A method, device and electronic equipment for preventing malicious loading of drivers

Abstract

The invention provides a method and an apparatus for preventing malicious loading of a drive and an electronic device, which is used for reinforcing the interception of a malicious program loading the drive. The method comprises the following steps: acquiring a function address list in a call stack of a loading drive operation; determining an address of a first function according to the function address list, wherein the first function is a function collectively called in the loading drive operation; defining an address of a second function which is used for replacing the first function and has same parameters with the first function; acquiring operation information corresponding to the loading drive operation in the second function; and determining whether the loading drive operation is malicious or not according to the operation information, and rejecting the loading of a drive which is determined to be malicious. Since the first function collectively called in the loading drive operation is judged, the problem of incapability of interception caused by the incapability of executing the corresponding drive loading function in the prior art can be avoided.

Description

technical field [0001] The invention relates to the technical field of system security, in particular to a method, device and electronic equipment for preventing malicious loading of drivers. Background technique [0002] With the development of Internet technology, malicious program technologies such as viruses and Trojan horses emerge in an endless stream, and security software also needs to take corresponding blocking countermeasures. [0003] Individual malicious programs use special codes (unknown technology) to load drivers with malicious behaviors, and the drivers are digitally signed, so it is easy to bypass the defense of security software. [0004] In the prior art, there is also a method for intercepting driver module loading. Conventionally, most malicious programs can be intercepted to load driver modules, but some unknown technical means cannot be used to intercept modules loaded. Contents of the invention [0005] Embodiments of the present invention provid...

AI Technical Summary

Problems solved by technology

[0004] There is also an interception method for driver module loading in the prior art. Generally speaking, most malicious programs can be intercepted to load driver modules, but some unknown technical means cannot be intercepted to load modules.

Images