentage of other files with valid signatures in the detection results can be used to determine whether the loading behavior is a white-to-black attack.

[0044] Scenario 2: If the trusted executable file does not have a valid signature, it means that the trusted executable file without a valid signature is loading a dynamic library file without a valid signature. In this case, the files in the disk directory where the dynamic library file is located are likely black files deployed by the attacker. As long as the number of files without valid signatures exceeds a certain set value, it can be determined that the loading behavior is a white-to-black attack. Therefore, the loading behavior can be quickly determined as a white-to-black attack by the number of other files without valid signatures in the detection results.

[0045] The following will explain the two situations mentioned above.

[0046] Regarding scenario one:

[0047] In one embodiment of the present invention, determining whether the loading behavior constitutes a white-to-black attack based on the proportion of other files with legitimate signatures in the detection results may include the following:

[0048] Determine whether the number of traversals and checks on other files in the disk directory has reached the number required by the first set condition; if so, determine the total number of files that have been traversed and checked and the number of legal files with valid signatures based on the detection results; determine whether the ratio of the number of legal files to the total number of files is not greater than the first threshold; if so, determine that the loading behavior is a white-plus-black attack behavior; otherwise, determine that the loading behavior is not a white-plus-black attack behavior.

[0049] In this embodiment of the invention, the quantity required by the first set condition can be the first of the total number of other files in the disk directory and the target quantity.

[0050] Since the dynamic library files reside in different disk directories, and the number of files in each directory varies, if the number of files in a directory is small, all other files in the directory can be traversed and checked to determine whether the loading behavior constitutes a white-plus-black attack. However, if the number of files in a directory is large, traversing and checking all other files would consume a significant amount of time, negatively impacting user experience. Therefore, a target number can be set. If the total number of other files in the directory is less than this target number, all other files can be traversed and checked. If the total number of other files is greater than the target number, only the target number of files can be traversed and checked before a judgment is given, ensuring a fast response when the loading behavior is normal.

[0051] Furthermore, according to the aforementioned embodiments, the other file is an executable file; or, the other file is an executable file and a dynamic library file; then, the threshold values ​​set are different when the other file is an executable file and when the other file is an executable file and a dynamic library file.

[0052] Specifically, when the other file is an executable file, the first threshold value is set less than the first threshold value when the other file is both an executable file and a dynamic library file. For example, when the other file is an executable file, the first threshold is G. If the ratio of the number of legitimate files with valid signatures among the other executable files in the disk directory to the total number of files that have been traversed and detected is not greater than the first threshold G, then the loading behavior is determined to be a white-on-black attack. When the other file is both an executable file and a dynamic library file, the first threshold is H. Since G is less than H, if the ratio of the number of legitimate files with valid signatures among the other executable files and other dynamic library files in the disk directory to the total number of files that have been traversed and detected is not greater than the first threshold H, then the loading behavior is determined to be a white-on-black attack.

[0053] In practical applications, a positive threshold determination table can be maintained to determine white-on-black attack behavior. In one embodiment, the positive threshold determination table is shown in Table 1 below:

[0054] Table 1:

[0055]

[0056] It is understandable that these judgment thresholds can be dynamically adjusted to adapt to different host scenarios and tolerance for false positives and false negatives.

[0057] Regarding scenario two:

[0058] In one embodiment of the present invention, determining whether the loading behavior is a white-on-black attack based on the number of other files without valid signatures in the detection results may include the following:

[0059] Based on the detection results, determine whether the number of other files without valid signatures reaches the number required by the second set condition. If it does, then determine that the loading behavior is a white-plus-black attack behavior; otherwise, determine that the loading behavior is not a white-plus-black attack behavior.

[0060] In this embodiment of the invention, the quantity required by the second setting condition is related to the total number of other files in the disk directory and the size of the second threshold, and may specifically include the following two cases:

[0061] Case A: When the total number of other files in the disk directory is less than the second threshold, if the ratio of the number of other files without legal signatures to the total number of other files in the disk directory is not less than the third threshold, then it is determined that the number of other files without legal signatures meets the requirements of the second set condition.

[0062] Case B: When the total number of other files in the disk directory is not less than the second threshold, the number required by the second setting condition is the second threshold.

[0063] For example, if the second threshold is 10, and the total number of other files in the disk directory is 20, then the second threshold requires a quantity of 10.

[0064] In scenario two, if the number of files without valid signatures exceeds the second threshold, the loading behavior can be determined to be a white-and-black attack. However, if the total number of other files in the disk directory is small, possibly less than the second threshold (scenario A), it will lead to an inability to determine the attack. Therefore, for scenario A, if the ratio of the number of other files without valid signatures to the total number of other files in the disk directory exceeds the third threshold, the loading behavior is determined to be a white-and-black attack. If the total number of other files in the disk directory is not less than the second threshold (scenario B), then as long as the number of other files without valid signatures exceeds the second threshold, the loading behavior is determined to be a white-and-black attack.

[0065] Similarly, in practical applications, a reverse threshold determination table can be maintained to determine white-on-black attack behavior. In one embodiment, the reverse threshold determination table is shown in Table 2 below:

[0066] Table 2:

[0067]

[0068] It is understandable that these judgment thresholds can be dynamically adjusted to adapt to different host scenarios and tolerance for false positives and false negatives.

[0069] The above implements the determination of whether the loading behavior is a white-on-black attack.

[0070] If the loading behavior is determined to be a white-plus-black attack, an alarm is issued for the white-plus-black attack; otherwise, the loading behavior is allowed.

[0071] In this embodiment of the invention, there is no need to implement white-plus-black attack behavior through dynamic behavior. Instead, the signature status of other files in the loading directory is detected during dynamic loading to quickly determine whether the loading behavior is a white-plus-black attack behavior based on the detection results.

[0072] In this embodiment of the invention, detection can be performed while traversing. When the number of other files in the disk directory is large, it is not necessary to traverse them all. The signature status of the number of files that have been traversed and detected can be used to determine white-and-black attack behavior, thereby saving directory traversal time and preventing long traversal times for very large directories, which would delay the response and processing for users and affect the user experience.

[0073] In this embodiment of the invention, threshold tables with two dimensions (positive and negative) are used to make different judgments for different situations, thereby enabling faster identification of white-on-black attack behavior.

[0074] In this embodiment of the invention, the judgment threshold can be dynamically adjusted according to the actual scenario of the host and the tolerance for false alarms and missed alarms, so that the method can meet more scenarios.

[0075] like Figure 2 , Figure 3 As shown, this invention provides a device for detecting white-on-black attacks. The device can be implemented in software, hardware, or a combination of both. From a hardware perspective, such as... Figure 2 The diagram shown is a hardware architecture diagram of an electronic device used for detecting white-on-black attack behavior, as provided in an embodiment of the present invention. (Except for...) Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing packets. Taking software implementation as an example, such as... Figure 3 As shown, a device in a logical sense is formed by the CPU of its host electronic device reading the corresponding computer program from non-volatile memory into memory for execution. This embodiment provides a white-on-black attack behavior detection device, comprising:

[0076] The monitoring blocking unit 301 is used to block the loading behavior when it is detected that a trusted executable file is loading a dynamic library file in the current host environment;

[0077] The first detection unit 302 is used to detect whether the dynamic library file has a valid signature. If it does, the loading behavior is allowed; if it does not, the loading behavior is determined to be suspicious.

[0078] The second detection unit 303 is used to determine the disk directory where the dynamic library file is located when the loading behavior is determined to be suspicious, traverse the other files in the disk directory other than the trusted executable file and the dynamic library file, and detect whether the other files traversed have a legitimate signature, so as to determine whether the loading behavior is a white-on-black attack behavior based on the detection results.

[0079] The processing unit 304 is configured to issue an alarm for the white-plus-black attack behavior when it is determined that the loading behavior is a white-plus-black attack behavior; otherwise, it allows the loading behavior to proceed.

[0080] In one embodiment of the present invention, when the second detection unit determines whether the loading behavior is a white-on-black attack behavior based on the detection result, it specifically includes:

[0081] Determine whether the trusted executable file has a valid signature. If it does, determine whether the loading behavior is a white-on-black attack based on the proportion of other files with valid signatures in the detection results. If it does not, determine whether the loading behavior is a white-on-black attack based on the number of other files without valid signatures in the detection results.

[0082] In one embodiment of the present invention, when the second detection unit determines whether the loading behavior is a white-on-black attack based on the proportion of other files with legitimate signatures in the detection results, it specifically includes:

[0083] Determine whether the number of traversals and checks on other files in the disk directory has reached the number required by the first set condition; if so, determine the total number of files that have been traversed and checked and the number of legal files with valid signatures based on the detection results; determine whether the ratio of the number of legal files to the total number of files is not greater than the first threshold; if so, determine that the loading behavior is a white-plus-black attack behavior; otherwise, determine that the loading behavior is not a white-plus-black attack behavior.

[0084] In one embodiment of the present invention, the quantity required by the first set condition is the first of the total number of other files in the disk directory and the target quantity to be reached.

[0085] In one embodiment of the present invention, when the second detection unit determines whether the loading behavior is a white-on-black attack based on the number of other files without legitimate signatures in the detection results, it specifically includes:

[0086] Based on the detection results, determine whether the number of other files without valid signatures reaches the number required by the second set condition. If it does, then determine that the loading behavior is a white-plus-black attack behavior; otherwise, determine that the loading behavior is not a white-plus-black attack behavior.

[0087] In one embodiment of the present invention, when the total number of other files in the disk directory is less than a second threshold, if the ratio of the number of other files without legal signatures to the total number of other files in the disk directory is not less than a third threshold, then the number of other files without legal signatures is determined to meet the requirements of the second set condition.

[0088] When the total number of other files in the disk directory is not less than the second threshold, the number required by the second setting condition is the second threshold.

[0089] In one embodiment of the present invention, the other file is an executable file; or,

[0090] The other files are executable files and dynamic library files;

[0091] The threshold values ​​are different when the other files are executable files, and when the other files are both executable files and dynamic library files.

[0092] It is understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on a white-and-black attack behavior detection device. In other embodiments of the present invention, a white-and-black attack behavior detection device may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0093] The information interaction and execution process between the modules in the above-mentioned device are based on the same concept as the method embodiment of the present invention, and the specific details can be found in the description of the method embodiment of the present invention, and will not be repeated here.

[0094] This invention also provides an electronic device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements a white-on-black attack behavior detection method according to any embodiment of this invention.

[0095] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform a white-plus-black attack detection method according to any embodiment of this invention.

[0096] Specifically, a system or apparatus equipped with a storage medium may be provided, on which software program code implementing the functions of any of the embodiments described above is stored, and the computer (or CPU or MPU) of the system or apparatus may read and execute the program code stored in the storage medium.

[0097] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute part of the present invention.

[0098] Examples of storage media used to provide program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer via a communication network.

[0099] Furthermore, it should be clear that not only can the program code read by the computer be executed, but also the operating system or other components operating on the computer can be instructed based on the program code to perform some or all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0100] Furthermore, it is understood that the program code read from the storage medium is written to the memory set in the expansion board inserted into the computer or to the memory set in the expansion module connected to the computer. Then, based on the instructions of the program code, the CPU or other components installed on the expansion board or expansion module execute some and all of the actual operations, thereby realizing the function of any of the above embodiments.

[0101] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0102] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as ROM, RAM, magnetic disk, or optical disk.

[0103] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting white-on-black attack behavior, characterized in that, include: When a trusted executable file is detected loading a dynamic library file in the current host environment, the loading behavior is blocked. The system checks whether the dynamic library file has a valid signature; if it does, the loading process is allowed. If it does not exist, then the loading behavior is determined to be suspicious. When the loading behavior is determined to be suspicious, the disk directory where the dynamic library file is located is determined, and other files in the disk directory other than the trusted executable file and the dynamic library file are traversed. The presence of a legitimate signature in the other traversed files is checked to determine whether the loading behavior is a white-on-black attack based on the detection results. If the loading behavior is determined to be a white-plus-black attack, an alarm is issued for the white-plus-black attack; otherwise, the loading behavior is allowed. The step of determining whether the loading behavior is a white-on-black attack based on the detection results includes: Determine whether the trusted executable file has a valid signature; If it exists, determine whether the number of traversals and checks on other files in the disk directory has reached the number required by the first set condition; if so, determine the total number of files that have been traversed and checked and the number of legal files with valid signatures based on the detection results; determine whether the ratio of the number of legal files to the total number of files is not greater than the first threshold; if so, determine that the loading behavior is a white-on-black attack behavior; otherwise, determine that the loading behavior is not a white-on-black attack behavior. If none exists, then based on the detection results, determine whether the number of other files without valid signatures reaches the number required by the second set condition. If it does, then determine that the loading behavior is a white-plus-black attack behavior; otherwise, determine that the loading behavior is not a white-plus-black attack behavior.

2. The method according to claim 1, characterized in that, The quantity required by the first setting condition is the first of the total number of other files in the disk directory and the target number to be reached.

3. The method according to claim 1, characterized in that, If the total number of other files in the disk directory is less than the second threshold, and the ratio of the number of other files without legal signatures to the total number of other files in the disk directory is not less than the third threshold, then the number of other files without legal signatures is determined to meet the requirements of the second set condition. When the total number of other files in the disk directory is not less than the second threshold, the number required by the second setting condition is the second threshold.

4. The method according to claim 1, characterized in that, The other files are executable files; or, The other files are executable files and dynamic library files; The threshold values ​​are different when the other files are executable files, and when the other files are both executable files and dynamic library files.

5. A device for detecting white-on-black attack behavior, characterized in that, The method for performing the white-plus-black attack behavior detection method as described in any one of claims 1-4 above includes: The monitoring and blocking unit is used to block the loading behavior when it is detected that a trusted executable file is loading a dynamic library file in the current host environment. The first detection unit is used to detect whether the dynamic library file has a valid signature. If it does, the loading behavior is allowed; if it does not, the loading behavior is determined to be suspicious. The second detection unit is used to determine the disk directory where the dynamic library file is located when the loading behavior is determined to be suspicious, traverse the other files in the disk directory other than the trusted executable file and the dynamic library file, and detect whether the other files traversed have a legitimate signature, so as to determine whether the loading behavior is a white-on-black attack behavior based on the detection results. The processing unit is configured to issue an alarm for the white-plus-black attack behavior when it is determined that the loading behavior is a white-plus-black attack behavior; otherwise, it allows the loading behavior to proceed.

6. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, and the processor, when executing the computer program, implements the method as described in any one of claims 1-4.

7. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-5.

Images