METHOD AND SYSTEM FOR DETECTING A MALICIOUS CODE
Embodiments of the present invention provide a method and a system for detecting a malicious code. The method includes obtaining first system information and second system information, and detecting the malicious code by identifying difference between the first system information and the second system information, which thus can detect an unknown malicious code, improve the system security, and can be easily implemented.
1 . A method for detecting a malicious code, comprising:
obtaining first system information and second system information in system information, wherein the first system information is obtained when a kernel code is running, and the second system information is obtained when a user code is running; and
detecting the malicious code by identifying difference between the first system information and the second system information.
2 . The method according to claim 1 , wherein the first system information is difficult to be modified by the malicious code, and the second system information is easy to be modified by the malicious code.
3 . The method according to claim 1 , wherein the system information comprises one or any combination of: process information, port information, file information, registry information, system service information, and service provider interface (SPI) information.
4 . The method according to claim 3 , wherein obtaining the first system information and the second system information comprises:
when a type of the system information is the process information, reading a global handle table in a system kernel mode in a driver, and determining whether a process handle in the global handle table is a valid handle or not, and if the process handle in the global handle table is a valid handle, taking first process information corresponding to the process handle as the first system information; invoking a process tracking instruction of an application programming interface (API) of a system user mode, and taking second process information responded by the instruction as the second system information;
when a type of the system information is the port information, creating and invoking a query instruction for a transmission control protocol (TCP) device port condition of a system kernel mode in a driver, and taking first TCP device port condition information responded by the instruction as the first system information; invoking an enumeration instruction for a TCP device port condition of an API of a system user mode, and taking second TCP device port condition information responded by the instruction as the second system information; or
when a type of the system information is the file information, creating and invoking a query instruction for file information in a designated path of a system kernel mode in a driver, and taking first file information responded by the instruction as the first system information; invoking a query instruction for file information in a designated path of an API of a system user mode, and taking second file information responded by the instruction as the second system information.
5 . The method according to claim 3 , wherein obtaining the first system information and the second system information further comprises:
when a type of the system information is the registry information, invoking a privilege granting instruction for registry information of a system kernel mode, and taking first registry key value information in a designated path obtained according to a granted privilege as the first system information; invoking a registry operation instruction of an API of a system user mode, and taking second registry key value information responded by the instruction as the second system information;
when a type of the system information is the system service information, invoking a privilege granting instruction for registry information of a system kernel mode, and taking first system service information obtained according to a granted privilege as the first system information; invoking a registry operation instruction of an API of a system user mode for obtaining system service information, and taking second system service information responded by the instruction as the second system information; or
when a type of the system information is the SPI information, invoking a privilege granting instruction for registry information of a system kernel mode, and taking first SPI information obtained according to a granted privilege as the first system information; invoking a registry operation instruction of an API of a system user mode for obtaining SPI information, and taking second SPI information responded by the instruction as the second system information.
6 . The method according to claim 1 , further comprising:
obtaining system service descriptor table (SSDT) information, global descriptor table (GDT) information, or interrupt descriptor table (IDT) information to serve as reference information provided for a user during malicious code detection.
7 . The method according to claim 1 , further comprising:
blocking execution of the malicious code and/or recording related information.
8 . A system for detecting a malicious code, comprising:
a system information collection module, adapted to obtain first system information and second system information in system information, wherein the first system information is obtained when a kernel code is running, and the second system information is obtained when a user code is running; and
a malicious behavior detection module, adapted to detect the malicious code by identifying difference between the first system information and the second system information.
9 . The system according to claim 8 , wherein the first system information is difficult to be
modified by the malicious code, and the second system information is easy to be modified by the malicious code.
10 . The system according to claim 8 , wherein the system information comprises one or any combination of: process information, port information, file information, registry information, system service information, and service provider interface (SPI) information.
11 . The system according to claim 10 , wherein the system information collection module comprises one or any combination of the following modules:
a process information collection sub-module, when a type of the system information is the process information, adapted to read a global handle table of a system kernel mode in a driver, determine whether a process handle in the global handle table is a valid handle or not, take first process information corresponding to the process handle as the first system information if the process handle in the global handle table is the valid handle, invoke a process tracking instruction of an application programming interface (API) of a system user mode, and take second process information responded by the instruction as the second system information;
a port information collection sub-module, when a type of the system information is the port information, adapted to create and invoke a query instruction for a transmission control protocol (TCP) device port condition of a system kernel mode in a driver, take first TCP device port condition information responded by the instruction as the first system information, invoke an enumeration instruction for a TCP device port condition of an API of a system user mode, and take second TCP device port condition information responded by the instruction as the second system information;
a file information collection sub-module, when a type of the system information is the file information, adapted to create and invoke a query instruction for file information in a designated path of a system kernel mode in a driver, take first file information responded by the instruction as the first system information, invoke a query instruction for file information in a designated path of an API of a system user mode, and take second file information responded by the instruction as the second system information;
a registry information collection sub-module, when a type of the system information is the registry information, adapted to invoke a privilege granting instruction for registry information of a system kernel mode, take first registry key value information in a designated path obtained according to a granted privilege as the first system information, invoke a registry operation instruction of an API of a system user mode, and take second registry key value information responded by the instruction as the second system information;
a system service information collection sub-module, when a type of the system information is the system service information, adapted to invoke a privilege granting instruction for registry information of a system kernel mode, take first system service information obtained according to a granted privilege as the first system information, invoke a registry operation instruction of an API of a system user mode for obtaining system service information, and take second system service information responded by the instruction as the second system information; and
an SPI information collection sub-module, when a type of the system information is the SPI information, adapted to invoke a privilege granting instruction for registry information of a system kernel mode, take first SPI information obtained according to a granted privilege as the first system information, invoke a registry operation instruction of an API of a system user mode for obtaining SPI information, and take second SPI information responded by the instruction as the second system information.
12 . The system according to claim 8 , wherein the system information collection module further comprises:
a reference information collection sub-module, adapted to obtain system service descriptor table (SSDT) information, global descriptor table (GDT) information, or interrupt descriptor table (IDT) information to serve as reference information provided for a user during malicious code detection.
13 . The system according to claim 8 , further comprising:
a malicious behavior blocking module, adapted to block execution of the malicious code and/or record related information.
14 . A machine-readable storage, wherein a computer program stored therein comprises at least one code section adapted to process signals, the code section is executed by a machine, comprising:
obtaining first system information and second system information in system information, wherein the first system information is obtained when a kernel code is running, and the second system information is obtained when a user code is running; and
detecting the malicious code by identifying difference between the first system information and the second system information.
15 . The machine-readable storage according to claim 14 , wherein the first system information is difficult to be modified by the malicious code, and the second system information is easy to be modified by the malicious code.
16 . The machine-readable storage according to claim 14 , wherein the system information comprises one or any combination of: process information, port information, file information, registry information, system service information, and service provider interface (SPI) information.
17 . The machine-readable storage according to claim 16 , wherein the obtaining the first system information and the second system information comprises:
when a type of the system information is the process information, reading a global handle table in a system kernel mode in a driver, and determining whether a process handle in the global handle table is a valid handle or not, and if the process handle in the global handle table is the valid handle, taking first process information corresponding to the process handle as the first system information; invoking a process tracking instruction of an application programming interface (API) of a system user mode, and taking second process information responded by the instruction as the second system information;
when a type of the system information is the port information, creating and invoking a query instruction for a transmission control protocol (TCP) device port condition of a system kernel mode in a driver, and taking first TCP device port condition information responded by the instruction as the first system information; invoking an enumeration instruction for a TCP device port condition of an API of a system user mode, and taking second TCP device port condition information responded by the instruction as the second system information; or
when a type of the system information is the file information, creating and invoking a query instruction for file information in a designated path of a system kernel mode in a driver, and taking first file information responded by the instruction as the first system information; invoking a query instruction for file information in a designated path of an API of a system user mode, and taking second file information responded by the instruction as the second system information.
18 . The machine-readable storage according to claim 16 , wherein obtaining the first system information and the second system information further comprises:
when a type of the system information is the registry information, invoking a privilege granting instruction for registry information of a system kernel mode, and taking first registry key value information in a designated path obtained according to a granted privilege as the first system information; invoking a registry operation instruction of an API of a system user mode, and taking second registry key value information responded by the instruction as the second system information;
when a type of the system information is the system service information, invoking a privilege granting instruction for registry information of a system kernel mode, and taking first system service information obtained according to a granted privilege as the first system information; invoking a registry operation instruction of an API of a system user mode for obtaining system service information, and taking second system service information responded by the instruction as the second system information; or
when a type of the system information is the SPI information, invoking a privilege granting instruction for registry information of a system kernel mode, and taking first SPI information obtained according to a granted privilege as the first system information; invoking a registry operation instruction of an API of a system user mode for obtaining SPI information, and taking second SPI information responded by the instruction as the second system information.