Shellcode detection method and device

Abstract

Embodiments of the invention provide a shellcode detection method and device. The method comprises the following steps of: obtaining instruction information of a to-be-detected shellcode; generating feature data of the to-be-detected shell code by adoption of the instruction information; respectively calculating a similarity between the to-be-detected shellcode and each shellcode category in a preset shellcode sample library according to the feature data; and determining a category of the to-be-detected shellcode according to the similarity, so as to deploy a corresponding preventive measure for the shellcode and then avoid the occurrence of safety accidents. According to the method and device, codes of the to-be-detected shellcode do not need to be executed line by line, and safety experts do not need to pre-define feature sequences, so that the consumption of resources such as human cost and the like is decreased and the shellcode detection efficiency is improved.

Description

technical field [0001] The present application relates to the technical field of information security, in particular to a shellcode detection method, a shellcode detection device, a shellcode sample library generation method and a shellcode sample library generation device. Background technique [0002] Shellcode refers to a piece of binary code that can complete special tasks, and can call or establish a shell (shell) with higher authority according to different tasks. Shellcode is the core of overflow programs and worms. It is generally sent to the attacked server as data. By sending a piece of binary code to an unpatched and vulnerable host and executing it, the control of the target machine can be obtained, and then implemented. Hacktivism. However, if the type of shellcode can be detected in advance, corresponding preventive measures can be deployed to avoid security incidents. [0003] In the prior art, the detection of shellcode mainly includes two methods of dynami...

AI Technical Summary

Problems solved by technology

[0004] However, dynamic detection does not work at all for a special part of the code

For example, shellcode that uses anti-virtualization technology cannot be detected through dynamic detection at all; secondly, when performing dynamic detection, in order to improve efficiency, an effective detection time is often set, and some behavior codes that hide for a long time It is also impossible to detect through dynamic detection

On the other hand, if static detection is used, the signature sequence must be pre-defined by security experts. Once the characteristics of the shellcode change, manpower and material resources need to be re-invested to analyze the sample, which consumes a lot of time and cost.

Images