WO2025189909A1 - Application processing method and apparatus, and attack defense system - Google Patents

Abstract

The present application relates to the field of computer security, and provides an application processing method and apparatus, and an attack defense system. A computer device monitors whether an application running on the computer device loads a network dynamic link library. If it is detected that the application loads the network dynamic link library, and a memory block where the running code used for loading the network dynamic link library in the application is located meets a shellcode running condition, the execution of the application is terminated before the application successfully calls a network connection function in the network dynamic link library. In this way, an application running shellcode can be prevented from being connected to a remote server, thereby preventing the computer device from being controlled by an attacker by means of the remote server or preventing internal data of the computer device from being stolen by the attacker by means of the remote server.

Description

Application processing method and device, attack defense system

This application claims priority to Chinese patent application number 202410272421.3, filed on March 11, 2024, entitled “Application Processing Method and Device, Attack Defense System,” the entire contents of which are incorporated herein by reference.

Technical Field

The present application relates to the field of computer security, and in particular to an application processing method and device, and an attack defense system.

Background Art

Shellcode is a piece of machine code executed to exploit software vulnerabilities. It's used to perform specific tasks within a computer system, such as providing remote access or escalating privileges. Therefore, shellcode is often used to launch malicious attacks against computer systems. In other words, shellcode is a form of malicious code. Because shellcode is simply a piece of machine code, it can easily evade detection through methods such as distortion or encryption. Furthermore, shellcode is often used to decrypt malicious files and execute them in memory. Since shellcode itself doesn't perform any actual malicious functions, it can easily evade static anti-virus (AV) detection.

In scenarios where shellcode is used as a malicious program to attack a computer device, related technologies provide a solution for identifying malicious programs running on the computer device by performing memory scanning on the computer device to detect whether malicious files are loaded into the computer device's memory. However, when using the memory scanning technology provided by related technologies, the malicious program can only be identified after the shellcode has loaded the malicious file into the computer device's memory. Before the malicious program is identified, the shellcode may have already run the malicious file, indicating that actual malicious behavior has already occurred, resulting in the computer device being remotely attacked, such as the computer device being remotely controlled by the attacker or the data in the computer device being stolen by the attacker.

Summary of the Invention

The present application provides an application processing method and device, and an attack defense system.

In a first aspect, a method for processing an application is provided. The method includes: a computer device monitors whether a sample program running on the computer device loads a network dynamic link library. The network dynamic link library is used to support network communication of the application. The network dynamic link library includes one or more network connection functions. In response to monitoring that the sample program loads the network dynamic link library, the computer device determines whether a target memory block meets the shellcode running condition, where the target memory block is the memory block where the running code for loading the network dynamic link library is located in the sample program. If the target memory block meets the shellcode running condition, the computer device executes a malicious program processing flow for the sample program. The malicious program processing flow includes: terminating the execution of the sample program before the sample program successfully calls the network connection function in the network dynamic link library. The target memory block meets the shellcode running condition, that is, the running code in the target memory block is shellcode.

In the present application, when a computer device determines that shellcode is running in a sample program, the sample program is treated as a malicious program, so that the sample program is terminated before the network connection function in the network dynamic link library is successfully called, so as to prevent the application from connecting to the remote server, thereby preventing the computer device from being controlled by an attacker through the remote server, or the internal data of the computer device from being stolen by an attacker through the remote server, thereby achieving protection for the computer device.

Optionally, the target memory block is determined to meet the shellcode execution condition when the target memory block meets any one of the following conditions. The conditions include: the size of the target memory block is equal to the memory page size in the operating system of the computer device; the target memory block has private permission, writable permission, and executable permission; and the target memory block contains a format header of a portable executable (PE) file (or the target memory block contains a complete PE file).

Optionally, an implementation method for a computer device to monitor whether a sample program running on the computer device loads a network dynamic link library includes: the computer device hooks a dynamic library loading function in the operating system of the computer device through a first hook function to monitor whether the sample program loads the network dynamic link library, and the dynamic library loading function is used to load the network dynamic link library.

In this application, the computer device uses hook technology to monitor whether the running sample program loads the network dynamic link library.

Optionally, the first hook function is a user-mode hook function in the sample program, and the first hook function is injected into the sample program after the sample program is started. Alternatively, the first hook function is a kernel-mode hook function in the kernel of the computer device.

In this application, the computer device uses user-mode hook technology to monitor whether the running sample program loads the network dynamic link library, or uses kernel-mode hook technology to monitor whether the running sample program loads the network dynamic link library.

Optionally, the computer device executes a malicious program processing process on the sample program, including: obtaining network connection parameters provided by the sample program when the sample program attempts to call a network connection function in a network dynamic link library, and terminating execution of the sample program before the sample program successfully calls the network connection function in the network dynamic link library. The network connection parameters include network address information of a remote server that the sample program attempts to connect to.

This application helps to provide security protection against network attacks carried out by the attacker through the control facility by obtaining the network address information of the attacker's control facility before the malicious program in the computer device commits any actual malicious behavior.

Optionally, one implementation of a computer device obtaining network connection parameters provided by a sample program when attempting to call a network connection function in a network dynamic link library includes: the computer device suspending execution of the sample program and, during the suspension period, hooking the network connection function in the network dynamic link library using a second hook function. After the computer device completes hooking the network connection function in the network dynamic link library using the second hook function, it resumes execution of the sample program. In response to the sample program calling the network connection function in the network dynamic link library, the computer device obtains, through the second hook function, the network connection parameters provided by the sample program when calling the network connection function.

In this application, the computer device uses hook technology to obtain the network connection parameters provided by the sample program without querying the configuration file of the sample program. The network address information of the attacker's control facility can also be obtained for fileless attack scenarios. It is highly feasible and can cover more attack scenarios.

Optionally, the second hook function is a user-mode hook function in the sample program, and the second hook function is injected into the sample program after the sample program is started. Alternatively, the second hook function is a kernel-mode hook function in the kernel of the computer device.

Optionally, the computer device also sends the network address information of the remote server to a protection device deployed between the computer device and the remote server, and the network address information of the remote server is used by the protection device to intercept traffic from and/or traffic to the remote server.

In this application, the computer device provides the protection device with the network address information of the remote server identified as the attacker's control facility. The protection device can prevent the data in the computer devices within the protected network from being stolen by intercepting the traffic sent from the protected network to the remote server. The protection device can prevent the computer devices within the protected network from being remotely controlled by intercepting the traffic sent from the remote server to the protected network. This application realizes the global ban of the attacker's control facility by linking the computer device with the protection device, thereby protecting all computer devices within the protected network from remote attacks by the attacker.

Optionally, the network address information of the remote server includes one or more of the Internet Protocol (IP) address of the remote server, the domain name address of the remote server, or the port number of the remote server.

Optionally, the above method is executed by security software running in a computer device.

In a second aspect, a device for processing malicious programs is provided. The device is applied to a computer device. The device includes multiple functional modules that interact with each other to implement the method of the first aspect and its respective embodiments. The multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be arbitrarily combined or divided based on the specific implementation.

In a third aspect, a computer device is provided, comprising: a memory, a network interface, and at least one processor. The memory is configured to store program instructions, and the at least one processor reads the program instructions stored in the memory, thereby causing the computer device to execute the method of the first aspect and its respective embodiments.

In a fourth aspect, an attack defense system is provided, comprising: a computer device and a protection device, wherein the computer device is located within a protected network protected by the protection device, wherein the computer device is configured to execute the method of the first aspect and its respective embodiments.

For example, a computer device is configured to monitor whether a sample program running on the computer device loads a network dynamic link library (DLL), which is used to support network communication for applications and includes one or more network connection functions. The computer device is further configured to, in response to monitoring the sample program loading the DLL, determine whether a target memory block meets a shellcode execution condition, where the target memory block is the memory block containing the execution code in the sample program used to load the DLL. If the target memory block meets the shellcode execution condition, execute a malicious program processing flow on the sample program. The malicious program processing flow includes obtaining network connection parameters provided by the sample program when attempting to call a network connection function in the DLL, and terminating execution of the sample program before the sample program successfully calls the network connection function in the DLL. The network connection parameters include network address information of a remote server that the sample program attempts to connect to. The computer device is further configured to transmit the remote server's network address information to a protection device. The protection device is configured to intercept traffic from and/or to the remote server based on the remote server's network address information.

Optionally, the attack defense system further includes a cloud security server. The computer device and/or the protection device is further configured to send the network address information of the remote server to the cloud security server. The cloud security server is configured to aggregate the network address information of remote servers (malicious servers) collected from various sources. Optionally, the cloud security server is further configured to provide the subscriber with an attacker profile based on subscription requirements. The attacker profile includes, but is not limited to, the malicious server's network address information and/or attack behavior characteristics.

In a fifth aspect, an attack defense system is provided, comprising: a computer device and a cloud security server, wherein the computer device is configured to execute the method of the first aspect and its respective embodiments.

For example, a computer device is used to monitor whether a sample program running on the computer device loads a network dynamic link library, which is used to support network communication for applications and includes one or more network connection functions. The computer device is also used to, in response to monitoring the sample program loading the network dynamic link library, determine whether a target memory block meets the shellcode execution condition, where the target memory block is the memory block where the execution code used to load the network dynamic link library in the sample program is located; and if the target memory block meets the shellcode execution condition, execute a malicious program processing flow on the sample program, wherein the malicious program processing flow includes: obtaining network connection parameters provided when the sample program attempts to call a network connection function in the network dynamic link library, and terminating execution of the sample program before the sample program successfully calls the network connection function in the network dynamic link library, wherein the network connection parameters include network address information of a remote server that the sample program attempts to connect to. The computer device is also used to send the network address information of the remote server to a cloud security server. The cloud security server is used to aggregate the network address information of remote servers (i.e., malicious servers) collected from various sources. Optionally, the cloud security server is also used to provide the subscriber with an attack organization portrait according to subscription requirements. The attack organization portrait includes but is not limited to the network address information and/or attack behavior characteristics of the malicious server.

Optionally, the attack defense system further includes a protection device, wherein the computer device is located within a protected network protected by the protection device. The computer device and/or the cloud security server is further configured to send the network address information of the remote server to the protection device. The protection device is configured to intercept traffic from and/or traffic destined for the remote server based on the network address information of the remote server.

In a sixth aspect, a computer-readable storage medium is provided, on which instructions are stored. When the instructions are executed by a processor, the method in the above-mentioned first aspect and its various embodiments is implemented.

In a seventh aspect, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the method in the above-mentioned first aspect and its various embodiments.

In an eighth aspect, a chip is provided, which includes a programmable logic circuit and/or program instructions. When the chip is running, it implements the method in the above-mentioned first aspect and its various embodiments.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of an implementation scenario provided by an embodiment of the present application;

FIG2 is a schematic diagram of the hardware structure of a computer device provided in an embodiment of the present application;

FIG3 is a schematic diagram of the hardware structure of a protective device provided in an embodiment of the present application;

FIG4 is a flow chart of an application processing method provided in an embodiment of the present application;

FIG5 is a schematic structural diagram of an application processing device provided in an embodiment of the present application.

DETAILED DESCRIPTION

In order to make the objectives, technical solutions and advantages of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

Shellcode, a piece of machine code executed to exploit software vulnerabilities, is often used to launch malicious attacks against computer systems. For example, in the first attack scenario, attackers implementing advanced threat or fileless attacks do not directly provide a malicious program with actual malicious functionality. Instead, they inject shellcode into a computer device as a malicious program. By running the shellcode on the computer device, the attacker retrieves a fully functional encrypted dynamic link library (DLL) from the network and decrypts the encrypted DLL. The decrypted DLL is then loaded into the computer device's memory and the functions within it are executed, thereby attacking the computer device. For another example, in the second attack scenario, the attacker stores the fully functional encrypted DLL in the malicious program's local directory or its own resource segment. The attacker then injects the shellcode into the computer device along with the file containing the fully functional encrypted DLL. By running the shellcode on the computer device, the attacker decrypts the injected encrypted DLL, then loads the decrypted DLL into the computer device's memory and executes the functions within the DLL, thereby attacking the computer device. Among them, the decrypted dynamic link library is the real attack payload.

When using the memory scanning technology provided by the related technology, it can be identified that a malicious program is running in the computer device only after the shellcode has loaded the attack payload into the memory of the computer device. However, before the malicious program is identified, the shellcode may have already run the attack payload, causing the computer device to be remotely attacked, such as the computer device has been remotely controlled by the attacker, or the data in the computer device has been stolen by the attacker.

Based on this, the present application provides a technical solution, which monitors and analyzes the application running on the computer device in real time to determine whether the application is a malicious program containing shellcode, or whether it is injected with shellcode (i.e., infected by a malicious program), and terminates the execution of the malicious program before the malicious program performs any substantial malicious behavior, thereby ensuring the security of the computer system. The technical solution of the present application is as follows: the computer device monitors whether the application running on the computer device loads a network dynamic link library, which is used to support the application to perform network communication. In response to monitoring that the application loads the network dynamic link library, the computer device determines whether the memory block where the running code for loading the network dynamic link library in the application meets the shellcode running conditions. If the memory block meets the shellcode running conditions, the computer device executes the malicious program processing flow for the application to terminate the execution of the application before the application successfully calls the network connection function in the network dynamic link library. The present application determines whether the running code in the memory block used to load the network dynamic link library in the application is shellcode by judging whether the memory block where the running code is located meets the shellcode running conditions. If the running code is shellcode, it means that the application is very likely to be a malicious program, or the application is very likely to have been infected by a malicious program. Then, if the application continues to run, it is likely to cause the computer device to be attacked by the malicious program, and the security of the computer device will be threatened. Therefore, when the present application determines that there is shellcode running in the memory space of the application, the application is treated as a malicious program, so that the application is terminated before the network connection function in the network dynamic link library is successfully called, so as to avoid the application from connecting to the remote server, thereby preventing the computer device from being controlled by the attacker through the remote server, or the internal data of the computer device from being stolen by the attacker through the remote server.

For example, for the first attack scenario mentioned above, by implementing the solution of the present application, it is possible to prevent shellcode from connecting to the remote server, thereby preventing shellcode from downloading a fully functional encrypted dynamic link library from the network. For the second attack scenario mentioned above, by implementing the solution of the present application, it is possible to prevent shellcode from connecting to the remote server, thereby preventing shellcode from loading the attack payload into the memory and then connecting to the attacker's server after execution. In short, by implementing the solution of the present application, it is possible to identify whether shellcode is running on a computer device. After identifying that shellcode is running on the computer device, it is further possible to prevent shellcode from connecting to the remote server, thereby preventing the computer device from being attacked and controlled by the remote server, thereby achieving protection for the computer device.

Optionally, the shellcode running conditions are determined based on the characteristics of the memory block in which the shellcode is running. Before the shellcode is run in a computer device, it is necessary to apply for a memory block in the computer device's memory for running the shellcode. Since the characteristics of the memory block used to run the shellcode are somewhat different from the characteristics of the memory block used to run a normal application, the characteristics of the memory block include but are not limited to the memory block size, memory block permissions or memory block content. Therefore, the present application summarizes the characteristics of the memory block used to run the shellcode, and realizes the judgment based on the memory block size, memory block permissions or memory block content whether the memory block where the running code is located meets the shellcode running conditions, that is, judges whether the running code is shellcode. The specific judgment method is as follows: when the size of the memory block where the running code is located is equal to the memory page size in the operating system of the computer device, or the memory block where the running code is located has private permissions, writable permissions and executable permissions, or the memory block where the running code is located contains the format header of the PE file, it is determined that the memory block where the running code is located meets the shellcode running conditions. The judgment principle based on the above three conditions is explained below.

(1) Judgment condition 1: When the size of the memory block where the running code is located is equal to the memory page size in the operating system of the computer device, it is determined that the memory block meets the shellcode running condition. The memory page size in the operating system is the smallest memory allocation unit in the operating system. For example, the memory page size in the Windows operating system generally defaults to 4 kilobytes (KB). In this case, the above judgment condition 1 is: when the size of the memory block where the running code is located is equal to 4KB, it is determined that the memory block meets the shellcode running condition. Since the code segment of a normal application usually contains compiler code when running in memory, the memory occupied by the code segment of a normal application is generally much larger than the memory page size in the operating system (such as 4KB). Shellcode, as a machine code, requires very little memory to run, usually less than the memory page size in the operating system (such as 4KB). Therefore, if the memory block size where the running code is located is equal to the memory page size in the operating system of the computer device, then the running code is very likely to be shellcode. It is worth noting that the memory page size in the operating system can be configured and modified. For example, the memory page size in the Windows operating system can be set to other values such as 8KB or 32KB.

(2) Judgment condition 2: When the memory block where the running code is located has private permissions, writable permissions, and executable permissions, it is determined that the memory block meets the shellcode running conditions. Since the memory block where the code segment of a normal application is located usually only has read permissions and executable permissions, the memory block where the shellcode is located must have private permissions, writable permissions, and executable permissions to support the normal operation of the shellcode. Therefore, if the memory block where the running code is located has private permissions, writable permissions, and executable permissions, then the running code is very likely to be shellcode.

(3) Judgment condition 3: When the memory block where the running code is located contains the format header of the PE file, it is determined that the memory block meets the shellcode running condition. Since the format header of the PE file of a normal application is read-only, and the code segment of the PE file of a normal application is readable and executable, and the permissions of the same memory block are the same, when a normal application is running in the memory, the format header and code segment of the PE file will be loaded into different memory blocks, so that the format header and code segment of the PE file have different read and write permissions. When the shellcode is running in the memory of the computer device, the PE file of the shellcode will be loaded completely into the same memory block. Therefore, if the memory block where the running code is located also contains the format header of the PE file, then the running code is very likely to be shellcode. Since the memory block where the running code is located must include the code segment of the PE file, if the memory block also contains the format header of the PE file, it means that the memory block contains a complete PE file. Accordingly, in the above judgment condition 3, "the memory block contains the format header of the PE file" can also be replaced with: the memory block contains the complete PE file, or the memory block contains the format header and code segment of the PE file.

In some embodiments, when a computer device processes an application as a malicious program, it obtains the network connection parameters provided by the application when it attempts to call a network connection function in a network dynamic link library, and terminates the execution of the application before the application successfully calls the network connection function in the network dynamic link library. The network connection parameters include the network address information of the remote server that the application attempts to connect to. Optionally, the network address information of the remote server includes one or more of the IP address of the remote server, the domain name address of the remote server, or the port number of the remote server. Since the application provides network connection parameters including the network address information of the remote server when calling the network connection function in the network dynamic link library to try to connect to the remote server, for a malicious program, the remote server that the malicious program attempts to connect to is usually the attacker's control facility. This application helps to provide security protection against network attacks carried out by the attacker through the control facility by obtaining the network address information of the attacker's control facility before the malicious program in the computer device commits any substantial malicious behavior.

In some embodiments, the computer device is located in a protected network protected by a protective device, that is, a protective device is deployed between the computer device and the remote server. After obtaining the network address information of the remote server, the computer device sends the network address information of the remote server to the protective device deployed between the computer device and the remote server. The protective device intercepts the traffic from the remote server and/or the traffic sent to the remote server based on the network address information of the remote server. By intercepting the traffic sent from the protected network to the remote server, the protective device can prevent the data in the computer device in the protected network from being stolen. By intercepting the traffic sent from the remote server to the protected network, the protective device can prevent the computer device in the protected network from being remotely controlled. The present application realizes a global ban on the attacker's control facilities by linking the computer device with the protective device, thereby protecting the computer devices in the protected network from remote attacks by the attacker. Alternatively, after obtaining the network address information of the remote server, the computer device can also output the network address information of the remote server, and the security operation and maintenance personnel can input the network address information of the remote server into the protective device through manual configuration, so that the protective device can intercept the sending traffic and/or receiving traffic (collectively referred to as attack traffic) of the remote server. This application does not limit the manner in which the protection device obtains the network address information of the remote server collected by the computer device.

The following is a detailed introduction to the technical solution of this application from multiple perspectives, including implementation scenarios, hardware devices, method flows, software devices, and systems.

The following is an example of an implementation scenario of the embodiment of the present application.

The application processing methods provided in the embodiments of the present application can be applied to various computer devices that may be vulnerable to remote attacks based on shellcode. For example, the computer device is a terminal device installed with a Windows operating system, including but not limited to a server, host, personal computer, mobile phone, or workstation. Windows operating systems include but are not limited to Windows XP, Windows Server 2003, Windows 7, Windows 8, or Windows 10.

Embodiments of the present application can handle various shellcode-based remote attack scenarios, such as commercial remote control systems that use shellcode, including but not limited to CobaltStrike, MeterPreter, Gh0stRat, Silver, and Brute Ratel C4. Another example is fileless Trojan attacks that use shellcode, including but not limited to Icedid, Emotet, and Ursnif.

Optionally, the computer device in the embodiments of the present application is located within a protected network protected by a protective device, i.e., the computer device is a protected device. For example, Figure 1 is a schematic diagram of an implementation scenario provided by an embodiment of the present application. As shown in Figure 1, this implementation scenario primarily involves three types of devices: a protective device, a computer device, and a remote server. The following provides examples of each of these three types of devices.

(1) Protective equipment

Protection devices are deployed between external networks (such as the Internet) and protected networks. For example, protection devices are typically deployed at the boundaries of protected networks to protect computer devices within the protected network from attacks from external networks. Protection devices can securely filter traffic entering and leaving the protected network, blocking attack traffic to ensure the security of computer devices within the protected network, while allowing normal traffic to ensure that computer devices within the protected network can communicate normally with the external network. Protection devices include, but are not limited to, firewalls, security gateways (such as routers or switches), intrusion detection systems (IDS) devices, intrusion prevention systems (IPS) devices, unified threat management (UTM) devices, AV devices, anti-distributed denial of service (anti-DDoS) devices, and next-generation firewalls (NGFWs), integrated with one or more of these.

(2) Computer equipment

The computer device is a protected device located in a protected network. From the perspective of the computer device, the protected network in which the computer device is located is an internal network, and the Internet is an external network. Optionally, the computer device is a protected server that provides services to normal clients (not shown in the figure) in the protected network and the Internet. For example, computer devices include but are not limited to application servers or web servers. Among them, application servers include but are not limited to game servers, video application servers, file servers, search engine servers, instant messaging servers, etc. Web servers are also called World Wide Web (web) servers or website servers.

(3) Remote Server

A remote server is a control facility used by attackers to launch remote attacks. Optionally, the remote server is located on an external network (such as the internet), allowing attackers to launch remote attacks from the external network to computers within the protected network. Remote servers, for example, are command and control (CC) servers, which support cyberattacks, hacker activities, or other illegal activities. CC servers are characterized by high controllability and configurability, and can communicate with malicious programs to remotely control and operate infected computers.

Optionally, please continue to refer to Figure 1. This implementation scenario also involves a cloud security server. The cloud security server is communicatively connected to a computer device to receive the network address information of a malicious server sent by the computer device; and/or, the cloud security server is communicatively connected to a protective device to receive the network address information of a malicious server sent by the protective device (Figure 1 takes the communication connection between the cloud security server and the computer device as an example). Optionally, the cloud security server is used to collect and aggregate the network address information of malicious servers collected from various sources, and is further used to provide attack organization portraits to subscribers according to subscription requirements. Attack organization portraits include but are not limited to network address information of malicious servers and/or attack behavior characteristics.

The following is an example of the basic hardware structure involved in the embodiments of the present application.

For example, Figure 2 is a schematic diagram of the hardware structure of a computer device provided in an embodiment of the present application. As shown in Figure 2, computer device 200 includes a processor 201 and a memory 202, and processor 201 and memory 202 are connected via a bus 203. Figure 2 illustrates processor 201 and memory 202 as independent of each other. Optionally, processor 201 and memory 202 are integrated together. Optionally, in conjunction with Figure 1, computer device 200 shown in Figure 2 is any computer device in the implementation scenario shown in Figure 1.

Memory 202 is used to store computer programs, including an operating system and program code. Optionally, the operating system is a Windows operating system. Memory 202 is a storage medium of various types, such as read-only memory (ROM), random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM), flash memory, optical memory, register, optical disk storage, optical disc storage, magnetic disk, or other magnetic storage device.

The processor 201 is a general-purpose processor or a dedicated processor. The processor 201 may be a single-core processor or a multi-core processor. The processor 201 includes at least one circuit to execute the application processing method provided in the embodiment of the present application.

Optionally, the computer device 200 further includes a network interface 204, which is connected to the processor 201 and the memory 202 via the bus 203. The network interface 204 enables the computer device 200 to communicate with other devices.

Optionally, computer device 200 further includes an input/output (I/O) interface 205, which is connected to processor 201 and memory 202 via bus 203. Processor 201 can receive input commands or data through I/O interface 205. I/O interface 205 is used to connect computer device 200 to input devices, such as a keyboard and a mouse. Optionally, in some possible scenarios, the network interface 204 and I/O interface 205 are collectively referred to as a communication interface.

Optionally, the computer device 200 further includes a display 206, which is connected to the processor 201 and the memory 202 via the bus 203. The display 206 can be used to display intermediate results and/or final results generated by the processor 201 executing the application processing method provided in the embodiments of the present application, such as network address information of a remote server. In one possible implementation, the display 206 is a touch screen display to provide a human-computer interaction interface.

The bus 203 is any type of communication bus for interconnecting the internal components of the computer device 200, such as a system bus. The embodiments of the present application illustrate the example of interconnecting the aforementioned components within the computer device 200 via the bus 203. Alternatively, the aforementioned components within the computer device 200 may be communicatively connected to each other using other connection methods besides the bus 203, such as interconnecting the aforementioned components within the computer device 200 via a logical interface within the computer device 200.

The above-mentioned devices can be provided on separate chips, or at least partially or entirely on the same chip. Whether to provide each device independently on different chips or to integrate them on one or more chips often depends on the product design requirements. The embodiments of this application do not limit the specific implementation of the above-mentioned devices.

The computer device 200 shown in FIG2 is merely exemplary. During implementation, the computer device 200 includes other components, which are not listed here. The computer device 200 shown in FIG2 can process malicious programs by executing all or part of the steps of the data backup method provided in the embodiment of the present application.

For example, Figure 3 is a schematic diagram of the hardware structure of a protection device provided in an embodiment of the present application. As shown in Figure 3, protection device 300 includes a central processing unit (CPU) 301, a dedicated hardware chip 302, and at least one network interface 303. CPU 301 and dedicated hardware chip 302 may be collectively referred to as a processor. Optionally, in conjunction with Figure 1, protection device 300 shown in Figure 3 is the protection device in the implementation scenario shown in Figure 1.

CPU 301 is a general-purpose central processing unit (CPU) with high scalability and flexibility. CPU 301 may be, for example, a single-core processor (single-CPU) or a multi-core processor (multi-CPU).

The dedicated hardware chip 302 is a high-performance processing hardware module. The dedicated hardware chip 302 includes at least one of an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a network processor (NP).

At least one network interface 303 includes, for example, network interface 1, network interface 2, network interface 3...network interface n in Figure 3. The network interface 303 uses any transceiver-like device to communicate with other devices. For example, the network interface 1 in Figure 3 communicates with a computer device, and the network interface 2 in Figure 3 communicates with a remote server. Optionally, the network interface 303 includes at least one of a wired network interface or a wireless network interface. The wired network interface is, for example, an Ethernet interface. The Ethernet interface is, for example, an optical interface, an electrical interface, or a combination thereof. The wireless network interface is, for example, a wireless local area network (WLAN) interface, a cellular network interface, or a combination thereof.

At least one network interface 303 is connected to the dedicated hardware chip 302, and the dedicated hardware chip 302 is connected to the CPU 301 via an internal connection 304. The internal connection 304 includes a path for transmitting data between the network interface 303, the dedicated hardware chip 302, and the CPU 301. Optionally, the internal connection 304 is a single board or a bus. For example, the internal connection 304 is Ethernet, Fibre Channel, PCI-E (Peripheral Component Interconnect Express, PCI Express, a high-speed serial computer bus), RapidIO (a high-performance, low-pin-count, packet-switched interconnect architecture), InfiniBand, or a XAUI bus (an interface extender that connects the Ethernet Media Access Control (MAC) layer to the physical layer).

Optionally, protection device 300 further includes a content addressable memory (CAM) 305. CAM 305 is, for example, a ternary content addressable memory (TCAM). CAM 305 is used to store, for example, the network address information of a remote server (the attacker's control facility). Optionally, CAM 305 exists independently and is connected to dedicated hardware chip 302 via the aforementioned internal connection 304. Alternatively, CAM 305 and dedicated hardware chip 302 are integrated, such that CAM 305 functions as internal memory within dedicated hardware chip 302.

Optionally, the protection device 300 further includes a memory 306. The memory 306 may be, for example, a ROM or other type of static storage device capable of storing static information and instructions, a RAM or other type of dynamic storage device capable of storing information and instructions, an EEPROM, a CD-ROM or other optical disk storage, an optical disk storage (including a compact disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium capable of carrying or storing the desired program code 308 in the form of instructions or data structures and accessible by a computer, but is not limited thereto. The memory 306 may be, for example, independent and connected to the CPU 301 via the internal connection 304. Alternatively, the memory 306 and the CPU 301 may be integrated.

Memory 306 stores an operating system 307 and program code 308. Optionally, CPU 301 reads operating system 307 from memory 306 and executes it. CPU 301 also reads program code 308 from memory 306 and implements the method provided in the embodiments of the present application by executing program code 308 on operating system 307. For example, if protection device 300 is the protection device in the implementation scenario shown in FIG. 1 , while executing program code 308, CPU 301 performs the following process: Protection device 300 intercepts traffic from and/or to a remote server based on the network address information of the remote server.

Optionally, the above-mentioned devices are respectively provided on independent chips, or at least partially or entirely provided on the same chip. Whether each device is provided independently on different chips or integrated on one or more chips often depends on the needs of product design. The embodiments of the present application do not limit the specific implementation of the above-mentioned devices.

The following is an example of the method flow of the embodiment of the present application.

For example, FIG4 is a flow chart of an application processing method 400 provided in an embodiment of the present application. As shown in FIG4 , the method 400 includes but is not limited to the following steps 401 to 403. The method 400 is applied to a computer device. Optionally, the method 400 is executed by security software running on the computer device, and the security software is, for example, endpoint detection and response (EDR) software. Optionally, in combination with the implementation scenario shown in FIG1 , the computer device in the method 400 is any computer device in FIG1 . Optionally, the computer device in the method 400 has the hardware structure shown in FIG2 .

Step 401: The computer device monitors whether the sample program running on the computer device has loaded a network dynamic link library.

The network dynamic link library is used to support the application program to perform network communication, and the network dynamic link library includes one or more network connection functions.

Optionally, the network dynamic link library is a library file (DLL file) that comes with the operating system of the computer device. Of course, the embodiment of the present application does not exclude the possibility of the application program carrying the network dynamic link library. Optionally, the file type of the network dynamic link library includes but is not limited to ws2_32.dll, dnsapi.dll, Winhttp.dll or urlmon.dll.

Optionally, the network connection functions in the network dynamic link library include, but are not limited to, one or more of the following: InternetConnectA function, InternetConnectW function, UrlDownloadToFile function, connect function, WinHttpConnect function, or DnsQuery function. An application on a computer device can achieve network connection by loading the network dynamic link library and further calling the network connection functions in the network dynamic link library.

In the embodiments of the present application, a sample program is used to refer to any application program running on a computer device. A sample program may be, for example, a browser, office software, or game software.

Optionally, the computer device uses hook technology to monitor whether the running sample program loads the network dynamic link library. Accordingly, the implementation method of the above-mentioned step 401 is that the computer device hooks the dynamic library loading function in the operating system of the computer device through the first hook function to monitor whether the sample program loads the network dynamic link library. The first hook function hooks the dynamic library loading function in the operating system of the computer device, that is, the first hook function hooks the application programming interface (API) that calls the dynamic library loading function. In this way, the first hook function can monitor the behavior of the sample program calling the dynamic library loading function to load the network dynamic link library.

The dynamic library loading function is a function in a dynamic link library (different from a network dynamic link library) that comes with the operating system of the computer device. The dynamic link library function is used to load a dynamic link library, for example, to load a network dynamic link library. Optionally, the dynamic library loading function includes a LoadLibrary function or an LdrLoadDll function.

Optionally, the computer device uses user-state hook technology to monitor whether the running sample program loads the network dynamic link library. User-state hook technology is a technology for intercepting and modifying function calls made in an application. In this implementation, the first hook function is a user-state hook function in the sample program, and the first hook function is injected into the sample program after the sample program is started. For ease of distinction, in the embodiment of the present application, the user-state hook function used to hook the dynamic library loading function in the operating system of the computer device is referred to as the first user-state hook function. For example, when the computer device detects that the sample program is started, it injects the first user-state hook function into the sample program through security software. Optionally, the computer device injects the first user-state hook function into the sample program by injecting a DLL.

A user-mode hook function refers to a hook function that runs in user mode. User mode refers to the non-privileged mode in which applications run, with limited access to restricted resources and no direct hardware manipulation or privileged instruction execution. Applications enter kernel mode through the system call interface and request privileged operations from the operating system. User-mode hooking techniques may include, but are not limited to, inline hooking or import address table (IAT) hooking.

Alternatively, the computer device uses kernel-state hook technology to monitor whether the running sample program loads the network dynamic link library. Kernel-state hook technology is a technology for intercepting and modifying function calls performed in the kernel of the operating system. In this implementation, the first hook function is a kernel-state hook function in the kernel of the computer device. For ease of distinction, in the embodiment of the present application, the kernel-state hook function used to hook the dynamic library loading function in the operating system of the computer device is referred to as the first kernel-state hook function. For example, after the security software on the computer device is started, the first kernel-state hook function is injected into the kernel of the computer device. Among them, injecting the kernel-state hook function into the kernel of the computer device can be understood as implementing the function of the hook function in the kernel-state driver of the operating system.

A kernel-state hook function refers to a hook function that runs in kernel state. Kernel state refers to the kernel running in privileged mode, with access to all resources and the ability to execute privileged instructions. The operating system executes system calls and handles interrupts in kernel state. Optionally, kernel-state hooks are implemented based on a hypervisor. For example, kernel-state hook technologies include, but are not limited to, model-specific register hooks (MSR hooks) or extended page table hooks (EPT hooks).

Step 402: In response to monitoring that the sample program loads the network dynamic link library, the computer device determines whether a target memory block meets the shellcode execution condition, where the target memory block is a memory block where the execution code for loading the network dynamic link library in the sample program is located.

Optionally, when the target memory block meets any one of the following conditions, it is determined that the target memory block meets the shellcode running condition. The multiple conditions include: the size of the target memory block is equal to the memory page size in the operating system of the computer device; the target memory block has private permissions, writable permissions, and executable permissions; the target memory block contains the format header of the PE file. That is, when the size of the target memory block is equal to the memory page size in the operating system of the computer device, it is determined that the target memory block meets the shellcode running condition. Alternatively, when the target memory block has private permissions, writable permissions, and executable permissions, it is determined that the target memory block meets the shellcode running condition. Alternatively, when the target memory block contains the format header of the PE file, it is determined that the target memory block meets the shellcode running condition.

Optionally, the computer device sequentially determines whether the size, permissions, and content of the target memory block meet the shellcode execution conditions. Once it is determined that the target memory block meets the shellcode execution conditions, the computer device stops executing the judgment process. The embodiment of the present application does not limit the order of judging these three judgment conditions.

If the target memory block does not meet the shellcode execution conditions, it indicates that the code running in the target memory block for loading the network dynamic link library is normal code, and the computer device does not interfere with the network behavior after the code is executed. If the target memory block meets the shellcode execution conditions, it indicates that the code running in the target memory block for loading the network dynamic link library is shellcode, and the computer device needs to block the network behavior after the shellcode. The specific implementation method is shown in step 403 below.

Step 403: If the target memory block meets the shellcode running condition, the computer device executes a malicious program processing flow for the sample program, wherein the malicious program processing flow includes: terminating the execution of the sample program before the sample program successfully calls a network connection function in a network dynamic link library.

The computer device terminates execution of the sample program, including closing the sample program and releasing the memory space occupied by the sample program.

In an embodiment of the present application, when a computer device determines that shellcode is running in a sample program, the sample program is treated as a malicious program, so that the sample program is terminated before the network connection function in the network dynamic link library is successfully called, so as to prevent the application from connecting to the remote server, thereby preventing the computer device from being controlled by an attacker through the remote server, or preventing the internal data of the computer device from being stolen by an attacker through the remote server, thereby protecting the computer device.

Optionally, before terminating the execution of the sample program, the computer device also obtains the network address information of the remote server that the sample program attempts to connect to. Accordingly, the computer device executes a malicious program processing process on the sample program, including: the computer device obtains the network connection parameters provided when the sample program attempts to call the network connection function in the network dynamic link library, and terminates the execution of the sample program before the sample program successfully calls the network connection function in the network dynamic link library. Among them, the network connection parameters include the network address information of the remote server that the sample program attempts to connect to. The network address information of the remote server includes but is not limited to one or more of the IP address of the remote server, the domain name address of the remote server, or the port number of the remote server. Optionally, the network connection parameters also include information such as a user name and a login password. Based on the network connection parameters provided by the sample program, the computer device can connect to the remote server.

Optionally, the computer device uses hook technology to obtain the network connection parameters provided by the sample program. Accordingly, the computer device obtains the network connection parameters provided when the sample program attempts to call the network connection function in the network dynamic link library in the following implementation method, including the following steps S1 to S3.

In step S1, the computer device suspends the execution of the sample program and, during the suspension, hooks the network connection function in the network dynamic link library through the second hook function.

Among them, the second hook function hooks the network connection function in the network dynamic link library, that is, the second hook function hooks the API that calls the network connection function in the network dynamic link library, so that the second hook function can monitor the behavior of the sample program calling the network connection function to connect to the remote server.

Optionally, the second hook function is a user-mode hook function in the sample program, which is injected into the sample program after the sample program is launched. For ease of distinction, in the embodiments of the present application, the user-mode hook function used to hook the network connection function in the network dynamic link library is referred to as the second user-mode hook function. For example, upon detecting the launch of the sample program, the computer device injects the second user-mode hook function into the sample program via security software. Optionally, the computer device injects the second user-mode hook function into the sample program by injecting a DLL.

Optionally, when the computer device detects that the sample program is started, it injects the first user-state hook function and the second user-state hook function into the sample program at the same time, and hooks the dynamic library loading function in the operating system of the computer device through the first user-state hook function. Thereafter, when it is necessary to obtain the network connection parameters of the remote server to which the sample program attempts to connect, it hooks the network connection function in the network dynamic link library through the second user-state hook function. Alternatively, when the computer device detects that the sample program is started, it injects the first user-state hook function into the sample program, and hooks the dynamic library loading function in the operating system of the computer device through the first user-state hook function. Thereafter, when it is necessary to obtain the network connection parameters of the remote server to which the sample program attempts to connect, it injects the second user-state hook function into the sample program, and hooks the network connection function in the network dynamic link library through the second user-state hook function. That is, the first user-state hook function and the second user-state hook function can be injected into the sample program at one time, or can be injected into the sample program separately.

Alternatively, the second hook function is a kernel-mode hook function in the kernel of the computer device. For ease of distinction, in the embodiments of the present application, the kernel-mode hook function used to hook the network connection function in the network dynamic link library is referred to as the second kernel-mode hook function. For example, after the security software on the computer device is started, the second kernel-mode hook function is injected into the kernel of the computer device.

Optionally, after the security software on the computer device is started, the first kernel-state hook function and the second kernel-state hook function are simultaneously injected into the kernel of the computer device, and the first kernel-state hook function is used to hook the dynamic library loading function in the operating system of the computer device. Thereafter, when it is necessary to obtain the network connection parameters of the remote server to which the sample program attempts to connect, the second kernel-state hook function is used to hook the network connection function in the network dynamic link library. Alternatively, after the security software on the computer device is started, the first kernel-state hook function is injected into the kernel of the computer device, and the first kernel-state hook function is used to hook the dynamic library loading function in the operating system of the computer device. Thereafter, when it is necessary to obtain the network connection parameters of the remote server to which the sample program attempts to connect, the second kernel-state hook function is injected into the kernel of the computer device, and the second kernel-state hook function is used to hook the network connection function in the network dynamic link library. In other words, the first kernel-state hook function and the second kernel-state hook function can be injected into the kernel of the computer device at once, or can be injected into the kernel of the computer device separately.

In step S2, after the computer device completes hooking the network connection function in the network dynamic link library through the second hook function, it resumes executing the sample program.

Optionally, after the computer device completes hooking all network connection functions in the network dynamic link library through the second hook function, it resumes executing the sample program. In this way, no matter which network connection function in the network dynamic link library is called by the sample program, the second hook function can monitor it, thereby achieving comprehensive monitoring of the network connection behavior of the sample program.

In step S3, in response to the sample program calling the network connection function in the network dynamic link library, the computer device obtains the network connection parameters provided by the sample program when calling the network connection function through the second hook function.

Afterwards, the computer device terminates execution of the sample program.

Because the second hook function hooks the network connection function in the network dynamic link library, the second hook function can monitor the sample program's call to the network connection function in the network dynamic link library, thereby obtaining the network connection parameters provided by the sample program when calling the network connection function. For shellcode running in an application, the remote server the shellcode attempts to connect to is typically the attacker's control facility. By obtaining the network address information of the attacker's control facility before the malicious program in the computer device actually performs any malicious behavior, the embodiments of the present application help provide security protection against network attacks carried out by the attacker through the control facility.

Optionally, the computer device is located within a protected network protected by the protection device, and the computer device further transmits the network address information of the remote server to the protection device deployed between the computer device and the remote server. The network address information of the remote server is used by the protection device to intercept traffic from and/or traffic to the remote server.

In an embodiment of the present application, a computer device provides the protection device with the network address information of a remote server identified as the attacker's control facility. The protection device can prevent data from being stolen from computer devices within the protected network by intercepting traffic sent from the protected network to the remote server. The protection device can prevent computer devices within the protected network from being remotely controlled by intercepting traffic sent from the remote server to the protected network. The present application achieves a global blockade of the attacker's control facility by linking computer devices with the protection device, thereby protecting all computer devices within the protected network from remote attacks by the attacker.

Optionally, the computer device also reports the network address information of the remote server identified as the attacker's control facility to the cloud. By collecting information reported by different computer devices, the cloud analyzes the attacker's attack behavior characteristics, such as the attacker's target, the industry, and whether the attack is targeting a specific local area network or type of computer device or an indiscriminate attack. This creates a profile of the attacking organization to help businesses and individuals prevent and respond to cyberattacks. This profile includes, but is not limited to, the network address information of the malicious server and/or attack behavior characteristics.

The order of the steps of the application processing method provided in the embodiments of the present application can be adjusted appropriately, and the steps can be increased or decreased accordingly. Any method that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application.

The following describes the virtual device in the embodiment of the present application by way of example.

Figure 5 is a schematic diagram of the structure of an application processing device provided in an embodiment of the present application. The application processing device having the structure shown in Figure 5 is used to implement the method 400 described in the above embodiment. Optionally, the application processing device shown in Figure 5 is the computer device shown in Figure 1 or Figure 2, or the application processing device shown in Figure 5 is the security software in the computer device shown in Figure 1 or Figure 2. As shown in Figure 5, the application processing device 500 includes a monitoring module 501 and a processing module 502. Optionally, please continue to refer to Figure 5, the application processing device 500 also includes a transceiver module 503.

The monitoring module 501 is configured to monitor whether the sample program running on the computer device has loaded a network dynamic link library (DLL), which is used to support network communication for the application program and includes one or more network connection functions. The processing module 502 is configured to, in response to monitoring that the sample program has loaded the DLL, determine whether a target memory block satisfies a shellcode execution condition. The target memory block is the memory block containing the execution code in the sample program used to load the DLL; and if the target memory block satisfies the shellcode execution condition, execute a malicious program processing flow on the sample program. The malicious program processing flow includes: terminating the sample program before the sample program successfully calls a network connection function in the DLL.

Optionally, when the target memory block meets any one of the following conditions, it is determined that the target memory block meets the shellcode execution condition, and the multiple conditions include: the size of the target memory block is equal to the memory page size in the operating system of the computer device; the target memory block has private permission, writable permission and executable permission; the target memory block contains the format header of the PE file.

Optionally, the monitoring module 501 is specifically configured to hook a dynamic library loading function in the operating system of the computer device through a first hook function to monitor whether the sample program loads a network dynamic link library, where the dynamic library loading function is used to load the network dynamic link library.

Optionally, the first hook function is a user-mode hook function in the sample program, and the first hook function is injected into the sample program after the sample program is started. Alternatively, the first hook function is a kernel-mode hook function in the kernel of the computer device.

Optionally, the processing module 502 is specifically configured to obtain network connection parameters provided when the sample program attempts to call a network connection function in a network dynamic link library if the target memory block meets the shellcode running conditions, and terminate the execution of the sample program before the sample program successfully calls the network connection function in the network dynamic link library, where the network connection parameters include network address information of a remote server that the sample program attempts to connect to.

Optionally, the processing module 502 is specifically used to: if the target memory block meets the shellcode running conditions, suspend the execution of the sample program, and hook the network connection function in the network dynamic link library through the second hook function during the suspension period; after the hooking of the network connection function in the network dynamic link library is completed through the second hook function, resume the execution of the sample program; in response to the sample program calling the network connection function in the network dynamic link library, obtain the network connection parameters provided by the sample program when calling the network connection function through the second hook function; and terminate the execution of the sample program before the sample program successfully calls the network connection function in the network dynamic link library.

Optionally, the second hook function is a user-mode hook function in the sample program, and the second hook function is injected into the sample program after the sample program is started. Alternatively, the second hook function is a kernel-mode hook function in the kernel of the computer device.

Optionally, the transceiver module 503 is used to send the network address information of the remote server to the protection device deployed between the computer device and the remote server. The network address information of the remote server is used by the protection device to intercept traffic from the remote server and/or traffic sent to the remote server.

Optionally, the network address information of the remote server includes one or more of an IP address of the remote server, a domain name address of the remote server, or a port number of the remote server.

The device embodiment described in FIG5 is merely schematic. For example, the division of the modules is merely a logical functional division. In actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. The functional modules in the various embodiments of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module. The above-mentioned modules in FIG5 may be implemented in the form of hardware or in the form of software functional units. For example, when implemented in software, the above-mentioned monitoring module 501 and processing module 502 may be implemented as software functional modules generated by the processor 201 in FIG2 after reading the program code stored in the memory 202. The modules described above in FIG5 may also be implemented separately by different hardware components of the computer device. For example, the monitoring module 501 and processing module 502 may be implemented by a portion of the processing resources of the processor 201 in FIG2 (e.g., one core in a multi-core processor), while the transceiver module 503 may be implemented by the network interface 204 in FIG2 and the remaining processing resources of the processor 201 (e.g., other cores in a multi-core processor). Obviously, the functional modules described above may also be implemented using a combination of software and hardware. For example, the transceiver module 503 may be implemented by a hardware programmable device, while the monitoring module 501 and processing module 502 may be software functional modules generated by the processor after reading program instructions stored in the memory.

The following is an example of the system in the embodiment of the present application.

For example, an embodiment of the present application provides an attack defense system, comprising: a computer device and a protection device. The computer device is located within a protected network protected by the protection device. The computer device is configured to execute the above-described method 400. Optionally, the structure of the attack defense system is, for example, as shown in FIG1 .

For example, a computer device is configured to monitor whether a sample program running on the computer device loads a network dynamic link library (DLL), which is used to support network communication for applications and includes one or more network connection functions. The computer device is further configured to, in response to monitoring the sample program loading the DLL, determine whether a target memory block meets a shellcode execution condition, where the target memory block is the memory block containing the execution code in the sample program used to load the DLL. If the target memory block meets the shellcode execution condition, execute a malicious program processing flow on the sample program. The malicious program processing flow includes obtaining network connection parameters provided by the sample program when attempting to call a network connection function in the DLL, and terminating execution of the sample program before the sample program successfully calls the network connection function in the DLL. The network connection parameters include network address information of a remote server that the sample program attempts to connect to. The computer device is further configured to transmit the remote server's network address information to a protection device. The protection device is configured to intercept traffic from and/or to the remote server based on the remote server's network address information.

Optionally, the attack defense system further includes a cloud security server. The computer device and/or the protection device is further configured to send the network address information of the remote server to the cloud security server. The cloud security server is configured to aggregate the network address information of the remote server (malicious server) collected from various sources.

Optionally, the cloud security server is also used to provide the subscriber with an attacker profile according to subscription requirements. The attacker profile includes but is not limited to the network address information of the malicious server and/or attack behavior characteristics.

For another example, an embodiment of the present application provides another attack defense system, including: a computer device and a cloud security server.

For example, a computer device is used to monitor whether a sample program running on the computer device loads a network dynamic link library, which is used to support network communication for applications and includes one or more network connection functions. The computer device is also used to, in response to monitoring the sample program loading the network dynamic link library, determine whether a target memory block meets the shellcode execution conditions, where the target memory block is the memory block where the execution code used to load the network dynamic link library in the sample program is located; and if the target memory block meets the shellcode execution conditions, execute a malicious program processing flow on the sample program, wherein the malicious program processing flow includes: obtaining network connection parameters provided by the sample program when attempting to call a network connection function in the network dynamic link library, and terminating execution of the sample program before the sample program successfully calls the network connection function in the network dynamic link library, wherein the network connection parameters include network address information of a remote server that the sample program attempts to connect to. The computer device is also used to send the network address information of the remote server to a cloud security server. The cloud security server is used to aggregate the network address information of remote servers (malicious servers) collected from various sources.

Optionally, the cloud security server is also used to provide the subscriber with an attack organization portrait according to subscription requirements. The attack organization portrait includes but is not limited to the network address information and/or attack behavior characteristics of the malicious server.

Optionally, the attack defense system further includes a protection device, wherein the computer device is located within a protected network protected by the protection device. The computer device and/or the cloud security server is further configured to send the network address information of the remote server to the protection device. The protection device is configured to intercept traffic from and/or traffic destined for the remote server based on the network address information of the remote server.

An embodiment of the present application further provides a computer device comprising: a memory, a network interface, and at least one processor. The memory is configured to store program instructions, and the at least one processor reads the program instructions stored in the memory, causing the computer device to execute the above-described method 400. Optionally, the hardware structure of the computer device is shown in FIG2 .

An embodiment of the present application further provides a computer-readable storage medium having instructions stored thereon. When the instructions are executed by a processor of a computer device, the steps executed by the computer device in the above method embodiment are implemented; or, when the instructions are executed by a processor of a management device, the steps executed by the management device in the above method embodiment are implemented.

An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor of a computer device, implements the steps performed by the computer device in the above method embodiment; or, when executed by a processor of a management device, implements the steps performed by the management device in the above method embodiment.

In the embodiments of this application, the term "traffic" is also referred to as network traffic or data traffic. Traffic refers to the data transmitted over a network at a given point in time. For example, the traffic received by a device at time T refers to all packets received by the device at that point in time.

The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

The terms "first" and "second" and the like in the description and claims of the embodiments of this application are used to distinguish different objects, rather than to describe a specific order of objects, and cannot be understood as indicating or implying relative importance.

In the description of the embodiments of the present application, unless otherwise specified, "at least one" means one or more, and "a plurality of" means two or more.

A refers to B, which means that A is the same as B or A is a simple variant of B.

In this application, the term "and/or" simply describes a relationship between related objects, indicating the existence of three relationships. For example, A and/or B means: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" in this document generally indicates that the related objects are in an "or" relationship.

Optionally, in the above embodiments, all or part of the embodiments are implemented by software, hardware, firmware or any combination thereof. Optionally, when implemented using software, all or part of the embodiments are implemented in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. Optionally, the computer is a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Optionally, the computer instructions are stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. Optionally, the computer-readable storage medium is any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated therein. Optionally, the available medium is a magnetic medium (e.g., a floppy disk, a hard disk, a magnetic tape), an optical medium (e.g., a digital video disk (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)).

As described above, the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the above embodiments, ordinary technicians in this field should understand that they can still modify the technical solutions recorded in the above embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims (22)

A method for processing an application, characterized in that the method comprises: Monitoring whether a sample program running on a computer device has loaded a network dynamic link library, wherein the network dynamic link library is used to support network communication of an application program, and the network dynamic link library includes one or more network connection functions; In response to monitoring that the sample program loads the network dynamic link library, determining whether a target memory block meets a shellcode execution condition, the target memory block being a memory block where an execution code for loading the network dynamic link library in the sample program is located; If the target memory block meets the shellcode running condition, a malicious program processing flow is executed on the sample program, wherein the malicious program processing flow includes: terminating the execution of the sample program before the sample program successfully calls the network connection function in the network dynamic link library. The method according to claim 1, wherein the target memory block is determined to meet the shellcode execution condition when the target memory block meets any one of the following conditions, the conditions comprising: The size of the target memory block is equal to the memory page size in the operating system of the computer device; The target memory block has private permission, writable permission and executable permission; The target memory block includes a format header of a movable executable PE file. The method according to claim 1 or 2, wherein monitoring whether the sample program running on the computer device loads the network dynamic link library comprises: The dynamic library loading function in the operating system of the computer device is hooked by a first hook function to monitor whether the sample program loads the network dynamic link library, and the dynamic library loading function is used to load the network dynamic link library. The method according to claim 3 is characterized in that the first hook function is a user-mode hook function in the sample program, and the first hook function is injected into the sample program after the sample program is started; or, the first hook function is a kernel-mode hook function in the kernel of the computer device. The method according to any one of claims 1 to 4, wherein executing a malicious program processing process on the sample program comprises: Obtain network connection parameters provided by the sample program when attempting to call a network connection function in the network dynamic link library, and terminate execution of the sample program before the sample program successfully calls the network connection function in the network dynamic link library, wherein the network connection parameters include network address information of a remote server that the sample program attempts to connect to. The method according to claim 5, wherein obtaining the network connection parameters provided by the sample program when attempting to call the network connection function in the network dynamic link library comprises: Pausing the execution of the sample program, and hooking the network connection function in the network dynamic link library through a second hook function during the suspension period; After the network connection function in the network dynamic link library is hooked by the second hook function, resuming execution of the sample program; In response to the sample program calling the network connection function in the network dynamic link library, the network connection parameters provided by the sample program when calling the network connection function are obtained through the second hook function. The method according to claim 6 is characterized in that the second hook function is a user-mode hook function in the sample program, and the second hook function is injected into the sample program after the sample program is started; or, the second hook function is a kernel-mode hook function in the kernel of the computer device. The method according to any one of claims 5 to 7, characterized in that the method further comprises: The network address information of the remote server is sent to a protection device deployed between the computer device and the remote server, and the network address information of the remote server is used by the protection device to intercept traffic from and/or traffic to the remote server. The method according to any one of claims 5 to 8 is characterized in that the network address information of the remote server includes one or more of the Internet Protocol IP address of the remote server, the domain name address of the remote server, or the port number of the remote server. The method according to any one of claims 1 to 9, characterized in that the method is performed by security software running on the computer device. A computer device, comprising: a memory, a network interface, and at least one processor, The memory is used to store program instructions, After the at least one processor reads the program instructions stored in the memory, the computer device is caused to perform the following operations: monitoring whether a sample program running on the computer device has loaded a network dynamic link library, wherein the network dynamic link library is used to support network communication of the application program, and the network dynamic link library includes one or more network connection functions; In response to monitoring that the sample program loads the network dynamic link library, determining whether a target memory block meets a shellcode execution condition, the target memory block being a memory block where an execution code for loading the network dynamic link library in the sample program is located; If the target memory block meets the shellcode running condition, a malicious program processing flow is executed on the sample program, wherein the malicious program processing flow includes: terminating the execution of the sample program before the sample program successfully calls the network connection function in the network dynamic link library. The computer device according to claim 11, wherein the target memory block is determined to meet the shellcode execution condition when the target memory block meets any one of the following conditions, the conditions comprising: The size of the target memory block is equal to the memory page size in the operating system of the computer device; The target memory block has private permission, writable permission and executable permission; The target memory block includes a format header of a movable executable PE file. The computer device according to claim 11 or 12, wherein after the program instructions are read by the at least one processor, the computer device performs the following operations: The dynamic library loading function in the operating system of the computer device is hooked through a first hook function to monitor whether the sample program loads the network dynamic link library, and the dynamic library loading function is used to load the network dynamic link library. The computer device according to claim 13 is characterized in that the first hook function is a user-mode hook function in the sample program, and the first hook function is injected into the sample program after the sample program is started; or, the first hook function is a kernel-mode hook function in the kernel of the computer device. The computer device according to any one of claims 11 to 14, wherein after the program instructions are read by the at least one processor, the computer device performs the following operations: If the target memory block meets the shellcode execution condition, network connection parameters provided by the sample program when attempting to call a network connection function in the network dynamic link library are obtained, and execution of the sample program is terminated before the sample program successfully calls the network connection function in the network dynamic link library, wherein the network connection parameters include network address information of a remote server that the sample program attempts to connect to. The computer device according to claim 15, wherein after the program instructions are read by the at least one processor, the computer device performs the following operations: If the target memory block meets the shellcode running condition, suspending the execution of the sample program, and hooking the network connection function in the network dynamic link library through the second hook function during the suspension; After the network connection function in the network dynamic link library is hooked by the second hook function, resuming execution of the sample program; In response to the sample program calling a network connection function in the network dynamic link library, obtaining, through the second hook function, the network connection parameters provided by the sample program when calling the network connection function; The execution of the sample program is terminated before the sample program successfully calls the network connection function in the network dynamic link library. The computer device according to claim 16 is characterized in that the second hook function is a user-mode hook function in the sample program, and the second hook function is injected into the sample program after the sample program is started; or, the second hook function is a kernel-mode hook function in the kernel of the computer device. The computer device according to any one of claims 15 to 17, wherein after the program instructions are read by the at least one processor, the computer device further performs the following operations: The network address information of the remote server is sent to a protection device deployed between the computer device and the remote server, and the network address information of the remote server is used by the protection device to intercept traffic from and/or traffic to the remote server. The computer device according to any one of claims 15 to 18 is characterized in that the network address information of the remote server includes one or more of an Internet Protocol (IP) address of the remote server, a domain name address of the remote server, or a port number of the remote server. An attack defense system, characterized by comprising: a computer device and a protection device, wherein the computer device is located in a protected network protected by the protection device; The computer device is used to monitor whether the sample program running on the computer device has loaded a network dynamic link library, wherein the network dynamic link library is used to support the application program to perform network communication, and the network dynamic link library includes one or more network connection functions; The computer device is further configured to, in response to monitoring that the sample program loads the network dynamic link library, determine whether a target memory block satisfies a shellcode running condition, the target memory block being a memory block in the sample program where the running code for loading the network dynamic link library is located; and, if the target memory block satisfies the shellcode running condition, execute a malicious program processing flow for the sample program, wherein the malicious program processing flow comprises: obtaining network connection parameters provided when the sample program attempts to call a network connection function in the network dynamic link library, and terminating execution of the sample program before the sample program successfully calls the network connection function in the network dynamic link library, the network connection parameters comprising network address information of a remote server to which the sample program attempts to connect; The computer device is further configured to send the network address information of the remote server to the protection device; The protection device is used to intercept traffic from the remote server and/or traffic destined for the remote server according to the network address information of the remote server. A computer-readable storage medium, characterized in that instructions are stored on the computer-readable storage medium, and when the instructions are executed by a processor, the method according to any one of claims 1 to 10 is implemented. A computer program product, characterized in that it comprises a computer program, and when the computer program is executed by a processor, it implements the method according to any one of claims 1 to 10.