Dynamic detection method of Shellcode

Abstract

Disclosed is a dynamic detection method of a Shellcode. The method comprises the steps that network data flow is firstly grabbed and divided, and a plurality of execution links are obtained; then an operating system breakpoint is triggered to be abnormal, and the register value and internal storage content in the abnormality triggering process are used as an initial register value and internal storage content to be stored; finally, the execution links are executed in sequence, meanwhile, whether an endless loop or operating system abnormality occurs or not is detected in the execution process of each execution link, the current execution link has no Shellcode if the endless loop or operating system abnormality occurs, and otherwise whether the current execution link has the Shellcode or not is detected in a starting method, and detection is completed. According to the method, the Shellcode with the code obfuscation technology can be detected, the virtualization technology is not adopted, deployment is easy, the Shellcode capable of finding virtualization environment can be detected effectively, and the probability of Shellcode detection exposure is greatly reduced.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a dynamic detection method of Shellcode. Background technique [0002] With the development of network attack technology, the code injection attack of buffer overflow has been paid more and more attention by attackers, and has become the main means of attacking computer systems. Among them, the code injection of buffer overflow includes Shellcode injection. Shellcode injection is to send malicious data containing Shellcode to vulnerable applications in the target host, thereby changing the execution process of vulnerable applications and even controlling the entire computer system. The key to resisting this kind of attack lies in whether the existence of Shellcode in the network data stream can be accurately discovered, and the existing technical methods for detecting Shellcode can be divided into two categories: static detection methods and dynamic detection methods...

AI Technical Summary

Problems solved by technology

However, Shellcode is likely to evade detection by first detecting whether there is a virtualization environment to determine whether to actually execute the effective part of Shellcode

Therefore, there is a need to solve the problem that the existing Shellcode dynamic detection method is easy to be discovered, that is, a dynamic detection method that does not use virtualization technology to further improve the concealment of Shellcode detection

Images