Method, device and equipment for identifying shellcode malicious code

Abstract

Embodiments of the present application provide a Shellcode malicious code identification method, device and equipment. The Shellcode malicious code identification method comprises: in response to a key event triggered by a process to be processed, obtaining at least one return address information corresponding to the key event, wherein the key event is an event related to a system call operation; determining a memory address loading set used for analyzing and processing the at least one return address information; when there is return address information not located in the memory address loading set, determining that the process to be processed has a shellcode code; scanning a memory region corresponding to the shellcode code to obtain a Shellcode malicious code identification result, and the identification result is used to identify whether the process to be processed includes the Shellcode malicious code.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, apparatus, and device for identifying shellcode malicious code. Background Technology

[0002] Shellcode is a short, concise piece of code, often used as part of an attack payload. It is designed to execute directly in memory on the attacked computer to bypass security measures and perform specific malicious tasks, such as privilege escalation, opening backdoors, or executing other malicious instructions.

[0003] Currently, Endpoint Detection and Response (EDR) is often implemented by periodically performing static scanning and analysis of files on the disk. While this method is effective in preventing many known threats, its effectiveness is often significantly reduced when facing attacks with highly customized, strongly encrypted, and remotely loaded shellcode malware. Summary of the Invention

[0004] This invention provides a method, apparatus, and device for identifying shellcode malicious code, which can accurately and efficiently identify shellcode malicious code, improving the timeliness and accuracy of detection.

[0005] In a first aspect, embodiments of the present invention provide a method for identifying shellcode malicious code, comprising:

[0006] In response to a critical event triggered by a process to be processed, at least one return address information corresponding to the critical event is obtained, wherein the critical event is an event related to a system call operation;

[0007] Determine the memory address loading set used for analyzing and processing the at least one return address information;

[0008] When the returned address information is not located in the memory address loading set, it is determined that the process to be processed contains shellcode.

[0009] The memory region corresponding to the shellcode is scanned to obtain the identification result of the shellcode malicious code. The identification result is used to identify whether the process to be processed contains shellcode malicious code.

[0010] Secondly, embodiments of the present invention provide a shellcode malicious code identification device, comprising:

[0011] The first acquisition module is used to acquire at least one return address information corresponding to a key event triggered by the process to be processed, in response to the key event triggered by the process to be processed. The key event is an event related to system call operation.

[0012] The first determining module is used to determine the memory address loading set for analyzing and processing the at least one return address information;

[0013] The first determining module is further configured to determine that the process to be processed contains shellcode when the return address information is not located in the memory address loading set;

[0014] The first processing module is used to scan the memory region corresponding to the shellcode to obtain the identification result of the shellcode malicious code. The identification result is used to identify whether the process to be processed contains shellcode malicious code.

[0015] Thirdly, embodiments of the present invention provide an electronic device, including: a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein when the one or more computer instructions are executed by the processor, the shellcode malicious code identification method described in the first aspect is implemented.

[0016] Fourthly, embodiments of the present invention provide a computer storage medium for storing a computer program, wherein the computer program enables the Shellcode malicious code identification method described in the first aspect to be implemented when the computer is executed.

[0017] Fifthly, embodiments of the present invention provide a computer program product, comprising: a computer-readable storage medium storing computer instructions, wherein when the computer instructions are executed by one or more processors, the one or more processors cause the one or more processors to perform the steps in the shellcode malicious code identification method described in the first aspect above.

[0018] The shellcode malicious code identification method, apparatus, and device provided in this embodiment of the invention respond to a critical event triggered by a process to be processed. By acquiring at least one return address information corresponding to the critical event, a memory address loading set for analyzing and processing the at least one return address information is determined. When there is a return address information not located in the memory address loading set, it can be determined that the process to be processed contains shellcode. Then, the memory region corresponding to the shellcode is further scanned to obtain the shellcode malicious code identification result. This effectively realizes that when a critical event is triggered, an accurate identification operation for whether the process to be processed contains shellcode malicious code is immediately initiated, avoiding the problem of detection blind spots when detecting shellcode malicious code. In addition, since the identification method in this embodiment only scans the memory region corresponding to the shellcode and does not need to scan other memory regions, it can effectively reduce resource consumption and improve the timeliness of shellcode malicious code detection when facing attack scenarios with highly customized, strongly encrypted, and remotely loaded shellcode, thus further improving the practicality of the method. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 A schematic diagram illustrating a scenario for a shellcode malicious code identification method provided in an embodiment of the present invention;

[0021] Figure 2 A flowchart illustrating a method for identifying shellcode malware provided in an embodiment of the present invention;

[0022] Figure 3 A schematic diagram illustrating the determination of a memory address loading set for analyzing and processing the at least one return address information, provided in an embodiment of the present invention;

[0023] Figure 4 A flowchart illustrating another method for identifying Shellcode malware provided in an embodiment of the present invention;

[0024] Figure 5A schematic diagram of the structure of a shellcode malicious code identification device provided in an embodiment of the present invention;

[0025] Figure 6 To and Figure 5 A schematic diagram of the electronic device corresponding to the Shellcode malicious code identification device provided in the embodiment;

[0026] Figure 7 This is a schematic diagram of the structure of a terminal detection device provided in an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise; “multiple” generally includes at least two, but does not exclude the inclusion of at least one.

[0029] It should be understood that the term "and / or" used in this document is merely a description of the relationship between associated devices, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " in this document generally indicates that the preceding and following associated devices are in an "or" relationship.

[0030] Depending on the context, the words “if” or “suppose” as used here can be interpreted as “when” or “in response to determination” or “in response to detection.” Similarly, depending on the context, the phrases “if determination” or “if detection (of the stated condition or event)” can be interpreted as “when determination” or “in response to determination” or “when detection (of the stated condition or event)” or “in response to detection (of the stated condition or event).”

[0031] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a product or system comprising a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a product or system. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the product or system that includes that element.

[0032] Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0033] Terminology Explanation:

[0034] Endpoint Detection and Response (EDR) is a network security technology used to continuously detect endpoint activity, detect suspicious behavior, and respond to security incidents, including investigation, containment, and remediation.

[0035] Shellcode is a short, concise piece of code, often used as part of an attack payload. It is designed to execute directly in memory on the attacked computer to bypass security measures and perform specific malicious tasks, such as privilege escalation, opening backdoors, or executing other malicious instructions.

[0036] Dynamic Link Library (DLL) is a file type in operating systems used to store code and data that can be used by multiple programs simultaneously.

[0037] To facilitate understanding of the specific implementation process and effects of the Shellcode malicious code identification method, apparatus, and device in this embodiment, the relevant technologies are briefly described below:

[0038] With the rapid development of network technology, the current network security attack and defense confrontation is becoming increasingly fierce, and attackers frequently use covert techniques to evade traditional security defense systems. Among them, dynamically loading and executing malicious code in memory using shellcode has become a common advanced attack method. This type of attack starts a seemingly harmless process, but secretly downloads shellcode from a remote server and executes it in memory, thereby bypassing static detection by security software such as endpoint detection and EDR.

[0039] Currently, most EDR solutions on the market focus on static analysis of the file system and runtime behavior detection. While these methods are highly effective in preventing many known threats, their performance is often significantly reduced when facing highly customized, strongly encrypted attacks and remotely loaded shellcode, because EDR technology does not detect memory regions. Specifically, the main drawbacks of these solutions include:

[0040] There are blind spots in detection: EDR periodically performs static scanning and analysis of files on the disk. Although some detection products have real-time detection capabilities, they are not quick enough to detect dynamically loaded shellcode malicious code, especially when the shellcode malicious code appears briefly at a specific time and is quickly executed and then self-destructs, which can easily cause blind spots in detection.

[0041] Memory scan evasion: Traditional memory scanning strategies may be executed at times other than when shellcode is executed, meaning the memory scan time does not overlap with the shellcode execution time, resulting in a time misalignment. This allows attackers to evade detection by modifying memory page attributes to be non-executable or by using other memory evasion techniques, thus reducing the effectiveness of detection.

[0042] To address the aforementioned technical problems, embodiments of the present invention provide a method, apparatus, and device for identifying shellcode malicious code, wherein, with reference to the appendix... Figure 1 As shown, the execution entity of the shellcode malware identification method is the shellcode malware identification device 200. This device 200 can be communicatively connected to a client 100 to provide shellcode malware identification services to users. When the shellcode malware identification device 200 is implemented as a cloud server, the identification method can be executed in the cloud. Several computing nodes (cloud servers) can be deployed in the cloud, each with computing and storage resources. In the cloud, multiple computing nodes can be organized to provide a certain service; conversely, a single computing node can provide one or more services. The cloud can provide this service through an external service interface, which users can call to use the corresponding service. Service interfaces include Software Development Kits (SDKs) and Application Programming Interfaces (APIs).

[0043] Specifically, the client 100, which communicates with the shellcode malware identification device 200, can be a mobile phone, personal computer (PC), tablet computer, configuration application, wearable device, etc. Furthermore, the basic structure of the client 100 may include multiple processors. The number of processors depends on the configuration and type of the client 100. The client 100 may also include memory, which can be volatile, such as Random Access Memory (RAM), or non-volatile, such as Read-Only Memory (ROM), flash memory, etc., or both types. The memory typically stores the operating system (OS), one or more applications, and may also store program data. In addition to the processing unit and memory, the client 100 also includes some basic configurations, such as a network interface card (NIC) chip, I / O bus, display components, and some peripheral devices. Optionally, some peripheral devices may include, for example, a keyboard, mouse, stylus, printer, etc. Other peripheral devices are well known in the art and will not be described in detail here.

[0044] The shellcode malware identification device 200 refers to a device capable of identifying shellcode malware in a network virtual environment. It typically refers to a device that utilizes a network for information processing and shellcode malware identification. Physically, the shellcode malware identification device 200 can be any device capable of providing computing services, responding to shellcode malware identification requests, and performing shellcode malware identification operations. Examples include cluster servers, regular servers, cloud servers, cloud hosts, and virtual data centers. The shellcode malware identification device 200 mainly consists of a processor, hard disk, memory, and system bus, similar to a general computer architecture.

[0045] In this embodiment described above, a network connection is established between the client 100 and the shellcode malicious code identification device 200. This network connection can be a wireless or wired network connection. If the client 100 and the shellcode malicious code identification device 200 are connected via a communication connection, the mobile network standard can be any one of 2G (Global System for Mobile Communications GSM), 2.5G (General Packet Radio Service GPRS), 3G (Wideband Code Division Multiple Access WCDMA, Time Division Synchronous Code Division Multiple Access TD-SCDMA, Code Division Multiple Access 2000 CDMA2000, Universal Mobile Communications System UTMS), 4G (Long Term Evolution LTE), 4G+ (Enhanced Long Term Evolution LTE+), WiMax (Global Microwave Access Interoperability), 5G, 6G, etc.

[0046] Client 100 provides an application programming interface (API) for shellcode malicious code identification. When a user has a need for shellcode malicious code identification, the identification operation can be triggered through the API. Specifically, client 100 can display a human-computer interaction interface that includes the API; obtain the user's interactive operations or voice interactions input through the human-computer interaction interface to the API; and then obtain the pending process based on the interactive operations. When the pending process triggers a key event, the shellcode malicious code identification operation will be triggered. In order to accurately implement the shellcode malicious code identification operation, the pending process or the key event triggered by the pending process can be sent to the shellcode malicious code identification device 200.

[0047] Shellcode malware identification device 200 is used to obtain a process to be processed or a critical event triggered by the process to be processed. In response to a critical event triggered by the process to be processed or the process to be processed, it can obtain at least one return address information of the function called by the critical event. The critical event is an event related to system call operation. For example, the critical event may include at least one of the following: file operation event, network communication event, process creation event. File operation event may include at least one of the following: file creation event, file deletion event, file renaming event, file move event, etc.; network communication event includes: network connection event, etc.

[0048] To identify whether shellcode is present in a process under investigation, after obtaining at least one return address from the function called by the critical event, a set of memory addresses can be determined for analyzing the at least one return address. This set of memory addresses includes legitimate addresses corresponding to multiple processes. To identify whether shellcode is present in the process under investigation, all return address information can be analyzed and matched against the set of memory addresses. If all return address information is within the set of memory addresses, it indicates that the return address information corresponding to the critical event is legitimate, and therefore, the process under investigation does not contain shellcode. When the return address information is not located in the memory address load set, it is determined that shellcode exists in the process to be processed. Since shellcode may be ordinary shellcode or malicious shellcode, in order to accurately identify malicious shellcode, the memory region corresponding to the shellcode can be scanned to obtain the identification result. The identification result can indicate whether the process to be processed contains malicious shellcode. For example, if the process to be processed contains malicious shellcode, the identification result is determined as the first identification result; if the process to be processed does not contain malicious shellcode, the identification result is determined as the second identification result. In this way, the accurate identification of malicious shellcode is effectively achieved.

[0049] In this embodiment, when a critical event is triggered by the obtained process to be processed, at least one return address information of the function called by the critical event is obtained, and a memory address loading set for analyzing and processing at least one return address information is determined. The presence of shellcode in the process to be processed is identified by at least one return address information and the memory address loading set. When there is return address information that is not located in the memory address loading set, it can be determined that shellcode exists in the process to be processed. To avoid the shellcode being malicious, the shellcode can be blocked from execution first, and then the memory region corresponding to the shellcode can be scanned to obtain the identification result of whether the process to be processed contains shellcode. This effectively achieves accurate identification of shellcode, thereby avoiding the security threat posed by shellcode to memory space. In addition, since this scheme immediately starts the shellcode identification operation and scans the memory region corresponding to the shellcode when a critical event is triggered, without scanning other irrelevant regions, it can not only effectively reduce resource consumption and improve the timeliness of detection, but also effectively solve the problem of real-time detection blind spots, further improving the practicality of the method.

[0050] The following detailed description of some embodiments of the present invention is provided in conjunction with the accompanying drawings. Where there is no conflict between the embodiments, the following embodiments and features can be combined with each other. Furthermore, the timing of the steps in the following method embodiments is merely an example and not a strict limitation.

[0051] Figure 2 This is a flowchart illustrating a method for identifying shellcode malware provided in an embodiment of the present invention; see attached diagram. Figure 2 As shown, this embodiment provides a method for identifying shellcode malware. The execution subject of this method is a shellcode malware identification device, which can be implemented as software or a combination of software and hardware. When the shellcode malware identification device is implemented as hardware, it can be various electronic devices with shellcode malware identification capabilities, including but not limited to personal computers, servers, etc. When the shellcode malware identification device is implemented as software, it can be installed in the aforementioned electronic devices. Specifically, based on the above-mentioned shellcode malware identification device, the shellcode malware identification method in this embodiment can include:

[0052] Step S201: In response to a critical event triggered by the process to be processed, obtain at least one return address information corresponding to the critical event, wherein the critical event is an event related to a system call operation.

[0053] Step S202: Determine the memory address load set for analyzing and processing at least one return address information.

[0054] Step S203: When there is a return address information that is not located in the memory address loading set, it is determined that the process to be processed contains shellcode.

[0055] Step S204: Scan the memory region corresponding to the shellcode to obtain the identification result of the shellcode malicious code. The identification result is used to identify whether the process to be processed contains shellcode malicious code.

[0056] The specific implementation process and effects of each of the above steps are explained in detail below:

[0057] Step S201: In response to a critical event triggered by the process to be processed, obtain at least one return address information corresponding to the critical event, wherein the critical event is an event related to a system call operation.

[0058] Since shellcode malware is highly likely to trigger system-related calls or events, such as file creation, renaming, or network connection operations, it's crucial to analyze and process pending processes to accurately identify them. This analysis should determine if the pending processes trigger pre-defined key events. Key events can be pre-configured system call-related events, such as file operation events, network communication events, or process creation events. File operation events include file creation, deletion, renaming, and moving; network communication events include network connection events.

[0059] In some instances, identifying whether a process to be processed can trigger a preset critical event may include: obtaining the critical event identifier of the critical event; determining the event identifier corresponding to the process to be processed; if the event identifier and the critical event identifier are the same, it means that the process to be processed has triggered the critical event; if the event identifier and the critical event identifier are different, it means that the process to be processed has not triggered the critical event.

[0060] In other embodiments, identifying whether a process to be processed can trigger a preset key event may include: obtaining a detection anchor point for analyzing and processing the process to be processed; determining whether the process to be processed has triggered a key event by whether the detection anchor point can detect an event; when the event can be detected by the detection anchor point, determining that the detectable event is a key event triggered by the process to be processed; when the event cannot be detected by the detection anchor point, determining that the process to be processed has not triggered a key event.

[0061] When a process triggers a critical event or several critical events, in order to accurately identify whether there is malicious shellcode in the process, at least one return address information corresponding to the critical event can be obtained. At least one return address information can be determined by a function. In this case, obtaining at least one return address information of the function called by the critical event can include: determining at least one function called by the critical event; performing user-mode stack backtracking on the call stack to obtain the return address corresponding to each function.

[0062] Specifically, after a critical event is triggered in the process to be processed, in order to accurately analyze and process the process, at least one function called by the critical event can be obtained or determined. Since different functions have different return addresses, in order to accurately determine at least one return address information corresponding to the critical event, a user-mode stack backtracking operation can be performed on the call stack to obtain the return address information corresponding to each function.

[0063] For example, during the handling of a critical event, function A is called, function A calls function B, function B calls function C, and function C corresponds to a file creation function. By performing a user-mode stack backtracking operation on the call stack, the return address information corresponding to each function can be obtained. Specifically, this includes: return address information a for function A, return address information b for function B, return address information c for function C, and return address d for the file creation function. This effectively ensures the accuracy and reliability of obtaining at least one return address information corresponding to the critical event.

[0064] In some other instances, at least one return address information can be determined not only by the function called by the critical event, but also by a pre-defined detection module. In this case, obtaining at least one return address information corresponding to the critical event may include: determining the detection module used to analyze and process the critical event; determining the processing chain of the critical event through the detection module; and determining at least one return address information corresponding to the critical event based on the detection module and the processing chain of the critical event. This also ensures the accuracy and reliability of obtaining at least one return address information.

[0065] Step S202: Determine the memory address load set for analyzing and processing at least one return address information.

[0066] To accurately identify shellcode malware, after obtaining at least one return address information corresponding to a critical event, a set of memory addresses can be determined for analyzing and processing that return address information. This set of memory addresses can include multiple legitimate memory addresses that identify the process to be processed and do not contain shellcode. It should be noted that the multiple legitimate memory addresses included in the set of memory addresses can be consecutive or non-consecutive.

[0067] In some instances, the memory address load set can be determined through human-computer interaction. In this case, determining the memory address load set used for analyzing and processing at least one return address information may include: displaying a configuration page for memory address information; obtaining the memory address configuration operation entered by the user on the configuration page; and determining the memory address load set used for analyzing and processing at least one return address information based on the memory address configuration operation. This effectively ensures the accuracy and reliability of determining the memory address load set.

[0068] In other instances, the memory address load set can be determined by a third device. In this case, determining the memory address load set used for analyzing and processing at least one return address information may include: determining a third device that is communicatively connected to the identification device, wherein the third device includes a memory address load set used for analyzing and processing at least one return address information; or actively or passively acquiring the memory address load set used for analyzing and processing at least one return address information through the third device.

[0069] Step S203: When there is a return address information that is not located in the memory address loading set, it is determined that the process to be processed contains shellcode.

[0070] For a process containing shellcode, the return address corresponding to the critical event triggered by the process will be within the shellcode. Therefore, to identify whether shellcode exists in the process, after obtaining at least one return address and a memory address load set corresponding to the critical event, all return address information can be analyzed and compared with the memory address load set. This involves identifying whether the return address information is within the memory address load set, and matching all return address information with all valid memory addresses in the memory address load set.

[0071] Specifically, when the memory address loading set contains a valid memory address that matches all the return address information, it means that all the return address information is located in the memory address loading set. At this time, it can be determined that the process to be processed does not contain shellcode, let alone malicious shellcode.

[0072] If there is no valid memory address in the memory address loading set that matches one or more return addresses, it means that there is a return address that is not in the memory address loading set. Since return address information can only exist in shellcode, it can be determined that the process to be processed at this time contains shellcode.

[0073] Step S204: Scan the memory region corresponding to the shellcode to obtain the identification result of the shellcode malicious code. The identification result is used to identify whether the process to be processed contains shellcode malicious code.

[0074] After confirming that the process to be processed contains shellcode, since shellcode may be ordinary code or malicious shellcode, in order to avoid the information security risks caused by the shellcode being malicious, the shellcode can be blocked before scanning the memory area corresponding to the shellcode. Specifically, a blocking function can be used to control the shellcode to stop execution.

[0075] In order to accurately identify whether shellcode is malicious, the memory region corresponding to the shellcode can be scanned to obtain the identification result of the malicious shellcode. This identification result is used to indicate whether the process to be processed contains malicious shellcode.

[0076] In some instances, the identification of shellcode malware can be implemented using a pre-trained neural network model. In this case, scanning the memory region corresponding to the shellcode to obtain the identification result can include: scanning the memory region corresponding to the shellcode to obtain scanned code information; determining the neural network model used to implement the shellcode malware identification operation; inputting the scanned code information into the neural network model for identification, and obtaining the identification result output by the neural network model. This identification result can be a first identification result used to identify that the process to be processed contains shellcode malware; or, the identification result can be a second identification result used to identify that the process to be processed does not contain shellcode malware.

[0077] In other instances, shellcode malware identification can be achieved not only through neural network models but also through shellcode malware features. In this case, scanning the memory region corresponding to the shellcode to obtain the identification result can include: scanning the memory region corresponding to the shellcode to obtain the scanned code; determining the shellcode malware features used to implement the shellcode malware identification operation; and determining the shellcode malware identification result based on the shellcode malware features and the scanned code.

[0078] In order to accurately identify whether the process to be processed contains shellcode malware, the memory region corresponding to the shellcode (note that other unrelated memory regions are not included) can be scanned first to obtain the scanned code located in the memory region. Then, the shellcode malware features used to implement the shellcode malware identification operation can be determined. The shellcode malware features mentioned above can be obtained through human-computer interaction or preset devices. After obtaining the shellcode malware features and scanned code, they can be analyzed and processed to determine the shellcode malware identification result.

[0079] In some instances, shellcode malware identification can be achieved using a pre-trained neural network model, or by analyzing and comparing shellcode malware features with the scanned code. In this case, based on the shellcode malware features and the scanned code, the identification result can be determined as follows: if the scanned code includes shellcode malware features, it can be determined that the process to be processed has relevant shellcode malware features, thus determining the identification result as the first identification result for identifying that the process to be processed contains shellcode malware; if the scanned code does not include shellcode malware features, it can be determined that the process to be processed does not contain relevant shellcode malware features, thus determining the identification result as the second identification result for identifying that the process to be processed does not contain shellcode malware. This achieves accurate identification of whether shellcode malware exists in the process to be processed, further improving the practicality of the method.

[0080] Furthermore, after determining that the identification result is the second identification result, in order to avoid the security risks brought by shellcode malicious code, the method in this embodiment may also include: isolating the file corresponding to the process to be processed, and / or terminating the process to be processed. Specifically, the termination of the process to be processed can be achieved through a preset function, thereby ensuring the security and reliability of process processing.

[0081] The aforementioned isolation of the files corresponding to the processes to be processed may include: storing the files corresponding to the processes to be processed in a preset area, which is different from the storage area corresponding to the files corresponding to other processes; or, isolating the files corresponding to the processes to be processed may include: changing the access permissions of the files corresponding to the processes to be processed so that users cannot easily access the files corresponding to the processes to be processed, thereby achieving isolation of the files corresponding to the processes to be processed; or, isolating the files corresponding to the processes to be processed may include: encrypting the files corresponding to the processes to be processed so that users cannot easily access the files corresponding to the processes to be processed.

[0082] The shellcode malicious code identification method provided in this embodiment responds to a critical event triggered by the process to be processed. By obtaining at least one return address information corresponding to the critical event, it determines the memory address loading set used to analyze and process at least one return address information. When there is return address information not located in the memory address loading set, it can be determined that the process to be processed contains shellcode code, and the execution of the shellcode code is blocked. Then, the memory region corresponding to the shellcode code is scanned to obtain the shellcode malicious code identification result. This effectively realizes that when a critical event is triggered, the operation of accurately identifying whether the process to be processed contains shellcode malicious code is started immediately, avoiding the problem of detection blind spots when detecting shellcode malicious code. In addition, since the identification method in this embodiment only scans the memory region corresponding to the shellcode code and does not need to scan other irrelevant regions, it can not only effectively reduce resource consumption and improve the timeliness of detection, but also improve the practicality of the method.

[0083] Figure 3 This is a schematic diagram illustrating the determination of a memory address loading set for analyzing and processing at least one return address information, provided by an embodiment of the present invention; based on any of the above embodiments, refer to the appendix. Figure 3 As shown, this embodiment provides an implementation method for determining the memory address load set based on the dynamic link libraries loaded by the process to be processed. In this case, determining the memory address load set used for analyzing and processing at least one return address information may include:

[0084] Step S301: Obtain the dynamic link libraries loaded by the process to be processed.

[0085] After obtaining the process to be processed, in order to accurately determine the set of memory addresses loaded for analyzing and processing at least one return address information, the dynamic link libraries loaded by the process to be processed can be obtained first. The dynamic link libraries can be various application modules that the process to be processed can load. Specifically, the process to be processed can correspond to one or more dynamic link libraries. For example, a process to be processed can correspond to the following four dynamic link libraries: dynamic link library 1, dynamic link library 2, dynamic link library 3, and dynamic link library 4.

[0086] Specifically, dynamic link libraries can be obtained through the system-loaded image callback function. In this case, obtaining the dynamic link libraries loaded by the process to be processed can include: determining the system-loaded image callback function; using the image callback function to record and obtain the dynamic link libraries loaded by the process to be processed, thus effectively ensuring the accuracy and reliability of obtaining dynamic link libraries.

[0087] Step S302: Determine the self-image address of the process to be processed and the memory space address of the dynamic link library.

[0088] When a critical event is triggered by a process to be processed, in order to accurately determine the memory address load set, the self-mirror address of the process to be processed can be determined first. This self-mirror address can be determined through a callback function, and this self-mirror address is a part of the memory address load set.

[0089] Since the memory address loading set can include not only the image address of the process to be processed, but also the memory space address of the dynamic link library, after obtaining the dynamic link library loaded by the process to be processed, the dynamic link library can be analyzed and processed to determine the memory space address of the dynamic link library. For example, when the process to be processed corresponds to the above four dynamic link libraries, the memory space address corresponding to the dynamic link library can be determined by analyzing and processing the above four dynamic link libraries. Specifically, it can include: memory space address 1 corresponding to dynamic link library 1, memory space address 2 corresponding to dynamic link library 2, memory space address 3 corresponding to dynamic link library 3, and memory space address 4 corresponding to dynamic link library 4.

[0090] For the memory space address of a dynamic link library, it can include the initial memory address and the end memory address. In this case, determining the memory space address of the dynamic link library can include: determining the initial memory address and the end memory address used to store the dynamic link library; and determining the memory space address based on the initial memory address and the end memory address.

[0091] After obtaining the dynamic link library, it can be analyzed to determine the initial and final memory addresses of the memory space used to store the dynamic link library. The initial memory address can be determined using a mirror callback function. In this case, determining the initial memory address used to store the dynamic link library can include: determining the mirror callback function loaded by the system; and using the mirror callback function to determine the initial memory address of the dynamic link library.

[0092] Specifically, to accurately determine the initial memory address, the system-loaded image callback function can be identified, and then used to determine the initial memory address of the dynamic link library. After obtaining the initial memory address, a similar method can be used to determine the end memory address. That is, the end memory address can be determined using the system-loaded image callback function, or it can be determined based on the size of the dynamic link library. In this case, determining the end memory address used to store the dynamic link library can include: obtaining the size of the dynamic link library; determining the initial memory address used to store the dynamic link library; and determining the end memory address based on the size of the dynamic link library and the initial memory address. This also ensures the accuracy and reliability of determining the end memory address.

[0093] It is understandable that the initial memory address can be determined not only by the mirror callback function, but also by a preset memory pointer. Those skilled in the art can flexibly choose or configure the method of determining the initial memory address according to the specific application scenario or application requirements, as long as the initial memory address can be determined stably. This will not be elaborated further here.

[0094] After obtaining the initial memory address and the end memory address, the memory space address can be determined based on the initial memory address and the end memory address. At this time, the memory space address can include: the initial memory address, the end memory address, and the intermediate consecutive addresses between the initial memory address and the end memory address.

[0095] It's important to note that different dynamic link libraries (DLLs) can correspond to different memory addresses. These memory addresses can be contiguous or non-contiguous. Specifically, DLLs can be loaded into memory using memory-mapped files. These files directly map the file's contents to the process's address space, improving file access efficiency. The mappings within a memory-mapped file can be non-contiguous; that is, different parts of the file can be mapped to different virtual address spaces. Therefore, even if the file itself is contiguous, its memory mappings may be non-contiguous.

[0096] Step S303: Determine the memory address loading set based on its own mirror address and the memory space address of the dynamic link library.

[0097] After obtaining its own image address and the memory space address of the dynamic link library, the memory address loading set can be determined based on its own image address and the memory space address of the dynamic link library. For example, the memory address loading set can include its own image address and the memory space address of the dynamic link library. When the dynamic link library includes the four listed above, the memory address loading set can include: its own image address, memory space address 1, memory space address 2, memory space address 4, and memory space address 4.

[0098] In some instances, when the memory addresses of the self-image address and the dynamic link library are contiguous, the memory address loading set based on the self-image address and the dynamic link library's memory address includes a contiguous memory address segment; when the memory addresses of the self-image address and the dynamic link library's memory address are non-contiguous, the memory address loading set based on the self-image address and the dynamic link library's memory address includes multiple non-contiguous memory address segments. This effectively ensures the accuracy and reliability of determining the memory address loading set.

[0099] In this embodiment, by obtaining the dynamic link libraries loaded by the process to be processed, the self-image address of the process to be processed and the memory space address of the dynamic link libraries are determined. Then, based on the self-image address and the memory space address of the dynamic link libraries, the memory address loading set is determined. This effectively ensures the accuracy and reliability of determining the memory address loading set, which in turn helps to improve the accuracy of shellcode malicious code identification based on the memory address loading set.

[0100] Figure 4 This is a flowchart illustrating another method for identifying shellcode malware provided in an embodiment of the present invention; based on the above embodiments, refer to the appendix. Figure 4 As shown, after obtaining the dynamic link libraries loaded by the process to be processed, in order to further improve the accuracy of shellcode malicious code identification, the method can identify and detect whether the dynamic link libraries have been modified. At this time, the method in this embodiment may further include:

[0101] Step S401: Check if the dynamic link library has been modified.

[0102] For the memory address load set, since it is determined based on the memory space addresses of the dynamic link libraries loaded by the process to be processed, and shellcode malicious code is determined based on the memory address load set, in order to improve the accuracy of shellcode malicious code identification, after obtaining the dynamic link library, it is possible to detect whether the dynamic link library has been modified. In some instances, detecting whether the dynamic link library has been modified may include: detecting whether the dynamic link library has modification marks; if the dynamic link library has modification marks, it is determined that the dynamic link library has been modified; if the dynamic link library does not have modification marks, it is determined that the dynamic link library has not been modified. This achieves accurate detection of whether the dynamic link library has been modified.

[0103] In other instances, whether a dynamic link library has been modified can be determined not only by modifying its tags, but also by examining the file corresponding to the dynamic link library. In this case, detecting whether a dynamic link library has been modified can include: obtaining the file corresponding to the dynamic link library; and detecting whether the dynamic link library has been modified based on the file.

[0104] To accurately detect whether a dynamic link library (DLL) has been modified, the corresponding file can be obtained first. This file may contain the DLL's configuration or implementation code. After obtaining the file, it can be analyzed to detect any changes to the DLL. Specifically, based on the file, detecting DLL modification can include: checking if the file's content has changed; if the file's content has changed, determining that the DLL has been modified; and if the file's content has not changed, determining that the DLL has not been modified. This effectively allows for accurate determination of DLL modification based on whether the file's content has been altered.

[0105] Step S402: If the dynamic link library has not been modified, the memory space address of the dynamic link library can be determined.

[0106] Step S403: When the dynamic link library is modified, the memory space address of the dynamic link library is prevented from being determined.

[0107] Specifically, if it is determined that the dynamic link library has not been modified, it means that the dynamic link library has not undergone any illegal modification operations, and thus it is permissible to determine the memory space address of the dynamic link library. If it is determined that the dynamic link library has been modified, it means that the dynamic link library may have undergone illegal modification operations. In this case, in order to ensure accurate identification of shellcode malicious code, it is prohibited to determine the memory space address of the dynamic link library. This effectively avoids shellcode malicious code identification based on the memory space address of the modified dynamic link library, thereby ensuring the accuracy of shellcode malicious code identification.

[0108] In this embodiment, by detecting whether the dynamic link library has been modified, the memory address of the dynamic link library is allowed to be determined when the dynamic link library has not been modified, and the determination of the memory address of the dynamic link library is prohibited when the dynamic link library has been modified. In some instances, after prohibiting the determination of the memory address of the dynamic link library, the memory address corresponding to the modified dynamic link library can be marked, and it is checked whether the return address information corresponding to the critical event matches the memory address corresponding to the modified dynamic link library. If the return address information corresponding to the critical event matches the memory address corresponding to the modified dynamic link library, then shellcode malicious code can be directly identified in the pending process corresponding to the critical event. This effectively ensures the accuracy and reliability of the determination of the memory address, and avoids shellcode malicious code identification based on the memory address of the modified dynamic link library, thereby ensuring the accuracy of shellcode malicious code identification and further improving the practicality of the method.

[0109] In practical applications, to overcome the problem of blind spots in shellcode detection caused by EDR technology's lack of memory region scanning, this application embodiment provides a method for scanning memory shellcode based on EDR technology. This method locates and detects hidden shellcode through stack backtracking and implements real-time detection of shellcode based on a key operation triggering mechanism, thus effectively improving the accuracy and efficiency of shellcode identification. Specifically, the method may include the following steps:

[0110] Step 1: Initialize the detection and obtain the load mapping table corresponding to the process to be processed.

[0111] The driver in EDR is deployed at the operating system level. The driver is used to implement the detection of shellcode malware. Since the driver is deployed at the system level, during the detection of shellcode malware, the system-loaded image callback function can be used to record the PID of each process to be processed in real time. At the same time, the memory start address and memory end address of all dynamic link libraries (DLLs) loaded by the process to be processed can be determined. Then, a load mapping table corresponding to the process to be processed can be constructed based on the memory start address and memory end address. The load mapping table can include: the name of the DLL, the file storage path of the DLL, and the memory start address of the DLL. The name of the DLL is a part of the file storage path of the DLL.

[0112] Step 2: Trigger detection of critical events. When a critical event is triggered, at least one stack frame return address corresponding to the critical event is obtained (corresponding to the return address information in the above embodiment).

[0113] Since shellcode is likely to trigger some system-related calls, we can first identify the key events used to detect malicious shellcode. These key events can include at least one of the following: file operation events, network communication events, process creation events, etc. The file operation events include at least one of the following: file creation events, file deletion events, file renaming events, file moving events, etc. The network communication events can include network outbound connection events.

[0114] To accurately detect whether critical events have occurred, hooks can be set at multiple anchor points in the system that analyze and process the process after it has been acquired. These hooks allow for the detection of whether critical events have been triggered. When a critical event is confirmed to have occurred, a user-mode stack backtracking operation can be performed to collect the return addresses of stack frames in the call stack layer by layer. These return addresses correspond to the return addresses of the various functions called by the critical event, and there can be one or more return addresses.

[0115] Step 3: Stack address comparison.

[0116] An analysis and comparison operation is performed based on the load mapping table corresponding to the process to be processed and at least one stack frame return address. That is, the collected stack frame return addresses are compared one by one with the memory start addresses included in the previously constructed load mapping table to confirm whether each stack frame return address belongs to the loading range of a known legal DLL in the load mapping table.

[0117] If at least one stack frame return address does not fall within the load range corresponding to the load mapping table, it indicates that shellcode or other unexpected code exists in the process to be processed. If all stack frame return addresses fall within the load range corresponding to the load mapping table, it indicates that shellcode or other unexpected code does not exist in the process to be processed.

[0118] Step 4: Memory scan and response.

[0119] The memory region corresponding to the shellcode in the process to be processed (or the memory region of the process to be processed that is suspected of containing shellcode) is scanned to identify whether the code in the memory region has the characteristics of shellcode malware. The characteristics of shellcode malware are the feature information that shellcode malware has. For example, the feature information may include at least one of the following: instruction set features, jump instruction features, data features, etc. The above-mentioned instruction set features may include: NOP instruction features; jump instruction features may include shellcode malware often using jump instructions to bypass security checks or obfuscate code, such as: jmp instruction, call instruction, etc.; data features may include shellcode malware often containing hard-coded strings or byte arrays, such as: the string 68 77 77 77 77, etc.

[0120] If the code in the memory region exhibits characteristics of shellcode malware, it indicates that the current process under investigation contains shellcode malware. To mitigate the security risks posed by shellcode malware, appropriate countermeasures can be taken, such as immediately terminating the process, isolating the files associated with it, or conducting further investigations, to contain the potential threat. If the current process under investigation does not contain shellcode malware, then analysis and processing of the process are permitted.

[0121] The technical solution provided in this application embodiment can achieve the following effects:

[0122] (1) The dynamic triggering mechanism, unlike the conventional periodic or full-time scanning strategy, can scan the memory area corresponding to the shellcode when a specific critical event is triggered and the process to be processed contains shellcode. This avoids the resource consumption problem caused by full-time scanning. At the same time, by accurately selecting the scanning time, it effectively improves the ability to resist shellcode, reduces the opportunity for attackers to evade by using time windows or memory attribute modifications, and improves the timeliness of detection, effectively solving the problem of blind spots in real-time detection. By scanning at the moment the event occurs, the probability of missed detection due to shellcode self-destruction and resistance is reduced.

[0123] (2) Stack backtracking and address comparison: Stack backtracking technology is used to trace the call chain and the return address of the stack frame is accurately compared with the memory range of the known legal DLLs included in the load mapping table. This enables fine-grained tracing and legality verification of the execution flow in memory. This method can not only effectively improve the ability to identify abnormal behavior, but also efficiently identify abnormal execution flow, thereby enhancing the resistance to memory scanning avoidance technology, effectively improving the detection accuracy and response speed of shellcode loading attacks, enhancing the active defense capability of the application platform, and further improving the practicality of the method.

[0124] Figure 5 This is a schematic diagram of a shellcode malware identification device provided in an embodiment of the present invention; see attached diagram. Figure 5 As shown, this embodiment provides a shellcode malicious code identification device, which is used to execute the above-mentioned... Figure 2 The shellcode malware identification method shown can be specifically described using a device that includes:

[0125] The first acquisition module 11 is used to acquire at least one return address information of the function called by the key event in response to a key event triggered by the process to be processed, wherein the key event is an event related to system call operation;

[0126] The first determining module 12 is used to determine the memory address loading set for analyzing and processing at least one return address information;

[0127] The first determining module 12 is also used to determine that the process to be processed contains shellcode when there is return address information that is not located in the memory address loading set;

[0128] The first processing module 13 is used to scan the memory region corresponding to the shellcode code to obtain the identification result of the shellcode malicious code. The identification result is used to identify whether the process to be processed contains shellcode malicious code.

[0129] In some instances, key events include at least one of the following: file operation events, network communication events, and process creation events.

[0130] In some instances, file operation events include at least one of the following: file creation event, file deletion event, file renaming event, and file move event;

[0131] Network communication events include: network connection events.

[0132] In some instances, when the first acquisition module 11 acquires at least one return address information corresponding to a key event, the first acquisition module 11 is used to perform: determining at least one function called by the key event; performing user-mode stack backtracking in the call stack to obtain the return address information corresponding to each function.

[0133] In some instances, when the first determining module 12 determines the memory address loading set for analyzing and processing at least one return address information, the first determining module 12 is used to perform the following: obtaining the dynamic link library loaded by the process to be processed; determining the self-image address of the process to be processed and the memory space address of the dynamic link library; and determining the memory address loading set based on the self-image address and the memory space address of the dynamic link library.

[0134] In some instances, when the first determining module 12 determines the memory space address of the dynamic link library, the first determining module 12 is used to perform: determining the initial memory address and the end memory address for storing the dynamic link library; and determining the memory space address based on the initial memory address and the end memory address.

[0135] In some instances, when the first determining module 12 determines the initial memory address for storing the dynamic link library, the first determining module 12 is used to perform: determining the image callback function loaded by the system; and using the image callback function to determine the initial memory address of each dynamic link library.

[0136] In some instances, after obtaining the dynamic link library loaded by the process to be processed, the first processing module 13 in this embodiment is used to perform the following steps: detect whether the dynamic link library has been modified; if the dynamic link library has not been modified, then the memory space address of the dynamic link library is allowed to be determined; if the dynamic link library has been modified, then the memory space address of the dynamic link library is prohibited from being determined.

[0137] In some instances, when the first processing module 13 detects whether the dynamic link library has been modified, the first processing module 13 is used to perform the following: obtain the file corresponding to the dynamic link library; and detect whether the dynamic link library has been modified based on the file.

[0138] In some instances, when the first processing module 13 detects whether a dynamic link library has been modified based on a file, the first processing module 13 is used to perform the following: detect whether the content of the file has been changed; if the content of the file has been changed, determine that the dynamic link library has been modified; if the content of the file has not been changed, determine that the dynamic link library has not been modified.

[0139] In some instances, before scanning the memory region corresponding to the shellcode, the first processing module 13 is further configured to: block the execution of the shellcode.

[0140] In some instances, when the first processing module 13 scans the memory region corresponding to the shellcode to obtain the shellcode malicious code identification result, the first processing module 13 is used to perform: scanning the memory region corresponding to the shellcode to obtain the scanning code; determining the shellcode malicious code features used to implement the shellcode malicious code identification operation; and determining the shellcode malicious code identification result based on the shellcode malicious code features and the scanning code.

[0141] In some instances, when the first processing module 13 determines the identification result of shellcode malicious code based on shellcode malicious code characteristics and scanned code, the first processing module 13 is used to perform the following: if the scanned code includes shellcode malicious code characteristics, then the identification result is determined as a first identification result used to identify that the process to be processed includes shellcode malicious code; if the scanned code does not include shellcode malicious code characteristics, then the identification result is determined as a second identification result used to identify that the process to be processed does not include shellcode malicious code.

[0142] In some instances, after determining that the identification result is the second identification result, the first processing module 13 in this embodiment is used to perform: isolating the file corresponding to the process to be processed; and / or terminating the process to be processed.

[0143] Figure 5 The device shown can perform Figures 1-4 For the methods shown in the embodiments, the parts not described in detail in this embodiment can be referred to the following: Figures 1-4 The relevant descriptions of the illustrated embodiments are provided below. For the execution process and technical effects of this technical solution, please refer to [link / reference]. Figures 1-4The descriptions in the illustrated embodiments will not be repeated here.

[0144] In one possible design, Figure 5 The structure of the shellcode malware detection device shown can be implemented as an electronic device, which can be a controller, personal computer, server, or other similar devices. Figure 6 As shown, the electronic device may include a first processor 21 and a first memory 22. The first memory 22 is used to store data executed by the corresponding electronic device. Figures 1-4 In the illustrated embodiment, the program for identifying Shellcode malicious code includes a first processor 21 configured to execute a program stored in a first memory 22.

[0145] The program includes one or more computer instructions, wherein when executed by the first processor 21, the one or more computer instructions are capable of performing the following steps: in response to a critical event triggered by the process to be processed, obtaining at least one return address information corresponding to the critical event, wherein the critical event is an event related to a system call operation; determining a memory address loading set for analyzing and processing the at least one return address information; when there is return address information not located in the memory address loading set, determining that the process to be processed contains shellcode, and blocking the execution of the shellcode; scanning the memory region corresponding to the shellcode, obtaining the identification result of the shellcode malicious code, the identification result being used to identify whether the process to be processed contains shellcode malicious code.

[0146] Furthermore, the first processor 21 is also used to perform the aforementioned Figures 1-4 All or part of the steps in the illustrated embodiments.

[0147] The structure of the electronic device may also include a first communication interface 23 for communication between the electronic device and other devices or communication networks.

[0148] In addition, embodiments of the present invention provide a computer storage medium for storing computer software instructions used by an electronic device, which includes instructions for executing the above-described... Figures 1-4 The program involved in the Shellcode malicious code identification method in the illustrated embodiment.

[0149] Furthermore, embodiments of the present invention provide a computer program product, comprising: a computer-readable storage medium storing computer instructions, which, when executed by one or more processors, cause one or more processors to perform the aforementioned... Figures 1-4 The steps in the Shellcode malicious code identification method shown in the embodiment are illustrated.

[0150] Figure 7 This is a schematic diagram of a terminal detection device provided in an embodiment of the present invention, with reference to the attached diagram. Figure 7 As shown, this embodiment provides a terminal detection device, including:

[0151] The driver unit 31, located in the kernel layer, is used to respond to a critical event triggered by the process to be processed, obtain at least one return address information of the function called by the critical event, wherein the critical event is an event related to system call operation; determine the memory address loading set for analyzing and processing at least one return address information; when there is return address information not located in the memory address loading set, determine that the process to be processed contains shellcode, block the execution of the shellcode, and send a notification message to the scanning unit 32;

[0152] The scanning unit 32, located at the application layer, is used to obtain notification information and scan the memory area corresponding to the shellcode based on the notification information to obtain the identification result of the shellcode malicious code. The identification result is used to identify whether the process to be processed contains shellcode malicious code.

[0153] Figure 7 The terminal detection device shown can also perform Figures 1-4 For the methods shown in the embodiments, the parts not described in detail in this embodiment can be referred to the following: Figures 1-4 The relevant descriptions of the illustrated embodiments are provided below. For the execution process and technical effects of this technical solution, please refer to [link / reference]. Figures 1-4 The descriptions in the illustrated embodiments will not be repeated here.

[0154] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0155] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0156] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of a necessary general-purpose hardware platform, or by a combination of hardware and software. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a computer product. The present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0157] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0158] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable device to cause a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable device for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the functions specified in one or more boxes. In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory. Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0159] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0160] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying shellcode malware, characterized in that, include: In response to a critical event triggered by a process to be processed, at least one return address information corresponding to the critical event is obtained, wherein the critical event is an event related to a system call operation; Determine the memory address loading set used for analyzing and processing the at least one return address information; When the returned address information is not located in the memory address loading set, it is determined that the process to be processed contains shellcode. The memory region corresponding to the shellcode is scanned to obtain the identification result of the shellcode malicious code. The identification result is used to identify whether the process to be processed contains shellcode malicious code.

2. The method according to claim 1, characterized in that, Obtain at least one return address information corresponding to the key event, including: Determine at least one function invoked by the critical event; Perform user-mode stack backtracking in the call stack to obtain the return address information corresponding to each function.

3. The method according to claim 1, characterized in that, Determining the memory address load set for analyzing and processing the at least one return address information includes: Obtain the dynamic link libraries loaded by the process to be processed; Determine the self-image address of the process to be processed and the memory space address of the dynamic link library; The memory address loading set is determined based on its own image address and the memory space address of the dynamic link library.

4. The method according to claim 3, characterized in that, Determining the memory space address of the dynamic link library includes: Determine the initial memory address and the end memory address for storing the dynamic link library; The memory space address is determined based on the initial memory address and the end memory address.

5. The method according to claim 4, characterized in that, Determining the initial memory address for storing the dynamic link library includes: Determine the system image callback function; The initial memory address of the dynamic link library is determined using the image callback function.

6. The method according to claim 3, characterized in that, After obtaining the dynamic link libraries loaded by the process to be processed, the method further includes: Detect whether the dynamic link library has been modified; If the dynamic link library has not been modified, then the memory space address of the dynamic link library can be determined; When the dynamic link library is modified, the memory address of the dynamic link library is prevented from being determined.

7. The method according to claim 6, characterized in that, Detecting whether the dynamic link library has been modified includes: Obtain the file corresponding to the dynamic link library; Based on the file, detect whether the dynamic link library has been modified.

8. The method according to claim 7, characterized in that, Based on the file, detect whether the dynamic link library has been modified, including: Check whether the contents of the file have been changed; When the contents of the file have been changed, it is determined that the dynamic link library has been modified; If the contents of the file have not changed, it is determined that the dynamic link library has not been modified.

9. The method according to any one of claims 1-8, characterized in that, Before scanning the memory region corresponding to the shellcode, the method further includes: The shellcode is executed in a blocking manner.

10. The method according to any one of claims 1-8, characterized in that, The memory region corresponding to the shellcode is scanned to obtain the identification results of the malicious shellcode, including: The memory region corresponding to the shellcode is scanned to obtain the scanned code; Identify the characteristics of shellcode malware used to perform shellcode malware identification operations; Based on the shellcode malicious code characteristics and the scanning code, the identification result of the shellcode malicious code is determined.

11. The method according to claim 10, characterized in that, Based on the shellcode malicious code characteristics and the scanning code, the identification result of the shellcode malicious code is determined, including: When the scanned code includes the shellcode malicious code feature, the identification result is determined to be a first identification result used to identify that the process to be processed includes shellcode malicious code; If the shellcode malicious code feature is not included in the scanned code, then the identification result is determined to be a second identification result used to identify that the process to be processed does not contain shellcode malicious code.

12. The method according to claim 11, characterized in that, After determining that the recognition result is the second recognition result, the method further includes: Isolate the files corresponding to the process to be processed; and / or, Terminate the pending process.

13. A device for identifying shellcode malware, characterized in that, include: The first acquisition module is used to acquire at least one return address information corresponding to a key event triggered by the process to be processed, in response to the key event triggered by the process to be processed. The key event is an event related to system call operation. The first determining module is used to determine the memory address loading set for analyzing and processing the at least one return address information; The first determining module is further configured to determine that the process to be processed contains shellcode when the return address information is not located in the memory address loading set; The first processing module is used to scan the memory region corresponding to the shellcode to obtain the identification result of the shellcode malicious code. The identification result is used to identify whether the process to be processed contains shellcode malicious code.

14. A terminal detection device, characterized in that, include: The driver unit, located in the kernel layer, is used to respond to a key event triggered by the process to be processed, obtain at least one return address information corresponding to the key event, wherein the key event is an event related to system call operation; determine a memory address loading set for analyzing and processing the at least one return address information; when there is a return address information that is not located in the memory address loading set, determine that the process to be processed contains shellcode, and send a notification message to the scanning unit; The scanning unit, located at the application layer, is used to scan the memory region corresponding to the shellcode based on the notification information to obtain the identification result of the shellcode malicious code. The identification result is used to identify whether the process to be processed contains shellcode malicious code.

15. An electronic device, characterized in that, include: A memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions, when executed by the processor, implement the method of any one of claims 1-12.

16. A computer storage medium, characterized in that, Used to store a computer program that, when executed by a computer, implements the method of any one of claims 1-12.

17. A computer program product, characterized in that, include: A computer program, when executed by a processor of an electronic device, causes the processor to perform the steps of the method of any one of claims 1-12.

Images