Method and apparatus for detecting malicious shell codes using debugging events
AssigneeAhnlab, Inc.
InventorsCha Sung Lim, Ju Seok Lee
Life of this patent
Estimating the term…
Abstract
An apparatus for detecting malicious shell codes using a debugging event includes an alert setting unit configured to set a mother program to run a non-executable file to trigger the debugging event when a mother process created by the mother program tries to execute a code with no execution attribute; and an information storage unit configured to store information on an address range in which modules to be used by the mother process are loaded in a memory. Further, the apparatus includes a malicious code determination unit configured to determine whether the non-executable file is malicious using the information on the address range when there occurs the debugging event.
Claims16
An apparatus for detecting malicious shell codes using a debugging event, the apparatus comprising:
- an alert setting unit configured to set a mother program for executing a non-executable file to trigger the debugging event when a mother process created by the mother program tries to execute a code with no execution attribute;
- an information storage unit configured to store information on an address range in which modules to be used by the mother process are loaded in a memory;
- a malicious code determination unit configured to determine whether the non-executable file is malicious using the information on the address range when the debugging event occurs;
- a cause analyzing unit configured to compare the module having the instruction related to the execution address out of the address range with information on vulnerabilities to analyze the reason for the vulnerability when it is determined that the non-executable file is malicious;
- and
- a malicious code extraction unit configured to extract the code in memory regions corresponding to the execution address out of the address range,
- wherein the alert setting unit injects a data execution alerting thread into a target process to be detected when the debugging event occurs by the mother process, and
- wherein the malicious code determination unit determines that the non-executable file is malicious when the execution address of the instruction executed by the mother process is out of the address range, determines whether the non-executable file is malicious depending on information about whether a SEH (Structured Exception Handling) is infected when the execution address of the instruction is within the address range, and determines that the structured exception handling is infected and the non-executable file is malicious when a current address of a chain value of the structured exception handling is the same as an address of a next structured exception handling.
A method for detecting malicious shell codes using a debugging event, the method comprising:
- setting a mother program for executing a non-executable file to trigger the debugging event when a mother process created by the mother program tries to execute a code with no execution attribute;
- acquiring information on address range on which modules to be used by the mother process are loaded in a memory;
- determining whether the non-executable file is malicious using the address range when there occurs the debugging event;
- when it is determined that the non-executable file is malicious, analyzing the reason for the vulnerability by comparing the module having the instruction related to the execution address out of the address range with the information on vulnerabilities;
- and
- when it is determined that the non-executable file is malicious, extracting the code in memory region which corresponds to the execution address beyond the address range,
- wherein said setting a mother program comprises:
- identifying whether there occurs the debugging event by the mother process;
- and
- injecting a data execution alerting thread in a target process to be detected when the debugging event occurs, and
- wherein said determining whether the non-executable file comprises:
- determining that the non-executable file is malicious when an execution address of the instruction executed by the mother process is out of the address range;
- determining whether the non-executable file is malicious depending on information about whether a SEH (Structured Exception Handling) is infected when the execution address of the instruction executed by the mother process is within the address range;
- and
- after obtaining a chain value of the SEH, determining that the structured exception handling is infected and the non-executable file is malicious when a current address of a chain value of the structured exception handling is identical to an address of a next structured exception handling.
Dependencies are inferred from the claim text.