Network attack behavior detection method and related device

Abstract

Embodiments of the present application provide a network attack behavior detection method and related equipment. The network attack behavior detection method comprises: opening a target file through a target software, a detection unit being injected in a process of the target software; detecting, through the detection unit, whether the target file has a heap spraying behavior; and if the target file has the heap spraying behavior, determining that the target file has a network attack behavior. The technical solution of the embodiments of the present application determines whether the target file has a network attack behavior by detecting whether the target file has a heap spraying behavior. For a network attack behavior using a memory destruction vulnerability, the network attack behavior generally performs heap spraying with the aid of a control to complete memory layout. When it is detected that the target file performs heap spraying with the aid of a control, it can be considered that the target file is preparing to perform a network attack, thereby completing detection of the network attack behavior and solving the problem that there is no reliable and effective defense means to discover and identify a network attack behavior using a memory destruction vulnerability in the prior art.

Description

Technical Field

[0001] This application relates to the fields of computer and communication technology, and more specifically, to a method and related equipment for detecting network attack behavior. Background Technology

[0002] With the development of computer technology, office software has become increasingly popular, with a high installation rate on various electronic devices. However, this has also led to hackers frequently using vulnerabilities in office software for cyberattacks.

[0003] Currently, memory corruption vulnerabilities are among the most frequently used types of vulnerabilities exploited for cyberattacks via office software. However, traditional security software lacks reliable and effective defenses to detect and identify cyberattacks that exploit memory corruption vulnerabilities. Summary of the Invention

[0004] The embodiments of this application provide a method and related equipment for detecting network attack behavior, which can at least to some extent overcome the problem in the prior art that there are no reliable and effective defense means to detect and identify network attack behavior that exploits memory corruption vulnerabilities.

[0005] Other features and advantages of this application will become apparent from the following detailed description, or may be learned in part from practice of this application.

[0006] According to one aspect of the embodiments of this application, a method for detecting network attack behavior is provided. The method includes: opening a target file through target software, wherein a detection unit is injected into the process of the target software; importing the execution flow of the target file into the detection unit; determining the total allocated memory in the execution flow of the target file through the detection unit; and determining whether the target file exhibits heap spraying behavior based on the total allocated memory.

[0007] In one embodiment of this application, detecting whether the target file exhibits heap spraying behavior through the detection unit specifically includes: importing the execution flow of the target file into the detection unit; determining the total allocated memory in the execution flow of the target file through the detection unit; and determining whether the target file exhibits heap spraying behavior based on the total allocated memory.

[0008] In one embodiment of this application, importing the execution flow of the target file into the detection unit specifically includes: detecting whether the target file executes a predetermined step; if the target file executes the predetermined step, then importing the execution flow of the target file into the detection unit.

[0009] In one embodiment of this application, determining the total allocated memory in the execution flow of the target file through the detection unit specifically includes: obtaining target data in the execution flow of the target file through the detection unit, the target data including memory stack frame data; and determining the total allocated memory based on the memory stack frame data.

[0010] In one embodiment of this application, determining the total allocated memory based on the memory stack frame data specifically includes: determining the currently allocated memory based on the memory stack frame data; and accumulating the currently allocated memory to obtain the total allocated memory.

[0011] In one embodiment of this application, after determining that the target file has network attack behavior, the network attack behavior detection method further includes: obtaining analysis results based on the target information, wherein the target information includes the total allocated memory.

[0012] In one embodiment of this application, the target data further includes a memory object address, and the target information further includes a handle value. Before obtaining the analysis result based on the target information, the method further includes: determining the actual memory data address based on the memory object address; and determining the handle value based on the actual memory data address.

[0013] In one embodiment of this application, determining the actual memory data address based on the memory object address specifically includes: obtaining a CMemBytes memory object based on the memory object address; and parsing the CMemBytes memory object to obtain the actual memory data address.

[0014] In one embodiment of this application, determining the handle value based on the actual memory data address specifically includes: obtaining actual memory data based on the actual memory data address; and parsing the actual memory data to obtain the handle value.

[0015] In one embodiment of this application, determining whether the target file has heap spraying behavior based on the total allocated memory specifically includes: if the total allocated memory is greater than a predetermined heap spraying threshold within a predetermined time period, then heap spraying behavior is determined to have occurred; if the total allocated memory is not greater than the predetermined heap spraying threshold within a predetermined time period, then heap spraying behavior is determined not to have occurred.

[0016] In one embodiment of this application, before the target file is opened by the target software, the network attack behavior detection method further includes: pausing the process of the target software in response to its startup; injecting a dynamic library program file into the process of the target software, the dynamic library program file containing the detection unit; and initializing the dynamic library program file so that the process of the target software can import the detection unit.

[0017] In one embodiment of this application, the dynamic library program file includes a preset configuration file. Initializing the dynamic library program file to enable the process of the target software to import the detection unit specifically includes: loading the preset configuration file, which records configuration information, including the name of the target module; determining the target module in the process of the target software based on the target module name; and importing the detection unit into the target module to enable the process of the target module to import the detection unit.

[0018] In one embodiment of this application, the configuration information further includes a target offset position. The step of importing the detection unit into the target module so that the process of the target module can import the detection unit specifically includes: obtaining module information of the target module, the module information including the offset position of the target module; determining whether the module information and the configuration information match; if the module information and the configuration information match, then importing the detection unit at the offset position of the target module.

[0019] In one embodiment of this application, the step of importing the detection unit at the offset position of the target module specifically includes: using a hook function to cause the execution flow of the target software to jump to the detection unit; and at the end of the detection unit, jumping back to the original position of the execution flow in the target module.

[0020] According to one aspect of the embodiments of this application, a network attack behavior detection device is provided, characterized in that the network attack behavior detection device includes: a software startup module, used to open a target file through target software, wherein a detection unit is injected into the process of the target software; a behavior detection module, used to detect whether the target file has a pile-spraying behavior through the detection unit; and a behavior determination module, used to determine that the target file has network attack behavior if the target file has a pile-spraying behavior.

[0021] In one embodiment of this application, the behavior detection module specifically includes: a traffic import submodule, used to import the execution flow of the target file into the detection unit; a sum determination submodule, used to determine the total allocated memory in the execution flow of the target file through the detection unit; and a behavior determination submodule, used to determine whether the target file has heap spraying behavior based on the total allocated memory.

[0022] In one embodiment of this application, the traffic import submodule specifically includes: a condition detection unit, used to detect whether the target file has executed a predetermined step; and a file flow guiding unit, used to import the execution flow of the target file into the detection unit if the target file has executed the predetermined step.

[0023] In one embodiment of this application, the sum determination submodule specifically includes: a data acquisition unit, configured to acquire target data in the execution flow of the target file through the detection unit, the target data including memory stack frame data; and a sum determination unit, configured to determine the total allocated memory based on the memory stack frame data.

[0024] In one embodiment of this application, the data acquisition unit is specifically used to perform: determining the currently allocated memory based on the memory stack frame data; and accumulating the currently allocated memory to obtain the total allocated memory.

[0025] In one embodiment of this application, the network attack behavior detection device further includes: a result analysis module, used to obtain analysis results based on the target information, wherein the target information includes the total allocated memory.

[0026] In one embodiment of this application, the target data further includes a memory object address, the target information further includes a handle value, and the network attack behavior detection device further includes: an address determination module, used to determine the actual memory data address based on the memory object address; and a handle determination module, used to determine the handle value based on the actual memory data address.

[0027] In one embodiment of this application, the address determination module specifically includes: a memory object submodule, used to obtain a CMemBytes memory object based on the memory object address; and a first parsing submodule, used to parse the CMemBytes memory object to obtain the actual memory data address.

[0028] In one embodiment of this application, the handle determination module specifically includes: an actual memory submodule, used to obtain actual memory data according to the actual memory data address; and a second parsing submodule, used to parse the actual memory data to obtain a handle value.

[0029] In one embodiment of this application, the behavior determination submodule specifically includes: a first determination unit, configured to determine that a heap spraying behavior has occurred if the total allocated memory is greater than a predetermined heap spraying threshold within a predetermined time period; and a second determination unit, configured to determine that a heap spraying behavior has not occurred if the total allocated memory is not greater than the predetermined heap spraying threshold within a predetermined time period.

[0030] In one embodiment of this application, the network attack behavior detection device further includes: a process suspension module, used to suspend the process of the target software in response to the startup of the target software; a file injection module, used to inject a dynamic library program file into the process of the target software, the dynamic library program file containing the detection unit; and an initialization module, used to initialize the dynamic library program file so that the process of the target software can import the detection unit.

[0031] In one embodiment of this application, the dynamic library program file includes a preset configuration file, and the initialization module specifically includes: a file loading submodule, used to load the preset configuration file, the configuration file recording configuration information, the configuration information including the target module name; a module determination submodule, used to determine the target module in the process of the target software according to the target module name; and a detection import submodule, used to import the detection unit into the target module, so that the process of the target module can import the detection unit.

[0032] In one embodiment of this application, the configuration information further includes a target offset position, and the detection import submodule specifically includes: an information acquisition unit, used to acquire module information of the target module, the module information including the offset position of the target module; an information matching unit, used to determine whether the module information and the configuration information match; and a detection import unit, used to import the detection unit at the offset position of the target module if the module information and the configuration information match.

[0033] In one embodiment of this application, the detection import unit is specifically used to: cause the execution flow of the target software to jump to the detection unit through a hook function; and jump back to the original position of the execution flow in the target module at the end of the detection unit.

[0034] According to one aspect of the embodiments of this application, a computer-readable medium is provided having a computer program stored thereon, which, when executed by a processor, implements the network attack behavior detection method as described in the above embodiments.

[0035] According to one aspect of the embodiments of this application, an electronic device is provided, including: one or more processors; and a storage device for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement the network attack behavior detection method as described in the above embodiments.

[0036] In some embodiments of this application, the technical solutions provided determine whether a network attack is intended by detecting whether the target file exhibits heap spraying behavior. For network attacks that exploit memory corruption vulnerabilities, heap spraying is typically performed beforehand using controls to complete memory layout. When heap spraying is detected using controls on the target file, it can be considered that the target file is preparing to launch a network attack. This completes the detection of network attack behavior and solves the problem in the prior art of not having reliable and effective defense measures to detect and identify network attacks that exploit memory corruption vulnerabilities.

[0037] Meanwhile, since the heap spraying behavior occurs before the formal network attack and is a preparatory step for the network attack, the detection of heap spraying behavior can quickly determine whether the target file contains network attack behavior. This allows for timely detection, interception, and blocking of the network attack behavior before it is launched, thus protecting the security of network devices.

[0038] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description

[0039] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:

[0040] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solutions of the embodiments of this application can be applied is shown.

[0041] Figure 2 A flowchart illustrating a network attack behavior detection method provided in an embodiment of this application is shown.

[0042] Figure 3 It shows that according to Figure 2 A flowchart illustrating a specific implementation of step S200 in the network attack behavior detection method shown in the corresponding embodiment.

[0043] Figure 4 It shows that according to Figure 3A flowchart illustrating a specific implementation of step S220 in the network attack behavior detection method shown in the corresponding embodiment.

[0044] Figure 5 A flowchart illustrating another network attack behavior detection method provided in an embodiment of this application is shown.

[0045] Figure 6 It shows that according to Figure 5 A flowchart illustrating a specific implementation of step S600 in the network attack behavior detection method shown in the corresponding embodiment.

[0046] Figure 7 This is a schematic diagram of a network attack behavior detection device provided in an embodiment of this application.

[0047] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0048] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this application more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art.

[0049] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough understanding of embodiments of this application. However, those skilled in the art will recognize that the technical solutions of this application can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of this application.

[0050] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities can be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0051] The flowcharts shown in the accompanying drawings are merely illustrative and do not necessarily include all content and operations / steps, nor do they necessarily have to be performed in the described order. For example, some operations / steps can be broken down, while others can be combined or partially combined; therefore, the actual execution order may change depending on the specific circumstances.

[0052] Figure 1A schematic diagram of an exemplary system architecture to which the technical solutions of the embodiments of this application can be applied is shown.

[0053] like Figure 1 As shown, the system architecture may include terminal devices (such as...) Figure 1 The device shown includes one or more of a smartphone 101, tablet 102, and portable computer 103 (which could also be a desktop computer, etc.), a network 104, and a server 105. The network 104 serves as a medium for providing a communication link between the terminal device and the server 105. The network 104 can include various connection types, such as wired communication links, wireless communication links, etc.

[0054] It should be understood that Figure 1 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, there can be any number of terminal devices, networks, and servers. For example, server 105 could be a server cluster composed of multiple servers.

[0055] Users can use terminal devices to interact with server 105 via network 104 to receive or send messages, etc. Server 105 can be a server that provides various services. For example, a user can upload a target file to server 105 using terminal device 103 (or terminal device 101 or 102). Server 105 can open the target file using the target software; detect whether the target file exhibits heap spraying behavior; if the target file exhibits heap spraying behavior, it is determined that the target file has engaged in network attack behavior.

[0056] It should be noted that the network attack detection method provided in this application embodiment is generally executed by server 105, and correspondingly, the network attack detection device is generally located in server 105. However, in other embodiments of this application, the terminal device may also have similar functions to the server, thereby executing the network attack detection scheme provided in this application embodiment.

[0057] The implementation details of the technical solutions in the embodiments of this application are described in detail below:

[0058] Figure 2 A flowchart of a network attack behavior detection method according to an embodiment of this application is shown. This network attack behavior detection method can be executed by a server, which may be... Figure 1 The server shown. (Refer to...) Figure 2 As shown, this network attack detection method includes at least the following:

[0059] Step S100: Open the target file through the target software, wherein a detection unit is injected into the process of the target software.

[0060] Step S200: The detection unit detects whether the target file exhibits heap spraying behavior.

[0061] Step S300: If the target file exhibits heap spraying behavior, then it is determined that the target file has engaged in network attack behavior.

[0062] In the embodiments of this application, the presence of a network attack is determined by detecting whether the target file exhibits heap spraying behavior. For network attacks that exploit memory corruption vulnerabilities, heap spraying is typically performed beforehand using controls to complete the memory layout. When heap spraying is detected using controls on the target file, it can be considered that the target file is preparing to launch a network attack. This completes the detection of network attack behavior and solves the problem in the prior art of not having reliable and effective defense measures to detect and identify network attacks that exploit memory corruption vulnerabilities.

[0063] It should be noted that, in the embodiments of this application, the detection of network attack behavior occurs during the network attack process, or more precisely, during the preparation steps of the network attack. Therefore, determining whether a target file exhibits network attack behavior does not require that the network attack behavior of the target file has been completed or is currently in progress. It can be determined that the target file exhibits network attack behavior when it is performing the pre-attack preparation steps, i.e., when it exhibits splashing behavior. By determining whether a target file exhibits attack behavior based on the presence or absence of splashing behavior, it is possible to quickly determine whether a target file exhibits network attack behavior, allowing for timely detection, interception, and blocking of the network attack behavior before it is launched, thus protecting the security of network devices.

[0064] In step S100, the target software is typically conventional office software, such as Microsoft Office suite, WPS suite, and iWork suite, obtained after certain processing. That is, the target software is obtained by installing a detection function into its process. This detection function can be installed by injecting a detection unit into the target software's process.

[0065] The target file is the file to be tested. This target file is an office document and corresponds to a specific office document. For example, a Word document file should be opened with Microsoft Word or WPS Office. A Pages document file should be opened with Pages software in iWork.

[0066] It should be noted that the injection mentioned in the embodiments of this application refers to loading the program that performs the function into the context of another process and executing the corresponding function, but without affecting the normal operation of the original program of the other process.

[0067] In step S200, the execution flow of the target file is detected by the process detection function installed in the target software to determine whether the target file exhibits heap spraying behavior.

[0068] Traditional security software lacks reliable and effective defense mechanisms to detect and identify whether individual files have exploited memory corruption vulnerabilities in network attacks (i.e., it has not used methods to determine whether files have been subjected to network attacks by detecting whether they exhibit heap spraying behavior), nor does it have reliable and effective defense mechanisms to detect and identify whether individual files have used heap spraying behavior.

[0069] Specifically, in some embodiments, the specific implementation of step S200 can be found in [reference needed]. Figure 3 . Figure 3 It is based on Figure 2 The detailed description of step S200 in the network attack behavior detection method shown in the corresponding embodiment includes the following steps:

[0070] Step S210: Import the execution flow of the target file into the detection unit.

[0071] Step S220: The detection unit determines the total allocated memory in the execution flow of the target file.

[0072] Step S230: Determine whether the target file exhibits heap spraying behavior based on the total allocated memory.

[0073] In the embodiments of this application, the execution flow of the target file is first imported into the detection unit so that the execution steps and related data of the target file can be detected in real time by the detection unit. The total memory allocated to the target file is determined in the execution flow. Finally, based on the total allocated memory, it is determined whether there is a heap spraying behavior.

[0074] In step S210, if it is necessary to determine whether the target file has a stacking behavior, the execution flow of the target file needs to be imported into the detection unit, and the execution steps of the target file are detected in real time by the detection unit to determine the behavior.

[0075] Specifically, in some embodiments, the specific implementation of step S210 can be found in the following embodiments. This embodiment is based on... Figure 3 According to the detailed description of step S210 in the network attack behavior detection method shown in the corresponding embodiment, step S210 in the network attack behavior detection method may include the following steps:

[0076] Detect whether the target file has undergone the predetermined steps;

[0077] If the target file has performed predetermined steps, the execution flow of the target file is imported into the detection unit.

[0078] In the embodiments of this application, before the execution flow import detection unit monitors the target file, it is first determined whether the target file meets the preset conditions. If the target file meets the preset conditions, the execution flow is then imported into the detection unit. If the target file does not meet the preset conditions, it can be directly determined that the target file cannot have the behavior of piling up, and thus the result that the target file will not have the behavior of network attack can be directly concluded.

[0079] The preset condition is whether the target file has performed the predetermined steps, which in turn is whether the target file has created an ActiveX control.

[0080] If the target file has ActiveX controls, then there is a possibility that the target file may use ActiveX controls for spamming. In this case, the execution flow of the target file needs to be imported into the detection unit for real-time monitoring. If the target file does not have ActiveX controls, then there is no possibility that the target file may use ActiveX controls for spamming. Therefore, there is no need to import the execution flow of the target file into the detection unit for real-time monitoring. It can be directly determined that the target file cannot have spamming behavior, and thus it can be directly concluded that the target file will not have network attack behavior. This avoids unnecessary waste of resources, saves detection resources, and improves detection efficiency.

[0081] In step S220, the detection unit obtains each memory allocation of the target file by detecting the execution flow and determines the total allocated memory.

[0082] Specifically, in some embodiments, the specific implementation of step S220 can be found in [reference needed]. Figure 4 . Figure 4 It is based on Figure 3 According to the detailed description of step S220 in the network attack behavior detection method shown in the corresponding embodiment, step S220 in the network attack behavior detection method may include the following steps:

[0083] Step S222: The detection unit obtains target data from the execution stream of the target file, and the target data includes memory stack frame data.

[0084] Step S224: Determine the total allocated memory based on the memory stack frame data.

[0085] In the embodiments of this application, the detection unit obtains the memory stack frame data pointed to by the stack register by detecting the execution flow. By analyzing the memory stack frame data, the memory allocation situation can be determined, and then the total allocated memory can be obtained.

[0086] In step S222, during the process of the detection unit detecting the execution flow, the target data obtained from the execution flow may include memory stack frame data, which is the data pointed to by the stack register.

[0087] In step S224, the memory allocation situation can be determined by analyzing the memory stack frame data, and then the total allocated memory can be obtained.

[0088] Specifically, in some embodiments, the specific implementation of step S224 can be found in the following embodiments. This embodiment is based on... Figure 4 According to the detailed description of step S224 in the network attack behavior detection method shown in the corresponding embodiment, step S224 in the network attack behavior detection method may include the following steps:

[0089] The currently allocated memory is determined based on the memory stack frame data.

[0090] The total allocated memory is obtained by summing the currently allocated memory.

[0091] In the embodiments of this application, by parsing the memory stack frame data, the heap memory allocated to the target file each time (i.e. the currently allocated memory) can be determined, and the total allocated memory is obtained by accumulating the memory allocated to the target file each time.

[0092] In step S230, if the target file allocates too much memory, it is very likely that it uses ActiveX control heap spraying for memory layout, and at this time it should be determined that heap spraying behavior has occurred.

[0093] Specifically, in some embodiments, the specific implementation of step S230 can be found in the following embodiments. This embodiment is based on... Figure 2 According to the detailed description of step S230 in the network attack behavior detection method shown in the corresponding embodiment, step S230 in the network attack behavior detection method may include the following steps:

[0094] If the total allocated memory exceeds a predetermined heap spray threshold within a predetermined time period, a heap spray event is determined to have occurred.

[0095] If the total allocated memory is not greater than the predetermined heap spray threshold within the predetermined time, it is determined that no heap spraying has occurred.

[0096] In the embodiments of this application, if the total allocated memory of the target file exceeds a predetermined heap spraying threshold, it is determined that the target file has allocated excessive memory resources and is performing memory layout through heap spraying behavior. In this case, it is necessary to determine whether heap spraying behavior has occurred. However, if the total allocated memory does not exceed the predetermined heap spraying threshold, it should be determined that heap spraying behavior has not occurred, in order to save detection resources and improve detection efficiency. Therefore, if the total allocated memory is not greater than the predetermined heap spraying threshold within a predetermined time, it is determined that heap spraying behavior has not occurred. Generally, the predetermined time can be 1.5 minutes, 2 minutes, 3 minutes, etc., and this application does not limit it. The predetermined heap spraying threshold can be 56MB, 60MB, 66MB, etc., and this application does not limit it.

[0097] Once step S200 determines that the target file exhibits heap spraying behavior, step S300 is executed to determine that the target file exhibits network attack behavior.

[0098] If step S200 determines that the target file does not exhibit heap spraying behavior, then the target file is deemed to have no network attack behavior.

[0099] After executing step S300 and determining that the target file has network attack behavior, the target file can be subjected to security processing, such as intercepting and blocking the attack behavior of the target file, isolating and deleting the target file, etc.

[0100] In some embodiments, after step S300, the network attack behavior detection method further includes:

[0101] Based on the target information, the analysis results are obtained, whereby the target information includes the total allocated memory.

[0102] In the embodiments of this application, the target information may include, in addition to the total allocated memory and the currently allocated memory mentioned above, the target process ID, the current thread ID, the handle value, the total number of allocations, etc.

[0103] The analysis results may include the location of the pile-spraying behavior.

[0104] Specifically, the analysis of target information can be achieved through a neural network model. After vectorizing the target information, a target information vector is obtained. The target information vector is then input into the neural network model for analysis to obtain the analysis results.

[0105] In some other embodiments, the analysis of target information can also be achieved through a pre-defined analysis algorithm. By analyzing the target information according to the pre-defined analysis algorithm, the analysis result can be obtained.

[0106] The aforementioned target information can be obtained by analyzing the corresponding target data or directly from the corresponding target data.

[0107] For example, the handle value in the target information can be obtained from the memory object address in the target data.

[0108] Specifically, in one embodiment, the target data further includes a memory object address, the target information further includes a handle value, and before obtaining the analysis result based on the target information, the method further includes:

[0109] The actual memory data address is determined based on the memory object address.

[0110] The handle value is determined based on the actual memory data address.

[0111] In the embodiments of this application, the actual memory data address is first determined based on the memory object address, and then the handle value is determined based on the actual memory data address.

[0112] The memory object address is the address of the CMemBytes memory object in a general-purpose register. This address can be obtained from the general-purpose register, which is usually an accumulation register, such as the EAX register for 32-bit data.

[0113] A handle value is the address of a data structure. The handle value is different for different operating systems. In the Windows operating system, it is the hGlobal handle value. A handle value is generated every time memory is allocated to the target file. It is the final heap memory address allocated to the target file. The location of the heap spraying behavior can be locked through the handle value.

[0114] The step of determining the actual memory data address based on the memory object address specifically includes:

[0115] Obtain the CMemBytes memory object based on the memory object address.

[0116] The CMemBytes memory object is parsed to obtain the actual memory data address.

[0117] Determining the handle value based on the actual memory data address specifically includes:

[0118] Obtain the actual memory data based on the actual memory data address.

[0119] The actual memory data is parsed to obtain the handle value.

[0120] Specifically, in the embodiments of this application, having the memory object address, the CMemBytes memory object can be located and retrieved based on the memory object address. The CMemBytes memory object is a structure located in the target software program, storing the address information of the starting position of the actual memory data. By parsing the CMemBytes memory object, the address of the starting position of the actual memory data it stores can be obtained, i.e., the actual memory data address. Based on the actual memory data address, the actual memory data can be located and retrieved in the target software program. Finally, by parsing the actual memory data, the handle value can be obtained.

[0121] Understandably, in the above embodiments, the detection unit needs to be deployed in advance, therefore, before step S100, such as Figure 5 As shown, the network attack behavior detection method further includes:

[0122] Step S400: In response to the startup of the target software, the process of the target software is paused.

[0123] Step S500: Inject a dynamic library program file into the process of the target software, the dynamic library program file containing the detection unit.

[0124] Step S600: Initialize the dynamic library program file so that the process of the target software can be imported into the detection unit.

[0125] In the embodiments of this application, before deploying the detection function, the target software needs to be started first. Once the target software starts, its process is paused during its loading phase. Only after the process is paused can the dynamic library program file be injected into the target software's process, and then the dynamic library program file is initialized so that the target software's process, or execution flow, can be imported into the detection unit, thereby enabling the detection unit to detect its execution flow during the target software's operation. After the dynamic library program file is initialized in step S600, the target software's process can be restarted, allowing the target software to resume operation.

[0126] The main purpose of steps S400 to S600 is to link the execution flow of the target software with the detection unit, so that the detection unit can detect the execution flow during the operation of the target software.

[0127] In step S500, after injecting the dynamic library program file into the process of the target software, the entry function is also called. In step S600, the initialization of the dynamic library program file is performed in this entry function.

[0128] Specifically, in some embodiments, the specific implementation of step S600 can be found in [reference needed]. Figure 6 . Figure 6 It is based on Figure 5 Detailed description of step S600 in the network attack behavior detection method shown in the corresponding embodiment: Step S600 in the network attack behavior detection method may include the following steps:

[0129] Step S610: Load the preset configuration file, which records configuration information, including the target module name.

[0130] Step S620: Determine the target module in the process of the target software according to the target module name.

[0131] Step S630: Import the detection unit into the target module so that the process of the target module can import the detection unit.

[0132] In the embodiments of this application, a preset configuration file is first loaded, then the target module in the process of the target software is located and obtained according to the target module name in the configuration file, and finally a detection unit is imported into the target module so that the detection unit can detect the execution flow of the target module.

[0133] In step S610, the configuration file is a pre-configured file that stores various configuration information, such as the target module name (MSO.DLL), target checksum, target offset position, and target code snippet. The configuration file and the dynamic library program file are stored in the same location.

[0134] In step S620, the list of loaded system modules in the current target software process is first obtained. Based on the target module name in the configuration file, the target module is searched in the list of loaded system modules. This target module is one that can be used by the target file for ActiveX heap spraying.

[0135] In step S630, the core of the detection unit is the detection function. By importing the detection unit into the target module, the detection unit can detect the execution flow of the target module to further confirm whether the target module will be used by the target file to perform heap spraying behavior.

[0136] Specifically, in some embodiments, the specific implementation of step S630 can be found in the following embodiments. This embodiment is based on... Figure 6 According to the detailed description of step S630 in the network attack behavior detection method shown in the corresponding embodiment, step S630 in the network attack behavior detection method may include the following steps:

[0137] Obtain the module information of the target module, including the offset position of the target module.

[0138] Determine whether the module information and the configuration information match.

[0139] If the module information and the configuration information match, the detection unit is imported at the offset position of the target module.

[0140] In the embodiments of this application, the module information of the target module is first obtained. This module information corresponds to the configuration information and includes checksum, offset position, and code snippet, etc. By comparing it with the target checksum, target offset position, and target code snippet in the configuration information, if the comparison is consistent, the module information and configuration information match, proving that the detection unit has the risk of being used by the target file for heap spraying, and the detection unit needs to be implanted for further detection. Otherwise, the detection unit does not have the risk of being used by the target file for heap spraying, and the detection unit does not need to be implanted for further detection.

[0141] Specifically, the method of importing the execution flow of the target module into the detection unit, that is, importing the detection unit at the offset position of the target module, specifically includes:

[0142] The execution flow of the target software is redirected to the detection unit via a hook function.

[0143] At the end of the detection unit, the process jumps back to the original position of the execution flow in the target module.

[0144] In the embodiments of this application, the execution flow of the target module and the detection function are directly hooked together through the hook function. During the operation of the target module, the execution flow can jump to the detection unit. In order not to affect the normal operation of the target module, after the detection unit finishes detection, that is, at the end of the detection function, the execution flow is jumped back to the original position, so that the target module continues to operate normally.

[0145] The following describes an apparatus embodiment of this application, which can be used to execute the network attack behavior detection method described above in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the network attack behavior detection method described above in this application.

[0146] Figure 7 A block diagram of a network attack behavior detection apparatus according to an embodiment of this application is shown.

[0147] Reference Figure 7As shown, a network attack behavior detection device 700 according to an embodiment of this application includes: a software startup module 710, used to open a target file through target software, wherein a detection unit is injected into the process of the target software; a behavior detection module 720, used to detect whether the target file has a pile-spraying behavior through the detection unit; and a behavior determination module 730, used to determine that the target file has network attack behavior if the target file has a pile-spraying behavior.

[0148] In one embodiment of this application, the behavior detection module specifically includes: a traffic import submodule, used to import the execution flow of the target file into the detection unit; a sum determination submodule, used to determine the total allocated memory in the execution flow of the target file through the detection unit; and a behavior determination submodule, used to determine whether the target file has heap spraying behavior based on the total allocated memory.

[0149] In one embodiment of this application, the traffic import submodule specifically includes: a condition detection unit, used to detect whether the target file has executed a predetermined step; and a file flow guiding unit, used to import the execution flow of the target file into the detection unit if the target file has executed the predetermined step.

[0150] In one embodiment of this application, the sum determination submodule specifically includes: a data acquisition unit, configured to acquire target data in the execution flow of the target file through the detection unit, the target data including memory stack frame data; and a sum determination unit, configured to determine the total allocated memory based on the memory stack frame data.

[0151] In one embodiment of this application, the data acquisition unit is specifically used to perform: determining the currently allocated memory based on the memory stack frame data; and accumulating the currently allocated memory to obtain the total allocated memory.

[0152] In one embodiment of this application, the network attack behavior detection device further includes: a result analysis module, used to obtain analysis results based on the target information, wherein the target information includes the total allocated memory.

[0153] In one embodiment of this application, the target data further includes a memory object address, the target information further includes a handle value, and the network attack behavior detection device further includes: an address determination module, used to determine the actual memory data address based on the memory object address; and a handle determination module, used to determine the handle value based on the actual memory data address.

[0154] In one embodiment of this application, the address determination module specifically includes: a memory object submodule, used to obtain a CMemBytes memory object based on the memory object address; and a first parsing submodule, used to parse the CMemBytes memory object to obtain the actual memory data address.

[0155] In one embodiment of this application, the handle determination module specifically includes: an actual memory submodule, used to obtain actual memory data according to the actual memory data address; and a second parsing submodule, used to parse the actual memory data to obtain a handle value.

[0156] In one embodiment of this application, the behavior determination submodule specifically includes: a first determination unit, configured to determine that a heap spraying behavior has occurred if the total allocated memory is greater than a predetermined heap spraying threshold within a predetermined time period; and a second determination unit, configured to determine that a heap spraying behavior has not occurred if the total allocated memory is not greater than the predetermined heap spraying threshold within a predetermined time period.

[0157] In one embodiment of this application, the network attack behavior detection device further includes: a process suspension module, used to suspend the process of the target software in response to the startup of the target software; a file injection module, used to inject a dynamic library program file into the process of the target software, the dynamic library program file containing the detection unit; and an initialization module, used to initialize the dynamic library program file so that the process of the target software can import the detection unit.

[0158] In one embodiment of this application, the dynamic library program file includes a preset configuration file, and the initialization module specifically includes: a file loading submodule, used to load the preset configuration file, the configuration file recording configuration information, the configuration information including the target module name; a module determination submodule, used to determine the target module in the process of the target software according to the target module name; and a detection import submodule, used to import the detection unit into the target module, so that the process of the target module can import the detection unit.

[0159] In one embodiment of this application, the configuration information further includes a target offset position, and the detection import submodule specifically includes: an information acquisition unit, used to acquire module information of the target module, the module information including the offset position of the target module; an information matching unit, used to determine whether the module information and the configuration information match; and a detection import unit, used to import the detection unit at the offset position of the target module if the module information and the configuration information match.

[0160] In one embodiment of this application, the detection import unit is specifically used to: cause the execution flow of the target software to jump to the detection unit through a hook function; and jump back to the original position of the execution flow in the target module at the end of the detection unit.

[0161] Figure 8 A schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application is shown.

[0162] It should be noted that, Figure 8 The computer system of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0163] like Figure 8 As shown, the computer system includes a Central Processing Unit (CPU) 1801, which can perform various appropriate actions and processes based on programs stored in Read-Only Memory (ROM) 1802 or programs loaded from storage portion 1808 into Random Access Memory (RAM) 1803, such as performing the methods described in the above embodiments. Various programs and data required for system operation are also stored in RAM 1803. The CPU 1801, ROM 1802, and RAM 1803 are interconnected via bus 1804. An Input / Output (I / O) interface 1805 is also connected to bus 1804.

[0164] The following components are connected to I / O interface 1805: an input section 1806 including a keyboard, mouse, etc.; an output section 1807 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 1808 including a hard disk, etc.; and a communication section 1809 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 1809 performs communication processing via a network such as the Internet. A drive 1810 is also connected to I / O interface 1805 as needed. Removable media 1811, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 1810 as needed so that computer programs read from them can be installed into storage section 1808 as needed.

[0165] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 1809, and / or installed from removable medium 1811. When the computer program is executed by central processing unit (CPU) 1801, it performs various functions defined in the system of this application.

[0166] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. The transmitted data signal can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0167] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. Each block in a flowchart or block diagram may represent a module, segment, or portion of code, which contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0168] The units described in the embodiments of this application can be implemented in software or hardware, and the described units can also be located in a processor. The names of these units do not necessarily limit the specific unit itself.

[0169] In another aspect, this application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to perform the methods described in the above embodiments.

[0170] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to the embodiments of this application, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0171] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the methods according to the embodiments of this application.

[0172] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the embodiments disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein.

[0173] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.

Claims

1. A method for detecting network attack behavior, characterized in that, The network attack detection method includes: The target file is opened by the target software, and a detection unit is injected into the process of the target software; The detection unit detects whether the target file exhibits spraying behavior. If the target file exhibits heap spraying behavior, it is determined that the target file has engaged in network attack behavior. Determine the actual memory data address based on the memory object address; Determine the handle value based on the actual memory data address; Based on the target information, the analysis results are obtained, wherein the target information includes the total allocated memory and handle values; Specifically, detecting whether the target file exhibits spraying behavior through the detection unit includes: The execution flow of the target file is imported into the detection unit; The detection unit determines the total allocated memory in the execution flow of the target file. Based on the total allocated memory, determine whether the target file exhibits heap spraying behavior; The step of determining the total allocated memory in the execution flow of the target file through the detection unit specifically includes: The detection unit obtains target data from the execution flow of the target file. The target data includes memory stack frame data and memory object addresses. The memory stack frame data is the data pointed to by the stack register. The total allocated memory is determined based on the memory stack frame data; The step of determining the actual memory data address based on the memory object address specifically includes: Based on the memory object address, obtain the CMemBytes memory object. The CMemBytes memory object is a structure located in the target software program, which stores the address information of the starting position of the actual memory data. By parsing the CMemBytes memory object, the address of the starting position of the actual memory data it stores can be obtained, that is, the actual memory data address. The CMemBytes memory object is parsed to obtain the actual memory data address.

2. The network attack behavior detection method as described in claim 1, characterized in that, The step of importing the execution flow of the target file into the detection unit specifically includes: Detect whether the target file has undergone the predetermined steps; If the target file has performed predetermined steps, the execution flow of the target file is imported into the detection unit.

3. The network attack behavior detection method as described in claim 1, characterized in that, The step of determining the total allocated memory based on the memory stack frame data specifically includes: The currently allocated memory is determined based on the memory stack frame data; The total allocated memory is obtained by summing the currently allocated memory.

4. The network attack behavior detection method as described in claim 1, characterized in that, The step of determining the handle value based on the actual memory data address specifically includes: Obtain the actual memory data based on the actual memory data address; The actual memory data is parsed to obtain the handle value.

5. The network attack behavior detection method as described in claim 1, characterized in that, The step of determining whether the target file exhibits heap spraying behavior based on the total allocated memory specifically includes: If the total allocated memory exceeds a predetermined heap spray threshold within a predetermined time period, a heap spray event is determined to have occurred. If the total allocated memory is not greater than the predetermined heap spray threshold within the predetermined time, it is determined that no heap spraying has occurred.

6. The network attack behavior detection method as described in claim 1, characterized in that, Before opening the target file through the target software, the network attack detection method further includes: In response to the startup of the target software, the process of the target software is paused; A dynamic library program file is injected into the process of the target software, and the dynamic library program file contains the detection unit; The dynamic library program file is initialized so that the process of the target software can be imported into the detection unit.

7. The network attack behavior detection method as described in claim 6, characterized in that, The dynamic library program file contains a preset configuration file. Initializing the dynamic library program file to enable the target software process to import into the detection unit specifically includes: Load the preset configuration file, which records configuration information, including the target module name; Based on the target module name, the target module is determined in the process of the target software; The detection unit is imported into the target module so that the process of the target module can import the detection unit.

8. The network attack behavior detection method as described in claim 7, characterized in that, The configuration information also includes the target offset position. Importing the detection unit into the target module, so that the process of the target module can import the detection unit, specifically includes: Obtain the module information of the target module, the module information including the offset position of the target module; Determine whether the module information and the configuration information match; If the module information and the configuration information match, the detection unit is imported at the offset position of the target module.

9. The network attack behavior detection method as described in claim 8, characterized in that, The process of introducing the detection unit at the offset position of the target module specifically includes: By using a hook function, the execution flow of the target software is redirected to the detection unit; At the end of the detection unit, the process jumps back to the original position of the execution flow in the target module.

10. A network attack behavior detection device, characterized in that, The network attack detection device includes: The software startup module is used to open the target file through the target software, wherein a detection unit is injected into the process of the target software; The behavior detection module is used to detect whether the target file exhibits spraying behavior through the detection unit; The behavior determination module is used to determine that the target file has network attack behavior if the target file has heap spraying behavior. The address determination module is used to determine the actual memory data address based on the memory object address; The handle determination module is used to determine the handle value based on the actual memory data address; The results analysis module is used to obtain analysis results based on target information, including the total allocated memory and handle value. The behavior detection module specifically includes: a traffic import submodule, used to import the execution flow of the target file into the detection unit; a sum determination submodule, used to determine the total allocated memory in the execution flow of the target file through the detection unit; and a behavior determination submodule, used to determine whether the target file has heap spraying behavior based on the total allocated memory. The total determination submodule specifically includes: a data acquisition unit, used to acquire target data in the execution flow of the target file through the detection unit, the target data including memory stack frame data and memory object addresses; and a total determination unit, used to determine the total allocated memory based on the memory stack frame data. The address determination module specifically includes: a memory object submodule, used to obtain a CMemBytes memory object based on the memory object address. The CMemBytes memory object is a structure located in the target software program, storing the address information of the starting position of the actual memory data. By parsing the CMemBytes memory object, the address of the starting position of the actual memory data it stores can be obtained, i.e., the actual memory data address; and a first parsing submodule, used to parse the CMemBytes memory object to obtain the actual memory data address.

11. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the network attack behavior detection method as described in any one of claims 1 to 9.

12. An electronic device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the network attack behavior detection method as described in any one of claims 1 to 9.

Images