Malicious program processing method and device, equipment, storage medium and program product

Abstract

The invention discloses a malicious program processing method and device, equipment, a storage medium and a program product, and belongs to the technical field of information security. The method comprises the steps of monitoring whether a sample program running in computer equipment loads a network dynamic link library (DLL) or not, judging whether abnormal data exist in a target memory block in response to monitoring that the sample program loads the network DLL or not, and obtaining a configuration file of the sample program if the abnormal data exist in the target memory block. According to the method, the configuration file of the sample program is obtained, so that the flow between the computer equipment and the malicious server can be intercepted, communication between the computer equipment and the malicious server can be intercepted fundamentally, the computer equipment is prevented from being controlled by the malicious server, and the user experience is improved. Or the internal data of the computer equipment is stolen by the malicious server.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method, apparatus, device, storage medium, and program product for processing malicious programs. Background Art

[0002] With the rapid development of computers and the Internet, various malicious programs such as computer viruses, ransomware, keyloggers, password stealers, Word and Excel macro viruses, boot sector viruses, script viruses, Trojans, spyware and adware have emerged in an endless stream, posing a serious threat to computer systems, network security and user privacy. Therefore, there is an urgent need for a method to deal with malicious programs to promptly detect security risks and reduce the losses caused by malicious programs. Summary of the Invention

[0003] This application provides a method, apparatus, device, storage medium, and computer program for processing malicious programs, which can promptly detect security risks brought by malicious programs. The technical solution is as follows:

[0004] In a first aspect, a method for processing malicious programs is provided, the method comprising: monitoring whether a sample program running in a computer device loads a network dynamic link library DLL, the network DLL being used to support network communication of an application; in response to monitoring that the sample program loads the network DLL, determining whether there is abnormal data in a target memory block, the abnormal data comprising at least one of a format header and a file header of a portable executable PE file, the target memory block being a memory block where a running code for loading the network DLL in the sample program is located; if the abnormal data exists in the target memory block, determining that the sample program is a malicious program, and obtaining a configuration file of the sample program, the configuration file comprising address information of a malicious server, the malicious server being used to interact with the malicious program to control the malicious program to perform malicious operations on the computer device on which the malicious program is installed, and the address information of the malicious server being used to intercept traffic between the computer device and the malicious server.

[0005] Since applications usually load network DLLs in order to perform network communication, the present application can monitor in real time whether a sample program running in a computer device loads a network DLL to determine whether the sample program has engaged in network communication. If it is determined that the sample program has loaded a network DLL, it can further determine whether the sample program is a malicious program by determining whether there is abnormal data in the target memory block. Compared to related technologies that require scanning the entire memory area of ​​the computer device, since the target memory block is the memory block where the running code for loading the network DLL is located in the sample program, the time required to determine whether there is abnormal data in the target memory block is shorter and more efficient, which can further reduce the risk posed by malicious programs. If the sample program loads a network DLL and there is abnormal data in the target memory block, the sample program's configuration file can be obtained. Since the configuration file includes the address information of the malicious server, the sample program's configuration file can be obtained to facilitate interception of traffic between the computer device and the malicious server. In this way, communication between the computer device and the malicious server can be fundamentally intercepted, thereby preventing the computer device from being controlled by the malicious server or the internal data of the computer device from being stolen by the malicious server.

[0006] Optionally, the hook function is a user-state hook function in the sample program. In this case, the security software can inject the user-state hook function into the sample program after the sample program is started, and monitor the sample program through the user-state hook function to determine whether the sample program loads the network DLL.

[0007] Optionally, the hook function is a kernel-state hook function in the kernel of the computer device. In this case, the security software can inject the kernel-state hook function into the kernel of the computer device and monitor the computer device through the kernel-state hook function to determine whether the sample program loads the network DLL.

[0008] Optionally, before monitoring whether the sample program calls the network connection function, the security software can also monitor the startup operation of the program in the computer device, that is, the security software can also monitor whether a new program is started in the computer device. If the security software determines that a new program is started in the computer device, the newly started program is used as the sample program and the step of monitoring whether the sample program running in the computer device loads the network DLL is executed.

[0009] Since the present application starts monitoring the network communication behavior of the sample program at the beginning of the sample program startup, malicious operations of the sample program can be discovered in a timely manner, thereby reducing the security risks of computer equipment.

[0010] It should be noted that the above-mentioned format header refers to the DOS header of the PE file, and the file header refers to the standard PE header (_IMAGE_FILE_HEADER) in the PE header of the PE file.

[0011] Since the format header and file header of a normal application's PE file are read-only, the code segment of a normal application's PE file is readable and executable, and the permissions of the same memory block in a computer device are the same, when a normal application is running in memory, the format header and file header of the PE file can be loaded into the same memory block, and the code segment will be loaded into another memory block. In other words, the format header and code segment of the PE file are located in different memory blocks, and the file header and code segment of the PE file are located in different memory blocks, so that the format header and code segment of the PE file have different read and write permissions. However, when a PE file with malicious functions (such as shellcode or malicious DLL) is running in the memory of a computer device, the PE file with malicious functions is usually loaded in its entirety into the same memory block. Therefore, it is possible to determine whether the PE file with malicious functions has been loaded into memory for execution by determining whether the memory block where the running code is located also contains the format header and / or file header of the PE file. Since the memory block where the running code is located necessarily includes the code segment of the PE file, if the memory block also contains the format header of the PE file, it means that the memory block contains a complete PE file.

[0012] Optionally, when abnormal data exists in the target memory block, the security software can also determine that the sample program is a malicious program.

[0013] Optionally, after determining that the sample program is a malicious program, the security software can also display a prompt interface, where the prompt interface is used to prompt the user that the sample program is a malicious program.

[0014] Optionally, if there is no abnormal data in the target memory block, it is determined that the sample program is not a malicious program.

[0015] If there is no abnormal data in the target memory block, it means that the running code for loading the network DLL in the target memory block is normal code. Therefore, it can be determined that the sample program is not a malicious program.

[0016] Optionally, when abnormal data exists in the target memory block, the security software can also suspend the execution of the sample program.

[0017] Since malicious programs usually interact with malicious servers through the network, if the sample program loads the network DLL, it means that the sample program is about to send or receive data through the network. If there is abnormal data in the target memory block, it means that the sample program is a malicious program and poses a security risk. Therefore, when it is determined that the sample program contains abnormal data, the security software can avoid security risks by pausing the running of the sample program.

[0018] If the target memory block contains abnormal data, the code used to load the network dynamic link library in the target memory block is malicious code from a PE file with malicious functions. In this case, the target memory block usually stores the configuration file of a sample program to facilitate communication between the malicious program and the malicious server. Therefore, the security software can obtain the configuration file of the sample program when the target memory block contains abnormal data.

[0019] Optionally, the data in the target memory block is matched with the malicious features of at least one malicious program. If the target memory block contains target data that matches the malicious features of the target malicious program, the configuration file of the sample program is obtained from the target memory block based on the position of the target data in the target memory block and the file location indication information of the target malicious program. The target malicious program is one of the at least one malicious programs. The file location indication information of the target malicious program is used to describe the position offset in the memory between the configuration file of the target malicious program and the malicious features of the target malicious program. The malicious features represent the location of the configuration file of the malicious program in the target memory block.

[0020] Optionally, the security software stores at least one malicious program's malicious signature and file location information for each of the at least one malicious program, where the file location information describes the offset between the malicious program's configuration file and the malicious signature in memory. In this case, the security software can match the data in the target memory block with the malicious signature of the at least one malicious program.

[0021] If the target memory block contains target data that matches the malicious features of the target malicious program, the position of the target data in the target memory block is used as the starting point. According to the position offset between the configuration file of the malicious program and the malicious features of the target malicious program in the memory, the starting position of the configuration file of the sample program in the target memory block is determined. Then, based on the starting position of the configuration file of the sample program in the target memory block and the size of the configuration file of the target malicious program, the configuration file of the sample program is obtained from the target memory block.

[0022] To prevent the leakage of its own information, a malicious program may also encrypt its configuration file. In this case, the security software obtains the encrypted sample program configuration file from the target memory block. The security software also needs to decrypt the encrypted sample program configuration file to obtain the decrypted sample program configuration file. At this point, the security software also stores configuration file decryption information for each of the at least one malicious program. This configuration file decryption information is used to describe the decryption method of the malicious program configuration file. The security software can decrypt the sample program configuration file based on the configuration file decryption information of the target malicious program.

[0023] Optionally, the configuration file of the sample program includes at least one of the following: address information of the malicious server corresponding to the sample program, UA information of the sample program, injection method of the sample program, and process into which the sample program is injected.

[0024] Optionally, the injection method of the sample program includes structured query language (SQL) injection, command injection, etc.

[0025] Optionally, after obtaining the configuration file of the sample program, the security software can send the address information of the malicious server to a protection device deployed between the computer device and the malicious server, so that the protection device intercepts the traffic between the computer device and the malicious server, or intercepts the traffic from the malicious server and / or the traffic sent to the malicious server.

[0026] That is to say, after obtaining the address of the malicious server corresponding to the sample program, the security software can also link the protection device to intercept the traffic between the computer device and the malicious server, thereby fundamentally preventing the malicious behavior of the malicious server and improving the security performance of the computer device. When the protection device intercepts the traffic from the malicious server and / or the traffic sent to the malicious server, it can prevent the computer devices in the protected network from being subjected to malicious operations. This application realizes the global ban of the attacker's control facilities by linking the computer device with the protection device, thereby protecting all computer devices in the protected network from remote attacks by the attacker.

[0027] Optionally, after obtaining the configuration file of the sample program, the security software can release the memory resources allocated for the sample program to terminate the running of the sample program.

[0028] Since malicious programs can pose a security threat to computer devices, if the sample program is determined to be a malicious program, the security software can terminate the running of the sample program to further reduce the risk of information leakage of the computer device and ensure the security of the computer device.

[0029] Optionally, after obtaining the configuration file of the sample program, the security software can send the configuration file of the sample program to a server for providing security services (i.e., a security server) so that the server can determine a malicious program portrait corresponding to the sample program, and the malicious program portrait includes at least one of the following: address information of the malicious server corresponding to the malicious program, user agent UA information of the malicious program, injection method of the malicious program, and process into which the malicious program is injected.

[0030] Since malicious programs may be deployed on multiple computer devices, in this case, the malicious server corresponding to the malicious program may perform malicious operations on multiple computer devices. Therefore, after obtaining the configuration file of the sample program, the security software can also work with the security server to profile the malicious program to enrich the information of the attack organization behind the malicious program, making it easier for enterprises and individuals to prevent and respond to malicious attacks from the attack organization.

[0031] In a second aspect, a method for processing malicious programs is provided, the method comprising: monitoring whether a sample program running in a computer device loads a network dynamic link library DLL, the network DLL being used to support network communication of an application; in response to monitoring that the sample program loads the network DLL, determining whether there is abnormal data in a target memory block, the abnormal data comprising at least one of a format header and a file header of a portable executable PE file, the target memory block being a memory block where a running code for loading the network DLL in the sample program is located; and terminating the running of the sample program if the abnormal data exists in the target memory block.

[0032] If the sample program is determined to be a malicious program, the running of the sample is directly terminated to end the malicious behavior of the malicious program from the source. In this way, the computer device can handle the malicious program without relying on protective equipment, thereby effectively improving the security performance of the computer device.

[0033] In a third aspect, a device for processing malicious programs is provided, wherein the device implements the malicious program processing method described in the first aspect. The device includes at least one module configured to implement the malicious program processing method described in the first aspect.

[0034] In a fourth aspect, a device for processing malicious programs is provided, wherein the device has the function of implementing the malicious program processing method described in the second aspect. The device includes at least one module configured to implement the malicious program processing method described in the second aspect.

[0035] In a fifth aspect, a malicious traffic interception system is provided, which includes: a computer device and a protection device, wherein the computer device is located in a protected network protected by the protection device; the computer device is used to obtain a configuration file of the sample program when a sample program running in the computer device loads a network dynamic link library DLL and there is abnormal data in a target memory block; wherein the network DLL is used to support network communication of the application, the target memory block is the memory block where the running code for loading the network DLL in the sample program is located, the configuration file includes address information of a malicious server, and the malicious server is used to interact with the malicious program to control the malicious program to perform malicious operations on the computer device on which the malicious program is installed; the computer device is also used to send the address information of the malicious server to the protection device; the protection device is used to receive the address information of the malicious server sent by the computer device, and intercept traffic between the computer device and the malicious server based on the address information of the malicious server.

[0036] Optionally, the malicious traffic interception system further includes a server for providing security services. The computer device and / or protective device can send a sample program configuration file to the server, and the server is configured to receive the sample program configuration files sent from various sources and, based on the sample program configuration files, determine a malicious program profile corresponding to the sample program. Optionally, the server is further configured to provide a malicious program profile to a subscriber in accordance with a subscription requirement, wherein the subscription requirement refers to a need to obtain a malicious program profile, and the subscriber is a computer device that has such a subscription requirement.

[0037] In a sixth aspect, a malicious traffic interception system is provided, which includes: a computer device and a server, wherein the computer device is used to obtain a configuration file of the sample program when the sample program running in the computer device loads a network dynamic link library DLL and there is abnormal data in the target memory block; wherein the network DLL is used to support the application program to perform network communication, the target memory block is the memory block where the running code for loading the network DLL in the sample program is located, the configuration file includes the address information of the malicious server, and the malicious server is used to interact with the malicious program to control the malicious program to perform malicious operations on the computer device where the malicious program is installed; the computer device is also used to send the configuration file of the sample program to the server; the server is used to receive the configuration files of the sample program sent from various sources, and based on the configuration file of the sample program, determine the malicious program portrait corresponding to the sample program; the server is also used to provide the malicious program portrait to the subscriber according to the subscription demand, and the subscription demand refers to the demand for obtaining the malicious program portrait, and the subscriber is the computer device with the subscription demand.

[0038] Optionally, the malicious traffic interception system also includes a protection device, and the computer device is located in a protected network protected by the protection device; the computer device and / or server is also used to send the address information of the malicious server to the protection device; the protection device is used to receive the address information of the malicious server sent by the computer device, and intercept the traffic between the computer device and the malicious server based on the address information of the malicious server.

[0039] In a seventh aspect, a computer device is provided, comprising a processor and a memory, wherein the memory is configured to store a computer program for executing the method for processing malicious programs provided in the first aspect. The processor is configured to execute the computer program stored in the memory to implement the method for processing malicious programs described in the first aspect.

[0040] Optionally, the computer device may further include a communication bus, which is used to establish a connection between the processor and the memory.

[0041] In an eighth aspect, a computer-readable storage medium is provided, wherein the storage medium stores a computer program. When the computer program runs on a computer or a processor, the computer or the processor executes the steps of the malware processing method described in the first aspect, or executes the steps of the malware processing method described in the second aspect.

[0042] In a ninth aspect, a computer program product is provided, comprising computer instructions that, when executed on a computer or processor, cause the computer to execute the steps of the malware processing method described in the first aspect, or the steps of the malware processing method described in the second aspect. Alternatively, a computer program is provided that, when executed on a computer or processor, causes the computer or processor to execute the steps of the malware processing method described in the first aspect, or the steps of the malware processing method described in the second aspect.

[0043] The technical effects obtained in the above-mentioned second to ninth aspects are similar to the technical effects obtained by the corresponding technical means in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a schematic diagram of an implementation environment provided by an embodiment of the present application;

[0045] Figure 2 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present application;

[0046] Figure 3 This is a schematic diagram of the hardware structure of a protective device provided in an embodiment of the present application;

[0047] Figure 4 This is a flowchart of a method for processing malicious programs provided by an embodiment of the present application;

[0048] Figure 5 This is a flowchart of another method for processing malicious programs provided by an embodiment of the present application;

[0049] Figure 6 This is a schematic diagram of the structure of a malicious traffic interception system provided by an embodiment of the present application;

[0050] Figure 7 This is a schematic diagram of the structure of a malicious program processing device provided by an embodiment of the present application;

[0051] Figure 8 This is a structural diagram of another malicious program processing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0053] For ease of understanding, before explaining in detail the method for processing malicious programs provided in the embodiments of the present application, the nouns, application scenarios and implementation environments involved in the embodiments of the present application are first introduced.

[0054] First, the nouns involved in the embodiments of the present application are introduced.

[0055] Endpoint Detection and Response (EDR): EDR is a security solution used to protect computer devices. By deploying a specific software agent on a computer, it monitors and records various activities on the device in real time, including file operations, network communications, and process startups and shutdowns, enabling timely detection and response to potential security threats. EDR technology can quickly detect and respond to malicious code, network attacks, and other security incidents, improving network security.

[0056] Command and control (C2) system: The C2 system is used to remotely control infected computer devices or network devices. The attacker sends instructions to the infected device through the C2 system to control it to perform specific operations, such as transmitting data, executing malicious code, launching attacks, etc. The C2 system is usually implemented by the attacker implanting malicious programs or backdoor programs on the infected device, and communicating and controlling through the network connection established with the infected device. The C2 system can be used for various malicious activities, such as stealing sensitive information, launching distributed denial of service attacks, and spreading malicious programs. In the embodiments of the present application, the malicious program and the malicious server can be regarded as a C2 system. In some scenarios, the malicious server is also called a C2 server or CC server.

[0057] User-mode hooks: User-mode hooks run in user space and are used to monitor and modify the behavior of user-level applications, thereby changing program behavior and expanding functionality.

[0058] Inline hook: The normal application programming interface (API) function call process is for the caller (i.e., the process) to call the function in the loaded dynamic link library through the function name. The inline hook hijacks the function execution process by inserting a jump instruction in the header of the called function.

[0059] Import Address Table (IAT) hook: The IAT is a data structure that contains the addresses of imported functions used by applications at runtime. IAT hooking works by modifying function pointers in the IAT, redirecting the originally intended function to a custom function. This way, when the application executes, calling the hooked function actually executes the custom function. Using IAT hooking, you can intercept and modify application function calls to implement custom behaviors, such as logging, modifying function parameters, or return values.

[0060] Kernel-state hooking is a method for modifying and intercepting kernel events such as system calls, interrupts, and exceptions within the operating system kernel. By inserting a hook function into the kernel, kernel behavior can be modified or kernel events can be intercepted, thereby expanding or restricting certain operating system features. Kernel-state hooking operates at the lower-level hypervisor (Hypervisor) level. The Hypervisor is the infrastructure for virtual machine management, responsible for managing and coordinating the operation of virtual machines (VMs).

[0061] Dynamic link library (DLL): a function library that can be dynamically called by a program.

[0062] Shellcode: A piece of machine code executed to exploit program vulnerabilities, often used to launch malicious attacks on computer systems.

[0063] Processes and programs: Programs are static, while processes are dynamic. A program is binary code stored on some medium, and a process corresponds to the execution of a program. A process is a single execution of a program, and a process always corresponds to at least one specific program. A program can correspond to multiple processes, and the same program can run on different data sets, thus forming several different processes. Several processes can execute the same program code concurrently, while the same process can execute several programs sequentially.

[0064] Portable executable (PE) files are program files for Microsoft Windows operating systems. The basic structure of a PE file consists of a DOS header, a PE header, and a PE body. The DOS header is the first part of the PE header, consisting of the IMAGE_DOS_HEADER structure, typically 64 bytes in size. The PE header consists of a standard PE header (_IMAGE_FILE_HEADER) and an optional PE header (_IMAGE_OPTIONAL_HEADER).

[0065] User agent (UA): It is a special string header that enables the server to identify the client's operating system and version, CPU type, browser and version, browser rendering engine, browser language, browser plug-ins, etc.

[0066] CobaltStrike: A post-exploitation tool that uses a client / server (CS) architecture. To use it, you need to deploy the server first, then run the client. This tool is often used by attack teams as a team collaboration tool. Its workflow generally includes startup, configuration, monitoring, execution, going online, escalating privileges, information collection (network, credentials, location, etc.), and penetration. CobaltStrike itself is not a malicious program, but a powerful penetration tester. However, if used by an attacking organization for illegal purposes, it will become a malicious program.

[0067] Next, the application scenarios involved in the embodiments of this application are introduced.

[0068] Malicious programs are computer code or software that installs and runs on a user's computer or other terminal without explicit user notification or permission, and then engages in activities that infringe upon the user's legitimate rights and interests, such as stealing, encrypting, altering, and deleting data, and monitoring users. Examples include computer viruses, ransomware, keyloggers, password stealers, Word and Excel macro viruses, boot sector viruses, script viruses, Trojans, crimeware, spyware, and adware. With the rapid development of computers and the internet, various types of malicious programs have emerged in an endless stream, posing a serious threat to computer systems, network security, and user privacy.

[0069] At present, the executable file of a malicious program usually does not contain all functions or core malicious code, that is, the attacker implements advanced threats or fileless attacks. In this case, the attacker will not directly provide a malicious program that implements the malicious function, but will download and pull a fully functional encrypted malicious DLL from the network by running shellcode on the computer device, thereby performing malicious operations on the computer device through the encrypted malicious DLL. For example, in the first malicious scenario, the malicious program can decrypt the encrypted dynamic link library, then load the decrypted malicious DLL into the memory of the computer device and execute it to perform malicious operations on the computer device. The decrypted malicious DLL is the real malicious payload. In the second malicious scenario, the encrypted malicious DLL can be placed in a file on the hard disk, or the encrypted malicious DLL can be embedded in its own executable file. The malicious program can dynamically decrypt the malicious DLL at runtime and load the malicious DLL directly into the memory for execution to perform malicious operations on the computer device. In the third malicious scenario, the malicious program can inject the malicious DLL into a process trusted by the operating system for execution to perform malicious operations on the computer device.

[0070] Related malicious program detection technologies based on memory scanning can identify and deal with malicious programs by checking running processes and their memory usage. However, this technology can only identify the existence of a malicious program running in a computer device after the malicious DLL is loaded into the memory. In this case, the malicious program may have already performed malicious operations on the computer device. For example, the computer device has been maliciously controlled by an attacker, or the data in the computer device has been stolen. In this case, the user has already suffered losses. In addition, this technology requires scanning the entire memory area of ​​the computer device, which will result in a longer scanning process and lower efficiency. This method only determines whether there is a malicious program through memory scanning and cannot obtain information about the attacker behind the malicious program.

[0071] Based on this, an embodiment of the present application provides a method for handling malicious programs. Since applications typically load network DLLs for network communication, the embodiment of the present application can monitor in real time whether a sample program running in a computer device loads a network DLL to determine whether the sample program has engaged in network communication. If it is determined that the sample program has loaded a network DLL, it can further determine whether the sample program is a malicious program by determining whether there is abnormal data in the target memory block. Compared to related technologies that require scanning the entire memory area of ​​the computer device, since the target memory block is the memory block where the running code for loading the network DLL is located in the sample program, the time required to determine whether there is abnormal data in the target memory block is shorter and more efficient, which can further reduce the risk posed by malicious programs. If the sample program loads a network DLL and there is abnormal data in the target memory block, the sample program's configuration file can be obtained. Since the configuration file includes the address information of the malicious server, the sample program's configuration file can be obtained to facilitate interception of traffic between the computer device and the malicious server. In this way, communication between the computer device and the malicious server can be fundamentally intercepted, thereby preventing the computer device from being controlled by the malicious server or the internal data of the computer device from being stolen by the malicious server.

[0072] The execution subject of the malicious program processing method provided in the embodiments of the present application can be a processor in a computer device, or security software running in the computer device, and the embodiments of the present application are not limited to this. For ease of description, the following description of the malicious program processing method of the embodiments of the present application is based on the example of the execution subject being security software in a computer device.

[0073] In some embodiments, the computer device includes, but is not limited to, a server, a host, a personal computer, a mobile phone, or a workstation, and the security software may be, for example, EDR software. In the case where the computer device is a server, the server includes, but is not limited to, an application server or a web server. Application servers include, but are not limited to, game servers, video application servers, file servers, search engine servers, instant messaging servers, and the like. A web server is also known as a World Wide Web (WWW) server or website server.

[0074] Optionally, the computer device may be a terminal device installed with a Windows operating system, which includes but is not limited to Windows XP, Windows Server 2003, Windows 7, Windows 8 or Windows 10.

[0075] Next, the implementation environment involved in the embodiments of this application is introduced.

[0076] Please refer to Figure 1 , Figure 1 Schematic diagram of an implementation environment provided by an embodiment of the present application. The implementation environment includes a computer device 01. Security software in the computer device is capable of monitoring whether a sample program running on the computer device loads a network DLL. In response to monitoring that the sample program loads the network DLL, the security software determines whether abnormal data exists in a target memory block. If abnormal data exists in the target memory block, the configuration file of the sample program is obtained. The configuration file of the sample program includes address information of a malicious server 02. The malicious server 02 is used to interact with the malicious program to control the malicious program to perform malicious operations on the computer device on which the malicious program is installed. The address information of the malicious server is used to intercept traffic between the computer device 01 and the malicious server 02.

[0077] In some embodiments, the implementation environment further includes a protection device 03. The computer device 01 is located within a protected network protected by the protection device 03. The protection device 03 is deployed between an external network (such as the Internet) and the protected network. For example, the protection device 03 is typically deployed at the boundary of the protected network to protect the computer devices in the protected network from attacks from the external network. The protection device 03 can securely filter traffic entering and leaving the protected network, blocking malicious traffic to ensure the security of the computer devices in the protected network, while allowing normal traffic to pass, thereby ensuring that the computer devices in the protected network can communicate normally with normal servers and other devices in the external network.

[0078] Optionally, the protection device 03 includes, but is not limited to, an integration of one or more of a firewall, a security gateway (such as a router or switch), an intrusion detection system (IDS) device, an intrusion prevention system (IPS) device, a unified threat management (UTM) device, an AV device, an anti-distributed denial of service attack (anti-DDoS) device, and a next-generation firewall (NGFW). In some embodiments, the protection device 03 can be the same device as the computer device 01. In this case, the computer device 01 is deployed with protection software to implement the functions of the above-mentioned protection device.

[0079] In the embodiment of the present application, from the perspective of computer device 01, the protected network where computer device 01 is located is an internal network, and the Internet is an external network. In this case, after obtaining the configuration file of the sample program, the security software running in computer device 01 can send the address information of the malicious server to the protection device deployed between computer device 01 and malicious server 02. The protection device 03 can receive the address information of the malicious server sent by computer device 01, and then intercept the traffic between computer device 01 and malicious server 02 based on the address information of the malicious server (i.e., Figure 1 The traffic between the computer device 01 and the malicious server 02 includes the traffic sent by the computer device 01 to the malicious server 02 and the traffic sent by the malicious server 02 to the computer device 01.

[0080] Optionally, in some embodiments, the implementation environment further includes a server 04 for providing security services (to distinguish it from the malicious server 02, the server 04 will be referred to as the security server 04 in the following text). After obtaining the configuration file of the sample program, the security software running in the computer device 01 can send the configuration file of the sample program to the security server 04. The security server 04 can receive the configuration file of the sample program sent by the computer device 01 and then determine the malicious program profile corresponding to the sample program based on the configuration file of the sample program.

[0081] Those skilled in the art should understand that the above-mentioned computer equipment, protective equipment and security servers are only examples. Other existing or future computer equipment, protective equipment and security servers that are applicable to the embodiments of the present application should also be included in the scope of protection of the embodiments of the present application and are included here by reference.

[0082] It should be noted that the application scenarios, execution entities and implementation environments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Ordinary technicians in this field can know that with the emergence of new application scenarios and the evolution of technology and equipment, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0083] Please refer to Figure 2 , Figure 2 This is a schematic diagram of a computer device according to an embodiment of the present application. The computer device may be Figure 1 The computer device 01 shown in FIG. The computer device includes at least one processor 201 , a communication bus 202 , a memory 203 and at least one communication interface 204 .

[0084] The processor 201 may be a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, or one or more integrated circuits for implementing the solution of the present application, such as an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0085] The communication bus 202 is used to transmit information between the above components. The communication bus 202 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0086] The memory 203 may be a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), an optical disc (including a compact disc read-only memory (CD-ROM), a compact disc, a laser disc, a digital versatile disc, a Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 203 may exist independently and be connected to the processor 201 via the communication bus 202. The memory 203 may also be integrated with the processor 201.

[0087] The communication interface 204 uses any device, such as a transceiver, for communicating with other devices or communication networks. The communication interface 204 includes a wired communication interface and may also include a wireless communication interface. For example, the wired communication interface may be an Ethernet interface. The Ethernet interface may be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface may be a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof.

[0088] In a specific implementation, as an embodiment, the processor 201 may include one or more CPUs, such as Figure 2 CPU0 and CPU1 are shown in the figure.

[0089] In a specific implementation, as an embodiment, a computer device may include multiple processors, such as Figure 2 1 and 2. Each of these processors may be a single-core processor or a multi-core processor. A processor herein may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0090] In a specific implementation, as an embodiment, the computer device may further include an output device 206 and an input device 207. The output device 206 communicates with the processor 201 and can display information in a variety of ways. For example, the output device 206 can be a liquid crystal display (LCD), a light emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector. The input device 207 communicates with the processor 201 and can receive user input in a variety of ways. For example, the input device 207 can be a mouse, a keyboard, a touch screen device, or a sensor device.

[0091] In some embodiments, the memory 203 is used to store the program code 210 for executing the solution of the present application, and the processor 201 can execute the program code 210 stored in the memory 203. The program code 210 may include one or more software modules, and the computer device can implement the following by means of the processor 201 and the program code 210 in the memory 203. Figure 4 The embodiment provides a method for processing malicious programs.

[0092] Figure 3 This is a hardware structure diagram of a protective device provided in an embodiment of the present application. The protective device can be Figure 1 The protective equipment shown in 03. Figure 3As shown, the protection device includes a central processing unit (CPU) 301, a dedicated hardware chip 302, and at least one network interface 303. The CPU 301 and the dedicated hardware chip 302 may be collectively referred to as a processor.

[0093] The CPU 301 is a general-purpose central processing unit (CPU) with high scalability and flexibility. The CPU 301 is, for example, a single-core processor (single-CPU) or a multi-core processor (multi-CPU).

[0094] The dedicated hardware chip 302 is a high-performance processing hardware module and includes at least one of an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a network processor (NP).

[0095] At least one network interface 303 includes, for example, Figure 3 The network interface 303 is a network interface 1, a network interface 2, a network interface 3, ... a network interface n. The network interface 303 uses any transceiver or similar device for communicating with other devices. For example, Figure 3 The network interface 1 in communicates with the computer device, Figure 3 The network interface 2 in the embodiment communicates with the malicious server. Optionally, the network interface 303 includes at least one of a wired network interface and a wireless network interface. The wired network interface is, for example, an Ethernet interface. The Ethernet interface is, for example, an optical interface, an electrical interface, or a combination thereof. The wireless network interface is, for example, a wireless local area network (WLAN) interface, a cellular network interface, or a combination thereof.

[0096] At least one network interface 303 and the dedicated hardware chip 302, as well as the dedicated hardware chip 302 and the CPU 301, are connected via an internal connection 304. The internal connection 304 includes a path for transmitting data between the network interface 303, the dedicated hardware chip 302, and the CPU 301. Optionally, the internal connection 304 is a single board or a bus. For example, the internal connection 304 is Ethernet, fiber channel, PCI-E (Peripheral Component Interconnect Express, PCI Express, a high-speed serial computer bus), RapidIO (a high-performance, low-pin-count, packet-switching-based interconnect architecture), InfiniBand, or a XAUI bus (an interface extender characterized by connecting the Ethernet Media Access Control (MAC) layer to the physical layer).

[0097] Optionally, the protection device further includes a content addressable memory (CAM) 305. CAM 305 is, for example, a ternary content addressable memory (TCAM). CAM 305 is used, for example, to store network address information of malicious servers. Optionally, CAM 305 exists independently and is connected to dedicated hardware chip 302 via the aforementioned internal connection 304. Alternatively, CAM 305 and dedicated hardware chip 302 are integrated, i.e., CAM 305 functions as memory within dedicated hardware chip 302.

[0098] Optionally, the protection device further includes a memory 306. The memory 306 may be, for example, a ROM or other type of static storage device capable of storing static information and instructions, a RAM or other type of dynamic storage device capable of storing information and instructions, an EEPROM, a CD-ROM or other optical disk storage, an optical disk storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing the desired program code 308 in the form of instructions or data structures and accessible by a computer, but is not limited thereto. The memory 306 may be, for example, independent and connected to the CPU 301 via the internal connection 304. Alternatively, the memory 306 and the CPU 301 may be integrated together.

[0099] The memory 306 stores an operating system 307 and a program code 308. Optionally, the CPU 301 reads the operating system 307 from the memory 306 and runs the operating system 307. The CPU 301 also reads the program code 308 from the memory 306 and implements the method provided in the embodiment of the present application by running the program code 308 on the operating system 307. For example, the protective device is Figure 1 In the protection device 04 in the illustrated implementation scenario, the CPU 301 performs the following process while running the program code 308: receiving address information of a malicious server sent by a computer device, and intercepting traffic between the computer device and the malicious server based on the address information of the malicious server.

[0100] Optionally, the above-mentioned devices are respectively provided on independent chips, or at least partially or entirely provided on the same chip. Whether each device is provided independently on different chips or integrated on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation of the above-mentioned devices.

[0101] Figure 4 This is a flowchart of a method for processing malicious programs provided by an embodiment of the present application. Figure 4 , the method includes the following steps.

[0102] Step 401: Monitor whether a sample program running in a computer device has loaded a network dynamic link library DLL, which is used to support network communication of an application program.

[0103] It should be noted that the sample program in the embodiment of the present application refers to any application running on a computer device, such as a browser, office program or game program, etc., and the network dynamic link library includes one or more network connection functions.

[0104] In actual applications, whether the sample program sends data to the network side or receives data, it is necessary to load the network DLL and realize network communication through the network DLL. Therefore, the embodiment of the present application can accurately determine whether the sample program will send data or receive data through the network by monitoring whether the sample program loads the network DLL.

[0105] Optionally, the network dynamic link library is a library file (DLL file) that the operating system of the computer device carries. Of course, in actual application, the sample program can also carry a network dynamic link library.

[0106] By way of example, the network dynamic link library includes but is not limited to ws2_32.dll, dnsapi.dll, Winhttp.dll or urlmon.dll.

[0107] In some embodiments, the computer device uses hook technology to monitor whether the running sample program loads the network DLL. In this case, the security software uses a hook function to hook the dynamic library loading function in the operating system of the computer device to monitor whether the sample program loads the network DLL. The dynamic library loading function is used to load the network DLL.

[0108] Optionally, the hook function hooks an application programming interface (API) that calls a dynamic library loading function, so that the hook function can monitor the behavior of the sample program calling the dynamic library loading function to load the network dynamic link library.

[0109] The dynamic library loading function is a function in a DLL (different from a network DLL) that comes with the operating system of the computer device. The dynamic link library loading function is used to load a DLL, for example, to load a network DLL.

[0110] For example, the dynamic library loading function includes but is not limited to the LoadLibrary function or the LdrLoadDll function.

[0111] In some embodiments, the hook function is a user-state hook function in the sample program. In this case, the security software can inject the user-state hook function into the sample program after the sample program is started, and monitor the sample program through the user-state hook function to determine whether the sample program loads the network DLL.

[0112] Optionally, the user-mode hook includes but is not limited to an inline hook or an IAT hook.

[0113] In other embodiments, the hook function is a kernel-state hook function in the kernel of the computer device. In this case, the security software can inject the kernel-state hook function into the kernel of the computer device and monitor the computer device through the kernel-state hook function to determine whether the sample program loads the network DLL.

[0114] Optionally, the kernel-mode hook includes but is not limited to an MSR hook or an EPT hook.

[0115] It should be noted that the detailed implementation of injecting the user-mode hook function into the sample program and the kernel-mode hook function into the kernel of the computer device can be found in the relevant hook technology and will not be described in detail here.

[0116] Optionally, before monitoring whether the sample program calls the network connection function, the security software can also monitor the startup operation of the program in the computer device, that is, the security software can also monitor whether a new program is started in the computer device. If the security software determines that a new program is started in the computer device, the newly started program is used as the sample program and the step of monitoring whether the sample program running in the computer device loads the network DLL is executed.

[0117] For example, there are many ways to monitor program startup operations in a computer device, such as kernel-level (i.e., kernel-mode) monitoring and user-space (user-mode) monitoring. Kernel-level monitoring refers to monitoring system calls, process creation, and other operations at the operating system kernel level through hook technology or driver programs to capture newly started programs on the system and record related information. User-space monitoring refers to obtaining information about new programs in user space by monitoring the operating system's event logs, process tables, API calls, and other methods to monitor newly started programs on the operating system. This is not limited in the embodiments of the present application.

[0118] Since the embodiment of the present application starts monitoring the network communication behavior of the sample program at the beginning of the sample program startup, malicious operations of the sample program can be discovered in a timely manner, reducing the security risks of computer equipment.

[0119] Step 402: In response to monitoring that the sample program loads the network DLL, determine whether abnormal data exists in a target memory block, where the abnormal data includes at least one of a format header and a file header of a portable executable PE file. The target memory block is a memory block where the running code for loading the network DLL in the sample program is located.

[0120] It should be noted that the format header refers to the DOS header of the PE file, and the file header refers to the standard PE header (_IMAGE_FILE_HEADER) in the PE header of the PE file.

[0121] Since the format header and file header of a normal application's PE file are read-only, the code segment of a normal application's PE file is readable and executable, and the permissions of the same memory block in a computer device are the same, when a normal application is running in memory, the format header and file header of the PE file can be loaded into the same memory block, and the code segment will be loaded into another memory block. In other words, the format header and code segment of the PE file are located in different memory blocks, and the file header and code segment of the PE file are located in different memory blocks, so that the format header and code segment of the PE file have different read and write permissions. However, when a PE file with malicious functions (such as shellcode or malicious DLL) is running in the memory of a computer device, the PE file with malicious functions is usually loaded in its entirety into the same memory block. Therefore, it is possible to determine whether the PE file with malicious functions has been loaded into memory for execution by determining whether the memory block where the running code is located also contains the format header and / or file header of the PE file. Since the memory block where the running code is located necessarily includes the code segment of the PE file, if the memory block also contains the format header of the PE file, it means that the memory block contains a complete PE file.

[0122] If the target memory block contains no abnormal data, the code used to load the network dynamic link library in the target memory block is normal code. Therefore, the security software does not interfere with the network communication behavior of the sample program. If the target memory block contains abnormal data, it indicates that the code used to load the network dynamic link library in the target memory block is malicious code in a PE file with malicious functions. Therefore, the security software needs to process the malware to reduce security risks. For specific implementation methods, see step 403 below.

[0123] Optionally, when abnormal data exists in the target memory block, the security software can also determine that the sample program is a malicious program.

[0124] If there is abnormal data in the target memory block, it means that the running code used to load the network DLL in the target memory block is malicious code in a PE file with malicious functions. Therefore, it can be determined that the sample program is a malicious program.

[0125] Optionally, after determining that the sample program is a malicious program, the security software can also display a prompt interface, where the prompt interface is used to prompt the user that the sample program is a malicious program.

[0126] In some embodiments, if there is no abnormal data in the target memory block, it is determined that the sample program is not a malicious program.

[0127] If there is no abnormal data in the target memory block, it means that the running code for loading the network DLL in the target memory block is normal code. Therefore, it can be determined that the sample program is not a malicious program.

[0128] Optionally, when abnormal data exists in the target memory block, the security software can also suspend the execution of the sample program.

[0129] Since malicious programs usually interact with malicious servers through the network, if the sample program loads the network DLL, it means that the sample program is about to send or receive data through the network. If there is abnormal data in the target memory block, it means that the sample program is a malicious program and poses a security risk. Therefore, when it is determined that the sample program contains abnormal data, the security software can avoid security risks by pausing the running of the sample program.

[0130] Step 403: If abnormal data exists in the target memory block, a configuration file of the sample program is obtained. The configuration file includes address information of a malicious server. The malicious server is used to interact with the malicious program to control the malicious program to perform malicious operations on the computer device on which the malicious program is installed. The address information of the malicious server is used to intercept traffic between the computer device and the malicious server.

[0131] If the target memory block contains abnormal data, the code used to load the network dynamic link library in the target memory block is malicious code from a PE file with malicious functions. In this case, the target memory block usually stores the configuration file of a sample program to facilitate communication between the malicious program and the malicious server. Therefore, the security software can obtain the configuration file of the sample program when the target memory block contains abnormal data.

[0132] In some embodiments, data in a target memory block can be matched with a malicious feature of at least one malicious program. If target data matching the malicious feature of a target malicious program exists in the target memory block, a configuration file of a sample program is obtained from the target memory block based on the position of the target data in the target memory block and file location indication information of the target malicious program. The target malicious program is one of the at least one malicious programs. The file location indication information of the target malicious program is used to describe the position offset in memory between the configuration file of the target malicious program and the malicious feature of the target malicious program. The malicious feature characterizes the location of the configuration file of the malicious program in the target memory block.

[0133] Optionally, the security software stores at least one malicious program's malicious signature and file location information for each of the at least one malicious program, where the file location information describes the offset between the malicious program's configuration file and the malicious signature in memory. In this case, the security software can match the data in the target memory block with the malicious signature of the at least one malicious program.

[0134] There are many ways to match the data in the target memory block with the malicious features of at least one malicious program. In practical applications, this can be achieved through matching algorithms such as binary matching and regular expressions, which is not limited in the embodiments of the present application.

[0135] Optionally, the malicious feature of the malicious program is a hexadecimal character string. The file location indication information is also used to describe the size of the configuration file of the malicious program.

[0136] If the target memory block contains target data that matches the malicious features of the target malicious program, the position of the target data in the target memory block is used as the starting point. According to the position offset between the configuration file of the malicious program and the malicious features of the target malicious program in the memory, the starting position of the configuration file of the sample program in the target memory block is determined. Then, based on the starting position of the configuration file of the sample program in the target memory block and the size of the configuration file of the target malicious program, the configuration file of the sample program is obtained from the target memory block.

[0137] For example, the at least one malicious program includes CobaltStrike, and the malicious signature of CobaltStrike is a hexadecimal string, namely, \x69\x68\x69\x68\x69. The file location indication information of CobaltStrike describes the position immediately following the string as the starting position of the sample program's configuration file in the target memory block, and also describes the size of the CobaltStrike configuration file. If target data matching the malicious signature of CobaltStrike, namely, the string "\x69\x68\x69\x68\x69," exists in the target memory block, the security software can determine the position immediately following the string as the starting position of the sample program's configuration file in the target memory block. Based on the starting position of the sample program's configuration file in the target memory block and the size of the CobaltStrike configuration file, the security software can retrieve the sample program's configuration file from the target memory block.

[0138] In actual applications, malicious programs may encrypt their configuration files to prevent the leakage of their own information. In this case, the security software retrieves the encrypted sample program configuration file from the target memory block. The security software then needs to decrypt the encrypted sample program configuration file to obtain the decrypted sample program configuration file. In this case, the security software also stores configuration file decryption information for each of the at least one malicious program. This configuration file decryption information describes the decryption method for the malicious program configuration file. The security software can decrypt the sample program configuration file based on the configuration file decryption information of the target malicious program.

[0139] Still taking the above-mentioned CobaltStrike as an example, the decryption information of the CobaltStrike configuration file is XOR decrypted with 0x69. In this case, if the target memory block contains target data that matches the malicious characteristics of CobaltStrike, and the security software obtains the configuration file of the sample program from the target memory block, it can XOR the encrypted configuration file of the sample program with 0x69 to achieve decryption of the encrypted configuration file of the sample program.

[0140] In some embodiments, the configuration file of the sample program includes at least one of the following: address information of the malicious server corresponding to the sample program, UA information of the sample program, injection method of the sample program, and process into which the sample program is injected.

[0141] Optionally, the injection method of the sample program includes structured query language (SQL) injection, command injection, etc., which is not limited in the embodiment of the present application.

[0142] For example, the configuration file of the sample program may include the following:

[0143] C2Server:stygga.castle.local, / c / msdownload / update / others / 2016 / 12 / 29136388_

[0144] UserAgent:Windows-Update-Agent / 10.0.10011.16384Client-Protocol / 1.40

[0145] Injection Process:'0[? 5? i? o? q↑? JD

[0146] ProcInject_AllocationMethod:VirtualAllocEx

[0147] C2Server:stygga.castle.local, / c / msdownload / update / others / 2016 / 12 / 29136388_ indicates the address of the malicious server corresponding to the sample program is stygga.castle.local, / c / msdownload / update / others / 2016 / 12 / 29136388_. UserAgent:Windows-Update-Agent / 10.0.10011.16384Client-Protoco1 / 1.40 indicates that the UA information of the sample program is Windows version 10.0.10011.16384, and the client uses protocol version 1.40. Injection Process:'0[? 5? i? o? q↑? JD' indicates that the process injected by the sample program is '0[? 5? i? o? q↑? JD', which is encrypted information. ProcInject_AllocationMethod:VirtualAllocEx indicates the injection method of the sample program. VirtualAllocEx is a Windows API function that is used to allocate memory for the target process. The allocated memory may be used to store the code, data, or other resources to be injected.

[0148] Optionally, after obtaining the configuration file of the sample program, the security software can send the address information of the malicious server to a protection device deployed between the computer device and the malicious server, so that the protection device intercepts the traffic between the computer device and the malicious server, or intercepts the traffic from the malicious server and / or the traffic sent to the malicious server.

[0149] That is to say, after obtaining the address of the malicious server corresponding to the sample program, the security software can also link the protection device to intercept the traffic between the computer device and the malicious server, thereby fundamentally preventing the malicious behavior of the malicious server and improving the security performance of the computer device. When the protection device intercepts the traffic from the malicious server and / or the traffic sent to the malicious server, it can prevent the computer devices in the protected network from being subjected to malicious operations. The embodiment of the present application realizes the global ban of the attacker's control facilities by linking the computer device with the protection device, thereby protecting all computer devices in the protected network from remote attacks by the attacker.

[0150] Optionally, after obtaining the configuration file of the sample program, the security software can release the memory resources allocated for the sample program to terminate the running of the sample program.

[0151] Since malicious programs can pose a security threat to computer devices, if the sample program is determined to be a malicious program, the security software can terminate the running of the sample program to further reduce the risk of information leakage of the computer device and ensure the security of the computer device.

[0152] Optionally, after obtaining the configuration file of the sample program, the security software can send the configuration file of the sample program to a server for providing security services (i.e., a security server) so that the server can determine a malicious program portrait corresponding to the sample program, and the malicious program portrait includes at least one of the following: address information of the malicious server corresponding to the malicious program, user agent UA information of the malicious program, injection method of the malicious program, and process into which the malicious program is injected.

[0153] In actual applications, malicious programs may be deployed on multiple computer devices. In this case, the malicious server corresponding to the malicious program may perform malicious operations on multiple computer devices. Therefore, after obtaining the configuration file of the sample program, the security software can also link with the security server to profile the malicious program to enrich the information of the attack organization behind the malicious program, making it easier for enterprises and individuals to prevent and respond to malicious attacks from the attack organization.

[0154] Since applications typically load network DLLs for network communication, embodiments of the present application can monitor in real time whether a sample program running in a computer device loads a network DLL to determine whether the sample program has engaged in network communication. If it is determined that the sample program has loaded a network DLL, it can further determine whether the sample program is a malicious program by determining whether there is abnormal data in the target memory block. Compared to related technologies that require scanning the entire memory area of ​​the computer device, since the target memory block is the memory block where the running code for loading the network DLL is located in the sample program, the time required to determine whether there is abnormal data in the target memory block is shorter and more efficient, further reducing the risk posed by malicious programs. If the sample program loads a network DLL and there is abnormal data in the target memory block, the sample program's configuration file can be obtained. Since the configuration file includes the address information of the malicious server, the sample program's configuration file can be obtained to facilitate interception of traffic between the computer device and the malicious server. This can fundamentally intercept communication between the computer device and the malicious server, thereby preventing the computer device from being controlled by the malicious server or the internal data of the computer device from being stolen by the malicious server.

[0155] Furthermore, because the embodiments of the present application monitor the network communication behavior of the sample program from the moment it is launched, malicious operations of the sample program can be promptly detected, reducing security risks to the computer device. Since malicious programs typically interact with malicious servers over the network, if the sample program loads a network DLL, it indicates that the sample program is about to send or receive data over the network. If abnormal data is present in the target memory block, it indicates that the sample program is malicious and poses a security risk. Therefore, upon determining that the sample program contains abnormal data, the security software can avoid security risks by pausing the sample program.

[0156] After obtaining the address of the malicious server corresponding to the sample program, the security software can also work with the protection device to intercept the traffic between the computer device and the malicious server, thereby fundamentally preventing the malicious behavior of the malicious server and improving the security performance of the computer device. When the protection device intercepts the traffic from and / or to the malicious server, it can prevent the computer devices within the protected network from performing malicious operations. This application achieves a global ban on the attacker's control facilities by linking the computer device with the protection device, thereby protecting all computer devices within the protected network from remote attacks by the attacker. Since malicious programs pose a security threat to computer devices, if the sample program is determined to be malicious, the security software can terminate the sample program to further reduce the risk of computer device information leakage and ensure the security of the computer device. In actual applications, malicious programs may be deployed on multiple computer devices. In this case, the malicious server corresponding to the malicious program may perform malicious operations on multiple computer devices. Therefore, after obtaining the configuration file of the sample program, the security software can also work with the security server to profile the malicious program to enrich the information of the attack organization behind the malicious program, making it easier for enterprises and individuals to prevent and respond to malicious attacks from the attack organization.

[0157] This application embodiment also provides another method for processing malware, please refer to Figure 5 , the method includes the following steps.

[0158] Step 501: Monitor whether the sample program running in the computer device has loaded a network dynamic link library DLL, which is used to support the application program to perform network communication. The detailed implementation process is referred to the corresponding content in the above embodiments and will not be repeated here.

[0159] Step 502: In response to monitoring that the sample program loads the network DLL, a determination is made as to whether abnormal data exists in a target memory block. The abnormal data includes at least one of a format header and a file header of a portable executable (PE) file. The target memory block is the memory block where the execution code for loading the network DLL in the sample program is located. The detailed implementation process is described in the above embodiments and will not be repeated here.

[0160] Step 503: If abnormal data exists in the target memory block, the sample program is terminated.

[0161] Optionally, the security software can release the memory resources allocated for the sample program to terminate the running of the sample program.

[0162] Since malicious programs can pose a security threat to computer devices, if the sample program is determined to be a malicious program, the security software can terminate the running of the sample program to further reduce information leakage of the computer device and ensure the security of the computer device.

[0163] It should be noted that the difference between the malware processing method provided by steps 501-503 and the malware processing method provided by 401-403 above is that the malware processing method provided by steps 501-503 can directly terminate the operation of the sample when it is determined that there is abnormal data in the target memory block, that is, when it is determined that the sample program is a malicious program, so as to end the malicious behavior of the malicious program from the source. In this way, the computer device can process the malicious program without relying on protective equipment, thereby effectively improving the security performance of the computer device.

[0164] Next, the malicious traffic interception system provided by the embodiment of the present application is introduced. The malicious traffic interception system includes a computer device, and optionally, the malicious traffic interception system also includes at least one of a protection device and a server (i.e., a security server), wherein the computer device is located within a protected network protected by the protection device.

[0165] For example, the structure of the malicious traffic interception system is as follows: Figure 6 As shown, the computer device is used to obtain the configuration file of the sample program when the sample program running in the computer device loads the network dynamic link library DLL and there is abnormal data in the target memory block; the network DLL is used to support the application program to perform network communication, the target memory block is the memory block where the running code for loading the network DLL in the sample program is located, and the configuration file includes the address information of the malicious server, which is used to interact with the malicious program to control the malicious program to perform malicious operations on the computer device where the malicious program is installed; the computer device is also used to send the address information of the malicious server to the protection device.

[0166] The protection device is used to receive the address information of a malicious server sent by a computer device, and intercept malicious traffic based on the address information of the malicious server, where the malicious traffic refers to the traffic between the computer device and the malicious server, or to intercept traffic from the malicious server and / or traffic to the malicious server based on the address information of the malicious server.

[0167] In the case where the malicious traffic interception system includes a server (i.e., a security server), the computer device and / or the protection device can send a configuration file of the sample program to the security server ( Figure 6 (The example uses a computer device sending a sample program configuration file to a security server as an example.) The security server can receive sample program configuration files from various sources and, based on the sample program configuration files, determine a malware profile corresponding to the sample program. Optionally, the security server can also provide malware profiles to subscribers based on subscription requirements. Subscription requirements refer to requests for malware profiles, and subscribers are computer devices that have subscribed to such requirements.

[0168] Figure 7 This is a schematic diagram of the structure of a malicious program processing device provided by an embodiment of the present application. The malicious program processing device can be implemented as part or all of a computer device by software, hardware, or a combination of both. Figure 7 The device includes: a monitoring module 701, a judgment module 702 and an acquisition module 703.

[0169] The monitoring module 701 is used to monitor whether the sample program running in the computer device has loaded the network dynamic link library DLL, which is used to support the application program to perform network communication. The detailed implementation process is referred to the corresponding content of the above embodiments and will not be repeated here.

[0170] Determination module 702 is configured to, in response to monitoring the sample program loading the network DLL, determine whether abnormal data exists in a target memory block, the abnormal data comprising at least one of a format header and a file header of a portable executable (PE) file. The target memory block is the memory block where the execution code for loading the network DLL in the sample program is located. The detailed implementation process is described in the corresponding embodiments above and will not be repeated here.

[0171] Acquisition module 703 is configured to obtain a configuration file of the sample program if abnormal data is present in the target memory block. This configuration file includes the address information of a malicious server. The malicious server is used to interact with the malicious program to control the malicious program to perform malicious operations on the computer device on which the malicious program is installed. The address information of the malicious server is used to intercept traffic between the computer device and the malicious server. The detailed implementation process is referred to the corresponding content in the above embodiments and will not be repeated here.

[0172] Optionally, the monitoring module 701 is specifically configured to:

[0173] The dynamic library loading function in the operating system of the computer device is hooked by a hook function to monitor whether the sample program loads the network DLL. The dynamic library loading function is used to load the network DLL.

[0174] Optionally, the hook function is a user-mode hook function in the sample program, which is injected into the sample program after the sample program is started; or, the hook function is a kernel-mode hook function in the kernel of the computer device.

[0175] Optionally, the acquisition module 703 is specifically configured to:

[0176] matching data in the target memory block with a malicious signature of at least one malicious program;

[0177] If target data matching the malicious features of the target malicious program exists in the target memory block, a configuration file of the sample program is obtained from the target memory block based on the position of the target data in the target memory block and file location indication information of the target malicious program, where the target malicious program is one of the at least one malicious program, and the file location indication information of the target malicious program is used to describe the position offset in memory between the configuration file of the target malicious program and the malicious features of the target malicious program.

[0178] Optionally, the device further comprises:

[0179] The first sending module is used to send the address information of the malicious server to a protection device deployed between the computer device and the malicious server, so that the protection device intercepts the traffic between the computer device and the malicious server.

[0180] Optionally, the device further comprises:

[0181] The pause module is used to pause the running of the sample program.

[0182] Optionally, the device further comprises:

[0183] The termination module is used to release the memory resources allocated for the sample program to terminate the running of the sample program.

[0184] Optionally, the device further comprises:

[0185] The second sending module is used to send the configuration file of the sample program to the server so that the server can determine the malicious program portrait corresponding to the sample program. The malicious program portrait includes at least one of the following: the address information of the malicious server corresponding to the malicious program, the user agent UA information of the malicious program, the injection method of the malicious program, and the process into which the malicious program is injected.

[0186] Optionally, the device is security software running in a computer device.

[0187] Since applications typically load network DLLs for network communication, embodiments of the present application can monitor in real time whether a sample program running in a computer device loads a network DLL to determine whether the sample program has engaged in network communication. If it is determined that the sample program has loaded a network DLL, it can further determine whether the sample program is a malicious program by determining whether there is abnormal data in the target memory block. Compared to related technologies that require scanning the entire memory area of ​​the computer device, since the target memory block is the memory block where the running code for loading the network DLL is located in the sample program, the time required to determine whether there is abnormal data in the target memory block is shorter and more efficient, further reducing the risk posed by malicious programs. If the sample program loads a network DLL and there is abnormal data in the target memory block, the sample program's configuration file can be obtained. Since the configuration file includes the address information of the malicious server, the sample program's configuration file can be obtained to facilitate interception of traffic between the computer device and the malicious server. This can fundamentally intercept communication between the computer device and the malicious server, thereby preventing the computer device from being controlled by the malicious server or the internal data of the computer device from being stolen by the malicious server.

[0188] Furthermore, because the embodiments of the present application monitor the network communication behavior of the sample program from the moment it is launched, malicious operations of the sample program can be promptly detected, reducing security risks to the computer device. Since malicious programs typically interact with malicious servers over the network, if the sample program loads a network DLL, it indicates that the sample program is about to send or receive data over the network. If abnormal data is present in the target memory block, it indicates that the sample program is malicious and poses a security risk. Therefore, upon determining that the sample program contains abnormal data, the security software can avoid security risks by pausing the sample program.

[0189] After obtaining the address of the malicious server corresponding to the sample program, the security software can also work with the protection device to intercept the traffic between the computer device and the malicious server, thereby fundamentally preventing the malicious behavior of the malicious server and improving the security performance of the computer device. When the protection device intercepts the traffic from and / or to the malicious server, it can prevent the computer devices within the protected network from performing malicious operations. This application achieves a global ban on the attacker's control facilities by linking the computer device with the protection device, thereby protecting all computer devices within the protected network from remote attacks by the attacker. Since malicious programs pose a security threat to computer devices, if the sample program is determined to be malicious, the security software can terminate the sample program to further reduce the risk of computer device information leakage and ensure the security of the computer device. In actual applications, malicious programs may be deployed on multiple computer devices. In this case, the malicious server corresponding to the malicious program may perform malicious operations on multiple computer devices. Therefore, after obtaining the configuration file of the sample program, the security software can also work with the security server to profile the malicious program to enrich the information of the attack organization behind the malicious program, making it easier for enterprises and individuals to prevent and respond to malicious attacks from the attack organization.

[0190] It should be noted that the malware processing device provided in the above embodiments uses the division of the functional modules described above as an example for illustrative purposes only. In actual applications, the functions described above can be assigned to different functional modules as needed, i.e., the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. Furthermore, the malware processing device provided in the above embodiments and the malware processing method embodiment are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0191] Figure 8 This is a schematic diagram of the structure of another malicious program processing device provided by an embodiment of the present application. The malicious program processing device can be implemented as part or all of a computer device by software, hardware, or a combination of both. Figure 8 The device includes: a monitoring module 801, a judgment module 802 and a termination module 803.

[0192] The monitoring module 801 is used to monitor whether the sample program running in the computer device has loaded the network dynamic link library DLL, which is used to support the application program to perform network communication. The detailed implementation process is referred to the corresponding content of each embodiment above and will not be repeated here.

[0193] Determination module 802 is configured to, in response to monitoring the sample program loading the network DLL, determine whether abnormal data exists in a target memory block, the abnormal data comprising at least one of a format header and a file header of a portable executable (PE) file. The target memory block is the memory block where the execution code for loading the network DLL in the sample program is located. The detailed implementation process is described in the corresponding sections of the aforementioned embodiments and will not be further elaborated here.

[0194] The termination module 803 is used to terminate the sample program if abnormal data exists in the target memory block. The detailed implementation process is referred to the corresponding content of each embodiment above and will not be repeated here.

[0195] If the sample program is determined to be a malicious program, the running of the sample is directly terminated to end the malicious behavior of the malicious program from the source. In this way, the computer device can handle the malicious program without relying on protective equipment, thereby effectively improving the security performance of the computer device.

[0196] It should be noted that the malware processing device provided in the above embodiments uses the division of the functional modules described above as an example for illustrative purposes only. In actual applications, the functions described above can be assigned to different functional modules as needed, i.e., the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. Furthermore, the malware processing device provided in the above embodiments and the malware processing method embodiment are based on the same concept. The specific implementation process is detailed in the method embodiment and will not be repeated here.

[0197] An embodiment of the present application further provides a computer-readable storage medium, wherein the storage medium stores instructions. When the instructions are executed on a computer or a processor, the computer or the processor executes the steps of the malware processing method described in the above embodiment.

[0198] The present application also provides a computer program product comprising instructions that, when executed on a computer or processor, cause the computer or processor to execute the steps of the malware processing method described in the above embodiments. Alternatively, the present application also provides a computer program that, when executed on a computer or processor, causes the computer or processor to execute the steps of the malware processing method described in the above embodiments.

[0199] In the above embodiments, all or part of the embodiments can be implemented by software, hardware, firmware, or any combination thereof. When implemented using software, all or part of the embodiments can be implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) method. The computer-readable storage medium can be any available medium that can be accessed by a computer, or a data storage device such as a server or data center that includes one or more available media integrated therein. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, or a magnetic tape), an optical medium (e.g., a digital versatile disc (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)). It is worth noting that the computer-readable storage medium mentioned in the embodiments of the present application may be a non-volatile storage medium, in other words, a non-transient storage medium.

[0200] It should be understood that the "plurality" mentioned herein refers to two or more. In the description of the embodiments of the present application, unless otherwise specified, " / " means or, for example, A / B can mean A or B; "and / or" in this article is merely a description of the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in order to facilitate a clear description of the technical solutions of the embodiments of the present application, in the embodiments of the present application, words such as "first" and "second" are used to distinguish between identical or similar items with substantially the same functions and effects. Those skilled in the art will understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit them to be different.

[0201] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.), and signals involved in the embodiments of this application are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data must comply with the relevant laws, regulations, and standards of the relevant countries and regions. For example, the configuration files of the sample programs involved in the embodiments of this application were obtained with full authorization.

[0202] The above description is an embodiment provided for this application and is not intended to limit this application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of this application should be included in the scope of protection of this application.

Claims

1. A method for processing malicious programs, characterized in that: The method comprises: Monitoring whether a sample program running in a computer device loads a network dynamic link library (DLL), wherein the network DLL is used to support network communication of the application program; In response to monitoring that the sample program loads the network DLL, determining whether there is abnormal data in a target memory block, the abnormal data comprising at least one of a format header and a file header of a portable executable (PE) file, the target memory block being a memory block where the running code for loading the network DLL in the sample program is located; If the abnormal data exists in the target memory block, a configuration file of the sample program is obtained, where the configuration file includes address information of a malicious server. The malicious server is used to interact with the malicious program to control the malicious program to perform malicious operations on the computer device on which the malicious program is installed. The address information of the malicious server is used to intercept traffic between the computer device and the malicious server.

2. The method according to claim 1, wherein The monitoring of whether the sample program running in the computer device is a network DLL includes: The dynamic library loading function in the operating system of the computer device is hooked by a hook function to monitor whether the sample program loads the network DLL, and the dynamic library loading function is used to load the network DLL.

3. The method according to claim 2, wherein The hook function is a user-mode hook function in the sample program, and the hook function is injected into the sample program after the sample program is started; or, the hook function is a kernel-mode hook function in the kernel of the computer device.

4. The method according to any one of claims 1 to 3, wherein The obtaining of the configuration file of the sample program includes: matching the data in the target memory block with a malicious feature of at least one malicious program; If target data matching the malicious features of the target malicious program exists in the target memory block, the configuration file of the sample program is obtained from the target memory block based on the position of the target data in the target memory block and the file location indication information of the target malicious program, where the target malicious program is one of the at least one malicious program, and the file location indication information of the target malicious program is used to describe the position offset in the memory between the configuration file of the target malicious program and the malicious features of the target malicious program.

5. The method according to any one of claims 1 to 4, characterized in that After obtaining the configuration file of the sample program, the method further includes: The address information of the malicious server is sent to a protection device deployed between the computer device and the malicious server, so that the protection device intercepts traffic between the computer device and the malicious server.

6. The method according to any one of claims 1 to 5, wherein: In the case where the abnormal data exists in the target memory block, the method further includes: Pause the execution of the sample program.

7. The method according to any one of claims 1 to 6, wherein: After obtaining the configuration file of the sample program, the method further includes: The memory resources allocated for the sample program are released to terminate the running of the sample program.

8. The method according to any one of claims 1 to 7, wherein: After obtaining the configuration file of the sample program, the method further includes: The configuration file of the sample program is sent to the server so that the server determines the malicious program portrait corresponding to the sample program, and the malicious program portrait includes at least one of the following: the address information of the malicious server corresponding to the malicious program, the user agent UA information of the malicious program, the injection method of the malicious program, and the process into which the malicious program is injected.

9. The method according to claims 1 to 8, characterized in that The method is executed by security software running in the computer device.

10. A method for processing malicious programs, characterized in that: The method comprises: Monitoring whether a sample program running in a computer device loads a network dynamic link library (DLL), wherein the network DLL is used to support network communication of the application program; In response to monitoring that the sample program loads the network DLL, determining whether there is abnormal data in a target memory block, the abnormal data comprising at least one of a format header and a file header of a portable executable (PE) file, the target memory block being a memory block where the running code for loading the network DLL in the sample program is located; If the abnormal data exists in the target memory block, the running of the sample program is terminated.

11. A device for processing malicious programs, characterized in that: The device comprises: A monitoring module, used to monitor whether the sample program running in the computer device loads a network dynamic link library DLL, wherein the network DLL is used to support the application program to perform network communication; a determination module configured to determine, in response to monitoring that the sample program loads the network DLL, whether abnormal data exists in a target memory block, the abnormal data comprising at least one of a format header and a file header of a portable executable PE file, the target memory block being a memory block where a running code for loading the network DLL in the sample program is located; An acquisition module is configured to obtain a configuration file of the sample program if the abnormal data exists in the target memory block, wherein the configuration file includes address information of a malicious server, wherein the malicious server is configured to interact with the malicious program to control the malicious program to perform malicious operations on a computer device on which the malicious program is installed, and wherein the address information of the malicious server is configured to intercept traffic between the computer device and the malicious server.

12. A malicious program processing device, characterized in that: The device comprises: A monitoring module, used to monitor whether the sample program running in the computer device loads a network dynamic link library DLL, wherein the network DLL is used to support the application program to perform network communication; a determination module configured to determine, in response to monitoring that the sample program loads the network DLL, whether abnormal data exists in a target memory block, the abnormal data comprising at least one of a format header and a file header of a portable executable PE file, the target memory block being a memory block where a running code for loading the network DLL in the sample program is located; A termination module is configured to terminate the execution of the sample program if the abnormal data exists in the target memory block.

13. A computer device, characterized in that: The computer device includes a memory and a processor; The memory is used to store computer programs; The processor is configured to execute the computer program to implement the steps of the method according to any one of claims 1 to 9, or to implement the steps of the method according to claim 10.

14. A malicious traffic interception system, characterized in that: include: Computer equipment and a protective device, the computer equipment being located within a protected network protected by the protective device; The computer device is used to obtain a configuration file of the sample program when the sample program running in the computer device loads a network dynamic link library DLL and abnormal data exists in the target memory block; The network DLL is used to support network communication of the application program, the target memory block is the memory block in the sample program where the running code for loading the network DLL is located, and the configuration file includes address information of a malicious server, which is used to interact with the malicious program to control the malicious program to perform malicious operations on the computer device on which the malicious program is installed; The computer device is further configured to send the address information of the malicious server to the protection device; The protection device is used to receive the address information of the malicious server sent by the computer device, and intercept the traffic between the computer device and the malicious server based on the address information of the malicious server.

15. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when run on a computer or a processor, enables the computer or the processor to execute the method according to any one of claims 1 to 9, or the method according to claim 10.

16. A computer program product, characterized in that The computer program product comprises computer instructions, and when the computer instructions are executed by a computer or a processor, the steps of the method according to any one of claims 1 to 9 are performed, or the steps of the method according to claim 10 are performed.

Images