A method and system for detecting malicious codes of Gaowei stealing secrets based on backtracking

Abstract

The invention discloses a high-power secret information stealing malicious code detection method and a system based on backward tracing. The method comprises the steps that a bait file and a keyword base are preset in the system; a system file is subjected to keyword base matching if the bait file is monitored and a progress and / or a thread perform / performs illegal operation on the bait file, or if the system file is monitored, and the progress and / or the thread perform / performs illegal operation on the system file; if a sensitive word in the keyword base is found in the system file, the progress and / or the thread are / is positioned, and executable files related to the progress and / or the thread are positioned; white list matching is performed; if the matching fails, the file is a high-power secret information stealing malicious code file; relevance comparison is performed based on the high-power secret information stealing malicious code file; and other related high-power secret information stealing malicious code files are acquired. Therefore, the defect that the existing malicious code detection method cannot detect a high-power secret information stealing malicious code is overcome, and the high-power secret information stealing malicious code detection method is timely in detection, and does not have the hysteretic nature.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a backtracking-based method and system for detecting malicious codes of high-wei stealing secrets. Background technique [0002] The attack behavior of Gaowei stealing malicious code has extremely strong concealment ability, and usually uses the trusted application program loopholes in the enterprise or institutional network to form the network environment required by the attacker; it is also highly targeted, usually before the attack is triggered It is necessary to be familiar with the user's network environment, collect a large amount of accurate information about the user's business process and the usage of the target system, locate the storage location and communication method of key information, and especially collect all kinds of 0day for the attacked environment is an important link. [0003] Gaowei secret-stealing malicious code uses various 0day vuln...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the above-mentioned technical problems, the present invention provides a method and system for detecting malicious codes of Gaowei stealing secrets based on reverse tracing. code, and utilize correlation comparison technology to detect the associated high-wei stealing malicious code, the method overcomes the shortcomings of traditional malicious code detection methods that cannot detect high-wei stealing malicious code and detection lag

Images