Malicious program recognition method and related apparatus

Abstract

The present application relates to the field of information security, and discloses a malicious program recognition method and a related apparatus. The method comprises: reading data in a memory area corresponding to a target program to obtain target memory data, wherein the memory area is a memory area allocated by an operating system to a process of the target program during running of the target program; determining a hash value of the target memory data by means of a similarity hashing algorithm to obtain a first hash value; determining, from a sample hash library, a second hash value having the smallest distance from the first hash value; and if the distance between the first hash value and the second hash value is less than a distance threshold, and a sample program corresponding to the second hash value is a malicious program, determining that the target program is a malicious program. In the present application, the security risk can be found in time by means of the similarity hashing algorithm, thereby reducing the loss caused by malicious programs, and the sample hash library does not need to be frequently updated, thereby achieving low maintenance cost.

Description

Malicious program identification methods and related devices

[0001] This application claims priority to Chinese Patent Application No. 202411548823.8, filed on October 30, 2024, entitled “Method and Apparatus for Identifying Malicious Programs”, the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of information security technology, and in particular to a method and related apparatus for identifying malicious programs. Background Technology

[0003] Malicious programs are computer code or software that installs and runs on a user's computer or other terminal without explicit notification or permission, and engages in activities that infringe upon the user's legitimate rights, such as stealing, encrypting, altering, and deleting data, and monitoring the user. Examples include computer viruses, ransomware, backdoor programs, keyloggers, password thieves, Word and Excel macro viruses, boot sector viruses, script viruses, Trojans, criminal software, spyware, and adware. As malicious program technology continues to evolve, the difficulty of identifying malicious programs is increasing, posing a significant challenge to enterprise network security. Therefore, there is an urgent need for a method to identify malicious programs in a timely manner to detect security risks and reduce losses caused by malicious programs. Summary of the Invention

[0004] This application provides a method and related apparatus for identifying malicious programs, which can promptly detect security risks and reduce losses caused by malicious programs. The technical solution is as follows:

[0005] Firstly, a method for identifying malicious programs is provided. The method includes: reading data in a memory region corresponding to a target program to obtain target memory data, wherein the memory region is a memory region allocated by the operating system to the process of the target program during its execution; determining the hash value of the target memory data using a similarity hash algorithm to obtain a first hash value; determining a second hash value from a sample hash library that has the smallest distance to the first hash value; and determining that the target program is malicious if the distance between the first hash value and the second hash value is less than a distance threshold and the sample program corresponding to the second hash value is a malicious program.

[0006] When a program's executable file is loaded into memory, the operating system allocates a region of memory to cache the executable file. This region is also called the code segment. During program execution, memory regions can be dynamically allocated; these are the non-code segments. Therefore, for a target program, the memory regions allocated by the operating system to its process during execution include both the code and non-code segments. Alternatively, the memory regions allocated by the operating system to the target program's process during execution may include the non-code segment but not the code segment. Of course, the memory regions allocated by the operating system to the target program's process during execution may also include the code segment but not the non-code segment.

[0007] Programs are static, while processes are dynamic. A process is the manifestation of a program after it has run. Therefore, for a target program, once its executable file is loaded into memory, the target program is considered to have been run, and the memory region read at this time can be considered the memory region of the process corresponding to the target program. For ease of description, this application embodiment refers to the memory region allocated by the operating system to the process of the target program as the memory region corresponding to the target program.

[0008] This application uses a similarity hashing algorithm to determine the hash value of the target memory data, i.e., the first hash value, and then determines whether the target program is malicious by the distance between the first hash value and the second hash value. Since the hash values ​​determined by the similarity hashing algorithm for two similar objects are also quite close, and known malicious programs and their variants are also quite similar, the method provided by this application can not only identify known malicious programs but also their variants. In other words, this application can detect unknown threats in a timely manner, reducing the losses caused by malicious programs. Furthermore, since the hash values ​​determined by the similarity hashing algorithm for two similar objects are also quite close, identifying malicious programs using the similarity hashing algorithm does not require frequent updates to the sample hash database, resulting in lower maintenance costs.

[0009] In one possible implementation, before reading data in the memory area corresponding to the target program, the method further includes: if the currently running program is a specified program, then determining the currently running program as the target program, wherein the specified program includes programs that have been maliciously exploited.

[0010] Since programs that have been maliciously exploited are usually more likely to be maliciously exploited again, if the currently running program is a program that has been maliciously exploited, then the currently running program is identified as the target program, and then the method provided in this application embodiment is used to determine whether the target program is a malicious program, thereby improving the efficiency of malicious program identification.

[0011] In one possible implementation, before reading data from the memory region corresponding to the target program, the method further includes: determining the characteristics of the memory region corresponding to the currently running program; if the characteristics of the memory region corresponding to the currently running program meet the malicious memory assessment criteria, then the currently running program is identified as the target program.

[0012] Malicious memory assessment criteria are used to evaluate whether a memory region is a suspicious memory region. Programs corresponding to suspicious memory regions are usually also suspicious. Therefore, identifying the target program through malicious memory assessment criteria can improve the efficiency of malicious program identification.

[0013] In one possible implementation, the memory region is characterized by at least one of the following: memory permissions, memory state, type of memory data, and memory size.

[0014] In one possible implementation, the malicious memory assessment criteria include at least one of the following:

[0015] The memory region must simultaneously have read, write, and execute permissions;

[0016] The data in the memory region is in a committed state, the memory region has executable permissions, and the memory region includes executable file headers other than the executable file header of the target program;

[0017] The memory region is smaller than the size threshold and contains an executable program;

[0018] The read permission means that data in the memory area can be read, the write permission means that data can be written to the memory area, and the execute permission means that an executable program is stored in the memory area.

[0019] Typically, the permissions of a memory region (also known as memory permissions) include some of the permissions of read, write, and execute. The probability of having all permissions is small. Therefore, if a memory region has read, write, and execute permissions at the same time, it is considered a suspicious memory region.

[0020] Data in a memory region being in a committed state means that the data has been committed to the memory region. This can also be understood as the data in the memory region being committed, or the memory state being committed. For example, process data has been written to the memory region.

[0021] The executable file header refers to the beginning of a program's executable file. For Windows systems, the executable file header is the portable executable (PE) header, which usually begins with MZ.

[0022] If the data in the memory region is in a committed state, it means that the data in the memory region can be accessed later. At this time, if the memory region also contains other executable file headers (i.e., the type of memory data is an executable file header) and has executable permissions, it indicates that the program is more likely to be a malicious program. Therefore, this memory region is considered a suspicious memory region.

[0023] Normally, the memory area storing executable programs is relatively large, which facilitates the execution of the executable program. However, malicious programs usually request a smaller memory area in order to disguise themselves. Therefore, if the size of a memory area is less than the size threshold and an executable program is stored in the memory area, it indicates that the program is more likely to be malicious. Thus, this memory area is considered a suspicious memory area.

[0024] In one possible implementation, reading data from the memory region corresponding to the target program to obtain target memory data includes: using the address of the memory region corresponding to the target program as a parameter of a memory read function, and reading the target memory data through the memory read function.

[0025] A memory read function is a function used to read data from a memory region. Typically, a function includes input parameters (also called input arguments) and output parameters (also called output arguments). Therefore, the address of the memory region corresponding to the target program can be used as the input parameter of the memory read function, and the data in the target program's memory region can be read using the memory read function to obtain the target memory data.

[0026] In one possible implementation, reading data from the memory region corresponding to the target program to obtain target memory data includes: reading the target memory data from a file in the target path based on the address of the memory region corresponding to the target program, wherein the target path refers to the path used to store memory data.

[0027] The target path refers to the path used to store memory data, so the files in the target path are also used to store memory data. In some embodiments, the target path can be determined based on the identifier of the process corresponding to the target program, and then the data in the memory region corresponding to the target program can be read from the file in the target path based on the address of the memory region corresponding to the target program to obtain the target memory data.

[0028] In one possible implementation, the sample hash library further includes the identifier of the malicious sample family corresponding to the second hash value; after determining that the target program is a malicious program, the method further includes: outputting alarm information, the alarm information including the identifier of the target program and the identifier of the malicious sample family corresponding to the second hash value.

[0029] In one possible implementation, the similarity hashing algorithm includes locality-sensitive hashing and fuzzy hashing.

[0030] Secondly, a malicious program identification device is provided, the device having the function of implementing the method behavior described in the first aspect. The device includes at least one module for implementing the method provided in the first aspect.

[0031] Thirdly, a computer device is provided, comprising a processor and a memory, the memory being used to store a computer program for performing the methods provided in the first aspect. The processor is configured to execute the computer program stored in the memory to implement the methods described in the first aspect.

[0032] Optionally, the computer device may further include a communication bus for establishing a connection between the processor and the memory.

[0033] Fourthly, a computer-readable storage medium is provided, wherein the storage medium stores instructions that, when executed on a computer, cause the computer to perform the method described in the first aspect.

[0034] Fifthly, a computer program product containing instructions is provided, which, when executed on a computer, cause the computer to perform the method described in the first aspect.

[0035] The technical effects achieved by the second to fifth aspects mentioned above are similar to those achieved by the corresponding technical means in the first aspect, and will not be repeated here. Attached Figure Description

[0036] Figure 1 is a schematic diagram of an implementation environment provided in an embodiment of this application;

[0037] Figure 2 is a schematic diagram of the structure of a computer device provided in an embodiment of this application;

[0038] Figure 3 is a flowchart of a method for identifying malicious programs provided in an embodiment of this application;

[0039] Figure 4 is a schematic diagram of a method for identifying malicious programs provided in an embodiment of this application;

[0040] Figure 5 is a schematic diagram of the structure of a malicious program identification device provided in an embodiment of this application. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0042] To facilitate understanding, before providing a detailed explanation of the malicious program handling methods provided in the embodiments of this application, the terms, application scenarios, and implementation environments involved in the embodiments of this application will be introduced first.

[0043] First, the terms used in the embodiments of this application will be introduced.

[0044] 1. Program, process

[0045] A program is static; it has an executable file containing binary code, which is typically stored on a hard drive. A process is dynamic; it corresponds to one execution of a program, or in other words, the manifestation of a program after it has run. Normally, a process runs when the program's executable file is loaded into memory and executed. One program can correspond to one or more processes; the same program's executable file running on different data sets can constitute different processes.

[0046] 2. Memory

[0047] When a program's executable file is loaded into memory, the operating system allocates a region of memory to cache the executable file. This region is also called the code segment. During program execution, memory regions can also be dynamically allocated; these are the non-code segments. In other words, during program execution, the operating system allocates two parts of memory to the program's process: the code segment and the non-code segment.

[0048] 3. Similarity Hash Algorithm

[0049] For any two objects, after determining their corresponding hash values ​​using a similarity hashing algorithm, the closer these two hash values ​​are, the more similar the two objects are. In other words, two similar objects will also have relatively similar hash values ​​determined by the similarity hashing algorithm. Therefore, the similarity hashing algorithm can map objects from a high-dimensional space to a low-dimensional space, while also ensuring that, with a certain probability, similar objects in a high-dimensional space will remain similar in a low-dimensional space.

[0050] Secondly, the application scenarios involved in the embodiments of this application will be introduced.

[0051] Malicious programs are computer code or software that installs and runs on a user's computer or other terminal without explicit notification or permission, and engages in activities that infringe upon the user's legitimate rights, such as stealing, encrypting, altering, and deleting data, and monitoring the user. Examples include computer viruses, ransomware, keyloggers, password thieves, Word and Excel macro viruses, boot sector viruses, script viruses, Trojans, criminal software, spyware, and adware. With the rapid development of computers and the internet, various malicious programs are emerging in endless streams, posing a serious threat to computer systems, network security, and user privacy.

[0052] The relevant technologies mainly employ two methods for malicious detection: static detection and dynamic detection.

[0053] Static detection refers to the method of detecting malware by utilizing static attribute information or file structure information of a program without running the program. Static attribute information includes, for example, the program's executable file. By performing security checks on the executable file, malicious programs can be identified. However, static detection is easily bypassed; attackers can bypass the detection by modifying and obfuscating the executable file.

[0054] Dynamic detection refers to a method of malicious detection that utilizes behavioral information generated by a program during or after its execution. This behavioral information includes, for example, execution flow, function calls, network connections, and registry modifications. Because this behavioral information is generated after the program has fully started, if the target program is malicious, the malicious behavior has already occurred, making real-time protection and interception difficult.

[0055] Memory, as a dynamic data view of system operation, can capture data at critical moments. It reveals more on-site information than disk forensics, and memory forensics is also an important means of anti-virus and anti-malware. Therefore, this application provides a method for identifying malicious programs. In this method, data in the memory region corresponding to the target program is read to obtain target memory data. This memory region is the memory region allocated by the operating system to the target program's process during its execution. A hash value of the target memory data is determined using a similarity hash algorithm to obtain a first hash value. A second hash value with the smallest distance to the first hash value is determined from a sample hash database. If the distance between the first hash value and the second hash value is less than a distance threshold, and the sample program corresponding to the second hash value is a malicious program, then the target program is determined to be a malicious program.

[0056] Since this application embodiment uses a similarity hash algorithm to determine the hash value of the target memory data, i.e., the first hash value, and then determines whether the target program is malicious by the distance between the first hash value and the second hash value, and since the hash values ​​determined by the similarity hash algorithm for two similar objects are also relatively close, and known malicious programs and their variants are also relatively similar, the method provided by this application embodiment can not only identify known malicious programs, but also identify variants of known malicious programs. That is, this application embodiment can detect unknown threats in a timely manner. Moreover, using a similarity hash algorithm to identify malicious programs does not require frequent updates to the sample hash database, resulting in lower maintenance costs.

[0057] Finally, the implementation environment involved in the embodiments of this application will be described.

[0058] The malicious program identification method provided in this application can be applied to any computer device subjected to software attacks, supporting threat detection, real-time protection, and source tracing. It is highly effective against highly resistant malware such as fileless attacks and memory-resident malware. Computer devices include, but are not limited to, servers, host computers, personal computers, mobile phones, or workstations.

[0059] In some embodiments, the computer device is a device with a Windows or Linux operating system installed, including but not limited to Windows XP, Windows Server 2003, Windows 7, Windows 8, or Windows 10.

[0060] In some embodiments, the computer device in this application is located within a protected network protected by the protective device, i.e., the computer device is a protected device. For example, FIG1 is a schematic diagram of an implementation environment provided by an embodiment of this application. Referring to FIG1, the implementation environment includes a computer device 101, a protective device 102, and a remote server 103.

[0061] Computer device 101 is a protected device located in a protected network. From the perspective of computer device 101, the protected network where computer device 101 resides is an internal network, and the Internet is an external network. For example, computer device 101 is a protected server used to provide services to normal clients (not shown in the figure) in the protected network and the Internet. For example, computer devices include, but are not limited to, application servers or web servers. Application servers include, but are not limited to, game servers, video application servers, file servers, search engine servers, instant messaging servers, etc. Web servers are also called World Wide Web (WWW) servers or website servers. Alternatively, computer device 101 can be a protected host, personal computer, mobile phone, workstation, etc. This application embodiment does not limit the type of computer device 101. In this application embodiment, security software is deployed on computer device 101, such as endpoint detection and response (EDR) software, extended detection and response (XDR) software, intranet protection software, or email security detection software, etc.

[0062] The protection device 102 is deployed between an external network (such as the Internet) and the protected network. For example, the protection device 102 is typically deployed at the boundary of the protected network to protect computer devices within the protected network from attacks from the external network. The protection device 102 can perform security filtering on traffic entering and leaving the protected network, blocking attack traffic to ensure the security of computer devices within the protected network, while allowing normal traffic to ensure that computer devices within the protected network can communicate normally with the external network.

[0063] Protection device 102 includes, but is not limited to, one or more of the following: firewall, security gateway (such as a router or switch), intrusion detection system (IDS) device, intrusion prevention system (IPS) device, unified threat management (UTM) device, AV device, anti-DDoS device, and next-generation firewall (NGFW). Protection device 102 can work in conjunction with security software on computer devices to provide multiple layers of protection. For example, protection device 102 may identify emails with phishing attachments as legitimate traffic; in this case, the security software on computer device 101 can further detect and identify the phishing attachments.

[0064] In some embodiments, the protection device 102 may be the same device as the computer device 101. In this case, protection software is deployed on the computer device 101 to implement the functions of the protection device 102.

[0065] Remote server 103 is the control facility for attackers to launch remote attacks. In some embodiments, remote server 103 is located on an external network (such as the Internet), meaning that attackers launch remote attacks from the external network to computer device 101 in the protected network through remote server 103. Remote server 103 is, for example, a command and control (CC) server, which provides support for network attacks, hacking activities, or other illegal activities. CC servers are characterized by high controllability and configurability, and can communicate with malicious programs to remotely control and operate infected computer devices. For example, a CC server may compromise computer device 101 by sending emails with phishing attachments to computer device 101. Alternatively, remote server 103 can also be other computer devices used by attackers to launch attacks.

[0066] In some embodiments, the implementation environment further includes a server 104 for providing security services (to distinguish it from the remote server 103 described above, this server 104 will be referred to as the security server 104 hereinafter). The security server 104 is, for example, a cloud security server. The security server 104 is communicatively connected to the computer device 101 to receive alarm notifications sent by the computer device 101. For example, the security server 104 is used to collect and summarize alarm notifications from multiple computer devices 101 to determine the attacker's location, attack methods, etc.

[0067] Those skilled in the art should understand that the computer equipment, protection equipment, remote server, and security server described above are merely examples. Other existing or future computer equipment, protection equipment, remote server, and security server that are applicable to the embodiments of this application should also be included within the scope of protection of the embodiments of this application, and are hereby incorporated by reference.

[0068] It should be noted that the application scenarios and implementation environments described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the emergence of new application scenarios and the evolution of technologies and equipment, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0069] Please refer to Figure 2, which is a schematic diagram of the structure of a computer device according to an embodiment of this application. The computer device may be the computer device 101 shown in Figure 1. The computer device includes at least one processor 201, a communication bus 202, a memory 203, and at least one communication interface 204.

[0070] The processor 201 can be a general-purpose central processing unit (CPU), a network processor (NP), a microprocessor, or one or more integrated circuits for implementing the solutions of this application, such as an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The aforementioned PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0071] The communication bus 202 is used to transmit information between the aforementioned components. The communication bus 202 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, it is represented by only one thick line in the figure, but this does not indicate that there is only one bus or one type of bus.

[0072] The memory 203 may be a read-only memory (ROM), a random access memory (RAM), an electrically erasable programmable read-only memory (EEPROM), an optical disc (including a compact disc read-only memory (CD-ROM), a compressed optical disc, a laser disc, a digital versatile optical disc, a Blu-ray disc, etc.), a magnetic disk storage medium, or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures that can be accessed by a computer, but not limited thereto. The memory 203 may exist independently and be connected to the processor 201 via the communication bus 202. The memory 203 may also be integrated with the processor 201.

[0073] Communication interface 204 uses any transceiver-like device for communicating with other devices or communication networks. Communication interface 204 includes a wired communication interface and may also include a wireless communication interface. The wired communication interface may be, for example, an Ethernet interface. The Ethernet interface may be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface may be a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof.

[0074] As an example, processor 201 may include one or more CPUs, such as CPU0 and CPU1 as shown in FIG2.

[0075] As an example, a computer device may include multiple processors, such as processor 201 and processor 205 as shown in Figure 2. Each of these processors may be a single-core processor or a multi-core processor. Here, "processor" may refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0076] In some embodiments, the computer device may further include output devices and input devices. The output device communicates with the processor 201 and can display information in various ways. For example, the output device may be a liquid crystal display (LCD), a light-emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device communicates with the processor 201 and can receive user input in various ways. For example, the input device may be a mouse, keyboard, touchscreen device, or sensing device, etc.

[0077] In some embodiments, memory 203 is used to store program code 210 that executes the scheme of this application, and processor 201 can execute the program code 210 stored in memory 203. The program code 210 may include one or more software modules, and the computer device can implement the malicious program identification method provided in the following embodiments through processor 201 and program code 210 in memory 203.

[0078] The method for identifying malicious programs provided in the embodiments of this application will be explained in detail below.

[0079] Figure 3 is a flowchart of a method for identifying malicious programs provided in an embodiment of this application. This method is applied to a computer device; for example, it is executed by security software running on the computer device. Referring to Figure 3, the method includes the following steps.

[0080] Step 301: Read the data in the memory area corresponding to the target program to obtain the target memory data. This memory area is the memory area allocated by the operating system to the process of the target program during its execution.

[0081] Based on the above description, when the executable file of a program is loaded into memory, the operating system allocates a region from memory to cache the executable file. This region is also called the code segment. During program execution, memory regions can be dynamically allocated; these are the non-code segments. Therefore, for the target program, the memory regions allocated by the operating system to the target program's process during execution include both the code and non-code segments. Alternatively, in some embodiments, the memory regions allocated by the operating system to the target program's process during execution may include the non-code segment but not the code segment. Of course, the memory regions allocated by the operating system to the target program's process during execution may also include the code segment but not the non-code segment.

[0082] Since programs are static and processes are dynamic, and a process is the manifestation of a program after it has run, for a target program, once its executable file is loaded into memory, the target program is considered to have been run. The memory region read at this time can be considered the memory region of the process corresponding to the target program. For ease of description, this application embodiment refers to the memory region allocated by the operating system to the process of the target program as the memory region corresponding to the target program.

[0083] There are several ways to read data from the memory region corresponding to the target program. Two of these methods will be introduced below.

[0084] The first implementation method uses the address of the memory region corresponding to the target program as the parameter of the memory read function, and reads the target memory data through the memory read function.

[0085] A memory read function is a function used to read data from a memory region. Typically, a function includes input parameters (also called input arguments) and output parameters (also called output arguments). Therefore, the address of the memory region corresponding to the target program can be used as the input parameter of the memory read function, and the data in the target program's memory region can be read using the memory read function to obtain the target memory data.

[0086] In some embodiments, the input parameters of the memory read function include the starting address (also called the base address) of the memory region and the size of the memory region. In this case, the starting address and size of the memory region corresponding to the target program are used as the input parameters of the memory read function, and the data in the memory region corresponding to the target program is read by the memory read function to obtain the target memory data.

[0087] In other embodiments, the input parameters of the memory read function include the start and end addresses of the memory region. In this case, the start and end addresses of the memory region corresponding to the target program are used as input parameters of the memory read function, which reads the data in the memory region corresponding to the target program to obtain the target memory data.

[0088] For example, in Windows systems, the memory read function is the ReadProcessMemory function, which is shown below:

[0089] As can be seen from the above functions, the input parameters of the ReadProcessMemory function include the starting address and size of the memory region. Therefore, by using the starting address and size of the memory region corresponding to the target program as input parameters, the ReadProcessMemory function reads data from the memory region corresponding to the target program to obtain the target memory data.

[0090] The second implementation method reads the target memory data from the file in the target path based on the address of the memory region corresponding to the target program. The target path refers to the path used to store memory data.

[0091] Since the target path refers to the path used to store memory data, the file in the target path is also used to store memory data. In some embodiments, the target path can be determined based on the identifier of the process corresponding to the target program, and then the data in the memory region corresponding to the target program can be read from the file in the target path based on the address of the memory region corresponding to the target program to obtain the target memory data.

[0092] In some embodiments, based on the starting address and size of the memory region corresponding to the target program, the data in the memory region corresponding to the target program is read by a read function to obtain the target memory data.

[0093] In other embodiments, based on the start and end addresses of the memory region corresponding to the target program, a read function is used to read the data in the memory region corresponding to the target program to obtain the target memory data.

[0094] A process identifier is used to uniquely identify a process at any given time. That is, each process running at the same time has a different and unique identifier. However, processes running at different times may have the same identifier. For example, a process identifier is called a process identification (PID).

[0095] It should be noted that the file in the target path may also store other data besides the data in the memory area corresponding to the target program, but this application embodiment does not limit this.

[0096] For example, in a Linux system, the target path is / proc / [pid] / mem, where pid is the process identifier of the target program. Based on the memory address of the target program, data in the memory region corresponding to the target program is read from the file at the target path to obtain the target memory data.

[0097] The above describes two methods for reading target memory data. In other embodiments, target memory data can also be read in other ways. For example, target memory data can be directly obtained using memory acquisition tools such as AvDump, FTK Imager, Memdump, fmem, and Volatility.

[0098] In some embodiments, the target program needs to be determined before reading data from the memory region corresponding to the target program. The following section uses two implementation methods as examples to illustrate the process of determining the target program.

[0099] The first implementation method is to identify the currently running program as the target program if the currently running program is the specified program. The specified program includes programs that have been maliciously exploited.

[0100] Since programs that have been maliciously exploited are usually more likely to be maliciously exploited again, if the currently running program is a program that has been maliciously exploited, then the currently running program is identified as the target program, and then the method provided in this application embodiment is used to determine whether the target program is a malicious program, thereby improving the efficiency of malicious program identification.

[0101] In other embodiments, any program launched and run by the user can be used as the target program; that is, the specified program also includes programs launched and run by the user. In other words, malicious program identification is performed on each program launched and run by the user, thereby minimizing the probability of missing malicious programs.

[0102] It should be noted that the designated procedure can be specified by researchers or determined through historical malicious program identification; this application embodiment does not limit this.

[0103] The second approach involves determining the characteristics of the memory region corresponding to the currently running program. If the characteristics of the memory region corresponding to the currently running program meet the malicious memory assessment criteria, then the currently running program is identified as the target program.

[0104] Malicious memory assessment criteria are used to evaluate whether a memory region is a suspicious memory region. Programs corresponding to suspicious memory regions are usually also suspicious. Therefore, identifying the target program through malicious memory assessment criteria can improve the efficiency of malicious program identification.

[0105] In some embodiments, the characteristics of a memory region include at least one of the following: memory permissions, memory state, type of memory data, and memory size. Of course, other characteristics of a memory region may also include, such as memory type.

[0106] In some embodiments, malicious memory assessment criteria include at least one of the following:

[0107] (1) The memory region must simultaneously have read permission, write permission, and execute permission;

[0108] (2) The data in the memory region is in a committed state, the memory region has executable permissions, and the memory region includes executable file headers other than the executable file header of the target program;

[0109] (3) The size of the memory region is less than the size threshold and the memory region contains an executable program;

[0110] Read permission means that data in the memory area can be read, write permission means that data can be written to the memory area, and execute permission means that an executable program is stored in the memory area.

[0111] Typically, the permissions of a memory region (also known as memory permissions) include some of the permissions of read, write, and execute. The probability of having all permissions is small. Therefore, if a memory region has read, write, and execute permissions at the same time, it is considered a suspicious memory region.

[0112] Data in a memory region being in a committed state means that the data has been committed to the memory region. This can also be understood as the data in the memory region being committed, or the memory state being committed. For example, process data has been written to the memory region.

[0113] The executable file header refers to the beginning of a program's executable file. For Windows systems, the executable file header is the portable executable (PE) header, which usually begins with MZ.

[0114] If the data in the memory region is in a committed state, it means that the data in the memory region can be accessed later. At this time, if the memory region also contains other executable file headers (i.e., the type of memory data is an executable file header) and has executable permissions, it indicates that the program is more likely to be a malicious program. Therefore, this memory region is considered a suspicious memory region.

[0115] For example, based on the above description, during program execution, the operating system allocates memory to the program's process, including the code segment and the non-code segment. The fact that data in the memory segment is in a committed state usually refers to data in the non-code segment being in a committed state. When data in the non-code segment is in a committed state, it indicates that the data in the non-code segment can be accessed and is likely to be used later. If, in this case, the non-code segment also contains other executable file headers with executable permissions, it indicates a high probability that the program is malicious; therefore, this memory segment is considered suspicious.

[0116] Normally, the memory area storing executable programs is relatively large, which facilitates the execution of the executable program. However, malicious programs usually request a smaller memory area in order to disguise themselves. Therefore, if the size of a memory area is less than the size threshold and an executable program is stored in the memory area, it indicates that the program is more likely to be malicious. Thus, this memory area is considered a suspicious memory area.

[0117] The size threshold can be set based on experience, or it can be set in other ways. For example, based on experience, the probability of storing an executable program in a memory area smaller than 4k is relatively small, so the size threshold can be set to 4k.

[0118] It should be noted that the above are examples of several evaluation criteria. In other embodiments, other evaluation criteria may also be included, and this application does not limit them.

[0119] Step 302: Determine the hash value of the target memory data using a similarity hashing algorithm to obtain the first hash value.

[0120] In some embodiments, the similarity hashing algorithm includes locality-sensitive hashing and fuzzy hashing. Of course, other similarity hashing algorithms may also be included, and this application embodiment does not limit this.

[0121] For example, the Locality Sensitive Hash algorithm is the Trend Micro Locality Sensitive Hash (TLSH) algorithm, and the Fuzzy Hash algorithm is the Context-Triggered Piecewise Hash (CTPH) algorithm.

[0122] In some embodiments, before determining the hash value of the target memory data using a similarity hashing algorithm, the target memory data can be preprocessed, and the hash value of the preprocessed target memory data can be determined using a similarity hashing algorithm to obtain a first hash value.

[0123] As an example, preprocessing includes feature extraction, that is, extracting features from the target in-memory data. Then, a similarity hashing algorithm can be used to determine the hash value of the extracted features, resulting in a first hash value.

[0124] As another example, preprocessing operations include converting to an image, that is, transforming the target memory data into an image. In this way, a similarity hashing algorithm can be used to determine the hash value of the converted image, obtaining a first hash value.

[0125] As another example, the preprocessing operation includes converting to a string, that is, converting the target memory data into a string. Then, a similarity hash algorithm can be used to determine the hash value of the converted string, obtaining the first hash value.

[0126] Step 303: Determine the second hash value that has the smallest distance from the first hash value from the sample hash library.

[0127] The distance between the first hash value and the second hash value is used to characterize the similarity between the two hash values. The smaller the distance between the first hash value and the second hash value, the higher the similarity between the two hash values; the larger the distance between the first hash value and the second hash value, the lower the similarity between the two hash values.

[0128] There are various ways to determine the distance between the first hash value and the second hash value, and this application embodiment does not limit this one.

[0129] The sample hash library is used to store the hash values ​​of data in the memory area corresponding to the sample program. This sample program includes malicious programs. In other embodiments, the sample program may also include non-malicious programs.

[0130] It should be noted that there are various ways to determine the second hash value with the smallest distance from the first hash value from the sample hash library, such as brute-force search, nearest neighbor search algorithm, clustering algorithm, etc., and this application embodiment does not limit this.

[0131] In addition, the sample hash library can be obtained from a secure server, or it can be obtained in other ways, which are not limited in this application embodiment.

[0132] Step 304: If the distance between the first hash value and the second hash value is less than the distance threshold, and the sample program corresponding to the second hash value is a malicious program, then the target program is determined to be a malicious program.

[0133] If the distance between the first hash value and the second hash value is less than a distance threshold, it indicates that the target program is very similar to the sample program corresponding to the second hash value. In this case, if the sample program corresponding to the second hash value is malicious, then the target program is also determined to be malicious.

[0134] The distance threshold can be set empirically, or it can be set in other ways to balance the false alarm rate and accuracy. For example, the distance threshold can be 50 or 100.

[0135] In some embodiments, after determining that the target program is malicious, it can be processed according to a program handling strategy to prevent the target program from attacking the computer device, thus avoiding malicious behavior during its operation and preventing malicious impact. For example, the program handling strategy includes terminating the process corresponding to the target program, isolating or deleting data in the memory area corresponding to the target program, etc.

[0136] In other embodiments, after processing the target program according to the program processing strategy, the processing result can be displayed, allowing the user to know the outcome of the malicious program's actions and thus promptly predict the malicious impact caused by the malicious program. Alternatively, the processing result can also be sent to a security server.

[0137] In some embodiments, the sample hash database also includes the identifier of the malicious sample family corresponding to the second hash value. Thus, after determining that the target program is malicious, an alert can be output, which includes the identifier of the target program and the identifier of the malicious sample family corresponding to the second hash value.

[0138] As an example, the computer device outputs alarm information, including but not limited to displaying alarm information for the user to view, thereby alerting the user that the computer device may be under attack; and / or, the computer device sends alarm information to a security server for tracing and hunting.

[0139] In some embodiments, after the computer device sends an alarm message to the security server, the security server can update the first hash value to the sample hash database and add the target program to the malicious sample family corresponding to the second sample hash value.

[0140] The target program's identifier is used to uniquely identify the target program, and is typically one or more of the target program's name, the hash value of the target program's executable file, or a combination thereof. The identifier of the malicious sample family corresponding to the second hash value is used to uniquely identify the malicious sample family corresponding to the second hash value. The malicious sample family corresponding to the second hash value includes the sample program corresponding to the second hash value and sample programs that are associated with it. Generally, sample programs belonging to the same sample family are either all malicious programs or all non-malicious programs.

[0141] It should be noted that alarm information can include not only the information mentioned above, but also other information, such as the trigger time of the malicious program or one or more of the users who triggered the malicious program.

[0142] Since this application embodiment uses a similarity hash algorithm to determine the hash value of the target memory data, i.e., the first hash value, and then determines whether the target program is malicious by the distance between the first hash value and the second hash value, and since the hash values ​​determined by the similarity hash algorithm for two similar objects are also quite close, and known malicious programs and their variants are also quite similar, the method provided by this application embodiment can not only identify known malicious programs, but also identify variants of known malicious programs. That is, this application embodiment can detect unknown threats in a timely manner and reduce the losses caused by malicious programs. Moreover, since the hash values ​​determined by the similarity hash algorithm for two similar objects are also quite close, identifying malicious programs by the similarity hash algorithm does not require frequent updates to the sample hash database, resulting in low maintenance costs.

[0143] The method for identifying malicious programs provided in this application embodiment will be described again next with reference to Figure 4.

[0144] Referring to Figure 4, the computer device includes a data acquisition module, a detection module, and a response module. The data acquisition module reads data from the memory region corresponding to the target program to obtain the target memory data. The detection module determines the hash value of the target memory data using a similarity hash algorithm, obtaining a first hash value. It then determines a second hash value from the sample hash library provided by the cloud-side security server that has the smallest distance to the first hash value. If the distance between the first and second hash values ​​is less than a distance threshold, and the sample program corresponding to the second hash value is malicious, the target program is determined to be malicious. The response module, in the case of a malicious program, takes action against the target program to prevent it from attacking the computer device. It also sends an alarm message to the cloud-side security server, which includes the identifier of the target program and the identifier of the malicious sample family corresponding to the second hash value. The cloud-side security server updates the first hash value to the sample hash library and adds the target program to the malicious sample family corresponding to the second sample hash value.

[0145] Figure 5 is a schematic diagram of a malicious program identification device provided in an embodiment of this application. This device can be implemented as part or all of a computer device by software, hardware, or a combination of both. This computer device can be the computer device shown in Figure 1 or Figure 2. Referring to Figure 5, the device includes: a memory data reading module 501, a first hash value determination module 502, a second hash value determination module 503, and a malicious program determination module 504. The memory data reading module 501 can be the acquisition module in Figure 4, and the first hash value determination module 502, the second hash value determination module 503, and the malicious program determination module 504 can be the detection modules in Figure 4.

[0146] The memory data reading module 501 is used to read data in the memory area corresponding to the target program to obtain the target memory data. The memory area is the memory area allocated by the operating system to the process of the target program during the execution of the target program.

[0147] The first hash value determination module 502 is used to determine the hash value of the target memory data through a similarity hash algorithm to obtain the first hash value;

[0148] The second hash value determination module 503 is used to determine the second hash value that has the smallest distance from the first hash value from the sample hash library;

[0149] The malicious program determination module 504 is used to determine that the target program is a malicious program if the distance between the first hash value and the second hash value is less than a distance threshold and the sample program corresponding to the second hash value is a malicious program.

[0150] In one possible implementation, the device further includes:

[0151] The target program determination module is used to determine the currently running program as the target program if it is a specified program. The specified program includes programs that have been maliciously exploited.

[0152] In one possible implementation, the device further includes:

[0153] The memory feature determination module is used to determine the characteristics of the memory region corresponding to the currently running program;

[0154] The target program determination module is used to determine the currently running program as the target program if the characteristics of the memory region corresponding to the currently running program meet the malicious memory assessment criteria.

[0155] In one possible implementation, the characteristics of the memory region include at least one of the following: memory permissions, memory state, type of memory data, and memory size.

[0156] In one possible implementation, the malicious memory assessment criteria include at least one of the following:

[0157] The memory region must simultaneously have read, write, and execute permissions;

[0158] The data in the memory region is in a committed state, the memory region has executable permissions, and the memory region includes executable file headers other than the executable file header of the target program;

[0159] The memory region is smaller than the size threshold and contains an executable program;

[0160] Read permission means that data in the memory area can be read, write permission means that data can be written to the memory area, and execute permission means that an executable program is stored in the memory area.

[0161] In one possible implementation, the memory data reading module 501 is specifically used for:

[0162] The address of the memory region corresponding to the target program is used as the parameter of the memory read function, which then reads the target memory data.

[0163] In one possible implementation, the memory data reading module 501 is specifically used for:

[0164] Based on the address of the memory region corresponding to the target program, the target memory data is read from the file in the target path, where the target path refers to the path used to store the memory data.

[0165] In one possible implementation, the sample hash library further includes an identifier for the malicious sample family corresponding to the second hash value; the apparatus also includes:

[0166] The alarm module is used to output alarm information, which includes the identifier of the target program and the identifier of the malicious sample family corresponding to the second hash value.

[0167] In one possible implementation, similarity hashing algorithms include locality-sensitive hashing and fuzzy hashing.

[0168] Since this application embodiment uses a similarity hash algorithm to determine the hash value of the target memory data, i.e., the first hash value, and then determines whether the target program is malicious by the distance between the first hash value and the second hash value, and since the hash values ​​determined by the similarity hash algorithm for two similar objects are also quite close, and known malicious programs and their variants are also quite similar, the method provided by this application embodiment can not only identify known malicious programs, but also identify variants of known malicious programs. That is, this application embodiment can detect unknown threats in a timely manner and reduce the losses caused by malicious programs. Moreover, since the hash values ​​determined by the similarity hash algorithm for two similar objects are also quite close, identifying malicious programs by the similarity hash algorithm does not require frequent updates to the sample hash database, resulting in low maintenance costs.

[0169] It should be noted that the malware identification device provided in the above embodiments is only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the malware identification device and malware identification method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0170] This application also provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the aforementioned method for identifying malicious programs.

[0171] This application also provides a computer program product containing instructions that, when executed on a computer, cause the computer to perform the aforementioned method for identifying malicious programs.

[0172] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer, or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., digital versatile disc (DVD)), or a semiconductor medium (e.g., solid-state disk (SSD)). It is worth noting that the computer-readable storage medium mentioned in the embodiments of this application can be a non-volatile storage medium; in other words, it can be a non-transient storage medium.

[0173] It should be understood that "multiple" as mentioned herein refers to two or more. In the description of the embodiments of this application, unless otherwise stated, " / " means "or," for example, A / B can mean A or B; "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. In addition, to facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first," "second," etc., are used in the embodiments of this application to distinguish identical or similar items with substantially the same function and effect. Those skilled in the art will understand that the terms "first," "second," etc., do not limit the quantity or execution order, and the terms "first," "second," etc., do not necessarily imply that they are different.

[0174] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, data stored, data displayed, etc.) and signals involved in the embodiments of this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0175] The above descriptions are embodiments provided in this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the principles of this application should be included within the protection scope of this application.

Claims

1. A method for identifying malicious programs, characterized in that, The method includes: Read the data in the memory area corresponding to the target program to obtain the target memory data. The memory area is the memory area allocated by the operating system to the process of the target program during the execution of the target program. The hash value of the target memory data is determined using a similarity hashing algorithm to obtain a first hash value; Determine the second hash value that has the smallest distance from the first hash value from the sample hash database; If the distance between the first hash value and the second hash value is less than a distance threshold, and the sample program corresponding to the second hash value is a malicious program, then the target program is determined to be a malicious program.

2. The method as described in claim 1, characterized in that, Before reading data from the memory region corresponding to the target program, the method further includes: If the currently running program is the specified program, then the currently running program is identified as the target program, and the specified program includes programs that have been maliciously exploited.

3. The method as described in claim 1, characterized in that, Before reading data from the memory region corresponding to the target program, the method further includes: Determine the characteristics of the memory region corresponding to the currently running program; If the characteristics of the memory region corresponding to the currently running program meet the malicious memory assessment criteria, then the currently running program is identified as the target program.

4. The method as described in claim 3, characterized in that, The characteristics of the memory region include at least one of the following: memory permissions, memory status, type of memory data, and memory size.

5. The method as described in claim 3, characterized in that, The malicious memory assessment criteria include at least one of the following: The memory region must simultaneously have read, write, and execute permissions; The data in the memory region is in a committed state, the memory region has executable permissions, and the memory region includes executable file headers other than the executable file header of the target program; The memory region is smaller than the size threshold and contains an executable program; The read permission means that data in the memory area can be read, the write permission means that data can be written to the memory area, and the execute permission means that an executable program is stored in the memory area.

6. The method as described in claim 1, characterized in that, The step of reading data from the memory region corresponding to the target program to obtain target memory data includes: The address of the memory region corresponding to the target program is used as a parameter of the memory read function, and the target memory data is read through the memory read function.

7. The method as described in claim 1, characterized in that, The step of reading data from the memory region corresponding to the target program to obtain target memory data includes: Based on the address of the memory region corresponding to the target program, the target memory data is read from the file in the target path, where the target path refers to the path used to store memory data.

8. The method according to any one of claims 1-7, characterized in that, The sample hash library also includes the identifier of the malicious sample family corresponding to the second hash value; After determining that the target program is malicious, the method further includes: Output alarm information, which includes the identifier of the target program and the identifier of the malicious sample family corresponding to the second hash value.

9. The method according to any one of claims 1-8, characterized in that, The similarity hashing algorithms include locality-sensitive hashing and fuzzy hashing.

10. A malicious program identification device, characterized in that, The device includes: The memory data reading module is used to read data in the memory area corresponding to the target program to obtain the target memory data. The memory area is the memory area allocated by the operating system to the process of the target program during the operation of the target program. The first hash value determination module is used to determine the hash value of the target memory data through a similarity hash algorithm to obtain the first hash value; The second hash value determination module is used to determine the second hash value that has the smallest distance from the first hash value from the sample hash database; The malicious program determination module is used to determine that the target program is a malicious program if the distance between the first hash value and the second hash value is less than a distance threshold and the sample program corresponding to the second hash value is a malicious program.

11. The apparatus as claimed in claim 10, characterized in that, The device further includes: The target program determination module is used to determine the currently running program as the target program if the currently running program is a specified program, wherein the specified program includes programs that have been maliciously exploited.

12. The apparatus as claimed in claim 10, characterized in that, The device further includes: The memory feature determination module is used to determine the characteristics of the memory region corresponding to the currently running program; The target program determination module is used to determine the currently running program as the target program if the characteristics of the memory region corresponding to the currently running program meet the malicious memory evaluation criteria.

13. The apparatus as claimed in claim 12, characterized in that, The characteristics of the memory region include at least one of the following: memory permissions, memory status, type of memory data, and memory size.

14. The apparatus as claimed in claim 12, characterized in that, The malicious memory assessment criteria include at least one of the following: The memory region must simultaneously have read, write, and execute permissions; The data in the memory region is in a committed state, the memory region has executable permissions, and the memory region includes executable file headers other than the executable file header of the target program; The memory region is smaller than the size threshold and contains an executable program; The read permission means that data in the memory area can be read, the write permission means that data can be written to the memory area, and the execute permission means that an executable program is stored in the memory area.

15. The apparatus as claimed in claim 10, characterized in that, The memory data reading module is specifically used for: The address of the memory region corresponding to the target program is used as a parameter of the memory read function, and the target memory data is read through the memory read function.

16. The apparatus as claimed in claim 10, characterized in that, The memory data reading module is specifically used for: Based on the address of the memory region corresponding to the target program, the target memory data is read from the file in the target path, where the target path refers to the path used to store memory data.

17. The apparatus according to any one of claims 10-16, characterized in that, The sample hash database also includes an identifier for the malicious sample family corresponding to the second hash value; the device further includes: The alarm module is used to output alarm information, which includes the identifier of the target program and the identifier of the malicious sample family corresponding to the second hash value.

18. The apparatus according to any one of claims 10-17, characterized in that, The similarity hashing algorithms include locality-sensitive hashing and fuzzy hashing.

19. A computer device, characterized in that, The computer device includes a memory and a processor, the memory being used to store a computer program, and the processor being configured to execute the computer program stored in the memory to implement the method of any one of claims 1-9.

20. A computer-readable storage medium, characterized in that, The storage medium stores instructions that, when executed on the computer, cause the computer to perform the method described in any one of claims 1-9.

21. A computer program product containing instructions, characterized in that, When the instructions are executed on a computer, the computer causes the computer to perform the method according to any one of claims 1-9.

Images