Malicious program detection method and device

Abstract

The embodiment of the invention discloses a malicious program detection method which comprises the steps that the access behavior of a process running in computer equipment to a target file is monitored, and the target file is a sensitive file which does not exist in the computer equipment. In consideration of the fact that a rogue program reads files on computer equipment according to a preset file list when stealing sensitive data of a user, and the preset file list of the rogue program is relatively complete, the probability that all files in the file list are stored at the same time is relatively low for a certain computer equipment, so that the probability of the rogue program is relatively low. Therefore, when the malicious program reads the files on the computer equipment according to the preset file list, the malicious program inevitably tries to read the files which do not exist on the computer equipment. Therefore, if the behavior that the process tries to access the target file occurs, it can be determined that the target program generating the process is the malicious program, and the alarm information including the identifier of the target program is output. Therefore, according to the scheme, the malicious program can be accurately identified.

Description

Technical Field

[0001] The present application relates to the field of information security, and in particular to a method and device for detecting malicious programs. Background Art

[0002] Attackers use malicious programs to attack computer devices such as hosts. Some malicious programs, such as stealing Trojans, are mainly aimed at stealing user data, for example, stealing sensitive data of users. The behavior of malicious programs stealing user data will not have a significant impact on the performance of computer devices. Therefore, it is difficult to detect malicious programs.

[0003] Most current malicious program detection solutions detect the behavior of other programs in computer devices accessing sensitive files, and when it is detected that sensitive files in the computer device are accessed, a prompt message is output to remind the user that his computer device may be at risk of being invaded by malicious programs.

[0004] However, the above scheme cannot accurately detect malicious programs, because legitimate applications running on the computer device may also read sensitive files in the computer device. For example, antivirus software will inevitably read sensitive files in the computer device when performing a full disk scan.

[0005] Therefore, there is an urgent need for a solution that can accurately detect malicious programs. Summary of the invention

[0006] The embodiment of the present application provides a malicious program detection method, which can accurately detect malicious programs.

[0007] In the first aspect, the embodiment of the present application provides a method for detecting malicious programs, which can accurately detect malicious programs. Specifically, considering that when a malicious program steals sensitive data of a user, it will read files on a computer device according to its own preset file list, and the file list preset by the malicious program itself is relatively complete. For a certain computer device, the probability of all files in the aforementioned file list existing at the same time is low. Therefore, when the malicious program reads files on the computer device according to its own preset file list, it will inevitably try to read files that do not exist on the computer device. Therefore, in this solution, the access behavior of the process running in the computer device to the target file is monitored, wherein the target file is a sensitive file that does not exist in the computer device. If the aforementioned process attempts to access the target file, it can be determined that the target program that generates the process is a malicious program. Therefore, if the aforementioned process attempts to access the target file, an alarm message including the identifier of the target program is output. It can be seen that using this solution, malicious programs can be accurately identified.

[0008] In one possible implementation, the aforementioned sensitive file is a file described by an entry in a sensitive file list, wherein the file described by the entry in the sensitive file list is a file that is more likely to be accessed by malware. As a specific example, the entry in the sensitive file list includes an identifier of the sensitive file and a corresponding storage location in the computer device. In other words, the target file is a file that does not exist in the computer device and is described by an entry in the sensitive file list. For this situation, using this solution, when the target program accesses a file that does not exist in the computer device and is described by an entry in the sensitive file list, it is determined that the target program that generates the process is a malicious program, thereby accurately identifying the malicious program.

[0009] In a possible implementation, the sensitive file list is sent by the server to the computer device, in other words, the computer device receives the sensitive file list sent by the server, so as to detect malicious programs based on the sensitive file list. The items in the sensitive file list include the identifier of the sensitive file and the corresponding storage location in the computer device.

[0010] In a possible implementation, when monitoring the access behavior of a process to a target file, a callback function is used to monitor the access behavior, wherein the callback function is used to determine whether the file that the process attempts to access is a file that does not exist in the computer device, and to determine whether the file that the process attempts to access is a file described by an entry in the sensitive file list. If the callback function determines that the file that the process attempts to access is a file that does not exist in the computer device, and the file that the process attempts to access is a file in the sensitive file list, then it is determined that the process attempts to access the target file. Correspondingly, if the callback function determines that the file that the process attempts to access is a file that exists in the computer device, or determines that the file that the process attempts to access is not a file in the sensitive file list, then it is determined that the process does not attempt to access the target file.

[0011] In a possible implementation, when monitoring the access behavior of a process to a target file, a hook function is used to change the entry point of a first function to a second function, and the second function is used to determine the access behavior. Wherein: the first function is a function provided by the operating system of the computer device for opening a file. The second function is used to call the first function, and to determine whether the file that the process attempts to access is a file described by an entry in the sensitive file list, and when the file that the process attempts to access is a file described by an entry in the sensitive file list, the access behavior is determined according to the error code returned by the first function, wherein the error code indicates that the file that the process attempts to access is a file that does not exist in the computer device. For example, the second function determines that the file that the process attempts to access is a file described by an entry in the sensitive file list, and when the first function returns the error code, it is determined that the process attempts to access the target file. Correspondingly, if the first function does not return an error code indicating that the file that the process attempts to access is a file that does not exist in the computer device, or if the second function determines that the file that the process attempts to access is not a file described by an entry in the sensitive file list, it is determined that the process does not attempt to access the target file.

[0012] In a possible implementation, if the computer device starts the virtualization function, the entry point of the first function is changed to the second function by using the hook function. In the specific implementation, the computer device changes the entry point of the first function to the second function by using the hook function in response to detecting the virtual machine exit event. When the process attempts to open a file in the computer device, the virtual machine exit event will be triggered. That is, when the process attempts to open a file in the computer device, the second function is called, and further, the computer device can determine whether the process attempts to access the target file based on the second function.

[0013] In a possible implementation, the computer device determines whether to output the warning information immediately or in combination with the historical detection results according to the security level of the target file. The security level of the target file indicates the file importance of the target file. The higher the file importance, the greater the loss caused by the leakage of the target file. The lower the file importance, the smaller the loss caused by the leakage of the target file. As a specific example, if the file importance indicated by the security level of the target file is higher than or equal to the specified threshold, it means that the importance of the target file is very high, and accordingly, once the target file is leaked, the loss caused to the user is large. In this case, once the process accesses the target file, the warning information is immediately output, so that the user can take corresponding countermeasures in time based on the warning information to avoid the leakage of the target file as much as possible. As another specific example, if the file importance indicated by the security level of the target file is lower than the specified threshold, it means that the importance of the target file is relatively not very high, and accordingly, once the target file is leaked, it will not cause irreparable losses to the user. In this case, if the number of times the target application attempts to access the target file exceeds the preset number within a certain period of time, the warning information is output. That is, if the target application attempts to access the target file multiple times within a certain period of time, an alarm message is output, so that the user can take corresponding countermeasures in a timely manner based on the alarm message to avoid the leakage of the target file as much as possible. In this way, the user can be reminded that his computer device is at risk of being invaded by the target program without disturbing the user by frequently outputting alarm messages.

[0014] In a possible implementation, sensitive files refer to files storing sensitive data. Sensitive data refers to files that will cause losses to users once leaked. Considering that the username and password saved by the browser, the username and password for logging into the File Transfer Protocol (FTP) server, the username and password saved by the email client, the username and password for logging into the Secure Shell Protocol (SSH) server, and the Bitcoin wallet data will all cause certain losses to the user once leaked. Therefore, sensitive data can include one or more of the username and password saved by the browser, the username and password for logging into the FTP server, the username and password saved by the email client, the username and password for logging into the SSH server, and the Bitcoin wallet data.

[0015] In a second aspect, an embodiment of the present application provides a malicious program detection device, which includes a monitoring unit and an alarm unit. The monitoring unit is used to monitor the access behavior of a process running in a computer device to a target file, wherein the target file is a sensitive file that does not exist in the computer device; the alarm unit is used to output an alarm message if the process attempts to access the target file, and the alarm message includes an identifier of the target program that generates the process.

[0016] In a possible implementation, the sensitive file is a file described by an entry in a sensitive file list, and the entry in the sensitive file list includes an identifier of the sensitive file and a corresponding storage location in the computer device.

[0017] In one possible implementation, the monitoring unit is used to: monitor the access behavior using a callback function, wherein the callback function is used to determine whether the file that the process attempts to access is a file that does not exist in the computer device, and to determine whether the file that the process attempts to access is a file described by an entry in the sensitive file list.

[0018] In one possible implementation, the monitoring unit is used to: use a hook function to change the entry point of the first function to a second function, and use the second function to determine the access behavior, wherein: the first function is a function provided by the operating system of the computer device for opening a file, and the second function is used to call the first function, and to determine whether the file that the process attempts to access is the file described by the entry in the sensitive file list, and when the file that the process attempts to access is the file described by the entry in the sensitive file list, determine the access behavior according to an error code returned by the first function, wherein the error code indicates that the file that the process attempts to access is a file that does not exist in the computer device.

[0019] In one possible implementation, if the computer device starts the virtualization function, the use of the hook function to change the entry point of the first function to the second function includes: in response to detecting a virtual machine exit event, using the hook function to change the entry point of the first function to the second function, wherein the virtual machine exit event is triggered when a process attempts to open a file in the computer device.

[0020] In a possible implementation manner, the device further includes: a receiving unit, configured to receive the sensitive file list sent by a server.

[0021] In a possible implementation, the alarm unit is used to output the alarm information in response to monitoring the process attempting to access the target file and the file importance indicated by the security level of the target file is higher than or equal to a specified threshold.

[0022] In a possible implementation, the alarm unit is used to output the alarm information if the file importance indicated by the security level of the target file is lower than a specified threshold and the number of times the target program attempts to access the target file exceeds a preset number within a certain time period.

[0023] In one possible implementation, the sensitive file includes: a file storing sensitive data, wherein the sensitive data includes one or more of the following: a user name and password saved by a browser, a user name and password for logging into a file transfer protocol FTP server, a user name and password saved by an email client, a user name and password for logging into a secure shell protocol SSH server, and Bitcoin wallet data.

[0024] In a third aspect, an embodiment of the present application provides a device. The device includes a processor and a memory. The memory is used to store instructions or computer programs. The processor is used to execute the instructions or computer programs in the memory to perform any method described in the first aspect above.

[0025] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, including instructions or a computer program, which, when executed on a computer, enables the computer to execute any one of the methods described in the first aspect above.

[0026] In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions or a computer program, which, when executed on a computer, enables the computer to execute any one of the methods described in the first aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 A flowchart of a malicious program detection method provided in an embodiment of the present application;

[0029] Figure 2 A signaling interaction diagram of a malicious program detection method provided in an embodiment of the present application;

[0030] Figure 3 A schematic diagram of a computer device detecting malicious programs provided in an embodiment of the present application;

[0031] Figure 4 A schematic diagram of another computer device detecting malicious programs provided in an embodiment of the present application;

[0032] Figure 5 A schematic diagram of another computer device detecting malicious programs provided in an embodiment of the present application;

[0033] Figure 6 A schematic diagram of the structure of a malicious program detection device provided in an embodiment of the present application;

[0034] Figure 7 A schematic diagram of the structure of a device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0035] The embodiment of the present application provides a malicious program detection method, which can effectively detect malicious programs that invade computer devices.

[0036] In the embodiments of the present application, it is considered that when a malicious program steals sensitive data of a user, it will read files on a computer device according to its own preset file list, and the file list preset by the malicious program itself is generally relatively complete. For a certain computer device, the probability of storing all the files in the aforementioned file list at the same time is low. For example, the preset file list includes files stored by various browsers, and for a certain computer device, it is basically impossible to install all browsers at the same time, which also makes the computer device not store files in the file list, but the files created by the browser that is not installed by the computer device.

[0037] It is precisely because of the characteristic that the malicious program reads files on the computer device based on its own preset file list that when the malicious program reads files on the computer device according to its own preset file list, it will inevitably attempt to read files that do not exist on the computer device. Therefore, in this solution, the access behavior of the process running in the computer device to the target file is monitored, wherein the target file is a sensitive file that does not exist in the computer device. If the aforementioned process attempts to access the target file, it can be determined that the target program that generates the process is a malicious program, thereby effectively detecting the malicious program that invades the computer device.

[0038] The malicious programs mentioned in the embodiments of the present application include any malicious programs that can read files on a computer device based on their own preset file lists, and the malicious programs include but are not limited to secret-stealing Trojans.

[0039] Next, the malicious program detection method provided in the embodiment of the present application is introduced in conjunction with the accompanying drawings.

[0040] See also Figure 1 , which is a flowchart of a malicious program detection method provided by an embodiment of the present application. In one example, Figure 1 The malicious program detection method shown is executed by a computer device, as a specific example, Figure 1 The malicious program detection method shown is executed by a malicious program detection program (such as terminal security software) running on the computer device. Figure 1 The malicious program detection method shown includes the following S101-S102.

[0041] S101: Monitor access behavior of a process running in a computer device to a target file, wherein the target file is a sensitive file that does not exist in the computer device.

[0042] The sensitive file in the embodiment of the present application refers to a file storing sensitive data. Sensitive data refers to a file that will cause losses to the user once it is leaked. In some scenarios, sensitive data is also referred to as private data. As a specific example, considering that the username and password saved by the browser, the username and password for logging in to the FTP server, the username and password saved by the email client, the username and password for logging in to the SSH server, and the Bitcoin wallet data are leaked, they will all cause certain losses to the user. For example, the username and password saved by the browser, the username and password for logging in to the FTP server, the username and password saved by the email client, or the username and password for logging in to the SSH server, once leaked, there will be a risk of information leakage, and the user needs to bear the loss caused by the information leakage. For example, the leakage of Bitcoin wallet data may cause property losses to the user. Therefore, sensitive data can include one or more of the username and password saved by the browser, the username and password for logging in to the FTP server, the username and password saved by the email client, the username and password for logging in to the SSH server, and the Bitcoin wallet data.

[0043] In the embodiment of the present application, the process in the computer device is monitored for accessing the target file. For example, the process in the computer device attempts to access the file, and further determines whether the file that the process attempts to access is a file that does not exist in the computer device. If it is determined that the file that the process attempts to access is a file that does not exist in the computer device, it is determined that the process attempts to access the target file.

[0044] As a specific example, when S101 is implemented, a callback function is used to monitor the access behavior of the process running in the computer device to the target file. The callback function is used to determine whether the file that the process attempts to access is a file that does not exist in the computer device. In a specific example, when the aforementioned malicious program detection program is installed, a file system micro-filter driver will be installed, and the file system micro-filter driver will register the aforementioned callback function. The callback function can intercept the action of the process attempting to access the file, and further determine whether the file that the process attempts to access is a file that does not exist in the computer device. For example, the callback function searches for a file existing in the computer device, and compares the information of the file that the process attempts to access with the information of the file existing in the computer device, so as to determine whether the file that the process attempts to access is a file that does not exist in the computer device. Among them, the file information includes the identification of the file and the corresponding storage location. If the callback function determines that the file that the process attempts to access is a file that does not exist in the computer device, it is determined that the process attempts to access the target file. Correspondingly, if the callback function determines that the file that the process attempts to access is a file that exists in the computer device, it is determined that the process does not attempt to access the target file.

[0045] In another specific example, during the specific implementation of S101, a hook function is used to change the entry point of the first function to a second function, and the second function is used to determine the access behavior.

[0046] In a specific example, when the aforementioned malicious program detection program is started in a computer device, a dynamic link library is injected into the program memory space, and the dynamic link library uses a hook function to change the entry point of the first function to the second function.

[0047] In another specific example, if the computer device starts the virtualization function, in response to detecting the virtual machine exit event, the entry point of the first function is changed to the second function using the hook function. Wherein, when the process attempts to open a file in the computer device, the virtual machine exit event will be triggered. In this way, when the process attempts to access the file in the computer device, the entry point of the first function is changed to the second function using the hook function, so as to monitor the access behavior of the process running in the computer device to the target file using the second function. As a specific example, when the aforementioned malicious program detection program is installed, a driver program will be installed, and the function of the driver program is to enable the virtualization function on the computer device, and to use registers or memory pages to change the entry point of the first function to the second function. In addition, the first function in the memory state is set to be non-executable, so that when the process accesses the file in the computer device, the non-executable first function will be called, thereby triggering the virtual machine exit event.

[0048] The first function is a function for opening a file provided by the operating system of the computer device. That is, when a process accesses a file in the computer device, it needs to call the first function to access the corresponding file. The first function can open a file existing in the computer device. If the file that the process attempts to access does not exist in the computer device, the first function will return a corresponding error code, for example, error code 2, to indicate that the file that the process attempts to access does not exist in the computer device. The first function is, for example, the CreateFileW function provided by the Windows operating system, or the NtCreateFile function provided by the Windows operating system.

[0049] The hook function is used to change the entry point of the first function to the second function, for example, the memory address of the first function is changed to the memory address of the second function. In this way, when the process accesses the file in the computer device, the first function is no longer directly called, but the second function is called.

[0050] The second function is used to call the first function. As mentioned above, if the file that the process attempts to access is a file that does not exist in the computer device, the first function will return a corresponding error code. Therefore, the second function can determine the process's access behavior to the target file based on the error code returned by the first function, indicating that the file that the process attempts to access is a file that does not exist in the computer device. For example, when the first function returns the error code, it is determined that the process has attempted to access the target file. Correspondingly, if the first function does not return an error code indicating that the file that the process attempts to access is a file that does not exist in the computer device, it is determined that the process has not attempted to access the target file.

[0051] In one example, it is considered that malicious programs may obtain user sensitive data by accessing sensitive files in a computer device. Therefore, in one example, the aforementioned target file is a sensitive file. In a specific example, a computer device receives a list of sensitive files sent by a server so as to detect malicious programs based on the list of sensitive files. The table items in the sensitive file list include an identifier of a sensitive file and a corresponding storage location in the computer device. Among them, the identifier of a sensitive file is, for example, the file name of a sensitive file. In another specific example, a sensitive file list is pre-configured in the computer device, and the computer device detects malicious programs based on the pre-configured sensitive file list.

[0052] In a specific example, after receiving the sensitive file list, the sensitive file list is filtered using files existing in the computer device, and the identifiers of the files existing in the computer device and included in the sensitive file list and the corresponding storage locations are deleted to obtain a target file list, wherein the target file list includes the identifiers of sensitive files not existing in the computer device and the corresponding storage locations.

[0053] As an example, the aforementioned target file is a file in the aforementioned target file list. Considering that the files existing in the computer device will change dynamically, for example, if a new browser is reinstalled on the computer device, the file corresponding to the newly installed browser will be added to the computer device. Therefore, in order to accurately monitor whether there is a process attempting to access the target file, it is necessary to update the target file list in real time based on the files currently existing in the computer device. If the target file list is not updated in real time based on the files currently existing in the computer device, it is impossible to accurately monitor whether the process has the behavior of accessing the target file.

[0054] As another example, the aforementioned target file is a file in the sensitive file list. In this case, when monitoring the process's access to the target file, it is sufficient to monitor it in conjunction with the sensitive file list, without the need to update the target file list in real time based on the files currently existing on the computer device, and it is also possible to accurately monitor whether the process has accessed the target file.

[0055] In an embodiment of the present application, when the target file is a file in the sensitive file list, one implementation of S101 is: using a callback function to monitor the access behavior, wherein the callback function is used to determine whether the file that the process attempts to access is a file that does not exist in the computer device, and to determine whether the file that the process attempts to access is a file described by an entry in the sensitive file list. In a specific example, when the aforementioned malicious program detection program is installed, a file system microfilter driver will be installed, and the file system microfilter driver will register a callback function, which can intercept the action of the process attempting to access the file, and further determine whether the file that the process attempts to access is a file that does not exist in the computer device, and determine whether the file that the process attempts to access is a file described by an entry in the sensitive file list. Among them, when determining whether the file that the process attempts to access is a file described by an entry in the sensitive file list, the callback function compares the information of the file that the process attempts to access with the entry in the sensitive file list, thereby determining whether the file that the process attempts to access is a file described by an entry in the sensitive file list. If the callback function determines that the file that the process attempts to access is a file that does not exist in the computer device, and the file that the process attempts to access is a file in the sensitive file list, then it is determined that the process attempts to access the target file. Correspondingly, if the callback function determines that the file that the process attempts to access is a file that exists in the computer device, or determines that the file that the process attempts to access is not a file in the sensitive file list, then it is determined that the process does not attempt to access the target file.

[0056] In an embodiment of the present application, when the target file is a file in the sensitive file list, another implementation method of S101 is: using a hook function to change the entry point of the first function to a second function, and using the second function to determine the access behavior. As a specific example, if the computer device has started the virtualization function, then in response to detecting a virtual machine exit event, the hook function is used to change the entry point of the first function to the second function. Among them, when a process attempts to open a file in a computer device, a virtual machine exit event is triggered. Regarding the triggering method of the virtual machine exit event and the activation of the virtualization function by the computer device, please refer to the relevant description part of the previous text, which will not be repeated here. Among them:

[0057] The first function is a function provided by the operating system of the computer device for opening a file. For the first function, reference may be made to the relevant description above, and no detailed description is given here.

[0058] The second function is used to call the first function, and to determine whether the file that the process attempts to access is a file described by an entry in the sensitive file list, and to determine the access behavior according to the error code returned by the first function when the file that the process attempts to access is a file described by an entry in the sensitive file list, wherein the error code indicates that the file that the process attempts to access is a file that does not exist in the computer device. As described above, if the file that the process attempts to access is a file that does not exist in the computer device, the first function will return a corresponding error code. Therefore, when the second function determines that the file that the process attempts to access is a file described by an entry in the sensitive file list, it can determine the process's access behavior to the target file according to the error code returned by the first function indicating that the file that the process attempts to access is a file that does not exist in the computer device. For example, the second function determines that the file that the process attempts to access is a file described by an entry in the sensitive file list, and when the first function returns the error code, it is determined that the process attempts to access the target file. Correspondingly, if the first function does not return an error code indicating that the file that the process attempts to access is a file that does not exist in the computer device, or if the second function determines that the file that the process attempts to access is not a file described by an entry in the sensitive file list, it is determined that the process does not attempt to access the target file.

[0059] S102: If the process attempts to access the target file, output a warning message, where the warning message includes an identifier of the target program that generated the process.

[0060] In the embodiment of the present application, if a process attempts to access a target file, it indicates that the target program that generates the process is a malicious program. Therefore, an alarm message including the identifier of the target program can be output to prompt the user that the computer device has been invaded by the target program, so that the user can take corresponding countermeasures.

[0061] In an embodiment of the present application, when S102 is implemented, an alarm message may be output immediately after determining that the process attempts to access the target file, or it may be determined whether to output an alarm message based on historical detection results. For example, if historical detection records indicate that the target program has read the target file multiple times, an alarm message is output to avoid frequent output of alarm messages that interfere with the user.

[0062] In one example, when S102 is implemented, it is determined whether to output the alarm information immediately or in combination with the historical detection results according to the security level of the target file. The security level of the target file is used to indicate the file importance of the target file, which can also be understood as the sensitivity of the target file, or the degree of loss caused by the leakage of the target file. The higher the file importance, the higher the sensitivity, and accordingly, the greater the loss caused by the leakage of the target file. The lower the file importance, the lower the sensitivity, and accordingly, the smaller the loss caused by the leakage of the target file.

[0063] As a specific example, if the file importance indicated by the security level of the target file is higher than or equal to a specified threshold, it means that the importance of the target file is very high. Accordingly, once the target file is leaked, the loss to the user is relatively large. In this case, once the process accesses the target file, an alarm message is immediately output so that the user can take corresponding countermeasures in time based on the alarm message to avoid the target file leakage as much as possible. In other words, S102, when implemented specifically, includes: in response to monitoring the process attempting to access the target file, and the file importance indicated by the security level of the target file is higher than or equal to a specified threshold, outputting the alarm message.

[0064] As another specific example, if the file importance indicated by the security level of the target file is lower than the specified threshold, it means that the importance of the target file is relatively not very high. Accordingly, once the target file is leaked, it will not cause irreparable losses to the user. For this case, combined with the historical detection results, it is determined whether to output the alarm information. For example, if the number of times the target application attempts to access the target file exceeds the preset number of times within a certain period of time, the alarm information is output. That is: within a certain period of time, the target application attempts to access the target file many times, and the alarm information is output, so that the user can take corresponding countermeasures in time based on the alarm information to avoid the leakage of the target file as much as possible. In other words, S102, when implemented specifically, includes: if the file importance indicated by the security level of the target file is lower than the specified threshold, and the number of times the target program attempts to access the target file exceeds the preset threshold number of times within a certain period of time, the alarm information is output. In this way, the user can be prompted that his computer device is at risk of being invaded by the target program without frequently outputting the alarm information to disturb the user.

[0065] Regarding the specific values ​​of the above-mentioned specified thresholds and preset times, they can be set according to actual conditions and are not specifically limited in the embodiments of the present application.

[0066] It can be seen from the above description that, compared with traditional technologies, the solution provided by the embodiments of the present application can accurately identify malicious programs.

[0067] Next, the malicious program detection method provided in the embodiment of the present application is introduced in combination with specific scenarios.

[0068] See also Figure 2 , Figure 2 A signaling interaction diagram of a malicious program detection method provided in an embodiment of the present application.

[0069] like Figure 2 As shown, the server sends a list of sensitive files to the computer device, and the computer device detects malicious programs based on the list of sensitive files and outputs warning information. Optionally, the computer device can also terminate and isolate the malicious program.

[0070] Next, combine Figures 3 to 5 , introduces the specific implementation method of computer equipment detecting malicious programs.

[0071] See also Figure 3 , which is a schematic diagram of a computer device detecting malicious programs provided in an embodiment of the present application.

[0072] like Figure 3 As shown, the malicious program 301 and the malicious program detection program 302 run in the user state of the computer device. When the malicious program detection program 302 is installed, the file system micro-filter driver 303 running in the kernel state of the computer device will be installed. In addition, the input output (IO) manager 304 and the filter manager 305 provided by the operating system of the computer device also run in the kernel state of the computer device. The file system micro-filter driver 303 will register a callback function. Among them, the user state and the kernel state correspond to two operating levels of the operating system. The user state corresponds to the lowest privilege level, and the kernel state corresponds to a higher privilege level. The operating system program and the program instructions related to the hardware operation run in the kernel state, and the application programs installed by the user run in the user state.

[0073] When the malicious program 301 attempts to read a file, the operating system of the computer device detects the file opening action of the process attempting to open the file, and the IO manager 304 notifies the file opening action to the file system microfilter driver 303 that registers the callback function through the filter manager 305, wherein the file opening action notified by the IO manager 304 to the file system microfilter driver 303 includes the file identifier and storage location that the process attempts to open. The callback function determines whether the file that the process attempts to access is a file that does not exist in the computer device, and determines whether the file that the process attempts to access is a file in the sensitive file list, thereby determining that the process attempts to access the target file, and reporting the behavior to the malicious program detection program 302.

[0074] See also Figure 4 , this figure is a schematic diagram of another computer device detecting malicious programs provided in an embodiment of the present application.

[0075] like Figure 4 As shown, malicious program 401 and malicious program detection program 402 run in the user state of the computer device. When malicious program detection program 402 is started in the computer device, a dynamic link library is injected into the program memory space. The dynamic link library uses the hook function to change the entry point of the first function 404 to the second function 403. The first function 404 and the second function 403 also run in the user state of the computer device. The first function example 404 is, for example, the CreateFileW function provided by the Windows operating system.

[0076] When the malicious program 401 attempts to read a file, the second function 403 is triggered, and the second function 403 calls the first function 404 and receives the error code 2 returned by the first function 404. The second function 403 also determines whether the file that the process attempts to access is a file in the sensitive file list. If the file that the process attempts to access is a file in the sensitive file list, it is determined that the process attempts to access the target file based on the error code 2 returned by the first function 404, and the behavior is reported to the malicious program detection program 402.

[0077] See also Figure 5 , which is a schematic diagram of another computer device detecting malicious programs provided in an embodiment of the present application.

[0078] like Figure 5As shown, the computer device has a virtualization function enabled, wherein the virtualization function of the computer device is enabled by a driver installed when the malicious program detection program is installed. In this case, the computer device includes a virtual machine layer and a physical layer, and the virtual machine layer runs a virtual machine. As a specific example, the virtual machine layer of the computer device includes at least one virtual machine manager (VMM) client or a hypervisor client, Figure 5 VMM client 501, VMM client 502 and VMM client 503 are shown. The VMM client or hypervisor client runs in a virtual machine, and one VMM client or hypervisor client corresponds to one virtual machine. Figure 5 In the scenario shown, the virtual machine layer of the computer device runs three virtual machines, namely virtual machine 1, virtual machine 2 and virtual machine 3. VMM client 501 corresponds to virtual machine 1, VMM client 502 corresponds to virtual machine 2, and VMM client 503 corresponds to virtual machine 3. The physical layer of the computer device includes a VMM manager 504. When the malicious program in the VMM client 502 of the virtual machine layer calls the first function, it triggers a virtual machine exit event. Accordingly, the VMM manager 504 intercepts the virtual machine exit event, changes the entry point of the first function to the second function, and further uses the second function to determine the behavior of the process attempting to access the target file, and reports the behavior to the malicious program detection program. Among them, Figure 5 The first function mentioned in the above is, for example, the NtCreateFile function provided by the Windows operating system. For the specific implementation of "using the second function to determine the behavior of the process attempting to access the target file", please refer to the above Figure 4 The description part will not be repeated here.

[0079] above Figures 3 to 5 It is only shown for the convenience of understanding the present solution and does not constitute a limitation on the internal structure of the computer device and the software modules included therein. For example, the physical layer of the computer device also includes a central processing unit (CPU).

[0080] Based on the malicious program detection method provided in the above embodiment, the present application embodiment also provides a malicious program detection device. Figure 6 , which is a schematic diagram of the structure of a malicious program detection device provided in an embodiment of the present application. Figure 6 The malicious program detection device shown is used to execute the malicious program detection method provided by the above method embodiment. Figure 6As shown, the malicious program detection device 600 includes: a monitoring unit 601 and an alarm unit 602.

[0081] The monitoring unit 601 is used to execute S101 provided in the above method embodiment: monitoring the access behavior of the process running in the computer device to the target file, wherein the target file is a sensitive file that does not exist in the computer device;

[0082] The alarm unit is used to execute S102 provided in the above method embodiment: if the process attempts to access the target file, output alarm information, and the alarm information includes the identifier of the target program that generates the process.

[0083] In a possible implementation, the sensitive file is a file described by an entry in a sensitive file list, and the entry in the sensitive file list includes an identifier of the sensitive file and a corresponding storage location in the computer device.

[0084] In one possible implementation, the monitoring unit 601 is used to: monitor the access behavior using a callback function, wherein the callback function is used to determine whether the file that the process attempts to access is a file that does not exist in the computer device, and to determine whether the file that the process attempts to access is a file described by an entry in the sensitive file list.

[0085] In a possible implementation, the monitoring unit 601 is used to: change the entry point of the first function to a second function by using a hook function, and determine the access behavior by using the second function, wherein:

[0086] The first function is a function for opening a file provided by the operating system of the computer device, and the second function is used to call the first function and determine whether the file attempted to be accessed by the process is the file described by the entry in the sensitive file list, and when the file attempted to be accessed by the process is the file described by the entry in the sensitive file list, the access behavior is determined according to an error code returned by the first function, wherein the error code indicates that the file attempted to be accessed by the process is a file that does not exist in the computer device.

[0087] In one possible implementation, if the computer device starts the virtualization function, the use of the hook function to change the entry point of the first function to the second function includes: in response to detecting a virtual machine exit event, using the hook function to change the entry point of the first function to the second function, wherein the virtual machine exit event is triggered when a process attempts to open a file in the computer device.

[0088] In a possible implementation, the apparatus 600 further includes:

[0089] A receiving unit is used to receive the sensitive file list sent by the server.

[0090] In a possible implementation, the alarm unit 602 is used to: in response to monitoring the process attempting to access the target file and the file importance indicated by the security level of the target file is higher than or equal to a specified threshold, output the alarm information.

[0091] In a possible implementation, the alarm unit 602 is used to output the alarm information if the file importance indicated by the security level of the target file is lower than a specified threshold and the number of times the target program attempts to access the target file exceeds a preset number within a certain time period.

[0092] In one possible implementation, the sensitive file includes: a file storing sensitive data, wherein the sensitive data includes one or more of the following: a user name and password saved by a browser, a user name and password for logging into a file transfer protocol FTP server, a user name and password saved by an email client, a user name and password for logging into a secure shell protocol SSH server, and Bitcoin wallet data.

[0093] Regarding the specific implementation of each unit of the malicious program detection device 600, since it belongs to the same concept as the malicious program detection method provided in the above method embodiment, the specific implementation of each unit of the malicious program detection device 600 can refer to the relevant description part of the above method embodiment, and will not be repeated here.

[0094] It should be noted that the hardware structure of the malicious program detection device mentioned above can be as follows: Figure 7 The structure shown, Figure 7 A schematic diagram of the structure of a device provided in an embodiment of the present application.

[0095] See also Figure 7 As shown, the device 700 includes: a processor 710, a communication interface 720 and a memory 730. The number of the processor 710 in the device 700 can be one or more. Figure 7 In the embodiment of the present application, the processor 710, the communication interface 720 and the memory 730 may be connected via a bus system or other means, wherein: Figure 7 The connection via bus system 740 is taken as an example.

[0096] The processor 710 may be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and a NP. The processor 710 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0097] The memory 730 may include a volatile memory (English: volatile memory), such as a random-access memory (RAM); the memory 730 may also include a non-volatile memory (English: non-volatile memory), such as a flash memory (English: flash memory), a hard disk drive (HDD) or a solid-state drive (SSD); the memory 730 may also include a combination of the above-mentioned types of memory. The memory 730 may, for example, store a list of sensitive files.

[0098] Optionally, the memory 730 stores an operating system and a program, an executable module or a data structure, or a subset thereof, or an extended set thereof, wherein the program may include various operating instructions for implementing various operations. The operating system may include various system programs for implementing various basic services and processing hardware-based tasks. The processor 710 may read the program in the memory 730 to implement the malicious program detection method provided in the embodiment of the present application.

[0099] The bus system 740 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus system 740 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 7Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0100] An embodiment of the present application also provides a computer-readable storage medium, including instructions or computer programs, which, when executed on a computer, enable the computer to execute the malicious program detection method provided in the above embodiment.

[0101] The embodiments of the present application also provide a computer program product including instructions or a computer program, which, when executed on a computer, enables the computer to execute the malicious program detection method provided in the above embodiments.

[0102] An embodiment of the present application also provides a malicious program detection system, which includes a computer device that executes the malicious program detection method provided in the above embodiment, and a server that sends a sensitive file list to the computer device.

[0103] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0104] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0105] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of units is only a logical business division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0106] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0107] In addition, each business unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software business units.

[0108] If the integrated unit is implemented in the form of a software business unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0109] Those skilled in the art will appreciate that in one or more of the above examples, the services described in the present invention may be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, the services may be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any media that facilitates the transmission of computer programs from one place to another. Storage media may be any available media that can be accessed by a general-purpose or special-purpose computer.

[0110] The above specific implementation modes further describe the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above are only specific implementation modes of the present invention.

[0111] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person of ordinary skill in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features thereof may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for detecting malicious programs, characterized in that: include: Monitoring access behavior of a process running in a computer device to a target file, wherein the target file is a sensitive file that does not exist in the computer device; If the process attempts to access the target file, an alarm message is output, where the alarm message includes an identifier of the target program that generated the process.

2. The method according to claim 1, characterized in that The sensitive file is a file described by an entry in a sensitive file list, and the entry in the sensitive file list includes an identifier of the sensitive file and a corresponding storage location in the computer device.

3. The method according to claim 2, characterized in that The monitoring of the access behavior of the process running in the computer device to the target file includes: The access behavior is monitored using a callback function, wherein the callback function is used to determine whether the file that the process attempts to access is a file that does not exist in the computer device, and to determine whether the file that the process attempts to access is a file described by an entry in the sensitive file list.

4. The method according to claim 2, characterized in that: The monitoring of the access behavior of the process running in the computer device to the target file includes: The entry point of the first function is changed to a second function by using a hook function, and the access behavior is determined by using the second function, wherein: The first function is a function for opening a file provided by the operating system of the computer device, and the second function is used to call the first function and determine whether the file attempted to be accessed by the process is the file described by the entry in the sensitive file list, and when the file attempted to be accessed by the process is the file described by the entry in the sensitive file list, determine the access behavior according to the error code returned by the first function, wherein the error code indicates that the file attempted to be accessed by the process is a file that does not exist in the computer device.

5. The method according to claim 4, characterized in that If the computer device starts the virtualization function, the method of using the hook function to change the entry point of the first function to the second function includes: In response to detecting a virtual machine exit event, the entry point of the first function is changed to the second function using the hook function, wherein the virtual machine exit event is triggered when a process attempts to open a file in the computer device.

6. The method according to claim 2, characterized in that The method further comprises: The sensitive file list sent by the receiving server.

7. The method according to any one of claims 1 to 6, characterized in that: If the process attempts to access the target file, outputting warning information includes: In response to monitoring the process attempting to access the target file, and the file importance indicated by the security level of the target file is higher than or equal to a specified threshold, the warning information is output.

8. The method according to any one of claims 1 to 6, characterized in that: If the process attempts to access the target file, outputting warning information includes: If the file importance indicated by the security level of the target file is lower than a specified threshold, and the number of times the target program attempts to access the target file exceeds a preset number within a certain period of time, the warning information is output.

9. The method according to any one of claims 1 to 8, characterized in that: The sensitive files include: files storing sensitive data, and the sensitive data include one or more of the following: username and password saved by the browser, username and password for logging into the File Transfer Protocol FTP server, username and password saved by the email client, username and password for logging into the Secure Shell Protocol SSH server, and Bitcoin wallet data.

10. A malicious program detection device, characterized in that: include: A monitoring unit, used to monitor the access behavior of a process running in a computer device to a target file, wherein the target file is a sensitive file that does not exist in the computer device; The alarm unit is used to output an alarm message if the process attempts to access the target file, and the alarm message includes an identifier of the target program that generates the process.

11. The device according to claim 10, characterized in that The sensitive file is a file described by an entry in a sensitive file list, and the entry in the sensitive file list includes an identifier of the sensitive file and a corresponding storage location in the computer device.

12. The device according to claim 11, characterized in that The monitoring unit is used for: The access behavior is monitored using a callback function, wherein the callback function is used to determine whether the file that the process attempts to access is a file that does not exist in the computer device, and to determine whether the file that the process attempts to access is a file described by an entry in the sensitive file list.

13. The device according to claim 11, characterized in that The monitoring unit is used for: The entry point of the first function is changed to a second function by using a hook function, and the access behavior is determined by using the second function, wherein: The first function is a function for opening a file provided by the operating system of the computer device, and the second function is used to call the first function and determine whether the file attempted to be accessed by the process is the file described by the entry in the sensitive file list, and when the file attempted to be accessed by the process is the file described by the entry in the sensitive file list, determine the access behavior according to the error code returned by the first function, wherein the error code indicates that the file attempted to be accessed by the process is a file that does not exist in the computer device.

14. The device according to claim 13, characterized in that If the computer device starts the virtualization function, the method of using the hook function to change the entry point of the first function to the second function includes: In response to detecting a virtual machine exit event, the entry point of the first function is changed to the second function using the hook function, wherein the virtual machine exit event is triggered when a process attempts to open a file in the computer device.

15. The device according to any one of claims 10 to 14, characterized in that: The alarm unit is used for: In response to monitoring the process attempting to access the target file, and the file importance indicated by the security level of the target file is higher than or equal to a specified threshold, the warning information is output.

16. The device according to any one of claims 10 to 14, characterized in that: The alarm unit is used for: If the file importance indicated by the security level of the target file is lower than a specified threshold, and the number of times the target program attempts to access the target file exceeds a preset number within a certain period of time, the warning information is output.

17. A device, characterized in that include: Processor and memory; The memory is used to store instructions or computer programs; The processor is used to execute the instructions or computer programs to perform the method according to any one of claims 1 to 9.

18. A computer-readable storage medium, characterized in that: The invention comprises instructions or computer programs, which, when executed on a computer, enable the computer to execute the method according to any one of claims 1 to 9.

Images