Process detection method and device, equipment and medium

Abstract

The invention provides a process detection method and device, equipment and a medium, and relates to the technical field of computers.The method comprises the steps that whether an abnormal process exists in a plurality of processes running in an operating system or not is determined by scanning a memory, and when the abnormal process occurs, the abnormal process is detected; then process information corresponding to the multiple processes is obtained in the two modes of kernel layer query and user layer query, the multiple pieces of process information obtained in two batches are matched to determine the matching result of two queries, the hidden processes in the multiple processes are found out according to the matching result, and the hidden processes are stored in the user layer. According to the method, the hidden process under the abnormal condition is quickly positioned when the abnormal process exists in a mode of combining memory scanning, kernel layer query and user layer query, and the hidden process does not need to be queried when the abnormal process does not exist, so that the detection rate of the hidden process is improved, and the stability of an operating system is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a process detection method, device, equipment and medium. Background Art

[0002] With the rapid development of Internet technology, server information security issues have become increasingly prominent. Traditional server information security protection systems often have problems such as a single protection level and limited protection capabilities, and cannot meet the increasingly complex information security needs.

[0003] Nowadays, network security threats are becoming increasingly diverse, among which malicious code attacks are one of the main threats, and process hiding is one of the important technologies for the success of almost all malicious code attacks.

[0004] Malicious code attacks are becoming more and more covert and persistent. System process hiding technology is widely used in Trojans and other malicious tools to avoid detection by users and security software in an "invisible" way, thereby achieving the purpose of long-term latency and increasing the life cycle. Many malicious software will lurk in the server system for a long time. The hidden process behavior makes it difficult for the system's security software to detect these hidden malicious programs and cannot achieve effective defense, allowing these malicious programs to successfully play a role in the computer system, causing information and data leakage. In serious cases, it may pose a huge threat to the information security of the company's products.

[0005] Currently, the monitoring methods for malicious hidden processes mostly rely on out-of-band execution detection of VM virtual machines, which has great uncertainty and unreliability. Summary of the invention

[0006] In view of this, embodiments of the present application provide a process detection method, apparatus, device, and medium to overcome the above problems or at least partially solve the above problems.

[0007] A first aspect of an embodiment of the present application provides a process detection method, the method comprising:

[0008] By scanning the memory, detect whether there are abnormal processes among the multiple processes running in the operating system;

[0009] When there is an abnormal process among the multiple processes, obtaining multiple process information of the multiple processes based on user layer query and kernel layer query respectively;

[0010] The obtained multiple process information are matched to obtain a matching result, and the hidden process is determined based on the matching result.

[0011] Optionally, the step of scanning the memory to detect whether there is an abnormal process among the multiple processes running in the operating system includes:

[0012] Using an interface function provided by the operating system to obtain actual memory usage of the multiple processes, and determining whether the actual memory usage of the multiple processes exceeds a threshold value of actual memory usage of the multiple processes;

[0013] When the actual memory usage of the multiple processes exceeds the actual memory usage threshold of the multiple processes, allocating memory space to a process used to scan the actual memory usage space addresses of the multiple processes, and traversing the actual memory usage space addresses of the multiple processes through pointers to read memory data of the multiple processes;

[0014] By analyzing the memory data of the multiple processes, it is determined whether there is a first abnormal code structure or a first abnormal information in the memory data of the multiple processes, a first memory data detection result is obtained, and based on the first memory data monitoring result, it is determined whether there is an abnormal process in the multiple processes.

[0015] Optionally, the process information includes first process information and second process information, and when there is an abnormal process among the multiple processes, obtaining multiple process information of the multiple processes based on user layer query and kernel layer query respectively includes:

[0016] Traversing the processes of the user layer to obtain first process information of multiple processes, wherein the first process information at least includes multiple process information;

[0017] Traverse the kernel layer processes through the kernel function to obtain the second process information of multiple processes;

[0018] The first process information is process information of the multiple processes except the hidden process, and the second process information includes at least multiple process information.

[0019] Optionally, when there is an abnormal process among the multiple processes, obtaining multiple process information of the multiple processes based on user layer query and kernel layer query respectively includes:

[0020] The traversing of the user layer processes to obtain first process information of multiple processes includes:

[0021] Taking snapshots of the multiple processes, and traversing the snapshots of the multiple processes using a first function to obtain first process information, wherein the first process information is obtained based on a user layer, and the first process information includes a first process identifier set and a first process number, wherein the first process identifier set includes a plurality of first process identifiers queried after traversing the multiple processes using the first function, and the first process number is the number corresponding to the first process identifiers;

[0022] The first function includes a first parameter, a second parameter and a third parameter, wherein the first parameter is used to receive a first process identifier set returned after traversing the multiple processes; the second parameter is used to indicate the size of the first parameter; and the third parameter is used to indicate the number of first processes returned after traversing the multiple processes;

[0023] The process of the kernel layer is traversed through the kernel function to obtain the second process information of multiple processes, including:

[0024] Use a kernel function to obtain second process information of all processes included in the multiple processes, the second process information is obtained based on the kernel layer, the second process information includes a second process identifier set and a second process number, the second process identifier set includes multiple second process identifiers corresponding to all processes queried after traversing the multiple processes through the kernel function, and the second process number is the number corresponding to the second process identifier.

[0025] Optionally, matching the acquired multiple process information to obtain a matching result, and determining the hidden process based on the matching result includes:

[0026] Compare the first process number with the second process number to determine whether the first process number is equal to the second process number;

[0027] When the first process number is equal to the second process number, determining that the comparison result is a first comparison result, the first comparison result indicates that there is no hidden process;

[0028] When the first process number is not equal to the second process number, comparing each second process identifier with each first process identifier in the first process identifier set in turn to determine whether there is a first process identifier in the first process identifier set that matches the second process identifier;

[0029] When it is determined that the second process identifier does not have a matching first process identifier, it is determined that the process corresponding to the second process identifier that does not have a matching first process identifier is a hidden process, and the comparison result is determined to be a second comparison result, the second comparison result indicating that there is a hidden process, and the hidden process is a second process identifier whose process identifier does not have a matching first process identifier;

[0030] Based on the second comparison result, the hidden process is determined.

[0031] Optionally, after matching the obtained multiple process information to obtain matching results, and determining the hidden process based on the matching results, the method further includes:

[0032] Obtaining the memory space address actually used by the hidden process, and reading the memory data of the hidden process;

[0033] By analyzing, determining whether there is a second abnormal code structure or second abnormal information in the memory data of the hidden process, obtaining a second memory data detection result, and determining whether the hidden process is malicious code based on the second memory data monitoring result;

[0034] When the hidden process is a malicious code, the hidden process is monitored.

[0035] Optionally, the method is applied to a hardware simulator, in which an operating system image is configured.

[0036] A second aspect of an embodiment of the present application provides a process detection device, the device comprising:

[0037] A detection module, used to detect whether there are abnormal processes among multiple processes running in the operating system by scanning the memory;

[0038] An acquisition module, used for respectively acquiring multiple process information of the multiple processes based on user layer query and kernel layer query when there is an abnormal process among the multiple processes;

[0039] The determination module is used to match the obtained multiple process information to obtain a matching result, and determine the hidden process based on the matching result.

[0040] A third aspect of an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the process detection method as described in the first aspect.

[0041] A fourth aspect of an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the process detection method as described in the first aspect is implemented.

[0042] Beneficial effects of this application:

[0043] The embodiments of the present application provide a process detection method, apparatus, device and medium, which relate to the field of computer technology. The method includes: detecting whether there are abnormal processes among multiple processes running in an operating system by scanning the memory, and when there are abnormal processes among the multiple processes, obtaining multiple process information of the multiple processes based on user layer query and kernel layer query respectively, matching the obtained multiple process information to obtain matching results, and determining the hidden process based on the matching results.

[0044] According to the technical solution of the present application, by scanning the memory, it is determined whether there are abnormal processes among the multiple processes running in the operating system. When an abnormal process occurs, the process information corresponding to the multiple processes is obtained respectively by kernel layer query and user layer query, and the multiple process information obtained in two batches are matched to determine the matching results of the two queries. According to the matching results, the hidden process among the multiple processes is found. By combining memory scanning, kernel layer query and user layer query, when an abnormal process exists, the hidden process in the abnormal situation is quickly located, and when there is no abnormal process, there is no need to query the hidden process, thereby improving the detection rate of the hidden process and thus improving the stability of the operating system. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The drawings constituting a part of the present application are used to provide a further understanding of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application.

[0046] In order to more clearly illustrate the technical solution of the present application, the drawings required for use in the description of the present application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0047] Figure 1 It is a flowchart of a process detection method provided by an embodiment of the present application;

[0048] Figure 2 is a schematic diagram of process information provided by an embodiment of the present application;

[0049] Figure 3 is a schematic diagram of a process A after it is successfully hidden, shown in an embodiment of the present application;

[0050] Figure 4 is a schematic diagram showing that process A is not detected after querying at the user layer according to an embodiment of the present application;

[0051] Figure 5 This is a schematic diagram of what is detected after process A performs a query at the kernel layer, shown in an embodiment of the present application;

[0052] Figure 6 It is a schematic diagram of a framework of a process detection device provided by an embodiment of the present application;

[0053] Figure 7 It is a schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0054] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application may be combined with each other.

[0055] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0056] EnumProcesses: retrieves each process identifier in the process;

[0057] ZwQuerySystemInformation: This function is called in the kernel to enumerate the kernel modules that have been loaded in the Windows system;

[0058] HOOK: A mechanism similar to interruption under Windows platform.

[0059] Most malicious hidden processes hide processes by hooking the function ZwQuerySystemInformation and modifying the runtime memory to replace the current instructions with their own content.

[0060] Therefore, if you want to detect, you can choose to bypass the ZwQuerySystemInformation function to traverse all processes, enter the kernel to call all process identifiers, so that you can bypass the HOOK code to query the process. Then compare the traversal results to find the hidden process.

[0061] Figure 1 is a flowchart of a process detection method provided by an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0062] Step S101, by scanning the memory, detecting whether there is an abnormal process among multiple processes running in the operating system;

[0063] Step S102, when there is an abnormal process among the multiple processes, obtaining multiple process information of the multiple processes based on user layer query and kernel layer query respectively;

[0064] Step S103: Match the obtained multiple process information to obtain a matching result, and determine the hidden process based on the matching result.

[0065] First, in step S101, the memory of the operating system is scanned to confirm whether there are any abnormal processes. Abnormal processes refer to illegal or malicious processes. In this process, it is necessary to determine whether the memory usage, code information, sensitive information and other information related to the process running process of each process are abnormal, so as to judge whether there are any illegal or malicious processes, and then determine whether it is necessary to trigger and find these abnormal processes. If there are no abnormal processes, the operating system memory is scanned periodically until it is determined that there are abnormal processes, and then step S102 is triggered.

[0066] Further, in step S102, when it is determined that there are abnormal processes among the multiple processes running in the operating system, it is necessary to further determine whether there are hidden processes among the abnormal processes. Therefore, based on the two methods of user layer query and kernel layer query, multiple process information of the multiple processes running in the operating system are obtained respectively. The user layer query is to obtain process information such as process PID by calling or monitoring tools, while the kernel layer query is to directly call the kernel function to traverse the PIDs of all processes in the operating system to obtain complete process information, so that the process information of two batches of multiple processes is obtained through these two methods.

[0067] Finally, in step S103, the multiple process information obtained in the two batches are matched in sequence to obtain matching results. The matching results show the differences between the multiple process information of the multiple processes in the query process of the two batches. According to the differences in the matching results, the hidden processes in the multiple processes are determined.

[0068] Through the above embodiment, firstly, the memory is scanned to determine whether there are abnormal processes among the multiple processes running in the operating system. When an abnormal process occurs, the process information corresponding to the multiple processes is obtained respectively through kernel layer query and user layer query. The multiple process information obtained in two batches are matched to determine the matching results of the two queries. According to the matching results, the hidden process among the multiple processes is found. By combining memory scanning, kernel layer query and user layer query, when an abnormal process exists, the hidden process in the abnormal situation is quickly located. Moreover, when there is no abnormal process, there is no need to query the hidden process, thereby improving the detection rate of the hidden process and thus improving the stability of the operating system.

[0069] Optionally, the method is applied to a hardware simulator, in which an operating system image is configured.

[0070] Specifically, as an embodiment, the technical solution of the present application is to use a hardware simulator as a carrier, in which an operating system image is installed. After accessing the service, it can directly act on the server's memory and processor, and traverse the server's CPU internal process with kernel state permissions. Real-time monitoring, once an abnormality is found, that is, it is determined that there is a hidden process, an alarm will be issued and the process will be continuously monitored. The activity trend of the process during the operation of the server can be output, and malicious behavior can be analyzed. If it is really malicious code, the malicious hidden process code can be analyzed and countered in time.

[0071] The main functions of the hardware simulator are:

[0072] 1) Check if there are any hidden processes.

[0073] 2) If a hidden process is detected, find the PID of the hidden process and output it in HTML or SQL format.

[0074] 3) Determine whether the hidden process is malicious code. If so, continuously monitor the hidden process.

[0075] Through the design of this hardware simulator, the hardware simulator is not an external detection device. Therefore, the uncertainty and instability of the detection result of the hidden process will not be caused due to network instability and other situations.

[0076] Optionally, the step S101 includes:

[0077] Step S101 - 1 : using an interface function provided by the operating system to obtain actual memory usage of the multiple processes, and determining whether the actual memory usage of the multiple processes exceeds a threshold value of actual memory usage of the multiple processes.

[0078] Step S101-2, when the actual memory usage of the multiple processes exceeds the actual memory usage threshold of the multiple processes, allocating memory space to a process used to scan the actual memory usage space addresses of the multiple processes, and traversing the actual memory usage space addresses of the multiple processes through pointers to read memory data of the multiple processes;

[0079] Step S101-3, by analyzing the memory data of the multiple processes, determine whether there is a first abnormal code structure or a first abnormal information in the memory data of the multiple processes, obtain a first memory data detection result, and based on the first memory data monitoring result, determine whether there is an abnormal process in the multiple processes.

[0080] Specifically, in another embodiment, step S101 specifically includes steps S101 - 1 to S101 - 3.

[0081] First, in step S101-1, the actual memory usage of multiple processes is obtained by using the API GlobalMemoryStatusEx interface function provided by the operating system, the actual memory usage of each process is compared with the actual memory usage threshold corresponding to the process, and it is determined whether the actual memory usage corresponding to each of the multiple processes exceeds the actual memory usage threshold corresponding to each process in the multiple processes, wherein the actual memory usage threshold corresponding to each process is pre-set according to different processes.

[0082] Further, in step S101-2, when the actual memory usage of one or some processes among multiple processes is greater than the actual memory usage threshold corresponding to the process, memory space is further allocated to the process used to scan the actual memory usage space addresses of multiple processes, and the actual memory usage space addresses of multiple processes are traversed through pointers to read memory data corresponding to multiple processes.

[0083] Finally, in step S101-3, the memory data of the acquired multiple processes are analyzed and compared to determine whether there is a first abnormal code structure or a first abnormal information, such as a malicious code structure or sensitive information, in the memory data corresponding to each of the multiple processes, and a first memory data detection result is obtained. Based on whether the first memory data detection result indicates the existence of the first abnormal code structure or the first abnormal information, it is determined whether there is an abnormal process among the multiple processes. If the first memory data detection result indicates the existence of the first abnormal code structure or the first abnormal information, it indicates that the multiple processes running in the operating system include abnormal processes. Conversely, if the first memory data detection result indicates the absence of the first abnormal code structure or the first abnormal information, it is determined that there is no abnormal process among the multiple processes.

[0084] Through the above embodiment, by analyzing the corresponding actual memory usage and memory data of multiple processes in turn, it is detected whether there are abnormal processes in the operating system, and then it is determined whether it is necessary to further search for hidden processes. This method helps to improve the security and stability of the operating system.

[0085] Optionally, the process information includes first process information and second process information, and the step S102 includes:

[0086] Step S102-1, traversing the processes of the user layer to obtain first process information of multiple processes, wherein the first process information at least includes multiple process information;

[0087] Step S102-2, traversing the processes of the kernel layer through the kernel function to obtain second process information of multiple processes;

[0088] The first process information is process information of the multiple processes except the hidden process, and the second process information includes at least multiple process information.

[0089] Specifically, in one embodiment, the process information of the process is divided into first process information and second process information, and step S102 includes steps S102 - 1 to S102 - 2.

[0090] In step S102-1, multiple processes in the user layer of the operating system are traversed to obtain first process information of the multiple processes, where the first process information at least includes multiple process information corresponding to the multiple processes queried in the user layer, wherein the first process information does not include hidden processes.

[0091] In step S102-2, the kernel function is used to traverse the processes in the kernel layer of the operating system to obtain second process information corresponding to multiple processes. The second process information at least includes multiple process information corresponding to the multiple processes queried in the kernel layer, wherein the second process information includes process information of all processes running in the operating system.

[0092] Hidden processes may not be visible at the user level, but they still exist at the kernel level, and the process information of hidden processes can be obtained through kernel functions.

[0093] Through the above embodiment, by traversing the user layer and kernel layer processes respectively and obtaining the first process information and the second process information, comprehensive monitoring and management of all processes in the operating system can be achieved, thereby improving the security and stability of the system.

[0094] Optionally, the step S102 includes:

[0095] The step S102-1 includes:

[0096] Step S102-1-1, taking snapshots of the multiple processes, and using a first function to traverse the snapshots of the multiple processes to obtain first process information, wherein the first process information is obtained based on a user layer, and the first process information includes a first process identifier set and a first process number, wherein the first process identifier set includes a plurality of first process identifiers queried after traversing the multiple processes by using the first function, and the first process number is the number corresponding to the first process identifiers;

[0097] The first function includes a first parameter, a second parameter and a third parameter, wherein the first parameter is used to receive a first process identifier set returned after traversing the multiple processes; the second parameter is used to indicate the size of the first parameter; and the third parameter is used to indicate the number of first processes returned after traversing the multiple processes;

[0098] The step S102-2 includes:

[0099] Step S102-2-1, use the kernel function to obtain the second process information of all processes included in the multiple processes, the second process information is obtained based on the kernel layer, the second process information includes a second process identifier set and a second process number, the second process identifier set includes multiple second process identifiers corresponding to all processes queried after traversing the multiple processes through the kernel function, and the second process number is the number corresponding to the second process identifier.

[0100] Specifically, in one embodiment, step S102-1 includes: said step S102-1-1, in step S102-1-1, firstly, by taking process snapshots of multiple processes, when taking process snapshots, hidden processes will not be modified, and the process snapshots are confidential. At the user layer, multiple processes in the current operating system are traversed through a first function, such as the EnumProcesses function, and during the traversal process, a series of operations are performed on each process to obtain the status information of multiple processes in the current operating system to form a process snapshot. The process snapshot includes first process information corresponding to multiple processes, and the first process information is a set of information of multiple processes obtained at the user layer through the first function, specifically including a first process identifier set and a first process number, and the first process identifier set is a set of process identifiers of multiple processes obtained at the user layer through the first function, and the first process identifier set includes multiple first process identifiers, and the first process number is the number corresponding to the first process identifier, that is, the number of multiple processes queried at the user layer through the first function.

[0101] Among them, the first function includes a first parameter, a second parameter and a third parameter. The first parameter is used to receive a first process identifier set returned after traversing multiple processes, the second parameter is used to indicate the size of the first parameter, and the third parameter is used to indicate the number of first processes returned after traversing multiple processes.

[0102] The first process information queried is retained so as to be compared with the second process information queried later in the kernel layer.

[0103] It should be noted that in the query process through the first function, the traversal process will be queried through the ZwQuerySystemInformation function, and the EnumProcesses function is no exception. Therefore, among the multiple processes queried by the first function, there is no hidden process that has been hidden.

[0104] For example, take the declaration of the EnumProcesses function in the Windows operating system as an example:

[0105] BOOL WINAPI EnumProcesses(

[0106] _Out_writes_bytes_(cb)DWORD*lpi dProcess,

[0107] _In_DWORD cb,

[0108] _Out_LPDWORD lpcbNeeded );

[0110] The first parameter pProcessIds is a DWORD pointer used to receive the first process identifier set found. The second parameter cb refers to the size of the first parameter. The third parameter pBytesReturned stores the actual number of bytes returned. The value of the third parameter divided by 4 is equal to the number of first processes returned.

[0111] Step S102-2 includes: Step S102-2-1, in step S102-2-1, using the kernel function, bypassing the traditional process traversal method, directly traversing the system bottom code, entering the kernel layer to call all processes of the operating system, and obtaining the second process information of all processes included in the multiple processes. The second process information represents the collection of the multiple process information obtained by calling the kernel function.

[0112] The second process information is obtained based on the kernel layer. The second process information includes a second process identifier set and a second process number. The second process identifier set includes multiple second process identifiers corresponding to all processes queried after traversing multiple processes through kernel functions. The second process number is the number corresponding to the second process identifiers.

[0113] It should be noted that the addresses of different operating systems are different, and the storage addresses of process identifiers are also different. Here we take the Windows 7 operating system as an example.

[0114]

[0115] Through the above code, enter the kernel layer to traverse all processes. The traversed process information is used as the second process information and saved. This traversal method is a traversal performed at the kernel layer, so the traversed process information contains all process information, that is, the process information of the hidden process.

[0116] Through the above embodiments, the process information of multiple processes in the operating system can be queried in the kernel layer and the user layer respectively, so as to quickly obtain the process information including hidden processes and excluding hidden processes.

[0117] Optionally, the step S103 includes:

[0118] Step S103-1, comparing the first process number with the second process number to determine whether the first process number is equal to the second process number;

[0119] Step S103-2, when the first process number is equal to the second process number, determining that the comparison result is a first comparison result, and the first comparison result indicates that there is no hidden process;

[0120] Step S103-3, when the first process number is not equal to the second process number, comparing each second process identifier with each first process identifier in the first process identifier set in turn, to determine whether there is a first process identifier in the first process identifier set that matches the second process identifier;

[0121] Step S103-4, when it is determined that the second process identifier does not have a matching first process identifier, then determining that the process corresponding to the second process identifier that does not have a matching first process identifier is a hidden process, and determining that the comparison result is a second comparison result, the second comparison result indicates that there is a hidden process, and the hidden process is a second process identifier whose process identifier does not have a matching first process identifier;

[0122] Step S103 - 5 : determining the hidden process based on the second comparison result.

[0123] Specifically, in one embodiment, step S103 specifically includes steps S103-1 to S103-5, wherein after obtaining the first process information that does not include the process information of the hidden process and the second process information that includes the process information of the hidden process obtained based on the user layer and the kernel layer query, the two sets of process information need to be compared to determine the hidden process.

[0124] First, in step S103 - 1 , the first process number in the first process information is compared with the second process number in the second process information, and it is determined whether the first process number is equal to the second process number.

[0125] Further, in step S103-2, the first process number should theoretically be less than or equal to the second process number. At this time, there are two situations. When the first process number is equal to the second process number, it means that the processes queried based on the user layer and the kernel layer are the same, and are all processes of the operating system. Therefore, the comparison result at this time is the first comparison result. When the first process number is less than the second process number, it means that the processes queried at the user layer are less than the processes queried at the kernel layer. At this time, it means that no hidden processes are queried during the query process at the user layer, and all processes queried during the query process at the kernel layer include hidden processes. Therefore, the situation that the first process number is less than the second process number will occur.

[0126] Further, in step S103-3, when the number of first processes is less than the number of second processes, each second process identifier queried at the kernel layer is compared with each first process identifier in the first process identifier set in turn to determine whether there is a first process identifier in the first process identifier set that matches the second process identifier. If there is a second process identifier that matches the corresponding first process identifier in the first process identifier set, it means that this second process identifier is the process identifier of the process queried in the process query process at both the kernel layer and the user layer. Therefore, this second process identifier is not a hidden process, wherein the process identifier matching process is to determine whether there is the same process identifier.

[0127] Further, in step S103-4, when it is determined that the second process identifier does not have a matching first process identifier, it is determined that the process corresponding to the second process identifier that does not have a matching first process identifier is a hidden process. At this time, the comparison result is determined to be the second comparison result, and the second comparison result is used to indicate that there is a hidden process, and this hidden process is a second process identifier whose process identifier does not have a matching first process identifier.

[0128] Finally, in step S103 - 5 , the hidden process is determined based on the second process identifier indicated in the obtained second comparison result.

[0129] For example, Figure 2 is a schematic diagram of process information provided by an embodiment of the present application, such as Figure 2 As shown, the first process identifier set and the second process identifier set are obtained respectively through the process traversal of the user layer and the process traversal of the kernel layer.

[0130] Among them, the process identifiers of the multiple processes included in the first process identifier set are A1, A2, A4, and A6, and the process identifiers of the multiple processes included in the second process identifier set are A1, A2, A3, A4, A5, and A6. The number of process identifiers in the two sets is different. Further comparison and search show that the process identifiers A3 and A5 included in the second process identifier set do not appear in the first process identifier set. Therefore, it is determined that the processes with process identifiers A3 and A5 are hidden processes.

[0131] Through the above embodiment, the first process information queried by the user layer and the second process information queried by the kernel layer are compared respectively, and the hidden process is determined according to the traversal of the process number and the process identifier in turn. This method improves the detection rate of the hidden process.

[0132] Optionally, after step S103, the method further includes:

[0133] Step S104, obtaining the memory space address actually used by the hidden process, and reading the memory data of the hidden process;

[0134] Step S105, determining whether there is a second abnormal code structure or second abnormal information in the memory data of the hidden process through analysis, obtaining a second memory data detection result, and determining whether the hidden process is malicious code based on the second memory data monitoring result;

[0135] Step S106: When the hidden process is a malicious code, monitor the hidden process.

[0136] Specifically, in one embodiment, after step S103, steps S104 to S106 are also included.

[0137] First, in step S104, after the hidden process is found, the process identifier of the hidden process is output in HTML or SQL format, the actual memory space address of the hidden process is further obtained, and the memory data of the hidden process is read. In step S105, the obtained memory data is analyzed and compared to determine whether there is a second abnormal code structure or second abnormal information in the memory data of the hidden process, and then the second memory data detection result is used to indicate whether there is a second abnormal code structure or second abnormal information in the memory data. Based on the obtained second memory data monitoring result, it is determined whether the queried hidden process is a malicious code. Finally, in step S106, when the hidden process is determined to be a malicious code, the hidden process is continuously monitored, and the activity trend of the hidden process during the server operation is output during the monitoring process, and the existing malicious behavior is analyzed.

[0138] Through the above embodiments, after the hidden process is determined, the hidden process can be further monitored and analyzed to issue an alarm before the malicious behavior completely occurs, thereby enhancing the protection capability of the system and ensuring that the computer is protected from malicious attacks.

[0139] Figure 3 is a schematic diagram of a process A after it is successfully hidden, shown in an embodiment of the present application. Figure 4 is a schematic diagram showing that process A is not detected after querying at the user layer in an embodiment of the present application, Figure 5 This is a schematic diagram of what is detected after process A performs a query at the kernel layer, shown in an embodiment of the present application.

[0140] Below, the detection of a hidden process using a hook to replace a memory process is taken as an example, and the technical solution of the present application is explained in conjunction with the accompanying drawings.

[0141] 1) Test environment

[0142] (1) Operating system: Windows 7x86

[0143] (2) Hardware environment

[0144] processor: Core(TM)i5-8250U CPU@1.80GHz

[0145] Memory: 16.00G

[0146] (3) Test application: built-in notepad tool, Windows Task Manager

[0147] 2) Test content

[0148] (1) There is a hidden process

[0149] Currently, many malicious processes will bypass firewalls in various ways, invade the operating system, and parasitize on the CPU core. By creating a simple process for testing, process A, simulates a malicious process that can bypass the firewall. There is no malicious code in process A. The process identifier (PID) corresponding to process A is 2776. Then hide process A, such as Figure 3 As shown, Hook success means process A is hidden successfully.

[0150] like Figure 4 As shown in the figure, after process A is successfully hidden, process A (HOOK PID) is 2776. When traversing the user layer process in the task manager, the process with PID 2776 cannot be found. At this time, when running the kernel layer process traversal process, the device will immediately go deep into the kernel layer to traverse all processes in the CPU. After monitoring that a process is hidden, it will issue a warning, such as Figure 5As shown, the process identifier PID is 2776. After comparison, it is the hidden process A, and the test is successful.

[0151] The process detection method provided by this application is efficient and accurate, and by calling the system kernel, it does not operate the malicious hidden process, so that the malicious hidden process cannot perceive whether it is being monitored or tracked and produce countermeasures, so that we have time to fully transparently analyze and kill the malicious code, which can be effectively applied to the background detection of malicious code in the service and improve product security. In the current era of rapid development of the Internet, security is an indispensable quality assurance for servers, which improves the information security protection of server products.

[0152] Optionally, in combination with the process detection method of the above embodiment, further research may be conducted from the following aspects:

[0153] 1. Conduct in-depth research on more process hiding technologies, including: analyzing and understanding the implementation principles of various process hiding technologies in order to develop more effective detection and defense measures.

[0154] For example, using the Rootkit method: A rootkit is a tool used to hide the identity of a privileged user and malicious activities, usually by modifying kernel code or using system call hooks. In these ways, rootkits can hide processes, files, and network connections.

[0155] How it works: It can be hidden through dynamic link library (DLL) injection, kernel module, or user space program. Study how to hide processes by modifying kernel data structures (such as the process table) and understand the technical details of these methods.

[0156] Process hiding techniques based on system services: Some processes use system services or scheduled task functions to avoid direct display. By disguising or injecting into normal processes, the chance of being discovered can be reduced. Therefore, the call flow of system services can be analyzed and abnormal call behaviors can be monitored to identify potential hidden activities. By conducting in-depth research on the above techniques, we can understand how malware evades detection, thereby enhancing the effectiveness of monitoring tools.

[0157] 2. Research more process hiding detection technologies: Develop effective detection schemes for different process hiding methods to improve the accuracy and reliability of the monitoring system. For example: Static analysis: Identify possible hiding techniques by reviewing the behavior and structure of binary files. For example, specific signatures or data structure changes can be identified. Dynamic behavior monitoring: Monitor system calls, abnormal behavior, and resource usage in real time. Once abnormal activity is found (such as frequent resource requests or similarities with known malicious processes), an alarm is triggered. Memory analysis: Use hardware simulators or real-time memory capture technology to analyze the behavior of processes in memory and look for clues to hidden processes. Process tree monitoring: Study process dependencies and call stacks in the system, and build a process tree to identify abnormal affiliations or child process generation.

[0158] By comprehensively using various detection technologies, we can improve the ability to detect hidden processes and enhance system defense.

[0159] 3. Research process hiding technology and detection technology for different operating systems. Through in-depth research on process hiding technology for different operating systems, understand their implementation differences and provide a basis for the formulation of defense measures.

[0160] Operating system differences: Study the process management and kernel architecture in different operating systems (such as Windows, Linux, and macOS), and analyze their characteristics in process hiding. For example, the kernel mode used by Windows is different from the user space / kernel space division of Linux, which affects the implementation of malware. Platform-specific detection methods: Develop customized detection tools based on the characteristics of different operating systems. For example, on Linux, you can use a variety of built-in tools (such as ps, top, lsmod) to extract process information, while Windows needs to use WMI or specific system APIs for monitoring. Improve the theoretical knowledge system: By building a comparison model between operating systems, improve the theoretical system of process hiding technology and detection technology, and form a cross-platform knowledge system to effectively respond to network threats in different environments.

[0161] Through the research on process hiding technology, the development of detection technology and the analysis of different operating systems, a more complete monitoring and defense system can be established to improve the security of the network environment.

[0162] Figure 6 is a schematic diagram of a process detection device provided by an embodiment of the present application. Figure 6 shown.

[0163] Based on the same inventive concept, another embodiment of the present application further provides a process detection device, the device comprising:

[0164] The detection module 11 is used to detect whether there is an abnormal process among multiple processes running in the operating system by scanning the memory;

[0165] An acquisition module 12, configured to respectively acquire multiple process information of the multiple processes based on a user layer query and a kernel layer query when there is an abnormal process among the multiple processes;

[0166] The determination module 13 is used to match the obtained multiple process information to obtain a matching result, and determine the hidden process based on the matching result.

[0167] Optionally, the detection module 11 includes:

[0168] an actual memory usage determination unit, configured to obtain the actual memory usage of the multiple processes using an interface function provided by the operating system, and determine whether the actual memory usage of the multiple processes exceeds an actual memory usage threshold of the multiple processes;

[0169] a first memory data acquisition unit, configured to allocate memory space to a process for scanning addresses of memory actually used spaces of the multiple processes when the actual memory usage of the multiple processes exceeds a threshold value of the actual memory usage of the multiple processes, and to traverse the addresses of memory actually used spaces of the multiple processes through pointers to read memory data of the multiple processes;

[0170] An abnormal process detection unit is used to determine whether there is a first abnormal code structure or a first abnormal information in the memory data of the multiple processes by analyzing the memory data of the multiple processes, obtain a first memory data detection result, and determine whether there is an abnormal process in the multiple processes based on the first memory data monitoring result.

[0171] Optionally, the process information includes first process information and second process information, and the acquisition module 12 includes:

[0172] A first acquisition unit is used to traverse the processes of the user layer to obtain first process information of multiple processes, where the first process information at least includes multiple process information;

[0173] A second acquisition unit is used to traverse the processes of the kernel layer through the kernel function to obtain second process information of multiple processes;

[0174] The first process information is process information of the multiple processes except the hidden process, and the second process information includes at least multiple process information.

[0175] Optionally, the acquisition module 12 includes:

[0176] The first acquisition unit includes:

[0177] A first acquisition subunit is configured to take snapshots of the multiple processes, and use a first function to traverse the snapshots of the multiple processes to obtain first process information, wherein the first process information is obtained based on a user layer, and the first process information includes a first process identifier set and a first process number, wherein the first process identifier set includes a plurality of first process identifiers queried after traversing the multiple processes by using the first function, and the first process number is a number corresponding to the first process identifiers;

[0178] The first function includes a first parameter, a second parameter and a third parameter, wherein the first parameter is used to receive a first process identifier set returned after traversing the multiple processes; the second parameter is used to indicate the size of the first parameter; and the third parameter is used to indicate the number of first processes returned after traversing the multiple processes;

[0179] The second acquisition unit includes:

[0180] The second acquisition sub-unit is used to use the kernel function to obtain the second process information of all processes included in the multiple processes, the second process information is obtained based on the kernel layer, the second process information includes a second process identifier set and a second process number, the second process identifier set includes a plurality of second process identifiers corresponding to all processes queried after traversing the multiple processes through the kernel function, and the second process number is the number corresponding to the second process identifier.

[0181] Optionally, the determining module 13 includes:

[0182] a process number comparison unit, configured to compare the first process number with the second process number to determine whether the first process number is equal to the second process number;

[0183] a first comparison result determining unit, configured to determine, when the first process number is equal to the second process number, that the comparison result is a first comparison result, wherein the first comparison result indicates that no hidden process exists;

[0184] a process identifier comparison unit, configured to, when the first process number is not equal to the second process number, sequentially compare each second process identifier with each first process identifier in the first process identifier set, to determine whether there is a first process identifier in the first process identifier set that matches the second process identifier;

[0185] A second comparison result determining unit is used for, when it is determined that the second process identifier does not have a matching first process identifier, determining that the process corresponding to the second process identifier that does not have a matching first process identifier is a hidden process, and determining the comparison result as a second comparison result, wherein the second comparison result indicates that there is a hidden process, and the hidden process is a second process identifier whose process identifier does not have a matching first process identifier;

[0186] A hidden process determining unit is used to determine the hidden process based on the second comparison result.

[0187] Optionally, the device further comprises:

[0188] A second memory data acquisition unit is used to match the obtained multiple process information to obtain a matching result, determine the hidden process based on the matching result, obtain the memory actual use space address of the hidden process, and read the memory data of the hidden process;

[0189] A hidden process analysis unit, configured to determine whether there is a second abnormal code structure or second abnormal information in the memory data of the hidden process through analysis, obtain a second memory data detection result, and determine whether the hidden process is malicious code based on the second memory data monitoring result;

[0190] The monitoring unit is used to monitor the hidden process when the hidden process is a malicious code.

[0191] Based on the same inventive concept, another embodiment of the present application further provides an electronic device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the process detection method as described in any of the above embodiments.

[0192] Among them, electronic equipment refers to Figure 7 , Figure 7 is a schematic diagram of an electronic device provided by an embodiment of the present application. Figure 7 As shown, the electronic device 700 includes: a memory 710 and a processor 720. The memory 710 and the processor 720 are connected via a bus communication. A computer program is stored in the memory 510. The computer program can be run on the processor 720 to implement the steps in the process detection method disclosed in the above embodiment of the present application.

[0193] Based on the same inventive concept, another embodiment of the present application further provides a computer program product, including a computer program, which is executed by a processor to perform the process detection method described in any of the above embodiments.

[0194] Based on the same inventive concept, another embodiment of the present application further provides a computer-readable storage medium on which a computer program is stored, wherein when the program is executed by a processor, the process detection method as described in any of the above embodiments is implemented.

[0195] As for the device, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0196] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0197] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, devices, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0198] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, terminal devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing terminal device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0199] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing terminal device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0200] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal device so that a series of operating steps are executed on the computer or other programmable terminal device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable terminal device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0201] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the embodiments of the present application.

[0202] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0203] The above is a detailed introduction to a process detection method, device, equipment and medium provided by the present application. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A process detection method, characterized in that: The method comprises: By scanning the memory, detect whether there are abnormal processes among the multiple processes running in the operating system; When there is an abnormal process among the multiple processes, obtaining multiple process information of the multiple processes based on user layer query and kernel layer query respectively; The obtained multiple process information are matched to obtain a matching result, and the hidden process is determined based on the matching result.

2. The process detection method according to claim 1, characterized in that: The method of scanning the memory to detect whether there is an abnormal process among the multiple processes running in the operating system includes: Using an interface function provided by the operating system to obtain actual memory usage of the multiple processes, and determining whether the actual memory usage of the multiple processes exceeds a threshold value of actual memory usage of the multiple processes; When the actual memory usage of the multiple processes exceeds the actual memory usage threshold of the multiple processes, allocating memory space to a process used to scan the actual memory usage space addresses of the multiple processes, and traversing the actual memory usage space addresses of the multiple processes through pointers to read memory data of the multiple processes; By analyzing the memory data of the multiple processes, it is determined whether there is a first abnormal code structure or a first abnormal information in the memory data of the multiple processes, a first memory data detection result is obtained, and based on the first memory data monitoring result, it is determined whether there is an abnormal process in the multiple processes.

3. The process detection method according to claim 1, characterized in that: The process information includes first process information and second process information, and when there is an abnormal process among the multiple processes, obtaining multiple process information of the multiple processes based on user layer query and kernel layer query respectively includes: Traversing the processes of the user layer to obtain first process information of multiple processes, wherein the first process information at least includes multiple process information; Traverse the kernel layer processes through the kernel function to obtain the second process information of multiple processes; The first process information is process information of the multiple processes except the hidden process, and the second process information includes at least multiple process information.

4. The process detection method according to claim 3, characterized in that: When there is an abnormal process among the multiple processes, obtaining multiple process information of the multiple processes based on user layer query and kernel layer query respectively includes: The traversing of the user layer processes to obtain first process information of multiple processes includes: Taking snapshots of the multiple processes, and traversing the snapshots of the multiple processes using a first function to obtain first process information, wherein the first process information is obtained based on a user layer, and the first process information includes a first process identifier set and a first process number, wherein the first process identifier set includes a plurality of first process identifiers queried after traversing the multiple processes using the first function, and the first process number is the number corresponding to the first process identifiers; The first function includes a first parameter, a second parameter and a third parameter, wherein the first parameter is used to receive a first process identifier set returned after traversing the multiple processes; the second parameter is used to indicate the size of the first parameter; and the third parameter is used to indicate the number of first processes returned after traversing the multiple processes; The process of the kernel layer is traversed through the kernel function to obtain the second process information of multiple processes, including: Use a kernel function to obtain second process information of all processes included in the multiple processes, the second process information is obtained based on the kernel layer, the second process information includes a second process identifier set and a second process number, the second process identifier set includes multiple second process identifiers corresponding to all processes queried after traversing the multiple processes through the kernel function, and the second process number is the number corresponding to the second process identifier.

5. The process detection method according to claim 4, characterized in that: The step of matching the obtained multiple process information to obtain a matching result, and determining the hidden process based on the matching result includes: Compare the first process number with the second process number to determine whether the first process number is equal to the second process number; When the first process number is equal to the second process number, determining that the comparison result is a first comparison result, and the first comparison result indicates that there is no hidden process; When the first process number is not equal to the second process number, comparing each second process identifier with each first process identifier in the first process identifier set in turn to determine whether there is a first process identifier in the first process identifier set that matches the second process identifier; When it is determined that the second process identifier does not have a matching first process identifier, it is determined that the process corresponding to the second process identifier that does not have a matching first process identifier is a hidden process, and the comparison result is determined to be a second comparison result, the second comparison result indicating that there is a hidden process, and the hidden process is a second process identifier whose process identifier does not have a matching first process identifier; Based on the second comparison result, the hidden process is determined.

6. The method according to claim 1, characterized in that After matching the obtained multiple process information to obtain matching results, and determining the hidden process based on the matching results, the method further includes: Obtaining the memory space address actually used by the hidden process, and reading the memory data of the hidden process; By analyzing, determining whether there is a second abnormal code structure or second abnormal information in the memory data of the hidden process, obtaining a second memory data detection result, and determining whether the hidden process is malicious code based on the second memory data monitoring result; When the hidden process is a malicious code, the hidden process is monitored.

7. The process detection method according to any one of claims 1 to 6, characterized in that: The method is applied to a hardware simulator, in which an operating system image is configured.

8. A process detection device, characterized in that: The device comprises: A detection module, used to detect whether there is an abnormal process among multiple processes running in the operating system by scanning the memory; An acquisition module, used for respectively acquiring multiple process information of the multiple processes based on user layer query and kernel layer query when there is an abnormal process among the multiple processes; The determination module is used to match the obtained multiple process information to obtain a matching result, and determine the hidden process based on the matching result.

9. An electronic device, characterized in that: The method comprises a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the process detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, wherein when the computer program is executed by a processor, the process detection method as described in any one of claims 1 to 7 is implemented.

Images