Process detection method and device and storage medium

Abstract

The embodiment of the invention discloses a process detection method and device and a storage medium, and is used for the technical field of data security. The method provided by the embodiment of the invention comprises the following steps: aiming at a to-be-detected process, determining a thread associated with the to-be-detected process and a thread function called when the thread is executed; wherein the thread function corresponds to a memory area; and determining whether the thread associated with the to-be-detected process executes the malicious code or not based on the related information of the memory region corresponding to the thread function. In the embodiment of the invention, the thread associated with the to-be-detected process can be detected based on the related information of the memory region corresponding to the thread function, and whether the to-be-detected process associated with the thread executes the malicious code or not can be accurately detected by detecting whether the thread executes the malicious code or not.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of data security technology, and in particular, to a process detection method, a detection device, and a storage medium. Background Art

[0002] A process is an instance of a running program. It is a program with certain independent functions that runs on a certain data set. A process is the basic unit of dynamic execution of an operating system. In an operating system, a process is both a basic allocation unit and a basic execution unit.

[0003] Attackers often load malicious code into the memory of a process through process injection or dynamic link library (DLL) hijacking, so that the process executes the malicious code. The current detection process for the execution of malicious code by a process generally sets the memory characteristics of the malicious code in the blacklist rule library. When the memory characteristics of the code in the process memory are detected to be the memory characteristics in the blacklist rule library, it is determined that the process executes the malicious code.

[0004] However, an attacker can confuse the memory characteristics of the malicious code loaded into the process, making it difficult to accurately use the blacklist rule base to detect whether the process executes the malicious code; or, when the memory characteristics of the malicious code loaded into the process are not in the blacklist rule base, it will be difficult to accurately use the blacklist rule base to detect whether the process executes the malicious code. That is, it is difficult to accurately detect whether a process executes malicious code using the existing blacklist rule base. Summary of the invention

[0005] The embodiments of the present application provide a process detection method, a detection device, and a storage medium, which can accurately detect whether a process executes malicious code.

[0006] The present application provides a method for detecting a process, including:

[0007] For a process to be detected, determining a thread associated with the process to be detected and a thread function called when the thread is executed; wherein the thread function corresponds to a memory area;

[0008] Based on the relevant information of the memory area corresponding to the thread function, determine whether the thread associated with the process to be detected executes malicious code.

[0009] Furthermore, before determining the thread associated with the process to be detected and the thread function called when the thread is executed, the method further includes:

[0010] For any process, when it is determined that the signature information of the process is valid, the process is determined to be the process to be detected.

[0011] Further, the thread function includes: a thread initialization function corresponding to the thread, and the related information of the memory area corresponding to the thread function includes: a memory attribute corresponding to the memory area of ​​the thread initialization function;

[0012] The determining, based on the relevant information of the memory area corresponding to the thread function, whether the thread associated with the process to be detected executes malicious code includes:

[0013] If the memory attribute corresponding to the memory area of ​​the thread initial function is not a system-assigned attribute, it is determined that the thread associated with the process to be detected is executing malicious code;

[0014] If the memory attribute corresponding to the memory area of ​​the thread initial function is a system allocated attribute, it is determined that the thread associated with the process to be detected does not execute malicious code.

[0015] Further, if the memory attribute corresponding to the memory area of ​​the thread initial function is a system allocated attribute, determining that the thread associated with the process to be detected does not execute malicious code includes:

[0016] If the memory attribute corresponding to the memory area of ​​the thread initial function is a system-assigned attribute, and the function name of the thread initial function is successfully resolved, it is determined that the thread associated with the process to be detected does not execute malicious code.

[0017] Further, the thread function includes: a stack thread function in a thread call stack corresponding to the thread; and determining whether the thread associated with the process to be detected executes malicious code based on the relevant information of the memory area corresponding to the thread function includes:

[0018] Based on the relevant information of the memory area corresponding to the stack thread function, determining an abnormal stack thread function among the stack thread functions of the thread call stack;

[0019] Determine whether there is a function execution flow from the abnormal stack thread function to a preset specific stack thread function in the thread call stack;

[0020] If the function execution flow exists, determining that the thread associated with the process to be detected is executing malicious code;

[0021] If the function execution flow does not exist, it is determined that the thread associated with the process to be detected does not execute malicious code.

[0022] Further, the relevant information of the memory area corresponding to the stack thread function includes: memory attributes corresponding to the memory area of ​​the stack thread function;

[0023] The determining of an abnormal stack thread function in the stack thread functions of the thread call stack based on the relevant information of the memory area corresponding to the stack thread function includes:

[0024] If the memory attribute corresponding to the memory area of ​​the stack thread function is not a system allocated attribute, it is determined that the stack thread function is an abnormal thread function.

[0025] Further, the relevant information of the memory area corresponding to the stack thread function includes: signature information of the dynamic link library to which the memory area corresponding to the stack thread function belongs;

[0026] The determining of an abnormal stack thread function in the stack thread functions of the thread call stack based on the relevant information of the memory area corresponding to the stack thread function includes:

[0027] If the signature information of the dynamic link library to which the memory area of ​​the stack thread function belongs is invalid, it is determined that the stack thread function is an abnormal thread function.

[0028] Furthermore, for the process to be detected, determining the thread associated with the process to be detected and the thread function called when the thread is executed includes:

[0029] The process name of the process to be detected is input into a thread query function to obtain a thread associated with the process to be detected and a thread function called when the thread is executed.

[0030] The present application also provides a process detection device, including:

[0031] A determination unit, configured to determine, for a process to be detected, a thread associated with the process to be detected and a thread function called when the thread is executed; wherein the thread function corresponds to a memory area;

[0032] The execution unit is used to determine whether the thread associated with the process to be detected executes malicious code based on the relevant information of the memory area corresponding to the thread function.

[0033] The present application also provides a process detection device, including:

[0034] CPU, memory, input and output interface, wired or wireless network interface, power supply;

[0035] The memory is a short-term storage memory or a persistent storage memory;

[0036] The central processing unit is configured to communicate with the memory, and execute the instruction operation in the memory on the control plane function entity to perform the above detection method.

[0037] An embodiment of the present application further provides a computer-readable storage medium, which includes instructions. When the instructions are executed on a computer, the computer executes the detection method as described above.

[0038] The embodiment of the present application also provides a computer program product including instructions or a computer program. When the computer program product is run on a computer, the computer executes the method described above.

[0039] It can be seen from the above technical solutions that the embodiments of the present application have the following advantages:

[0040] It can be seen that in the embodiment of the present application, for the process to be detected, the thread associated with the process to be detected and the thread function called when the thread is executed are determined; wherein the thread function corresponds to a memory area; based on the relevant information of the memory area corresponding to the thread function, it is determined whether the thread associated with the process to be detected executes malicious code. In the embodiment of the present application, based on the relevant information of the memory area corresponding to the thread function, the thread associated with the process to be detected can be detected, and by detecting whether the thread executes malicious code, it is possible to accurately detect whether the process to be detected associated with the thread executes malicious code. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0042] Figure 1 A detection flow chart of a process disclosed in an embodiment of the present application;

[0043] Figure 2 A detection flow chart based on a thread initialization function disclosed in an embodiment of the present application;

[0044] Figure 3 A detection flow chart based on thread call stack disclosed in an embodiment of the present application;

[0045] Figure 4 A detection flow chart of another process disclosed in an embodiment of the present application;

[0046] Figure 5 A schematic diagram of executing malicious code by creating a new thread disclosed in an embodiment of the present application;

[0047] Figure 6 Another schematic diagram of executing malicious code by creating a new thread disclosed in an embodiment of the present application;

[0048] Figure 7 A schematic diagram of executing malicious code by hijacking an existing thread disclosed in an embodiment of the present application;

[0049] Figure 8 This is another schematic diagram of executing malicious code by hijacking an existing thread disclosed in an embodiment of the present application;

[0050] Fig. 9 A schematic diagram of a detection device for a process disclosed in an embodiment of the present application;

[0051] Fig.10 A schematic diagram of a detection device for another process disclosed in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0053] In the description of the embodiments of the present application, it should be noted that the terms "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside", etc. indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the embodiments of the present application and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, they cannot be understood as limitations on the embodiments of the present application.

[0054] In the description of the embodiments of the present application, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the embodiments of the present application can be understood according to specific circumstances.

[0055] Attackers often load malicious code into the memory of a process through process injection or DLL dynamic link library hijacking to make the process execute the malicious code. The current detection process for the execution of malicious code by a process generally involves setting the memory features of the malicious code in the blacklist rule library. When the memory features of the code in the process memory are detected to be the memory features in the blacklist rule library, it is determined that the process executes the malicious code.

[0056] However, an attacker can confuse the memory characteristics of the malicious code loaded into the process, making it difficult to accurately use the blacklist rule library to detect whether the process executes the malicious code; or, when the memory characteristics of the malicious code loaded into the process are not in the blacklist rule library, it will be difficult to accurately use the blacklist rule library to detect whether the process executes the malicious code. That is, it is difficult to accurately detect whether the process executes the malicious code through the existing blacklist rule library. Therefore, the embodiment of the present application provides a process detection method that can accurately detect whether the process executes the malicious code, such as Figure 1 As shown, the process specifically includes the following steps 101 and 102.

[0057] 101. For the process to be detected, determine the thread associated with the process to be detected and the thread function called when the thread is executed.

[0058] In an embodiment of the present application, for a process to be detected, the thread associated with the process to be detected and the thread function called when the thread is executed can be determined. It can be understood that the process to be detected is an instance of a running program, which is an operation activity of a program with certain independent functions on a certain data set. The process to be detected is the basic unit of dynamic execution of the operating system. In the operating system, it is both a basic allocation unit and a basic execution unit. The process to be detected is associated with multiple threads, that is, the process to be detected contains multiple threads. The thread is the smallest unit that the operating system can perform calculation scheduling and is the actual operation unit in the process. When the thread is executed, the code contained in the memory space of the process is executed by calling the thread function.

[0059] The thread function can be a thread initial function, or a stack thread function in a thread call stack, which is not limited here. The thread initial function is specified when the thread is created, and the thread starts executing by calling the thread start function; the thread call stack includes multiple stack thread functions currently called when the thread is executed, and the calling relationship between the stack thread functions.

[0060] Specifically, in the embodiment of the present application, the process name PID of the process to be detected can be input into the thread query function to obtain the thread associated with the process to be detected, and the thread function called when the thread is executed. The thread query function can be a command PS for displaying system processes, or a data screening function TOP, which is not specifically limited here; all threads associated with the process to be detected can be obtained to fully detect all associated threads, so as to fully obtain the threads associated with the process to be detected, and the thread function called when the thread is executed.

[0061] 102. Based on the relevant information of the memory area corresponding to the thread function, determine whether the thread associated with the process to be detected executes malicious code.

[0062] After determining the thread function called when the thread is executed, it can be determined whether the thread associated with the process to be detected executes malicious code based on the relevant information of the memory area corresponding to the thread function. The malicious code refers to computer code that is deliberately compiled or set to pose a threat or potential threat to the network or system, including computer viruses (referred to as viruses), Trojan horses (referred to as Trojan horses), computer worms (referred to as worms), backdoors, and logic bombs, etc., which are not specifically limited here.

[0063] The memory area corresponding to the thread function is the memory address of the thread function. The memory area contains the code to be executed by the thread function, which is used to provide execution space for the thread function. The relevant information of the memory area can be the page attribute (i.e., memory attribute) of the memory area, or the signature information of the dynamic link library (DLL) to which the memory area belongs, which is not limited here. The relevant information of the memory area corresponding to the thread function can be obtained through the system function VirtualQueryEx.

[0064] It is understandable that when the relevant information of the memory area corresponding to the thread function is abnormal, it can be determined that the thread associated with the process to be detected executes malicious code, that is, the process to be detected executes malicious code. For example, when the page attribute of the memory area corresponding to the thread function is not a system-assigned attribute, the thread corresponding to the thread function may be a new thread created by the attacker to execute malicious code. At this time, it can be determined that the thread executes malicious code.

[0065] It can be seen that in the embodiment of the present application, for the process to be detected, the thread associated with the process to be detected and the thread function called when the thread is executed are determined; wherein the thread function corresponds to a memory area; based on the relevant information of the memory area corresponding to the thread function, it is determined whether the thread associated with the process to be detected executes malicious code. In the embodiment of the present application, based on the relevant information of the memory area corresponding to the thread function, the thread associated with the process to be detected can be detected, and by detecting whether the thread executes malicious code, it is possible to accurately detect whether the process to be detected associated with the thread executes malicious code.

[0066] Furthermore, in the existing, attackers can also load malicious code into the memory of a white process with a valid signature through process injection or dynamic link library (DLL) hijacking, so that the white process executes the malicious code. The white process may be a system process or a business process. At this time, the normal functions of the white process run together with the malicious code; if the existence of malicious code in the white process is detected, the entire white process is directly checked and killed, and the malicious code in the white process cannot be accurately detected and killed, which is easy to affect the stable operation of the system or business. In the embodiment of the present application, for the white process with a valid signature, the detection target is the thread associated with the white process, that is, the smallest unit of the white process operation scheduling; by detecting the thread associated with the white process, the thread that executes the malicious code in the white process can be accurately detected, and the thread that executes the malicious code in the white process can be accurately checked and killed to avoid affecting the stable operation of the system or business.

[0067] It is understandable that when detecting the thread of the white process, the thread start function of the thread may be detected, or the stack thread function in the thread call stack corresponding to the thread may be detected, as follows:

[0068] Among them, the attacker can execute malicious code by creating a new thread through process injection or dynamic link library (DLL) hijacking. At this time, the thread start function of the thread can be detected to determine whether the thread is a new thread to determine whether the thread executes malicious code; Figure 2 As shown, the process includes the following steps 201 to 203.

[0069] 201. Determine a process to be detected based on signature information of the process.

[0070] In the embodiment of the present application, before detecting the thread, it is necessary to determine the process to be detected based on the signature information of the process; that is, for any process, if it is determined that the signature information of the process is valid, the process is determined to be the process to be detected, and the process to be detected is a white process with a valid signature. That is, the white process can be filtered out by the signature information first, and then it is determined whether the thread associated with the white process executes malicious code. By filtering in advance, it is avoided to waste resources to detect processes with invalid signature information, and detection resources are effectively saved.

[0071] Specifically, the signature information of the process can be the digital signature information of the process (code signature of the process), and the digital signature information generally includes information such as the publisher and / or the release timestamp. When the publisher releases the program, it will generally be marked with a dedicated digital signature. The user can determine the publisher (developer), release timestamp and other information by checking the digital signature. It is possible to verify whether the digital signature information of the target process has a signature and whether the signature information is valid through a preset signature verification tool or a preset system function function; it is understandable that the preset signature verification tool can be the DigiCertCertificate Utility verification software, and the preset system function function can be a function function provided by the operating system. Through the function function provided by the operating system, it is possible to directly determine whether the target process has a signature and the validity of the signature information. Specifically, it is possible to determine whether the target process has a signature by determining whether the digital signature information of the target process has information such as the publisher or the release timestamp, and then check the release timestamp to determine whether the release time is normal to verify whether the signature information is valid.

[0072] 202. For the process to be detected, determine the thread associated with the process to be detected and the thread initialization function called when the thread is executed.

[0073] For the process to be detected with valid signature information, the thread associated with the process to be detected and the thread initial function called when the thread is executed can be determined. It can be understood that step 202 is similar to the above step 101, and the details are not repeated here.

[0074] 203. Based on the memory attribute corresponding to the memory area of ​​the thread initial function, determine whether the thread associated with the process to be detected executes malicious code.

[0075] It is understandable that when an attacker creates a new thread to execute malicious code, such as Figure 5As shown, an attacker can allocate memory with MEM_PRIVATE (private) or MEM_MAPPED (mapped) attributes in the memory space of the process to be detected with valid signature information through process injection or dynamic link library hijacking, write malicious code into the allocated memory, and then create a new thread in the allocated memory, and specify the new thread to execute the malicious code. At this time, the memory attribute of the thread initial function corresponding to the new thread is abnormal. In the figure, TID represents the thread identifier, CPU represents the processor, Cydes delta represents the occupied memory, Start address represents the starting address, Priority represents the priority, and Thread represents the thread. Therefore, in the embodiment of the present application, it is possible to determine whether the thread associated with the process to be detected executes malicious code based on the memory attribute corresponding to the memory area of ​​the thread initial function; by detecting the memory attribute corresponding to the memory area of ​​the thread initial function, it is possible to accurately determine whether the thread associated with the process to be detected executes malicious code.

[0076] Specifically, if the memory attribute corresponding to the memory area of ​​the thread initial function is not a system-assigned attribute, it is determined that the thread associated with the process to be detected is executing malicious code; wherein, the system-assigned attribute refers to the memory attribute automatically assigned by the system, which cannot be assigned by an attacker, and the system-assigned attribute may be a MEM_IMAGE (module loaded into memory) attribute; if the memory attribute corresponding to the memory area of ​​the thread initial function is not a system-assigned attribute, such as when the memory attribute corresponding to the memory area of ​​the thread initial function is a memory attribute assigned by an attacker, such as a MEM_PRIVATE (private) or MEM_MAPPED (mapped) attribute, then the thread initial function is output as abnormal, and it is determined that the thread corresponding to the thread initial function is a new thread created by the attacker by allocating memory, that is, the thread is executing malicious code.

[0077] If the memory attribute corresponding to the memory area of ​​the thread initial function is a system allocated attribute, it is determined that the thread associated with the process to be detected does not execute malicious code, that is, it is determined that the thread corresponding to the thread initial function is not a new thread created by the attacker by allocating memory, and the thread does not execute malicious code.

[0078] Further, such as Figure 6 As shown, the attacker can also load a malicious dynamic link library (i.e., a dynamic link library with invalid signature information) in a process to be detected with valid signature information through process injection or dynamic link library hijacking, and create a new thread through the internal function of the malicious dynamic link library to execute the malicious code in the malicious dynamic link library through the new thread. It is understandable that when a new thread is created through the internal function of a malicious dynamic link library, the thread initial function specified by the new thread is the internal function of the malicious dynamic link library. When the thread initial function is an internal function, the function name of the thread initial function cannot be parsed.

[0079] In an implementable manner, if the memory attribute corresponding to the memory area of ​​the thread initial function is a system-assigned attribute, it is necessary to further parse the function name of the thread initial function, and determine whether the thread corresponding to the thread initial function executes malicious code through the parsing result, so as to improve the accuracy of process detection. Specifically, if the memory attribute corresponding to the memory area of ​​the thread initial function is a system-assigned attribute, and the function name of the thread initial function is successfully parsed, it is determined that the thread associated with the process to be detected does not execute malicious code. If the memory attribute corresponding to the memory area of ​​the thread initial function is a system-assigned attribute, and the function name of the thread initial function is not parsed successfully, the thread initial function is output as abnormal, and it is determined that the thread corresponding to the thread initial function is a new thread created by the attacker in the internal function of the malicious dynamic link library, that is, the thread is executing malicious code.

[0080] In an embodiment of the present application, when an exception is detected in the thread initial function of a thread, it can be determined that the thread is a new thread created in the memory space of the process to be detected with a valid signature, and it can be determined that the thread is executing malicious code. The malicious code of the process to be detected can be accurately detected, and by checking and killing the thread, the malicious code of the process to be detected can be accurately checked and killed.

[0081] Furthermore, an attacker can execute malicious code by hijacking an existing thread in a process through process injection or dynamic link library (DLL) hijacking; at this time, the memory attribute of the thread start function of the existing thread is a system-assigned attribute, that is, the thread start function of the existing thread is normal, and it is difficult to detect the thread through the thread start function. When a thread executes malicious code, the function execution flow of the malicious code can be tracked in the thread call stack corresponding to the thread. Therefore, in the embodiment of the present application, when it is difficult to detect the thread through the thread start function, it is also possible to detect the function execution flow of the thread call stack corresponding to the thread to more comprehensively determine whether the thread executes malicious code; such as Figure 3 As shown, the process includes the following steps 301 to 306.

[0082] 301. Determine a process to be detected based on signature information of the process.

[0083] 302. For the process to be detected, determine a thread associated with the process to be detected and a stack thread function in a thread call stack corresponding to the thread.

[0084] Among them, the thread call stack includes: the stack thread function and the direct calling process of the stack thread function, that is, the stack thread function is called in a stack manner. The thread call stack contains the function execution flow. For example, the stack thread functions contained in the thread call stack are function1, function2, function3, and function4; the corresponding function execution flow is: function1 calls function2, function2 calls function3, and function3 calls function4; the thread call stack corresponding to the thread can be captured in real time through the system function StackWalk64. It can be understood that the stack thread function in the thread call stack is the thread function currently called by the thread, and the stack thread function in the thread call stack changes in real time, and the corresponding function execution flow also changes in real time.

[0085] It can be understood that step 301 and step 302 are similar to the above-mentioned step 201 and step 202, and the details are not repeated here.

[0086] 303. Based on the relevant information of the memory area corresponding to the stack thread function, determine the abnormal stack thread function among the stack thread functions in the thread call stack.

[0087] After obtaining the stack thread function in the thread call stack corresponding to the thread, the abnormal stack thread function can be determined in the stack thread function of the thread call stack based on the relevant information of the memory area corresponding to the stack thread function. Among them, the relevant information of the memory area corresponding to the stack thread function can be the page attribute (i.e., memory attribute) of the memory area corresponding to the stack thread function, or the signature information of the dynamic link library to which the memory area corresponding to the stack thread function belongs, which is not limited here. The abnormal stack thread function is determined in the stack thread function of the thread call stack as shown in the following steps 3031 and 3032. It can be understood that the execution order of step 3031 and step 3032 is not limited, and only one of the steps or both steps can be executed.

[0088] 3031. If the memory attribute corresponding to the memory area of ​​the stack thread function is not a system allocation attribute, it is determined that the stack thread function is an abnormal stack thread function.

[0089] It is understandable that, in the existing situation, an attacker allocates a memory area with MEM_PRIVATE (private) or MEM_MAPPED (mapped) attributes in the memory space of the process to be detected with valid signature information through process injection or dynamic link library hijacking, and writes malicious code into the allocated memory area. Then, the attacker may hijack an existing thread and use the existing thread to execute the malicious code in the allocated memory area. At this time, in the thread call stack of the existing thread, the function execution flow from the abnormal stack thread function (the memory area of ​​the abnormal stack thread function is the allocated memory area) to the preset characteristic stack thread function can be traced, such as Figure 7 As shown in the figure, Stack-thread represents the thread call stack.

[0090] In an embodiment of the present application, after obtaining the thread call stack, the memory attributes of the memory area corresponding to each stack thread function in the thread call stack can be parsed, and the memory attributes of the memory area corresponding to the stack thread function can be accurately determined whether the stack thread function is an abnormal thread function. If the memory attribute corresponding to the memory area of ​​the stack thread function is not a system-assigned attribute, that is, the memory area of ​​the stack thread function is a memory area with a MEM_PRIVATE (private) or MEM_MAPPED (mapped) attribute allocated by the attacker, then the stack thread function is determined to be an abnormal stack thread function. If the memory attribute corresponding to the memory area of ​​the stack thread function is a system-assigned attribute, that is, the memory area of ​​the stack thread function is a memory area with a MEM_IMAGE attribute allocated by the system, then the stack thread function is determined not to be an abnormal stack thread function.

[0091] 3032. If the signature information of the dynamic link library to which the memory area of ​​the stack thread function belongs is invalid, it is determined that the stack thread function is an abnormal stack thread function.

[0092] It is understandable that the attacker can also load a malicious dynamic link library (i.e., a dynamic link library with invalid signature information) into a process to be detected with valid signature information through process injection or dynamic link library hijacking, and execute the malicious code in the malicious dynamic link library by hijacking the existing thread in the internal function of the malicious dynamic link library. At this time, in the thread call stack of the existing thread, the function execution flow from the abnormal stack thread function (the memory area of ​​the abnormal stack thread function is the memory area of ​​the dynamic link library with invalid signature information) to the preset feature stack thread function can be traced, such as Figure 8 shown.

[0093] In the embodiment of the present application, after obtaining the stack thread function of the thread call stack, it is also possible to determine whether the signature information of the dynamic link library to which the memory area of ​​the stack thread function belongs is valid; if the signature information of the dynamic link library to which the memory area of ​​the stack thread function belongs is invalid, that is, the dynamic link library to which the memory area of ​​the stack thread function belongs is a malicious dynamic link library, then the stack thread function is determined to be an abnormal stack thread function. If the signature information of the dynamic link library to which the memory area of ​​the stack thread function belongs is valid, that is, the dynamic link library to which the memory area of ​​the stack thread function belongs is a normal dynamic link library, then the stack thread function is determined not to be an abnormal stack thread function.

[0094] It can be understood that in the embodiments of the present application, the memory attributes corresponding to the memory area of ​​the stack thread function and the signature information of the dynamic link library to which the memory area of ​​the stack thread function belongs can be detected simultaneously to determine whether the stack thread function is an abnormal stack thread function; when the memory attributes corresponding to the memory area of ​​the stack thread function are not system-assigned attributes, or the signature information of the dynamic link library to which the memory area of ​​the stack thread function belongs is invalid, that is, the stack thread function is determined to be an abnormal stack thread function, by simultaneously detecting the memory attributes and the signature information, it is possible to more accurately determine whether the stack thread function is an abnormal stack thread function.

[0095] 304 . Determine whether there is a function execution flow from the abnormal stack thread function to the preset characteristic stack thread function in the thread call stack. If so, execute step 305 ; if not, execute step 306 .

[0096] In an embodiment of the present application, it is possible to determine whether the thread corresponding to the thread call stack executes malicious code by detecting the function execution flow in the thread call stack. That is, by determining whether there is a function execution flow from an abnormal stack thread function to a preset feature stack thread function in the thread call stack, it is determined whether the thread corresponding to the thread call stack executes malicious code. The preset feature stack thread function can be a network request function (such as a Sleep function) or other self-defined functions, which are not specifically limited here. For example, if the function execution flow in the thread call stack is function1 calling function2, function2 calling function3, and function3 calling function4, if any one of the stack thread functions of function1, function2, and function3 is an abnormal stack thread function, and function4 is a preset feature stack thread function, it is determined that the function execution flow executes malicious code.

[0097] 305. Determine whether a thread associated with the process to be detected is executing malicious code.

[0098] If there is a function execution flow from an abnormal stack thread function to a preset feature stack thread function in the thread call stack, the thread call stack exception is output, and it is determined that the thread associated with the process to be detected (i.e., the thread corresponding to the thread call stack) is executing malicious code.

[0099] 306. Determine that the thread associated with the process to be detected does not execute malicious code.

[0100] If there is no function execution flow from the abnormal stack thread function to the preset feature stack thread function in the thread call stack, the output thread call stack is normal, and the thread associated with the process to be detected (i.e., the thread corresponding to the thread call stack) is determined to be executing malicious code.

[0101] In an practicable manner, the process detection device in the embodiment of the present application may include a thread start function detection module and a thread call stack verification module, wherein the thread start function detection module is used to execute the above step 203, and the thread call stack verification module is used to execute the above step 304. Figure 4 As shown, the thread start function detection module and the thread call stack verification module can be used simultaneously to detect the threads associated with the process to be detected, so as to further improve the accuracy of the detection.

[0102] Specifically, after obtaining the target process, it can be determined whether the signature of the target process is valid. If the signature is valid, the target process is determined to be a process to be detected (i.e., a white process), and the thread associated with the process to be detected is obtained; the thread start function detection module is used to detect whether the thread start function of the thread is abnormal; if so, the thread start function is abnormal; if not, the thread call stack of the thread is detected by the thread call stack verification module. If so, the thread call stack is abnormal. When the thread start function is abnormal or the thread call stack is abnormal, it is determined that the thread associated with the process to be detected executes malicious code, that is, it is determined that the process to be detected (white process) executes malicious code; when the thread start function is normal and the thread call stack is normal, it is determined that the thread associated with the process to be detected does not execute malicious code, that is, it is determined that the process to be detected (white process) does not execute malicious code.

[0103] The present application also provides a process detection device, such as Fig. 9 As shown, including:

[0104] A determination unit 901 is used to determine, for a process to be detected, a thread associated with the process to be detected and a thread function called when the thread is executed; wherein the thread function corresponds to a memory area;

[0105] The execution unit 902 is used to determine whether the thread associated with the process to be detected executes malicious code based on the relevant information of the memory area corresponding to the thread function.

[0106] The present application embodiment also provides a process detection device 1000, such as Fig.10 As shown, the detection device 1000 of the embodiment of the present application may include one or more central processing units (CPU) 1001 and a memory 1002 , and the memory 1002 stores one or more application programs or data.

[0107] The memory 1002 may be a volatile storage or a persistent storage. The program stored in the memory 1002 may include one or more modules, each of which may include a series of instruction operations in the electronic device. Furthermore, the central processor 1001 may be configured to communicate with the memory 1002 and execute a series of instruction operations in the memory 1002 on the detection device 1000.

[0108] The detection device 1000 may also include one or more power supplies 1005, one or more wired or wireless network interfaces 1004, one or more input and output interfaces 1003, and / or one or more operating systems, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

[0109] The central processor 1001 can execute the operations performed by the aforementioned first aspect or any specific method embodiment of the first aspect, and the details will not be repeated here.

[0110] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium includes instructions. When the instructions are executed on a computer, the computer executes the method described above.

[0111] The embodiment of the present application also provides a computer program product including instructions or a computer program. When the computer program product is run on a computer, the computer executes the method described above.

[0112] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0113] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0114] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0115] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0116] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. A process detection method, characterized in that: include: For a process to be detected, determining a thread associated with the process to be detected and a thread function called when the thread is executed; Wherein the thread function corresponds to a memory area; Based on the relevant information of the memory area corresponding to the thread function, determine whether the thread associated with the process to be detected executes malicious code.

2. The detection method according to claim 1, characterized in that: The thread function includes: a thread initialization function corresponding to the thread, and the related information of the memory area corresponding to the thread function includes: a memory attribute corresponding to the memory area of ​​the thread initialization function; The determining, based on the relevant information of the memory area corresponding to the thread function, whether the thread associated with the process to be detected executes malicious code includes: If the memory attribute corresponding to the memory area of ​​the thread initial function is not a system-assigned attribute, it is determined that the thread associated with the process to be detected is executing malicious code; If the memory attribute corresponding to the memory area of ​​the thread initial function is a system allocated attribute, it is determined that the thread associated with the process to be detected does not execute malicious code.

3. The detection method according to claim 2, characterized in that: If the memory attribute corresponding to the memory area of ​​the thread initial function is a system allocated attribute, determining that the thread associated with the process to be detected does not execute malicious code includes: If the memory attribute corresponding to the memory area of ​​the thread initial function is a system-allocated attribute, and the function name of the thread initial function is successfully resolved, it is determined that the thread associated with the process to be detected does not execute malicious code.

4. The detection method according to claim 1, characterized in that: The thread function includes: a stack thread function in a thread call stack corresponding to the thread; and determining whether the thread associated with the process to be detected executes malicious code based on relevant information of a memory area corresponding to the thread function includes: Based on the relevant information of the memory area corresponding to the stack thread function, determining an abnormal stack thread function among the stack thread functions of the thread call stack; Determine whether there is a function execution flow from the abnormal stack thread function to a preset specific stack thread function in the thread call stack; If the function execution flow exists, determining that the thread associated with the process to be detected is executing malicious code; If the function execution flow does not exist, it is determined that the thread associated with the process to be detected does not execute malicious code.

5. The detection method according to claim 4, characterized in that: The relevant information of the memory area corresponding to the stack thread function includes: memory attributes corresponding to the memory area of ​​the stack thread function; The determining of an abnormal stack thread function in the stack thread functions of the thread call stack based on the relevant information of the memory area corresponding to the stack thread function includes: If the memory attribute corresponding to the memory area of ​​the stack thread function is not a system allocated attribute, it is determined that the stack thread function is an abnormal thread function.

6. The detection method according to claim 4, characterized in that: The relevant information of the memory area corresponding to the stack thread function includes: signature information of the dynamic link library to which the memory area corresponding to the stack thread function belongs; The determining of an abnormal stack thread function in the stack thread functions of the thread call stack based on the relevant information of the memory area corresponding to the stack thread function includes: If the signature information of the dynamic link library to which the memory area of ​​the stack thread function belongs is invalid, it is determined that the stack thread function is an abnormal thread function.

7. A process detection device, characterized in that: include: A determination unit, configured to determine, for a process to be detected, a thread associated with the process to be detected and a thread function called when the thread is executed; Wherein the thread function corresponds to a memory area; The execution unit is used to determine whether the thread associated with the process to be detected executes malicious code based on the relevant information of the memory area corresponding to the thread function.

8. A process detection device, characterized in that: include: CPU, memory, input and output interface, wired or wireless network interface, power supply; The memory is a short-term storage memory or a persistent storage memory; The central processing unit is configured to communicate with the memory, and execute instruction operations in the memory on the control plane function entity to perform the detection method according to any one of claims 1 to 6.

9. A computer program product comprising a computer program, characterized in that When the computer program product is run on a computer, the computer is enabled to execute the detection method according to claims 1 to 6.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes instructions, and when the instructions are executed on a computer, the computer is caused to perform the detection method according to claims 1 to 6.

Images