Dynamic library hijacking attack detection method and device

Abstract

The invention discloses a dynamic library hijacking attack detection method and device, and the method comprises the following steps: obtaining process feature information of a newly created to-be-operated process, the process feature information comprising a process file path, a process file hash value, a dynamic library path list of process features and a dynamic library path list hash value; and based on the process feature information of the to-be-run process, detecting whether a dynamic library hijacking attack occurs in combination with process feature information of a preset process library. The key feature information of the newly created to-be-operated process is actively intervened and acquired in the process starting stage, and whether the dynamic library is hijacked or not is judged before the dynamic library attack is really implemented, so that the detection opportunity is greatly advanced, and active defense of the dynamic library hijacked attack is realized.

Description

Technical Field

[0001] The present invention relates to the field of software system attack detection, and in particular to a dynamic library hijacking attack detection device. Background Art

[0002] Dynamic library hijacking, also known as DLL hijacking (in Windows systems) or shared library hijacking (in UNIX-like systems), is a security vulnerability. Attackers take advantage of the search order mechanism when applications load dynamic-link libraries (DLLs) or shared libraries to execute malicious code. Normally, when a program runs and needs to call a function in a dynamic library, the operating system will search for the dynamic library in a specific path order. Attackers place malicious dynamic libraries in a specific location in the program's search path, causing the program to load and execute the malicious library instead of the legitimate library.

[0003] Many existing dynamic library hijacking detection methods are mainly based on post-detection of abnormal behavior. For example, when the system has performance degradation, abnormal software crashes, or sensitive information has been leaked, the suspicion and detection of dynamic library hijacking will be triggered. This approach often results in malicious behavior causing damage to the system or users before the attack is detected. In addition, some traditional detection methods may have a high false positive rate or missed positive rate when judging dynamic library hijacking. On the one hand, they may simply focus on surface features such as the number of dynamic libraries loaded in the system or the order of loading. If the attacker slightly disguises the loading method of the malicious dynamic library, it may bypass the detection. On the other hand, some detection methods do not comprehensively consider the correlation between the characteristics of the process itself and the characteristics of the dynamic library, resulting in the inability to accurately identify dynamic library hijacking behavior in complex environments. From the above, it can be seen that the current detection methods do not conduct comprehensive monitoring in the early stage of system process startup. In many cases, they only conduct limited detection on specific applications or processes that have been marked as high-risk. This will miss other processes that may be attacked by dynamic library hijacking. Moreover, with the development of hacker technology, dynamic library hijacking attack methods are becoming more and more complex. For example, attackers may exploit some zero-day vulnerabilities (vulnerabilities that have not yet been discovered and fixed) to bypass traditional security detection mechanisms, and existing dynamic library hijacking detection methods cannot quickly adapt to these new attack methods. Summary of the invention

[0004] The purpose of the embodiments of the present invention is to provide a dynamic library hijacking attack detection method and device, which actively intervenes in the process startup phase to obtain key feature information of the newly created process to be run, and determines whether a dynamic library hijacking attack has occurred before the dynamic library attack is actually implemented, thereby greatly advancing the detection timing and achieving active defense against dynamic library hijacking attacks.

[0005] In order to solve the above technical problems, a first aspect of an embodiment of the present invention provides a dynamic library hijacking attack detection method, comprising the following steps:

[0006] Obtaining process feature information of a newly created process to be run, the process feature information including: a process file path, a process file hash value, a dynamic library path list of process features and a dynamic library path list hash value;

[0007] Based on the process feature information of the process to be run and combined with the process feature information of the preset process library, it is detected whether a dynamic library hijacking attack occurs.

[0008] Further, it is determined in sequence whether the process file path, process file hash value, process characteristic dynamic library path list and dynamic library path list hash value of the process to be run are all the same as the process file path, process file hash value, process characteristic dynamic library path list and dynamic library path list hash value of a process in a preset process library;

[0009] If they are all the same, it is determined that no dynamic library hijacking attack has occurred;

[0010] If at least one is different, it is determined that a dynamic library hijacking attack has occurred.

[0011] Furthermore, before determining whether a dynamic library hijacking attack occurs, the process includes:

[0012] Get the list of dynamic library paths linked to the process to be run;

[0013] Determine whether all dynamic library paths in the dynamic library path list are in the first preset whitelist list;

[0014] If yes, it is determined that the dynamic library hijacking attack has not occurred;

[0015] If not, it is determined that the dynamic library hijacking attack has occurred.

[0016] Furthermore, before the detection of whether a dynamic library hijacking attack occurs, the following steps are performed:

[0017] Obtain a first environment variable list of the process to be run;

[0018] Determine whether the first environment variable list includes a variable whose variable name is LD_PRELOAD or LD_LIBRARY_PATH, and whether the corresponding environment variable value is not in the second preset whitelist list;

[0019] If yes, it is determined that the dynamic library hijacking attack occurs;

[0020] If not, it is determined based on the environment variable list that the dynamic library hijacking attack has not occurred.

[0021] Furthermore, before obtaining the process feature information of the newly created process to be run, the method further includes:

[0022] Obtain a second environment variable list for each of the running processes, and determine whether the second environment variable list includes a variable whose variable name is LD_PRELOAD or LD_LIBRARY_PATH, and whether the corresponding environment variable value is not in the second preset whitelist list;

[0023] If yes, it is determined that the dynamic library hijacking attack occurs;

[0024] If not, it is determined based on the second environment variable list that the dynamic library hijacking attack has not occurred.

[0025] Further, after determining based on the second environment variable list that the dynamic library hijacking attack has not occurred, the method further includes:

[0026] Obtain a list of dynamic library paths linked to the running process;

[0027] Determine whether the dynamic library paths in the dynamic library path list are all in a preset dynamic library path whitelist;

[0028] If yes, it is determined based on the dynamic library path that the running process has not been subjected to a dynamic library hijacking attack;

[0029] If not, it is determined that a dynamic library hijacking attack occurs to the running process.

[0030] Furthermore, after determining based on the dynamic library path that no dynamic library hijacking attack has occurred, the method further includes:

[0031] Saving the process characteristic information of the running process to the preset process library;

[0032] The process characteristic information includes: the process file path of the running process, the process file hash value, the dynamic library path list linked to the running process and the dynamic library path list hash value.

[0033] Furthermore, after determining that the running process has not been attacked by a dynamic library hijack based on the dynamic library path, the method further includes:

[0034] The dynamic library path list of the running process is stored in the memory after deduplication;

[0035] Real-time detection of the dynamic library path list stored in the memory;

[0036] If a write event of a file or directory in the dynamic library path list is detected, a blocking process operation is performed.

[0037] Accordingly, a second aspect of an embodiment of the present invention provides a dynamic library hijacking attack detection device, comprising:

[0038] An information acquisition module, which is used to acquire process feature information of a newly created process to be run, wherein the process feature information includes: a process file path, a process file hash value, a dynamic library path list of process features, and a dynamic library path list hash value;

[0039] The attack detection module is used to detect whether a dynamic library hijacking attack occurs based on the process feature information of the process to be run and the process feature information of a preset process library.

[0040] Accordingly, a third aspect of an embodiment of the present invention provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the above-mentioned dynamic library hijacking attack detection method.

[0041] Accordingly, a fourth aspect of an embodiment of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which implement the above-mentioned dynamic library hijacking attack detection method when executed by a processor.

[0042] The above technical solution of the embodiment of the present invention has the following beneficial technical effects:

[0043] 1. By actively intervening at the process startup stage, key feature information of the newly created process to be run is obtained, and whether a dynamic library hijacking attack has occurred is determined before the dynamic library attack is actually carried out, which greatly advances the detection time and realizes active defense against dynamic library hijacking attacks;

[0044] 2. By combining the process file path, hash value and dynamic library list hash value, and referring to the feature list and dynamic library list of the running process, suspicious dynamic library hijacking can be accurately discovered. The process file path and hash value can help determine whether the process itself has been tampered with, while the dynamic library list hash value can be used to check whether the dynamic library has been replaced with a malicious version;

[0045] 3. It can detect potential dynamic library hijacking before an attack occurs, and take proactive defense measures to effectively prevent the loading and execution of malicious dynamic libraries, thus avoiding a series of security issues that may arise later, such as sensitive information leakage, system function tampering, etc.;

[0046] 4. Achieve effective security protection, enhance the system's resistance to dynamic library hijacking attacks, and continuously monitor newly created processes, which is very helpful for maintaining the integrity and stability of the system, especially in a complex and changing network environment. In the face of increasingly complex malicious attack methods, it can effectively reduce the probability of successful dynamic library hijacking attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 is a flow chart of a dynamic library hijacking attack detection method provided by an embodiment of the present invention;

[0048] Figure 2 It is a schematic diagram of a process detection flow to be run provided by an embodiment of the present invention;

[0049] Figure 3 It is a schematic diagram of a running process detection process provided by an embodiment of the present invention;

[0050] Figure 4 It is a schematic diagram of detecting environment variables of a running process provided by an embodiment of the present invention;

[0051] Figure 5 It is a schematic diagram of running process dynamic library detection provided by an embodiment of the present invention;

[0052] Figure 6 It is a module block diagram of a dynamic library hijacking attack detection device provided by an embodiment of the present invention.

[0053] Reference numerals:

[0054] 1. Information acquisition module, 2. Attack detection module. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention is further described in detail below in conjunction with specific embodiments and with reference to the accompanying drawings. It should be understood that these descriptions are only exemplary and are not intended to limit the scope of the present invention. In addition, in the following description, the description of well-known structures and technologies is omitted to avoid unnecessary confusion of the concept of the present invention.

[0056] Please refer to Figure 1 A first aspect of an embodiment of the present invention provides a method for detecting a dynamic library hijacking attack, comprising the following steps:

[0057] Step S200, obtaining process characteristic information of the newly created process to be run, the process characteristic information including: process file path, process file hash value, dynamic library path list of process characteristics and dynamic library path list hash value.

[0058] The process file path refers to the location of the executable file of the process to be run in the computer storage system.

[0059] The hash value is a fixed-length feature value obtained by calculating the content of the dynamic library file through a specific hash algorithm (such as MD5, SHA1, SHA256, etc.). Different process files have different hash values. Even if the file name is the same, as long as there is a slight difference in the file content, the hash value will be different. Get the hash value of the process file. Each process often needs to call some dynamic link libraries to implement specific functions when it is running. The dynamic library list records all the dynamic libraries that the process to be run depends on. This list can clearly identify the dynamic libraries associated with the normal operation of the process, making it convenient to check whether there are any abnormal dynamic libraries mixed in. For example, an image processing software process will normally call some dynamic libraries related to image rendering and format processing. By mastering this list, you can know which dynamic libraries are in line with expectations.

[0060] Step S400, based on the process file path, process file hash value and dynamic library list hash value in the process feature information of the process to be run, combined with the process feature information of the preset process library, detect whether a dynamic library hijacking attack occurs.

[0061] The relevant list of running processes can be used as a reference standard, because if the running process is normal and has not been attacked, its characteristics and the dynamic library called are consistent with the normal operation logic of the system. By comparing and analyzing the information of the newly created process to be run with the corresponding information of the running process, such as checking whether the dynamic library called by the new process has similar normal calls in the running process, whether the called dynamic library version (judged by hash value, etc.) is consistent, etc., a comprehensive judgment can be made as to whether a dynamic library hijacking attack has occurred. If a dynamic library called by the new process has never appeared in a similar legitimate process that has been running, or the hash value is very different from the normal one, it is possible that a malicious dynamic library has been inserted to attempt a hijacking attack, thereby completing the detection of dynamic library hijacking attacks.

[0062] For details, please refer to Figure 2 , the detection of whether a dynamic library hijacking attack occurs in step S400 includes:

[0063] Step S411, determine in turn whether the process file path, process file hash value, dynamic library path list of process characteristics and dynamic library path list hash value of the process to be run are the same as the process file path, process file hash value, dynamic library path list of process characteristics and dynamic library path list hash value of a process in a preset process library.

[0064] First, after obtaining the file path of the process to be run, it will be compared one by one with the many paths in the list of running process characteristics. For example, the list of running process characteristics records the installation directory path of the executable file of a certain office software when it is normally started (such as "C:\Program Files\Office Software"). Then for a new process to be run, if it claims to be a process related to the office software, it is necessary to see whether its file path matches it. This comparison can check whether there is anomaly from the source position, because under normal circumstances, legitimate processes of the same type should be started from similar or the same reasonable path.

[0065] If different paths appear, it is likely that external factors have intervened, such as malware disguising itself as a normal process and placing it in other irregular paths, attempting to use dynamic library hijacking to execute malicious code or tamper with normal functions after the process is started. If the paths are inconsistent, there is reason to determine that a dynamic library hijacking attack has occurred, and further take corresponding security measures to deal with this potential security threat.

[0066] Secondly, the process file hash value is like a unique "digital fingerprint" of the process file, which is calculated by a specific hash algorithm on the process file content. The hash value recorded in the feature list of the running process represents the standard hash value corresponding to those process files that were previously identified as running normally, and is an important reference for measuring whether the current process to be run is legal. From the perspective of file content integrity and consistency, check again to see if there are any anomalies. Compare the newly obtained file hash value of the process to be run with each hash value saved in the feature list of the running process. For example, after using the common MD5 algorithm to calculate the hash values ​​of the running process and the process to be run file respectively, check whether the hash value of the process to be run can find a match within the legal hash value range covered by the feature list of the running process.

[0067] It is found that the file hash value of the process to be run is exactly the hash value in the feature list of the running process, which means that from the file content level, the file content of the process to be run is consistent with those of the legitimate and normal processes that have been run. When the file hash value of the process to be run is not the hash value in the feature list of the running process, it indicates that the content of the process file is different from the legitimate and normal process file that has been run. Even if its file path seems normal, the file content may have been tampered with, such as malicious code implanted or the original normal function code modified, and these tamperings are likely to be prepared by the attacker for the subsequent dynamic library hijacking attack, by changing the file content to guide the process to load malicious dynamic libraries, etc.

[0068] Finally, the dynamic library list hash value is a set of "digital fingerprints" calculated from the contents of each dynamic link library file that needs to be called when the process is running. The dynamic library list hash value recorded in the feature list of the running process represents the standard situation of the past normal running process in calling dynamic libraries. The hash value corresponding to each dynamic library in the dynamic library list of the newly created process to be run is compared one by one with the hash value of the corresponding dynamic library in the feature list of the running process.

[0069] After comparison, it is found that the hash value of the dynamic library list of the process to be run completely matches the hash value of the dynamic library list in the feature list of the running process. From the key link of the dynamic library, the dynamic library called by the process to be run is consistent with the legitimate and normal process that has been run in terms of content integrity and legitimacy. When the hash value of the dynamic library list of the process to be run does not match the hash value of the dynamic library list in the feature list of the running process, this indicates that the dynamic library called by the process to be run is different from the legitimate and normal process that has been run in terms of content. Even if the previous file path and file hash value are normal, the dynamic library may be maliciously tampered or replaced by the attacker, such as replacing the normal dynamic library used for data encryption with a malicious dynamic library that can steal encrypted data. This situation is likely that the attacker intends to implement malicious behavior through dynamic library hijacking, destroy system security or steal user information.

[0070] For example, an office software relies on several specific dynamic libraries when it runs normally, and the legal hash values ​​of these dynamic libraries have been clearly recorded. Now there is a process related to the office software to be run. The previous file path and file hash value checks are fine, but when comparing the dynamic library list hash value, it is found that the dynamic library list hash value used for document format conversion is inconsistent with the legal record. This very likely means that the dynamic library has been tampered with, and there is a risk of dynamic library hijacking attack. The process should be terminated immediately and the situation of the related dynamic libraries should be thoroughly investigated.

[0071] Step S412: If all are the same, it is determined that no dynamic library hijacking attack has occurred.

[0072] When the four key elements completely match the corresponding items in the preset process library, based on the comparison, we can be highly confident that the process to be run is in a safe and unhijacked state. This judgment result provides sufficient basis for the system to release the process to be run normally in the future, avoiding unwarranted obstruction of the operation of legitimate processes due to misjudgment, and ensuring the smoothness and stability of the overall operation of the system. At the same time, it also means that the system has successfully resisted potential dynamic library hijacking attacks at the current stage, maintaining the health of the running ecology of each process, and allowing user data and system functions to operate normally on a safe track.

[0073] Step S413: If at least one is different, it is determined that a dynamic library hijacking attack has occurred.

[0074] As long as at least one of the four comparison dimensions mentioned above is different, it can be determined that a dynamic library hijacking attack has occurred. On the one hand, it can promptly block the running of processes that may be hijacked, prevent malicious dynamic libraries from further executing malicious code, and avoid serious consequences such as leakage of user sensitive information and malicious tampering of system functions. On the other hand, accurate judgments provide a clear direction for subsequent security response measures, such as quickly launching emergency repair processes, isolating and analyzing affected processes and suspicious dynamic libraries, tracing attack paths, promptly repairing vulnerabilities, strengthening system protection, and minimizing the losses caused by attacks. It also accumulates valuable experience to prevent subsequent similar attacks and continuously strengthens the system's overall dynamic library hijacking attack defense capabilities.

[0075] Furthermore, before determining whether a dynamic library hijacking attack occurs in step S413, the following steps are performed:

[0076] Step S411a, obtaining a list of dynamic library paths linked to the process to be run.

[0077] At the operating system level, both Windows PE (Portable Executable) format executable files and Linux ELF (Executable and Linkable Format) format files contain relevant data structures that describe process dependencies. When the process starts, the operating system loader will locate and load the required dynamic libraries based on these structures. The detection tool or system module can intercept and record the path information of these dynamic libraries during the process of loading dynamic libraries by hooking the relevant functions of the loader, thereby constructing a list of dynamic library paths linked to the process to be run. By clarifying the paths of these dynamic libraries, it is possible to check from the source whether there are abnormally introduced dynamic libraries, providing the most direct clues for subsequent security assessments.

[0078] Step S411b, determining whether all the dynamic library paths in the dynamic library path list are in the first preset whitelist list.

[0079] The first preset whitelist includes: the system default library path and the dynamic library path registered during the installation of legitimate software, as well as specific library paths that have passed internal security audits. After obtaining the dynamic library path list of the process to be run, the paths in it are accurately matched with the entries in the whitelist one by one. This not only requires that the path string is completely consistent, but also needs to consider the path parsing rules. For example, in a Windows environment, it is necessary to consider details such as the equivalence of short path names and long path names, and the correct identification of UNC (Universal Naming Convention) paths; in a Linux environment, it is necessary to pay attention to whether the direction of the soft link meets the whitelist requirements to avoid misjudgment due to malicious use of path aliases or symbolic links.

[0080] Step S411c: if yes, it is determined that the dynamic library hijacking attack has not occurred.

[0081] When all paths in the dynamic library path list can be found in the first preset whitelist list, it can be determined that the process is in a safe operation state. In normal system and software updates and operation and maintenance scenarios, legitimate processes will follow the established path rules, obtain dynamic libraries from certified security directories, and maintain stable system operation. For example, after the system automatically updates the patch, the updated system process still calls the dynamic library from the system's native security directory. If there are no other obvious signs of abnormality, it can be determined that it has not been attacked by dynamic library hijacking, avoiding excessive detection and wasting system resources, and ensuring efficient system operation.

[0082] The running status of the process still needs to be continuously monitored, especially the calling behavior of the dynamic library. For example, by real-time monitoring the calling frequency of the process to the dynamic library function and the parameter passing situation, it is possible to prevent attackers from using legitimate dynamic libraries in the whitelist to execute malicious code by exploiting software vulnerabilities (such as buffer overflow vulnerabilities, function pointer tampering vulnerabilities, etc.). This requires the use of professional intrusion detection systems (IDS) or host-based security protection tools, using dynamic behavior analysis technology to ensure that the process does not have abnormal behavior in subsequent operation and maintain system security and stability.

[0083] Step S411d, if not, it is determined that the dynamic library hijacking attack has occurred. If it is found that at least one path in the dynamic library path list is not in the first preset whitelist list, it may be caused by a variety of malicious attack scenarios, such as: the attacker exploits a software vulnerability and obtains the permission to write to the key directory of the system through privilege escalation, and implants the malicious dynamic library into the directory pointed to by the whitelist path, replacing the original legitimate dynamic library, so that the process loads malicious code without knowing it, and performs malicious operations such as stealing user login credentials and tampering with system configuration.

[0084] In some complex APT (Advanced Persistent Threat) attacks, attackers may lurk for a long time, gradually tampering with the system's dynamic library search path configuration, and guiding the process to load dynamic libraries from external malicious sources. For example, by modifying environment variables (such as the PATH environment variable in Windows systems and the LD_LIBRARY_PATH environment variable in Linux systems), the process will prioritize locating the malicious dynamic library controlled by the attacker when searching for dynamic libraries. This covert hijacking method is difficult to detect through routine inspections, but once an abnormal path is found, potential threats can be identified in a timely manner.

[0085] Furthermore, before detecting whether a dynamic library hijacking attack occurs in step S400, the following steps are also included:

[0086] Step S311, obtaining a first environment variable list for each process to be run, and determining whether the first environment variable list includes a variable named LD_PRELOAD or LD_LIBRARY_PATH, and whether the corresponding environment variable value is not in the second preset whitelist.

[0087] Before the aforementioned detection and judgment process, you can also first detect the environment variables. Environment variables play an important configuration role in the operation of the program in the operating system. The two environment variables, such as "LD_PRELOAD" (commonly used to specify shared libraries that are loaded first in UNIX-like systems) and "LD_LIBRARY_PATH" (used to specify the search path for dynamic libraries), are particularly closely related to the loading of dynamic libraries. To obtain the first environment variable list for each process to be run is to check the specific environment configurations that the process depends on when it runs. The second preset whitelist list is a set of environment variable value ranges that are set in advance and are recognized as safe and legal. Through comparison and judgment, it can quickly discover whether there are abnormal environment variable settings, and check the hidden dangers that may lead to dynamic library hijacking from the source.

[0088] The first environment variable list of the running process is checked, with a focus on whether there is a variable named "LD_PRELOAD" or "LD_LIBRARY_PATH", and whether the corresponding environment variable values ​​are not in the preset second preset whitelist list. For example, under normal circumstances, "LD_LIBRARY_PATH" may be set to some safe dynamic library search paths by the system default. If it is set to a path of unknown external source and not in the whitelist, it may be exploited by attackers to change the search order of dynamic libraries so that malicious dynamic libraries are loaded first, thereby implementing dynamic library hijacking attacks.

[0089] Step S312: If yes, it is determined that a dynamic library hijacking attack has occurred.

[0090] If it is found that the "LD_PRELOAD" or "LD_LIBRA RY_PATH" variable does exist in the first environment variable list, and its corresponding environment variable value is not in the second preset whitelist list, it means that the environment configuration related to dynamic library loading followed by the process during operation has an abnormality and is out of the pre-set security range. It may be that the attacker intentionally tampered with these key environment variables to guide the process to load the malicious dynamic library they prepared, thereby achieving the purpose of hijacking.

[0091] Step S313: If not, determine based on the first environment variable list that no dynamic library hijacking attack has occurred.

[0092] When it is determined that variables such as "LD_PRELOAD" and "LD_LIBRARY_PATH" either do not exist in the first environment variable list, or exist but their corresponding environment variable values ​​are in the second preset whitelist list, this indicates that from the perspective of environment variable configuration, the running environment of the process complies with security specifications in key configurations related to dynamic library loading.

[0093] Please refer to Figure 3 and Figure 4 In an optional implementation of the embodiment of the present invention, before obtaining the characteristic information of the newly created process to be run in step S200, the method further includes:

[0094] Step S111, obtaining the second environment variable list of each running process, and determining whether the second environment variable list includes a variable named LD_PRELOAD or LD_LIBRARY_PATH, and whether the corresponding environment variable value is not in the second preset whitelist.

[0095] Conduct environmental variable checks on already running processes and perform pre-security checks. The two environment variables "LD_PRELOAD" and "LD_LIBRARY_PATH" have a significant impact on dynamic library loading. The former can specify the shared library to be loaded first, and the latter is used to clarify the search path of the dynamic library. Obtain the second environment variable list for each running process, comprehensively sort out the relevant environment configurations that these running processes rely on, and then compare with the second preset whitelist list to determine whether there are abnormal environment variable settings that may cause dynamic library hijacking, and discover potential security risks in advance from the perspective of the system's existing running processes.

[0096] Step S112: If yes, it is determined that a dynamic library hijacking attack has occurred.

[0097] If it is determined that there is a variable such as "LD_PRELOAD" or "LD_LIBRARY_PATH" in the second environment variable list of a running process, and its corresponding environment variable value is not in the second preset whitelist list, it indicates that the running process has an abnormality in the environment configuration related to dynamic library loading and has deviated from the pre-set security scope. It is very likely that the attacker has tampered with its environment variables, intending to allow malicious dynamic libraries to intervene and implement hijacking by changing the search path of the dynamic library or specifying priority loading of malicious shared libraries.

[0098] Step S113: If not, determine based on the second environment variable list that no dynamic library hijacking attack has occurred.

[0099] If the running process behaves normally, it can be preliminarily determined based on the second environment variable list that no dynamic library hijacking attack has occurred, and then subsequent steps can be continued, such as obtaining feature information of the newly created process to be run, so as to further improve the comprehensive detection process of dynamic library hijacking attacks on the entire system and ensure the overall security of the system.

[0100] For further information, please refer to Figure 5 After determining that no dynamic library hijacking attack has occurred based on the second environment variable list in step S113, the method further includes:

[0101] Step S121, obtaining a list of dynamic library paths linked to the running processes.

[0102] Obtaining the list of dynamic library paths linked to running processes is to clarify the locations of the dynamic libraries specifically called by these running processes during operation. This helps to analyze in depth whether there is a possibility of malicious tampering or introduction of malicious dynamic libraries from the perspective of the source path of the dynamic library, so as to more comprehensively detect whether there is a hidden danger of dynamic library hijacking attack in the system. Analyze each running process, sort out the specific storage paths corresponding to the dynamic libraries linked and called when they execute various functions, and summarize these paths to form a dynamic library path list.

[0103] Step S122, determining whether the dynamic library paths in the dynamic library path list are all in the preset dynamic library path whitelist.

[0104] After collecting the list of dynamic library paths linked to the running processes, each dynamic library path needs to be compared with the preset dynamic library path whitelist. The preset dynamic library path whitelist is a set of dynamic library storage locations that are pre-set and recognized as safe and legal. Under normal circumstances, the dynamic libraries called by the running processes should all come from paths within these safe ranges.

[0105] Step S123: If yes, determine based on the dynamic library path whether the running process has not been attacked by a dynamic library hijack.

[0106] If it is found that all dynamic library paths in the dynamic library path list of the running process are in the preset dynamic library path whitelist, this means that from the key aspect of the source path of the dynamic library, the dynamic libraries called by the running process are obtained from a safe and legal location, and there is no situation where the dynamic library is called from an abnormal external location, which means that there is no sign of dynamic library hijacking attack at this link.

[0107] Step S124: If not, it is determined that a dynamic library hijacking attack has occurred in the running process.

[0108] When a dynamic library path in the dynamic library path list of a running process is not in the preset dynamic library path whitelist, this means that these running processes have called dynamic libraries from unsafe and unauthorized locations. For example, by tampering with the configuration or exploiting vulnerabilities, the running processes are allowed to link to dynamic libraries from external malicious sources. The purpose is to implement dynamic library hijacking, by replacing the normal dynamic library with a malicious version, and then executing malicious code, stealing information, or destroying system functions.

[0109] Further, after determining that no dynamic library hijacking attack has occurred based on the dynamic library path in step S123, the method further includes:

[0110] Step S130, save the process characteristic information of the running process to a preset process library, wherein the process characteristic information includes: the process file path of the running process, the process file hash value, the dynamic library path list linked to the running process, and the dynamic library path list hash value.

[0111] After determining that the running process has not suffered a dynamic library hijacking attack based on the dynamic library path, the step of saving the characteristic information of the running process to the memory is executed. This can be used as a reference standard when detecting whether the newly created process to be run has a dynamic library hijacking attack. By comparing it with the characteristic information of the running process, possible abnormal situations in the new process can be quickly discovered, thereby efficiently and accurately judging the risk of dynamic library hijacking.

[0112] Further, after determining in step S123 that the running process has not been attacked by a dynamic library hijack based on the dynamic library path, the method further includes:

[0113] Step S141, the dynamic library path list of the running process is stored in the memory after deduplication.

[0114] When collecting the dynamic library path list of the running process, there may be a situation where the same dynamic library is recorded multiple times with different call paths. Deduplication can ensure that the dynamic library path information stored in the memory is more concise, accurate and non-redundant, which is convenient for subsequent related detection and management work to be more efficient. Specifically, use the corresponding data processing algorithm to traverse and compare all the collected dynamic library paths, remove the repeated paths, and then save these unique dynamic library paths to a specific data structure in the memory, such as an array or list, etc., to facilitate subsequent calls and operations.

[0115] Step S142, real-time detection of the dynamic library list of the running processes stored in the memory.

[0116] For example, in the Linux system, Fanotify is used to monitor the dynamic library list of the running process stored in the memory. By using its monitoring function, monitoring points are set for the files and directories corresponding to the dynamic libraries involved in the previously running processes, and various events occurring on the files and directories related to the dynamic libraries are monitored in real time. When it is detected whether a dynamic library file is attempted to be written by an external program, abnormal operations that may affect the normality of the dynamic library and pose security risks can be discovered in a timely manner.

[0117] Step S143: If a write event of a file or directory in the dynamic library list is detected, a blocking process operation is performed.

[0118] Dynamic library hijacking attacks often involve tampering with legitimate dynamic library files, such as replacing them with malicious versions or writing malicious code into them. Fanotify detection can detect these abnormal write operations at the moment they occur, providing a key basis for taking timely blocking and other security measures. Blocking process operations can be implemented through the relevant process management and permission control mechanisms provided by the operating system, such as directly terminating suspicious processes that attempt to write to dynamic libraries, or limiting their access rights to relevant dynamic library files and directories. In this way, the anti-tampering function of the dynamic library can be implemented to maximize the protection of the integrity, stability and security of user data of the system.

[0119] Accordingly, please refer to Figure 6 A second aspect of an embodiment of the present invention provides a dynamic library hijacking attack detection device, comprising:

[0120] Information acquisition module 1, which is used to obtain process feature information of the newly created process to be run, the process feature information includes: process file path, process file hash value, dynamic library path list of process features and dynamic library path list hash value;

[0121] Attack detection module 2 is used to detect whether a dynamic library hijacking attack occurs based on the process file path, process file hash value and dynamic library list hash value in the process feature information of the process to be run, combined with the process features of the preset process library.

[0122] Accordingly, a third aspect of an embodiment of the present invention provides an electronic device, comprising: at least one processor; and a memory connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the above-mentioned dynamic library hijacking attack detection method.

[0123] Accordingly, a fourth aspect of an embodiment of the present invention provides a computer-readable storage medium having computer instructions stored thereon, which implement the above-mentioned dynamic library hijacking attack detection method when executed by a processor.

[0124] The embodiment of the present invention aims to protect a dynamic library hijacking attack detection method and device, the method includes the following steps: obtaining the process feature information of the newly created process to be run, the process feature information includes: process file path, process file hash value, dynamic library path list of process features and dynamic library path list hash value; based on the process feature information of the process to be run, combined with the process feature information of the preset process library, detecting whether a dynamic library hijacking attack occurs. The above technical solution has the following effects:

[0125] 1. By actively intervening at the process startup stage, key feature information of the newly created process to be run is obtained, and whether a dynamic library hijacking attack has occurred is determined before the dynamic library attack is actually carried out, which greatly advances the detection time and realizes active defense against dynamic library hijacking attacks;

[0126] 2. By combining the process file path, hash value and dynamic library list hash value, and referring to the feature list and dynamic library list of the running process, suspicious dynamic library hijacking can be accurately discovered. The process file path and hash value can help determine whether the process itself has been tampered with, while the dynamic library list hash value can be used to check whether the dynamic library has been replaced with a malicious version;

[0127] 3. It can detect potential dynamic library hijacking before an attack occurs, and take proactive defense measures to effectively prevent the loading and execution of malicious dynamic libraries, thus avoiding a series of security issues that may arise later, such as sensitive information leakage, system function tampering, etc.;

[0128] 4. Achieve effective security protection, enhance the system's resistance to dynamic library hijacking attacks, and continuously monitor newly created processes, which is very helpful for maintaining the integrity and stability of the system, especially in a complex and changing network environment. In the face of increasingly complex malicious attack methods, it can effectively reduce the probability of successful dynamic library hijacking attacks.

[0129] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0130] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0131] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0132] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0133] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A dynamic library hijacking attack detection method, characterized in that: The steps include: Obtaining process feature information of a newly created process to be run, the process feature information including: a process file path, a process file hash value, a dynamic library path list of process features, and a dynamic library path list hash value; Based on the process feature information of the process to be run and combined with the process feature information of the preset process library, it is detected whether a dynamic library hijacking attack occurs.

2. The dynamic library hijacking attack detection method according to claim 1 is characterized in that: The detection of whether a dynamic library hijacking attack occurs includes: Determine in sequence whether the process file path, process file hash value, process characteristic dynamic library path list and dynamic library path list hash value of the process to be run are all the same as the process file path, process file hash value, process characteristic dynamic library path list and dynamic library path list hash value of a process in a preset process library; If they are all the same, it is determined that no dynamic library hijacking attack has occurred; If at least one is different, it is determined that a dynamic library hijacking attack has occurred.

3. The dynamic library hijacking attack detection method according to claim 2 is characterized in that: Before determining that a dynamic library hijacking attack occurs, the process includes: Get the list of dynamic library paths linked to the process to be run; Determine whether all dynamic library paths in the dynamic library path list are in the first preset whitelist list; If yes, it is determined that the dynamic library hijacking attack has not occurred; If not, it is determined that the dynamic library hijacking attack has occurred.

4. The dynamic library hijacking attack detection method according to claim 1 is characterized in that: Before the detection of whether a dynamic library hijacking attack occurs, the following steps are performed: Obtain a first environment variable list of the process to be run, and determine whether the first environment variable list includes a variable whose variable name is LD_PRELOAD or LD_LIBRARY_PATH, and whether the corresponding environment variable value is not in the second preset whitelist list; If yes, it is determined that the dynamic library hijacking attack occurs; If not, it is determined based on the environment variable list that the dynamic library hijacking attack has not occurred.

5. The method for detecting dynamic library hijacking attacks according to any one of claims 1 to 4, characterized in that: Before obtaining the process feature information of the newly created process to be run, the method further includes: Obtain a second environment variable list for each running process, and determine whether the second environment variable list includes a variable named LD_PRELOAD or LD_LIBRARY_PATH, and whether the corresponding environment variable value is not in the second preset whitelist list; If yes, it is determined that the dynamic library hijacking attack occurs; If not, it is determined based on the second environment variable list that the dynamic library hijacking attack has not occurred.

6. The dynamic library hijacking attack detection method according to claim 5 is characterized in that: After determining based on the second environment variable list that the dynamic library hijacking attack has not occurred, the method further includes: Obtain a list of dynamic library paths linked to the running process; Determine whether the dynamic library paths in the dynamic library path list are all in a preset dynamic library path whitelist; If yes, it is determined based on the dynamic library path that the running process has not been subjected to a dynamic library hijacking attack; If not, it is determined that a dynamic library hijacking attack occurs to the running process.

7. The dynamic library hijacking attack detection method according to claim 6 is characterized in that: After determining that no dynamic library hijacking attack has occurred based on the dynamic library path, the method further includes: Saving the process characteristic information of the running process to the preset process library; The process characteristic information includes: the process file path of the running process, the process file hash value, the dynamic library path list linked to the running process and the dynamic library path list hash value.

8. The dynamic library hijacking attack detection method according to claim 6 is characterized in that: After determining that the running process has not been attacked by a dynamic library hijack based on the dynamic library path, the method further includes: The dynamic library path list of the running process is stored in the memory after deduplication; Real-time detection of the dynamic library path list stored in the memory; If a write event of a file or directory in the dynamic library path list is detected, a blocking process operation is performed.

9. A dynamic library hijacking attack detection device, characterized in that: include: An information acquisition module, which is used to acquire process feature information of a newly created process to be run, wherein the process feature information includes: a process file path, a process file hash value, a dynamic library path list of process features, and a dynamic library path list hash value; The attack detection module is used to detect whether a dynamic library hijacking attack occurs based on the process feature information of the process to be run and the process feature information of a preset process library.

10. An electronic device, characterized in that: include: at least one processor; And a memory connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor executes the dynamic library hijacking attack detection method as described in any one of claims 1-8.

Images