Attack detection method and device, electronic equipment and storage medium
By detecting modifications to the memory attributes of ETW functions and obtaining function call stack information, combined with memory monitoring and security lists, the problem of detecting ETW bypass attacks has been solved, achieving efficient attack identification and alerting.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-09
- Publication Date
- 2026-03-27
AI Technical Summary
Existing technologies cannot effectively detect malicious attackers bypassing ETW monitoring by modifying ETW function instruction code in memory, which compromises the observation capabilities of security products and makes it impossible to detect advanced persistent threats and ransomware attacks in a timely manner.
By detecting changes in the memory attributes of the target event tracking function, function call stack information is obtained, and the call stack depth and path are analyzed. Combined with memory monitoring and security lists, abnormal behavior is identified to detect ETW bypass attacks.
It achieves accurate detection of ETW bypass attacks, reduces false positives and false negatives, and improves system security and detection efficiency.
Smart Images
Figure CN121744302A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of network security, and particularly relates to an attack detection method and device, electronic equipment and a storage medium. BACKGROUND
[0002] Event Tracing for Windows (ETW) is a high-efficiency event tracing mechanism provided by the Windows operating system kernel. It has become the core data source of modern terminal detection and response systems, anti-virus software and security information and event management solutions. By subscribing to the kernel and user state event streams provided by ETW, security products can monitor various behaviors of the system in near real time, including but not limited to process creation, network connection, file operation, registry modification and dynamic code loading.
[0003] However, the widespread adoption of ETW also makes it the primary bypass target for malicious attackers. Among them, memory patching is a particularly common and effective technique. Attackers modify the instruction code of key ETW functions in memory to disable them, thereby preventing the recording of security-related events. This attack directly undermines the observation capabilities of security products, allowing advanced persistent threats and ransomware attacks to hide in the system, but existing technical solutions cannot accurately detect this attack. SUMMARY
[0004] The present application provides an attack detection method, device, electronic equipment and storage medium to solve the defects in the prior art.
[0005] The present application provides an attack detection method, comprising: If a modification to the memory attribute of a target event tracing function is detected, it is detected whether there is an intersection between the memory region corresponding to the modified memory attribute and the function address range of the target event tracing function; If there is an intersection, the function call stack information triggering the modification is obtained; Attack detection is performed based on the function call stack information.
[0006] According to the attack detection method provided by the present application, the attack detection based on the function call stack information comprises: It is detected whether the caller corresponding to the function call stack information exists in a security whitelist; If not, the call stack depth and call path in the function call stack information are extracted; Attack detection is performed based on the call stack depth and the call path.
[0007] According to the attack detection method provided by the application, the attack detection is based on the call stack depth and the call path, and the method comprises the following steps of: detecting whether the call stack depth reaches a preset depth threshold value and detecting whether the call path represents direct calling; if the call stack depth does not reach the preset depth threshold value or the call path represents direct calling, it is determined that an attack is received.
[0008] According to the attack detection method provided by the application, before detecting whether the memory region corresponding to the modified memory attribute and the function address range of the target event tracking function exist intersection, the method comprises the following steps of: dynamically obtaining the base address and length range of the target event tracking function in the memory, and determining the function address range based on the base address and the length range; registering memory monitoring, and triggering a callback event when the target event tracking function detects modification of the memory attribute of the target event tracking function through the memory monitoring.
[0009] According to the attack detection method provided by the application, the function call stack information triggering the modification is obtained, and the method comprises the following steps of: obtaining the monitoring type of the memory monitoring; determining a call stack acquisition strategy based on the monitoring type; acquiring the function call stack information based on the call stack acquisition strategy.
[0010] According to the attack detection method provided by the application, the memory monitoring is registered, and the method comprises the following steps of: registering the memory monitoring through API Hook or ETW event log.
[0011] According to the attack detection method provided by the application, after the attack detection based on the function call stack information, the method further comprises the following steps of: if it is determined that there is an attack based on the function call stack information, generating security alarm information.
[0012] The application also provides an attack detection device, which comprises: a detection module configured to detect whether the memory region corresponding to the modified memory attribute and the function address range of the target event tracking function exist intersection if modification of the memory attribute of the target event tracking function is detected; an acquisition module configured to acquire the function call stack information triggering the modification if there is intersection; an attack detection module configured to perform attack detection based on the function call stack information.
[0013] The application further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the attack detection method according to any one of the above when executing the computer program.
[0014] The application further provides a non-transitory computer readable storage medium, which stores a computer program, wherein the computer program is executed by a processor to implement the attack detection method according to any one of the above.
[0015] The application further provides a computer program product, comprising a computer program, wherein the computer program is executed by a processor to implement the attack detection method according to any one of the above.
[0016] The attack detection method, device, electronic device and storage medium provided by the application, if the modification of the memory attribute of the target event tracking function is detected, whether the memory region corresponding to the modified memory attribute and the function address range of the target event tracking function exist intersection is detected. On the basis that the memory region corresponding to the modified memory attribute and the function address range of the target event tracking function exist intersection, further attack detection is performed based on the function call stack information triggering the modification. Through the technical scheme provided by the application, the modification of the memory region of the target event tracking function is combined with the function call stack information triggering the modification, so as to realize accurate detection of ETW bypass attack based on memory patching mode. BRIEF DESCRIPTION OF DRAWINGS
[0017] In order to more clearly illustrate the technical solutions of the present application or prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.
[0018] Figure 1 is a flowchart of the attack detection method provided by the application.
[0019] Figure 2 is a structural schematic diagram of the attack detection device provided by the application.
[0020] Figure 3 is a structural schematic diagram of the electronic device provided by the application. DETAILED DESCRIPTION
[0021] In order to make the objects, technical solutions and advantages of the present application clearer, the technical solutions in the present application will be described clearly and completely below in combination with the drawings in the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present application.
[0022] ETW allows monitoring, capturing and analyzing events generated by operating systems and applications in user mode and kernel mode. Existing detection of attack behaviors bypassing ETW is usually the following two schemes, one is the periodic ETW key API (Application Programming Interface, Application Programming Interface) memory code, such as EtwEventWrite, and the code of the corresponding API file in the disk is compared, if the code is inconsistent, it can be determined that there is ETW Patch, and there may be a situation of bypassing ETW monitoring by memory patching. ETW Patch is a common countermeasure technology that disables event tracking by modifying ETW-related function instructions in memory. Its main goal is to interfere with the normal function of security software (such as EDR) that relies on ETW for threat detection. The other scheme is that the security product monitors the key functions of memory operations to monitor and review all possible tampering with memory attributes, and modifies the related calls.
[0023] Both schemes have their own shortcomings. Specifically, frequent scanning of memory consumes CPU resources, affects system performance, and reducing the scanning frequency may result in attack gaps. Attackers can complete the attack and restore the scene in a very short time, which may restore the memory after the attack is completed, resulting in failure to detect etw bypass behavior. Although monitoring the modification of memory attributes can identify the modification of sensitive API memory, it may not be able to detect in some special scenarios, such as modifying the attributes of the entire memory page and then modifying the API memory. Since many antivirus software only detect whether the start address of the modified memory attribute is consistent with the first address of the API, it is easy to bypass such detection. At the same time, there may be multiple security products in the system, which will hook the same function, making it difficult for the detection logic to distinguish between legitimate hooks and malicious patches, which may cause false detection.
[0024] Therefore, based on the above defects, the present application provides an attack detection method, device, electronic equipment and storage medium. Figure 1 is a flowchart of an attack detection method according to an exemplary embodiment. As shown in Figure 1 the attack detection method includes steps 110-130, which are described in detail as follows.
[0025] Step 110, if the modification of the memory attribute of the target event tracking function is detected, detecting whether the memory region corresponding to the modified memory attribute and the function address range of the target event tracking function exist intersection.
[0026] In the embodiment of the present application, the target event tracking functions that need to be protected are defined in advance, for example, EtwEventWrite, EtwEventWriteFull, EtwEventWriteTransfer (located in ntdll.dll), and.NET ETW related functions (located in clr.dll or coreclr.dll).
[0027] The target event tracking functions are monitored, and once the behavior of modifying the memory attribute of the target ETW is monitored, the memory region corresponding to the modified memory attribute and the function address range of the target event tracking function are immediately detected for intersection, and if there is intersection, further detection is required.
[0028] Step 120, if there is intersection, obtaining the function call stack information triggering the modification.
[0029] In the embodiment of the present application, when the memory region corresponding to the modified memory attribute and the function address range of the target event tracking function are detected to exist intersection, the function call stack information triggering the modification is obtained.
[0030] The call stack is a key data structure used to manage function calls in the program execution process. The call stack dynamically manages function calls by pushing and popping stacks. When a function is called, the system creates a new stack frame for it and pushes the stack frame to the top of the call stack. This new stack frame becomes the current active stack frame. If another function is called inside the current function, the system will pause the execution of the current function, create a stack frame for the new function call and push it to the top of the stack. The execution right is transferred to the new function. When a function is executed, its stack frame is popped from the top of the call stack, and the system restores to the next instruction of the function call to continue execution according to the return address saved in the stack frame. Therefore, the function call stack information records the related information triggering the modification of the memory attribute.
[0031] Step 130, based on the function call stack information, attack detection is performed.
[0032] In the embodiment of the present application, based on the function call stack information, it is further determined whether it is attacked.
[0033] In the embodiment of the present application, if the modification of the memory attribute of the target event tracking function is detected, it is detected whether the memory region corresponding to the modified memory attribute and the function address range of the target event tracking function exist intersection. On the basis that the memory region corresponding to the modified memory attribute and the function address range of the target event tracking function exist intersection, further attack detection is performed based on the function call stack information triggering the modification. Through the technical scheme provided by the present application, the modification of the memory region of the target event tracking function is monitored and combined with the function call stack information triggering the modification, so that the ETW bypass attack based on the memory patching mode is accurately detected.
[0034] In an exemplary embodiment of the present application, the attack detection based on the function call stack information comprises: detecting whether the caller corresponding to the function call stack information exists in a security list; if not, extracting the call stack depth and the call path in the function call stack information; performing attack detection based on the call stack depth and the call path.
[0035] In the embodiment of the present application, when it is detected that the memory region corresponding to the modified memory attribute and the function address range of the target event tracking function exist intersection, further attack detection is performed based on the function call stack information. The captured function call stack information is analyzed, and the key features of the caller are extracted to judge and identify its legitimacy, such as the caller of some security software should be considered normal, which is not ETW bypass behavior.
[0036] Specifically, the security list is pre-configured, and the security list records a plurality of software modules authenticated as safe. After obtaining the function call stack information, it is checked whether the known, legitimate security software module (for example, LHShield64.dll.dll), operating system module or authenticated debugger module exists in the function call stack information, such as the following function call stack information: c:\\windows\\system32\\ntdll.dll:NtProtectVirtualMemory+0xA; c:\\windows\\system32\\kernelbase.dll:VirtualProtect+0xc0; c:\\windows\\system32\\LHShield64.dll+0xc0010; From the above stack, it can be seen that the caller of VirtualProtect is LHShield64.dll, which is a security module of a known antivirus software, so it can be determined that the modification behavior is not a sensitive behavior, and is not an ETW bypass behavior.
[0037] Therefore, when it is detected that the caller corresponding to the function call stack information does not exist in the security whitelist, the call stack depth and the call path in the function call stack information are further extracted, the call stack depth represents the number of current active stack frames in the call stack when the program is executed, that is, the nesting level of function calls, and the call path represents the complete route map or context relationship of program execution, and whether an attack is received is detected based on the call stack depth and the call path.
[0038] In an example embodiment of the present application, the attack detection based on the call stack depth and the call path comprises: detecting whether the call stack depth reaches a preset depth threshold, and detecting whether the call path represents direct calling; if the call stack depth does not reach the preset depth threshold or the call path represents direct calling, it is determined that an attack is received.
[0039] In the embodiment of the present application, if it is determined that the caller corresponding to the function call stack information does not exist in the security whitelist, the call stack depth and the call path are further analyzed. Malicious memory patching is usually directly called by an attack payload system API or through a very short call chain, such as the following call stack: c:\\windows\\system32\\ntdll.dll:NtProtectVirtualMemory+0xA; 0x7fef7811e83(); In the above function call stack information, the API directly calls NtProtectVirtualMemory through non-module memory (0x7fef7811e83), instead of using the Microsoft public function VirtualProtect to modify the memory attribute, so it can be considered that the behavior is suspicious.
[0040] Therefore, whether the call stack depth reaches a preset depth threshold is detected, and whether the call path represents direct calling is detected, if the call stack depth does not reach the preset depth threshold or the call path represents direct calling, it is determined that an attack is received, and if the call stack depth reaches the preset depth threshold and the call path does not represent direct calling, other features are further extracted for joint detection.
[0041] In an example embodiment of the present application, before the detecting whether the memory region corresponding to the modified memory attribute intersects with the function address range of the target event tracking function, the method comprises: dynamically obtaining a base address and a length range of the target event tracking function in memory, and determining the function address range based on the base address and the length range; registering memory monitoring, and triggering a callback event when the target event tracking function is detected by the memory monitoring to have a modification on the memory attribute of the target event tracking function.
[0042] In an example embodiment of the present application, when the system is started or a module is loaded, the base address and the length range of the target event tracking function in memory are dynamically obtained. This ensures that the target event tracking function can be accurately located regardless of how the system is updated or how the module is randomized. The base address is the starting address of the ETW function when it is loaded in memory, which is an absolute address representing the location of the target event tracking function in memory. The base address can be regarded as the logical starting point of the target event tracking function, and all internal addresses relative to the target event tracking function are calculated relative to the base address. The length range is the data length of the target event tracking function, and the function address range of the target event tracking function is determined based on the determined base address and length range.
[0043] Registering memory monitoring, the memory attribute of the target event tracking function is monitored. When any thread attempts to modify these memory attributes, a callback event will be triggered immediately, and when the callback event is received, it can be confirmed that there is a modification on the memory attribute of the target event tracking function.
[0044] In an example embodiment of the present application, the function call stack information triggered by the modification is obtained, comprising: obtaining a monitoring type of the memory monitoring; determining a call stack acquisition strategy based on the monitoring type; obtaining the function call stack information based on the call stack acquisition strategy.
[0045] In an example embodiment of the present application, there are different call stack acquisition strategies based on different monitoring types. For example, if the monitoring type is API Hook, the corresponding call stack acquisition strategy can be set to pass through the StackWalk64 function. If the monitoring type is ETW event log, the corresponding call stack acquisition strategy can be set to set EVENT_ENABLE_PROPERTY_STACK_TRACE to obtain the function call stack information when ETW is enabled.
[0046] The StackWalk64 function of the application layer can dynamically analyze the runtime memory state (such as the stack pointer ESP / EBP, the instruction pointer EIP) of the current process and a specific thread, and it can reconstruct the call history by traversing the linked list structure formed by the stack frame, and highly depends on the symbol file (PDB) to convert the address into a human-readable function name. Based on its strong flexibility, a security product can immediately capture the call stack of the relevant thread for deep analysis when it suspects that a piece of code behaves abnormally (for example, after a memory allocation operation, the memory is immediately attempted to be executed).
[0047] When the ETW tracing session is enabled, the EVENT_ENABLE_PROPERTY_STACK_TRACE attribute is set, indicating that the ETW framework automatically captures and attaches the call stack information generated at the moment when a specific event (such as a specific system call event) is recorded. This provides valuable context association, and it can be known which module or code path triggered the monitored operation. The call stack information is usually captured uniformly by the ETW infrastructure. By setting different call stack acquisition strategies, the function call stack information can be accurately acquired under the corresponding monitoring type.
[0048] In an exemplary embodiment of the present application, the registered memory monitoring includes: The memory monitoring is registered through API Hook or ETW event log.
[0049] In the embodiment of the present application, the memory monitoring can be registered by using the application layer API Hook or subscribing to the ETW event log, and the memory attribute of the aforementioned target event tracking function is monitored.
[0050] The application layer API Hook and the subscription to the ETW event log are two very important system monitoring and behavior analysis technologies in the Windows environment. They provide powerful capabilities for observing and intervening in program behavior from different dimensions.
[0051] The core idea of the application layer API Hook is to hijack the normal execution flow of the program. There are mainly the following implementation methods: IAT Hook: By modifying the import address table of the executable file, the address of the target API in the table is replaced with the address of the custom function. When the program calls the API, it will actually jump to your function; Inline Hook: More direct and powerful, by modifying the first few bytes of the target API function in memory, a jump instruction is written to make it jump directly to the custom function. After the custom function is executed, it jumps back to the original API to continue execution; Message Hook: By using the SetWindowsHookEx API provided by Windows, you can listen to and intercept Windows messages (such as keyboard and mouse messages) sent to a specific thread or all threads.
[0052] The ETW framework consists of three core components: event providers, controllers, and consumers. Providers are the sources of events, such as the Windows kernel, DNS server,.NET runtime, etc. They emit events containing specific information. Controllers: responsible for starting or closing event tracing sessions. Consumers: applications or tools (such as Filebeat) that subscribe to event providers of interest. When the provider emits an event, the consumer receives the event data and processes it. For example, you can configure the ETW input of Filebeat to subscribe to the Microsoft-Windows-Kernel-Network provider to capture detailed network connection events.
[0053] In an example embodiment of the present application, after the attack detection based on the function call stack information, the method further comprises: If an attack is determined to exist based on the function call stack information, a security alert information is generated.
[0054] In the embodiment of the present application, when it is determined that an attack exists based on the function call stack information, a security alert information is generated, and the security alert information is displayed on a preset display page.
[0055] The security alert information can be obtained based on the function call stack information. For example, if the caller corresponding to the function call stack information does not exist in the security whitelist, it is determined that an attack exists, and the caller is recorded in the security alert information. In addition, the security whitelist can also be recorded in the security alert information. If the attack is determined to exist based on the call path, the call path is recorded in the security alert information. If the attack is determined to exist based on the call stack depth, the call stack depth is recorded in the security alert information, so that relevant personnel can understand the specific situation and perform manual verification.
[0056] In the embodiment of the present application, after it is determined that there is no attack, the modification operation and the subsequent operation are allowed to continue to be executed.
[0057] The attack detection device provided by the present application is described below. The attack detection device described below can be referred to in conjunction with the attack detection method described above. It should be noted that the device provided in the following embodiments belongs to the same concept as the method provided in the above embodiments, and the specific manner in which each module and unit performs operations has been described in detail in the method embodiments, which will not be described here.
[0058] In an example embodiment of the present application, please refer toFigure 2 , Figure 2 An attack detection apparatus is shown according to an example embodiment, comprising the following modules.
[0059] The detection module 210 is configured to detect whether a memory region corresponding to a modified memory attribute of a target event tracking function intersects with a function address range of the target event tracking function if the modification of the memory attribute of the target event tracking function is detected. The acquisition module 220 is configured to acquire function call stack information triggering the modification if there is an intersection. The attack detection module 230 is configured to perform attack detection based on the function call stack information.
[0060] In an example embodiment of the present application, the attack detection module 230 comprises: The detection submodule is configured to detect whether a caller corresponding to the function call stack information exists in a security whitelist. The extraction submodule is configured to extract a call stack depth and a call path in the function call stack information if not. The attack detection submodule is configured to perform attack detection based on the call stack depth and the call path.
[0061] In an example embodiment of the present application, the attack detection submodule comprises: The detection unit is configured to detect whether the call stack depth reaches a preset depth threshold, and detect whether the call path represents a direct call. The determination unit is configured to determine that an attack is received if the call stack depth does not reach the preset depth threshold or the call path represents a direct call.
[0062] In an example embodiment of the present application, the attack detection apparatus further comprises: The dynamic acquisition module is configured to dynamically acquire a base address and a length range of the target event tracking function in memory, and determine the function address range based on the base address and the length range. The registration module is configured to register a memory monitor, and trigger a callback event when the target event tracking function is detected by the memory monitor to modify the memory attribute of the target event tracking function.
[0063] In an example embodiment of the present application, the acquisition module 220 comprises: The first acquisition submodule is configured to acquire a monitoring type of the memory monitor. The determination submodule is configured to determine a call stack acquisition strategy based on the monitoring type. A second obtaining sub-module, configured to obtain the function call stack information based on the call stack obtaining strategy.
[0064] In an example embodiment of the present application, the registration module comprises: A registration sub-module, configured to register the memory monitoring through API Hook or ETW event log.
[0065] In an example embodiment of the present application, the attack detection device further comprises: A generation module, configured to generate a security alarm information if it is determined that there is an attack based on the function call stack information.
[0066] Figure 3 An example of an entity structure diagram of an electronic device is shown in Figure 3 As shown, the electronic device can include a processor 310, a communications interface 320, a memory 330 and a communications bus 340, wherein the processor 310, the communications interface 320 and the memory 330 complete mutual communication through the communications bus 340. The processor 310 can call logical instructions in the memory 330 to execute an attack detection method, which comprises: if a modification of a memory attribute of a target event tracking function is detected, detecting whether there is an intersection between a memory region corresponding to the modified memory attribute and a function address range of the target event tracking function; if there is an intersection, obtaining function call stack information triggering the modification; performing attack detection based on the function call stack information.
[0067] In addition, the logical instructions in the memory 330 described above can be implemented in the form of a software functional unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium, includes a number of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.
[0068] In another aspect, the present application also provides a computer program product comprising a computer program, the computer program being stored in a non-transitory computer-readable storage medium, and the computer program being executable by a processor to cause a computer to perform the attack detection method provided by any of the above methods, the method comprising: if a modification to a memory attribute of a target event tracking function is detected, detecting whether a memory region corresponding to the modified memory attribute and a function address range of the target event tracking function have an intersection; if the intersection exists, obtaining function call stack information triggering the modification; performing attack detection based on the function call stack information.
[0069] In another aspect, the present application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, the computer program being executable by a processor to cause a computer to perform the attack detection method provided by any of the above methods, the method comprising: if a modification to a memory attribute of a target event tracking function is detected, detecting whether a memory region corresponding to the modified memory attribute and a function address range of the target event tracking function have an intersection; if the intersection exists, obtaining function call stack information triggering the modification; performing attack detection based on the function call stack information.
[0070] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., they can be located in one place, or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment according to actual needs. Those skilled in the art can understand and implement it without creative labor.
[0071] From the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be realized by means of software plus a necessary general hardware platform, or by hardware. Based on such understanding, the above technical solutions, essentially or in terms of the contribution to the prior art, can be embodied in the form of a software product. The computer software product can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.
[0072] It should be pointed out finally that the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit the same; and although the present application has been described in detail with reference to the foregoing embodiments, it should be appreciated by those skilled in the art that the technical solutions recorded in the foregoing embodiments can be modified, or some technical features thereof can be replaced equivalently; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.
Claims
1. An attack detection method, characterized in that, include: If a modification to the memory attributes of the target event tracking function is detected, check whether there is an intersection between the memory region corresponding to the modified memory attribute and the function address range of the target event tracking function; If an intersection exists, obtain the function call stack information that triggered the modification; Attack detection is performed based on the function call stack information.
2. The attack detection method according to claim 1, characterized in that, The attack detection based on the function call stack information includes: Check whether the caller corresponding to the function call stack information is in the security list; If it does not exist, extract the call stack depth and call path from the function call stack information; Attack detection is performed based on the call stack depth and the call path.
3. The attack detection method according to claim 2, characterized in that, The attack detection based on the call stack depth and the call path includes: Detect whether the call stack depth has reached a preset depth threshold, and detect whether the call path represents a direct call; If the call stack depth does not reach the preset depth threshold or the call path represents a direct call, then an attack is determined to have occurred.
4. The attack detection method according to claim 1, characterized in that, Before detecting whether the memory region corresponding to the modified memory attribute intersects with the function address range of the target event tracking function, the process includes: The base address and length range of the target event tracking function in memory are dynamically obtained, and the function address range is determined based on the base address and the length range; Register a memory monitor, and trigger a callback event when the memory monitor detects a modification to the memory properties of the target event tracking function.
5. The attack detection method according to claim 4, characterized in that, The step of obtaining the function call stack information that triggered the modification includes: Obtain the monitoring type of the memory monitoring; Determine the call stack retrieval strategy based on the monitoring type; Based on the aforementioned call stack retrieval strategy, the function call stack information is obtained.
6. The attack detection method according to claim 4, characterized in that, The registered memory monitoring includes: Register the memory monitoring via API Hook or ETW event log.
7. The attack detection method according to any one of claims 1 to 6, characterized in that, After performing attack detection based on the function call stack information, the method further includes: If an attack is determined to exist based on the function call stack information, a security alert is generated.
8. An attack detection device, characterized in that, The above includes: The detection module is configured to, if a modification to the memory attributes of the target event tracking function is detected, detect whether there is an intersection between the memory region corresponding to the modified memory attribute and the function address range of the target event tracking function; The acquisition module is configured to acquire the function call stack information that triggered the modification if an intersection exists; The attack detection module is configured to perform attack detection based on the function call stack information.
9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the attack detection method as described in any one of claims 1 to 7.
10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the attack detection method as described in any one of claims 1 to 7.