Program set attack detection method and device, computer equipment, storage medium and computer program product
By building a combination of hook modules and detection functions, the problem of high resource consumption of file-free attack defense in the existing technology is solved, efficient detection and identification of assembly attacks is achieved, and the flexibility of detection methods is improved.
Patent Information
- Application Number
- CN202411763112.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-03
- Publication Date
- 2025-03-11
AI Technical Summary
The prior art consumes a lot of resources when defending against fileless attacks and it is difficult to effectively identify and block assembly attacks.
By building a hook module, it includes detection functions, receives the target assembly and determines its characteristic information when a specific event is triggered, and sets up corresponding detection functions for identification processing to realize detection and identification of assembly attacks.
This method identifies the target assembly through an event-driven method, avoiding the resource overhead caused by regular scanning, and improving the flexibility of the detection method. It can add or delete detection functions according to actual needs without modifying the target running program.
Smart Images
Figure CN119598454A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, computer device, storage medium and computer program product for detecting program set attacks. Background Art
[0002] Fileless attacks are an attack method that does not write executable files to disk, allowing attackers to compromise systems with anti-virus and application whitelist policies. This attack method is generally implemented in the form of memory execution, which can avoid leaving suspicious files on the disk, thereby bypassing some file-based scanning defenses.
[0003] In the related art, the defense method against fileless attacks is usually to periodically scan the memory to detect suspicious behaviors in the memory. However, this method has the problem of high resource consumption. Summary of the invention
[0004] Based on this, it is necessary to provide a detection method, device, computer equipment, storage medium and computer program product for program set attacks in response to the above technical problems.
[0005] In a first aspect, the present application provides a method for detecting an assembly attack. The method comprises:
[0006] Constructing a hook module, wherein the hook module includes at least one detection function;
[0007] Receive a target assembly, and use a target running program loaded with the hook module to load the target assembly; the target running program includes a first calling function, and the first calling function is used to call the object pointed to by the first function pointer;
[0008] If a feature information detection event is triggered, the feature information of the target program set is determined, and a target detection function is determined from each of the detection functions in the hook module according to the feature information, and the object pointed to by the first function pointer is set as the target detection function;
[0009] If a feature information recognition event is triggered, the feature information is passed to the target detection function through the first calling function, and the feature information is identified and processed by the target detection function to obtain an abnormality judgment result for the target program set.
[0010] In one of the embodiments, the feature information identification event includes at least one of the target assembly being loaded into the memory, the target assembly creating a new process, and the target assembly calling an API interface.
[0011] In one of the embodiments, the target program set includes at least one module, the characteristic information detection event includes a module loading event, and the characteristic information of the target program set includes module version information;
[0012] If the feature information detection event is triggered, determining the feature information of the target program set includes:
[0013] If a module loading event is triggered, the module path of the target module corresponding to the module loading event is obtained;
[0014] Determining the module category of the target module according to the module path;
[0015] When the module type is a runtime module, the module version information of the target module is determined.
[0016] In one embodiment, each of the detection functions has corresponding target module version information, and determining a target detection function from each of the detection functions according to the feature information includes:
[0017] A detection function that matches the target module version information with the module version information is used as a target detection function.
[0018] In one embodiment, the characteristic information of the target program set further includes type reference information, and the identification and processing of the characteristic information by the target detection function to obtain an abnormality judgment result for the target program set includes:
[0019] Calculate the hash value corresponding to the type reference information through the target detection function;
[0020] The hash value corresponding to the type reference information is matched with a preset target hash value, and when the hash value corresponding to the type reference information matches any of the preset target hash values, the abnormal result is used as the abnormality judgment result of the target assembly.
[0021] In one embodiment, the method further comprises:
[0022] When the abnormality determination result is an abnormal result, the loading of the target assembly is terminated and / or an alarm message is generated.
[0023] In a second aspect, the present application also provides a device for detecting program set attacks. The device comprises:
[0024] A construction module, used to construct a hook module, wherein the hook module includes at least one detection function;
[0025] A receiving module, used for receiving a target program set, and using a target running program loaded with the hook module to load the target program set; the target running program includes a first calling function, and the first calling function is used to call the object pointed to by the first function pointer;
[0026] a determination module, configured to determine the characteristic information of the target program set if a characteristic information detection event is triggered, and determine a target detection function from each of the detection functions in the hook module according to the characteristic information, and set the object pointed to by the first function pointer to the target detection function;
[0027] The identification module is used to transmit the characteristic information to the target detection function through the first calling function if a characteristic information identification event is triggered, and to identify and process the characteristic information through the target detection function to obtain an abnormality judgment result for the target program set.
[0028] In one of the embodiments, the feature information identification event includes at least one of the target assembly being loaded into the memory, the target assembly creating a new process, and the target assembly calling an API interface.
[0029] In one of the embodiments, the target program set includes at least one module, the characteristic information detection event includes a module loading event, and the characteristic information of the target program set includes module version information;
[0030] The determining module is further used for:
[0031] If a module loading event is triggered, the module path of the target module corresponding to the module loading event is obtained;
[0032] Determining the module category of the target module according to the module path;
[0033] When the module type is a runtime module, the module version information of the target module is determined.
[0034] In one embodiment, each of the detection functions has corresponding target module version information, and the determination module is further used to:
[0035] A detection function that matches the target module version information with the module version information is used as a target detection function.
[0036] In one embodiment, the characteristic information of the target assembly also includes type reference information, and the identification module is further used to:
[0037] Calculate the hash value corresponding to the type reference information through the target detection function;
[0038] The hash value corresponding to the type reference information is matched with a preset target hash value, and when the hash value corresponding to the type reference information matches any of the preset target hash values, the abnormal result is used as the abnormality judgment result of the target assembly.
[0039] In one embodiment, the device further comprises:
[0040] The termination module is used to terminate the loading of the target assembly and / or generate warning information when the abnormal judgment result is an abnormal result.
[0041] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, any one of the above methods is implemented.
[0042] In a fourth aspect, the present application further provides a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, any of the above methods is implemented.
[0043] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, any of the above methods is implemented.
[0044] The detection method, device, computer equipment, storage medium and computer program product of the above-mentioned program set attack pre-sets a hook module, and sets a detection function in the hook module. When the target running program loads the target program set, if a feature information detection event is triggered, the target detection function pointed to by the first function pointer is set accordingly according to the feature information detected for the target program set. If a feature information identification event is further triggered thereafter, the feature information is identified and processed by the target detection function. The embodiment of the present application uses an event-driven method to identify the target program set, which can avoid the large resource overhead caused by periodic scanning. At the same time, the embodiment of the present application also decouples the detection function and the target running program by constructing a hook module, so that when adding or deleting the detection function according to the actual needs in the detection, it is not necessary to modify the target running program, thereby improving the flexibility of the detection method of the program set attack. BRIEF DESCRIPTION OF THE DRAWINGS
[0045] Figure 1 A schematic diagram of a flow chart of a method for detecting an assembly attack in an embodiment;
[0046] Figure 2 is a flow chart of step 106 in one embodiment;
[0047] Figure 3is a flow chart of step 108 in one embodiment;
[0048] Figure 4 A schematic diagram of a flow chart of a method for detecting an assembly attack in an embodiment;
[0049] Figure 5 is a structural block diagram of a detection device for program set attacks in one embodiment;
[0050] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION
[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.
[0052] In one embodiment, Figure 1 As shown, a method for detecting assembly attacks is provided. This embodiment uses the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:
[0053] Step 102: construct a hook module, which includes at least one detection function.
[0054] In the embodiment of the present application, the hook module is used to be loaded into the main program (target running program) used when running the target assembly, so that the main program can call the function contained in the hook module at a specific time. The target assembly is a .NET assembly. The detection function is used to identify the characteristic information of the target assembly to determine whether the target assembly is a malicious attack assembly.
[0055] Each detection function may be a detection function corresponding to different versions of the .NET assembly. That is, during actual detection, the target running program selects only one detection function that matches the target assembly version from the hook module to detect the target assembly. Alternatively, each detection function may be a detection function that identifies different feature information of the .NET assembly. That is, during actual detection, the target running program may select different detection functions from the hook module after extracting different feature information, and input different feature information into each monitoring function to detect the target assembly.
[0056] Step 104, receiving a target assembly, and using a target running program loaded with a hook module to load the target assembly; the target running program includes a first calling function, and the first calling function is used to call the object pointed to by the first function pointer.
[0057] In an embodiment of the present application, after the server receives the target assembly, the server loads the target assembly through the target running program, and loads the hook module into the process of the target running program. The target running program is pre-written with a first calling function for calling a function in the hook module. The first calling function is used to call the object pointed to by the first function pointer, and can also be used to pass the characteristic information of the target assembly to the object pointed to by the first function pointer.
[0058] Step 106, if a feature information detection event is triggered, the feature information of the target program set is determined, and the target detection function is determined from the detection functions in the hook module according to the feature information, and the object pointed to by the first function pointer is set as the target detection function.
[0059] In the embodiment of the present application, the feature information detection event can be any event that can indicate that the feature information of the target assembly can be detected at present. The feature information of the target assembly can be any information that can identify the target assembly, such as the version information of each module included in the target assembly, the defined types and the dependencies between the types, the API (Application Programming Interface) called during the execution process, the imported library, the communication through the network, etc.
[0060] According to the characteristic information of the target assembly, it can be determined which target detection function (or functions) need to be used when detecting the target assembly this time, and the object pointed to by the first function pointer is set as the target detection function.
[0061] In one embodiment, each detection function has corresponding target module version information, and the characteristic information of the target program set includes module version information. Determining the target detection function from each detection function in the hook module according to the characteristic information includes: using the detection function that matches the target module version information with the module version information as the target detection function.
[0062] In the embodiment of the present application, detection functions corresponding to the version of each .NET assembly module are pre-built, and these functions are added to the hook module. When the target running program loads the target assembly, the module version information of the module of the target assembly can be identified, and then the module version information and the target module version information corresponding to the detection function are matched. If there is a detection function that matches the target module version information, the function is used as the target detection function.
[0063] The module version information can be detected by reading the module version information of the runtime module when the target assembly is loaded into the runtime module in the target assembly. Figure 2 As shown, including:
[0064] Step 202: If a module loading event is triggered, the module path of the target module corresponding to the module loading event is obtained.
[0065] Step 204: Determine the module category of the target module according to the module path.
[0066] Step 206: When the module type is a runtime module, determine the module version information of the target module.
[0067] In the embodiment of the present application, the characteristic information detection event includes a module loading event. The LdrRegisterDllNotification function can be used to detect the module loading event. The function is a registration function, and a callback function can be registered through the registration function, so that after the registration function detects that the module of the target assembly is loaded, the notification of the module loading event can be output by calling the callback function.
[0068] When a module loading event is detected, the module path of the target module that triggers the module loading event is obtained. The module path is used to indicate the directory to which the module belongs. According to the module path, it can be determined whether the target module is a runtime module. The runtime module is a module used to provide a runtime environment for a .NET assembly.
[0069] If the target module is a runtime module, the module version information of the target module may be obtained as information that needs to be matched with the target module version information of each detection function.
[0070] In another embodiment, the feature information detection event includes a feature information extraction event, and each detection function has corresponding target feature information. Determining the feature information of the target program set, and determining the target detection function from each detection function in the hook module according to the feature information, includes:
[0071] If a feature information extraction event is triggered, extract feature information corresponding to the feature information extraction event;
[0072] For any feature information extracted, the target feature information is matched with the detection function of the feature information as the target detection function.
[0073] In the embodiment of the present application, a detection function for each feature information corresponding to a .NET assembly is pre-built, and these functions are added to the hook module. The target running program can continuously detect whether a feature information extraction event is currently triggered during the process of loading and running the target assembly, and extract the feature information of the target assembly when the feature information extraction event is triggered, and use the detection function corresponding to the feature information as the target detection function.
[0074] The feature information extraction event and its corresponding feature information can be preset by those skilled in the art. The feature information extraction event includes any event that can indicate that new feature information of the target program set can be extracted at present. Accordingly, the feature information corresponding to the feature information extraction time is the new feature information that can be extracted at present.
[0075] For example, a feature information extraction event may be that the loading progress of a target assembly reaches a certain progress (the corresponding feature information is the feature of the loaded target assembly that can be extracted from the memory), the target assembly starts to execute (the corresponding feature information is the feature generated by the target assembly during execution), the target assembly starts to send and receive information through the network (the corresponding feature information is the feature generated by the target assembly during communication), and so on.
[0076] After the feature information extraction event is triggered and the feature information is extracted, the detection function corresponding to the feature information can be used as the target detection function, and the object pointed to by the first function pointer can be set as the target detection function. If the first calling function is also used to pass the feature information to the object pointed to by the first function pointer, the extracted feature information can also be used as the feature information that the first calling function needs to pass.
[0077] Through the above method, the target running program can achieve the effect of replacing the target detection function called by the first calling function in real time according to the loading progress when loading the target program set. The technicians can define new feature information extraction events at any time according to actual needs and add detection functions to the hook module accordingly, without modifying the target running program, so as to achieve the decoupling of the detection function and the target running program.
[0078] Step 108, if a feature information recognition event is triggered, the feature information is passed to the target detection function through the first calling function, and the feature information is recognized and processed by the target detection function to obtain an abnormality judgment result for the target program set.
[0079] In the embodiment of the present application, the feature information identification event is any event that can indicate that if the target assembly is a malicious assembly, the operation currently executed by the target assembly has the risk of invading the server operating system. When the feature information identification event is triggered, the current feature information can be identified and processed by the target detection function to determine whether the target assembly is a malicious assembly.
[0080] In one example, the feature information identification event includes at least one of the following: the target assembly is loaded into memory, the target assembly creates a new process, and the target assembly calls an API interface. If the target assembly is a malicious assembly, the malicious assembly can start attacking the server after it is loaded into memory; after the malicious assembly creates a new process, the malicious assembly may attack the server through the new process; when the malicious assembly calls an API interface, the malicious assembly may also attack through other applications. Therefore, setting the above three events as feature information identification events can timely identify whether the target assembly is a malicious assembly before the malicious assembly is about to launch an attack, and block the malicious assembly if the target assembly is indeed a malicious assembly.
[0081] The embodiments of the present application do not specifically limit how the target detection function identifies feature information. For example, a judgment standard for feature information can be pre-constructed. For example, when the feature information is the number of new processes created within a period of time, a judgment condition for the number of new processes can be set in the target detection function, and an abnormal result is output when the number of new processes is greater than a threshold, and a normal result is output when the number of new processes is less than or equal to the threshold. Alternatively, a neural network model for identifying feature information can be pre-trained, and the target detection function can further call the interface of the trained neural network model, pass the feature information to the trained neural network model, and output the detection result returned by the neural network model to the target detection function.
[0082] In one embodiment, the feature information of the target assembly also includes type reference information, such as Figure 3 As shown, the feature information is identified and processed by the target detection function to obtain the abnormal judgment results for the target program set, including:
[0083] Step 302, calculating the hash value corresponding to the type reference information through the target detection function;
[0084] Step 304 , matching the hash value corresponding to the type reference information with the preset target hash value, and when the hash value corresponding to the type reference information matches any preset target hash value, taking the abnormal result as the abnormal judgment result of the target assembly.
[0085] In an embodiment of the present application, whether the target assembly is a malicious assembly can be identified based on the hash value (typeRefHash) corresponding to the type reference information (typeRef). The type reference information is the various types referenced in the target assembly and the dependencies between the types. The principle of using type reference information to identify malicious assemblies is that the various types imported into the assembly and the dependencies between the types reflect the function of the assembly, and the hash value is a summary of the type reference information. Therefore, the hash values of the type reference information of assemblies with the same functions should be the same. The functions of malicious assemblies and normal assemblies are quite different, so it is difficult for an attacker to design a malicious assembly with the same hash value as a normal assembly.
[0086] A hash value blacklist can be predetermined, and the blacklist includes multiple preset target hash values, and the preset target hash values are hash values of previously identified malicious program sets. After obtaining the type reference information, the target detection function can calculate the hash value of the type reference information and match the hash value with the preset target hash value. If the hash value matches any preset target hash value, the target program set is a malicious program set, and the abnormal result is used as the abnormal judgment result of the target program set. If the hash value does not match all the preset target hash values, the target program set is a normal program set, and the normal result is used as the abnormal judgment result of the target program set.
[0087] In one embodiment, the method further includes:
[0088] When the abnormal judgment result is an abnormal result, the loading of the target assembly is terminated and / or an alarm message is generated.
[0089] In an embodiment of the present application, if the exception judgment result is an abnormal result, that is, the target assembly is a malicious assembly, the loading or running of the target assembly is terminated, and an alarm message is generated to notify the operation and maintenance personnel to process the target assembly.
[0090] It should be noted that if the above embodiment is adopted, the solution of replacing the target detection function called by the first calling function in real time according to the loading progress, then since each target detection function will output an abnormal judgment result, multiple abnormal judgment results will be obtained during the detection process of the program set attack. In this case, when a preset number of abnormal judgment results (for example, 3 or 5) are abnormal results, it can be confirmed that the target program set is a malicious program set, and the loading or running of the target program set is terminated. In other cases, it is confirmed that the target program set is a normal program set.
[0091] In one embodiment, Figure 4 As shown, a detection method for assembly attack is provided, including:
[0092] S1, setting the hook module and loading the hook module into the detected process.
[0093] The detected process is a process generated when the target running program in the aforementioned embodiment is running.
[0094] S2, after the hook module is loaded into the detected process, the module loading callback function is registered through the LdrRegisterDllNotification function.
[0095] S3, when the module of the target assembly is loaded, the module loading callback function receives the module loading notification, determines whether the currently loaded module is a .NET runtime module according to the module path, and if so, obtains the .NET runtime module version, and sets the target hook function according to the .NET runtime module version.
[0096] Among them, the target hooking function is also the target detection function in the aforementioned embodiment.
[0097] S4, when the .NET assembly memory loading occurs, the target hook function obtains the loaded .NET assembly memory binary data, and passes the .NET assembly memory binary data to the judgment module in the hook module.
[0098] Among them, the characteristic information recognition event in the aforementioned embodiment is .NET assembly memory loading. After the characteristic information recognition event is triggered, the first calling function calls the target hook function through the first function pointer and passes the .NET assembly memory binary data to the target hook function.
[0099] S5, the judgment module parses the .NET assembly binary data, obtains the .NET assembly metadata therein, calculates and generates TypeRefHash according to the .NET assembly metadata, and judges whether the .NET assembly is a malicious assembly according to the TypeRefHash blacklist and whitelist data.
[0100] S6, the target hook function determines whether to load the .NET assembly and whether to issue an alarm based on whether the assembly returned by the judgment module is a malicious assembly.
[0101] The detection method for assembly attack provided in the embodiment of the present application pre-sets a hook module and sets a detection function in the hook module. When the target running program loads the target assembly, if a feature information detection event is triggered, the target detection function pointed to by the first function pointer is set accordingly according to the feature information detected for the target assembly. If a feature information identification event is further triggered thereafter, the feature information is identified and processed by the target detection function. The embodiment of the present application uses an event-driven method to identify the target assembly, which can avoid the large resource overhead caused by periodic scanning. At the same time, the embodiment of the present application also decouples the detection function and the target running program by constructing a hook module, so that when adding or deleting the detection function according to the actual needs in the detection, it is not necessary to modify the target running program, thereby improving the flexibility of the detection method for assembly attack.
[0102] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.
[0103] Based on the same inventive concept, the embodiment of the present application also provides a detection device for program set attacks for implementing the detection method for program set attacks involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of one or more detection devices for program set attacks provided below can refer to the limitations of the detection method for program set attacks above, and will not be repeated here.
[0104] In one embodiment, Figure 5 As shown, a detection device 500 for program set attack is provided, including: a construction module 502, a receiving module 504, a determination module 506, and an identification module 508, wherein:
[0105] A construction module 502 is used to construct a hook module, wherein the hook module includes at least one detection function;
[0106] A receiving module 504 is used to receive a target assembly, and load the target assembly using a target running program loaded with the hook module; the target running program includes a first calling function, and the first calling function is used to call the object pointed to by the first function pointer;
[0107] A determination module 506, configured to determine the characteristic information of the target program set if a characteristic information detection event is triggered, and determine a target detection function from each of the detection functions in the hook module according to the characteristic information, and set the object pointed to by the first function pointer to the target detection function;
[0108] The identification module 508 is used to transmit the characteristic information to the target detection function through the first calling function if a characteristic information identification event is triggered, and to identify and process the characteristic information through the target detection function to obtain an abnormality judgment result for the target program set.
[0109] The detection device for program set attacks provided in the embodiment of the present application pre-sets a hook module, and sets a detection function in the hook module. When the target running program loads the target program set, if a feature information detection event is triggered, the target detection function pointed to by the first function pointer is set accordingly according to the feature information detected for the target program set. If a feature information recognition event is further triggered thereafter, the feature information is recognized and processed by the target detection function. The embodiment of the present application uses an event-driven method to identify the target program set, which can avoid the large resource overhead caused by periodic scanning. At the same time, the embodiment of the present application also decouples the detection function and the target running program by constructing a hook module, so that when adding or deleting the detection function according to the actual needs in the detection, it is not necessary to modify the target running program, thereby improving the flexibility of the detection method for program set attacks.
[0110] In one of the embodiments, the feature information identification event includes at least one of the target assembly being loaded into the memory, the target assembly creating a new process, and the target assembly calling an API interface.
[0111] In one of the embodiments, the target program set includes at least one module, the characteristic information detection event includes a module loading event, and the characteristic information of the target program set includes module version information;
[0112] The determining module 506 is further configured to:
[0113] If a module loading event is triggered, the module path of the target module corresponding to the module loading event is obtained;
[0114] Determining the module category of the target module according to the module path;
[0115] When the module type is a runtime module, the module version information of the target module is determined.
[0116] In one embodiment, each of the detection functions has corresponding target module version information, and the determination module 506 is further used to:
[0117] A detection function that matches the target module version information with the module version information is used as a target detection function.
[0118] In one embodiment, the characteristic information of the target assembly also includes type reference information, and the identification module 508 is further used to:
[0119] Calculate the hash value corresponding to the type reference information through the target detection function;
[0120] The hash value corresponding to the type reference information is matched with a preset target hash value, and when the hash value corresponding to the type reference information matches any of the preset target hash values, the abnormal result is used as the abnormality judgment result of the target assembly.
[0121] In one embodiment, the device further comprises:
[0122] The termination module is used to terminate the loading of the target assembly and / or generate warning information when the abnormal judgment result is an abnormal result.
[0123] Each module in the above device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module above.
[0124] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a detection method for a program set attack is implemented.
[0125] Those skilled in the art will understand that Figure 6The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0126] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.
[0127] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.
[0128] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.
[0129] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.
[0130] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.
[0131] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.
[0132] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.
Claims
1. A method for detecting program set attacks, characterized in that: The method comprises: Constructing a hook module, wherein the hook module includes at least one detection function; Receive a target assembly, and use a target running program loaded with the hook module to load the target assembly; the target running program includes a first calling function, and the first calling function is used to call the object pointed to by the first function pointer; If a feature information detection event is triggered, the feature information of the target program set is determined, and a target detection function is determined from each of the detection functions in the hook module according to the feature information, and the object pointed to by the first function pointer is set as the target detection function; If a feature information recognition event is triggered, the feature information is passed to the target detection function through the first calling function, and the feature information is identified and processed by the target detection function to obtain an abnormality judgment result for the target program set.
2. The method according to claim 1, characterized in that: The feature information identification event includes at least one of the following: the target program set is loaded into the memory, the target program set creates a new process, and the target program set calls an API interface.
3. The method according to claim 1, characterized in that: The target program set includes at least one module, the characteristic information detection event includes a module loading event, and the characteristic information of the target program set includes module version information; If the feature information detection event is triggered, determining the feature information of the target program set includes: If a module loading event is triggered, the module path of the target module corresponding to the module loading event is obtained; Determining the module category of the target module according to the module path; When the module type is a runtime module, the module version information of the target module is determined.
4. The method according to claim 3, characterized in that: Each of the detection functions has corresponding target module version information, and determining a target detection function from each of the detection functions according to the feature information includes: A detection function that matches the target module version information with the module version information is used as a target detection function.
5. The method according to claim 1, characterized in that The characteristic information of the target program set also includes type reference information. The identification and processing of the characteristic information by the target detection function to obtain an abnormality judgment result for the target program set includes: Calculate the hash value corresponding to the type reference information through the target detection function; The hash value corresponding to the type reference information is matched with a preset target hash value, and when the hash value corresponding to the type reference information matches any of the preset target hash values, the abnormal result is used as the abnormality judgment result of the target assembly.
6. The method according to claim 1 or 5, characterized in that: The method further comprises: When the abnormality determination result is an abnormal result, the loading of the target assembly is terminated and / or an alarm message is generated.
7. A detection device for program set attack, characterized in that: The device comprises: A construction module, used to construct a hook module, wherein the hook module includes at least one detection function; A receiving module, used for receiving a target program set, and using a target running program loaded with the hook module to load the target program set; the target running program includes a first calling function, and the first calling function is used to call the object pointed to by the first function pointer; a determination module, configured to determine the characteristic information of the target program set if a characteristic information detection event is triggered, and determine a target detection function from each of the detection functions in the hook module according to the characteristic information, and set the object pointed to by the first function pointer to the target detection function; The identification module is used to transmit the characteristic information to the target detection function through the first calling function if a characteristic information identification event is triggered, and to identify and process the characteristic information through the target detection function to obtain an abnormality judgment result for the target program set.
8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.
10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.