Method, device and equipment for determining program by utilizing privileged bug and storage medium

Abstract

The invention discloses a method for determining a program by utilizing a privileged bug, and belongs to the technical field of computers. The method comprises the steps of obtaining a process identifier of a target process from a process creation component; in the process of monitoring the target process, obtaining a first permission level of the target process from a system kernel through a process identifier of the target process and a first callback function; obtaining a second permission level; and when the first permission level is higher than the second permission level, obtaining a program corresponding to the target process as a program utilizing the permission-enhancing vulnerability. The method comprises the steps of obtaining a process identifier of a target process from a process creation component; obtaining an authority level of the target process from a system kernel according to the process identifier, and determining whether the program corresponding to the target process utilizes the privilege-offering vulnerability or not according to the privilege levels acquired twice successively; the process does not need to monitor various privilege-offering behaviors in the system, and which processes utilize the privilege-offering vulnerability is judged according to the privilege change of the processes, so that the detection accuracy and the detection efficiency areimproved.

Description

technical field [0001] The present application relates to the field of computer technology, and in particular to a method, device, equipment and storage medium for determining a program that utilizes a privilege escalation vulnerability. Background technique [0002] With the development of the computer field, there are more and more types of application programs in the terminal. With the use of these application programs, more and more user data are stored in the terminal. Once these data are leaked, it may bring great harm to users. Loss, application security issues have been concerned by users. [0003] For example, in the network environment, there is a malicious program that uses a privilege escalation vulnerability to steal user application permissions. This type of malicious program can elevate its own application permissions to system permissions or even higher, so that it can obtain user data, delete system files, modify system configuration, etc. In related techn...

AI Technical Summary

Problems solved by technology

[0002] With the development of the computer field, there are more and more types of application programs in the terminal. With the use of these application programs, more and more user data are stored in the terminal. Once these data are leaked, it may bring great harm to users. loss, the security of the application has been concerned by users

[0004] In related technologies, it is more dependent on the integrity of the driver monitoring strategy, and the important operations monitored by the driver cannot cover all possible important operations, and when the driver monitors too many important operations, the system performance of the terminal will also be reduced, thus Affects the accuracy and detection efficiency of detecting malicious programs that exploit privilege escalation vulnerabilities

Images