CN114662098A - Attack code detection method, device, electronic device, program and storage medium - Google Patents

Abstract

The present invention provides an attack code detection method, device, electronic device, program and storage medium for obtaining the return address of a calling function within the scope of a process stack in the system, if the return address does not belong to the system configuration for storing system executable files address, it is determined that there is attack code in the system. By obtaining the return address of the calling function, the detection of the attack code is directly realized without establishing a signature library, and the identification process is simple, which is beneficial to improve the identification efficiency of the attack code.

Description

Attack code detection method, device, electronic device, program and storage medium

technical field

The invention relates to the technical field of information security protection, in particular to an attack code detection method, device, electronic device, program and storage medium.

Background technique

Network devices inevitably have loopholes, and attackers will use these loopholes to construct a piece of attack code to attack network devices. For example, attackers will use attack codes to escalate privileges, execute programs, and connect to remote machines in network devices, so as to achieve the purpose of arbitrarily controlling network devices. For example, the attack code shellcode of the Linux server used for the attack.

In the prior art, the call chain sequence of the system call needs to be learned in advance, and a normal behavior feature library is established, and then the sequence of the system call of the system and the normal sequence feature library are matched to identify the exploit behavior. However, this method has the following disadvantages: it needs to learn to build a feature library in advance, and it must be ensured that there is no vulnerability exploitation behavior during the learning process; the matching logic is complicated, and it must consume too much system resources. It can be seen that the existing attack code identification methods need to establish a feature library based on a large amount of data, the identification process is relatively complicated, and the identification efficiency is low.

SUMMARY OF THE INVENTION

The invention provides an attack code detection method, device, electronic device, program and storage medium, which are used to solve the problem that the existing attack code identification method needs to establish a feature library based on a large amount of data, the identification process is relatively complicated, and the identification efficiency is low. It can identify the attack code in a simple way and improve the identification efficiency.

The present invention provides an attack code detection method, comprising:

Obtain the return address of the calling function; wherein, the calling function is a function called by the target process of the system;

If the return address does not belong to the system configuration address, there is attack code in the system; the system configuration address is the code segment address of the executable file loaded by the target process.

According to the present invention, an attack code detection method is provided. On the basis of the above, before obtaining the return address of the calling function, the method further includes:

Obtain the monitoring information of whether the monitoring function is called; wherein, the monitoring function is determined according to the historical calling information of the function by the attack code;

If the monitoring information is that a monitoring function is called, the process that calls the monitoring function is used as the target process.

According to the present invention, an attack code detection method is provided. On the basis of the above, obtaining the return address of the calling function includes:

Obtain the function stack frame of the calling function from the kernel, and/or obtain the function stack frame of the calling function from the application layer;

The return address is obtained according to the function stack frame of the calling function.

According to the present invention, an attack code detection method is provided. On the basis of the above, obtaining the function stack frame of the calling function from the kernel includes:

When the target process is obtained from the kernel stack and falls into the kernel, the user-mode context structure saved in the kernel stack;

Determine the base address of the first function stack frame within the target process stack range according to the user-mode context structure, as the first base address;

Starting from the first base address, each function stack frame within the stack range of the target process is obtained to obtain the function stack frame of the calling function.

According to the present invention, an attack code detection method is provided. On the basis of the above, obtaining the function stack frame of the calling function from the application layer includes:

Obtain the base address of the first function stack frame within the range of the target process stack from the user stack of the application layer, as the second base address;

Starting from the second base address, each function stack frame within the stack range of the target process is acquired to obtain the function stack frame of the calling function.

According to the present invention, an attack code detection method is provided. On the basis of the above, before the return address does not belong to the system configuration address, the method further includes:

Determine the virtual memory block structure corresponding to the return address through the virtual memory management structure in the memory, and determine whether the return address belongs to the address pointed to by the member describing the mapped file in the virtual memory block structure the system configuration address;

And/or, obtain the memory layout file representing the memory layout from the application layer, obtain the line content where the return address is located from the memory layout file, and determine whether the return address belongs to the line content according to the file path in the line content. The system configuration address.

The present invention also provides an attack code detection device, comprising:

an acquisition module for acquiring the return address of the calling function; wherein, the calling function is a function called by the target process of the system;

The determining module is used for if the return address does not belong to the system configuration address, there is attack code in the system; the system configuration address is the code segment address of the executable file loaded by the target process.

The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, the processor implementing the attack code detection according to any one of the above when the processor executes the program steps of the method.

The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of any one of the above-mentioned attack code detection methods.

The present invention also provides a computer program that, when executed by a processor, implements the steps of any one of the attack code detection methods described above.

An attack code detection method, device, electronic device, program and storage medium provided by the present invention obtain the return address of a calling function within the scope of the process stack in the system, and if the return address exists, it does not belong to the system for storing system executable files. If the address is configured, it is determined that there is attack code in the system. By obtaining the return address of the calling function, the detection of the attack code is directly realized without establishing a signature library, and the identification process is simple, which is beneficial to improve the identification efficiency of the attack code.

Description of drawings

In order to explain the present invention or the technical solutions in the prior art more clearly, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are the For some embodiments of the invention, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without any creative effort.

Fig. 1 is one of the schematic flow charts of the attack code detection method provided by the present invention;

Fig. 2 is the structural representation of the stack frame in the stack provided by the present invention;

3 is a schematic diagram of the process of obtaining a function call chain through the kernel provided by the present invention;

4 is a schematic flowchart of the detection of attack code by the kernel provided by the present invention;

5 is one of the structural block diagrams of the attack code detection device provided by the present invention;

6 is a schematic diagram of a physical structure of an electronic device provided by the present invention;

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention. , not all examples. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

1 is a schematic flowchart of an attack code detection method provided by the present embodiment, the attack code detection method can be executed by a device (server or terminal) to be subjected to attack code detection, for example, the attack code detection method can be executed by a Linux server, Specifically, it is executed by the protection driver module implanted in the Linux server. See Figure 1. The attack code detection method includes:

Step 101: Obtain the return address of the calling function; wherein, the calling function is a function called by the target process of the system.

The process of the system usually completes the task corresponding to the process by calling the function in the system. The calling function called by the process can obtain the function stack frame from the stack created by the process, and there is information about the calling function in the function stack frame. The information includes the local variables of the calling function, the address and return address of the previous stack frame, and so on. Among them, the return address indicates the address of the code that needs to be executed after the function execution is completed.

Among them, the return addresses of the calling functions are sequentially obtained within the stack range of the target process, and these return addresses are sequentially stored in the linked list, that is, the function call chain of the target process is formed. Therefore, the function call chain actually represents the call path between functions in the process. During program execution, each stack frame corresponds to an unfinished calling function, and the stack frame stores the return address, stack base address, local variables, and so on of the calling function. FIG. 2 is a schematic structural diagram of a stack frame in a stack provided by this embodiment, each stack frame corresponds to a calling function, and the return address of the calling function can be directly obtained from the stack frame. The return address of the calling function indicates the address of the code that needs to be executed next after the called function is processed.

It should be noted that since each process will allocate space to the process in the application layer and the kernel when it is running, the function stack frame of each calling function can be obtained through the application layer and the kernel, and then the return of the calling function can be obtained. address.

Step 102: If the return address does not belong to the system configuration address, there is attack code in the system; the system configuration address is the code segment address of the executable file loaded by the target process.

Since in the process of not being attacked by the attack code, the return address of each function executed by the process of the system should belong to the system configuration address allocated for the executable file of the system. Therefore, in this embodiment, if any return address is detected If it does not belong to the system configuration address, it is determined that there is attack code in the system. The executable file of the system depends on the system. For example, in a Linux server, the executable file is an ELF file (the ELF file is actually an executable file and a dynamic link library file on the Linux system). For example, the protection driver module implanted in the Linux server determines whether the files pointed to by the return address of each calling function of the target process belong to the ELF file (that is, whether the return address belongs to the system configuration address). If so, the Linux server does not exist. Attack code, otherwise, there is attack code on the Linux server. There is attack code in the system, more specifically, the application program to which the target process belongs is attacked by the attack code.

In this embodiment, an attack code detection method is used to obtain the return address of a calling function within the scope of the process stack in the system. If the return address does not belong to the system configuration address used to store the system executable file, it is determined that the system has attack code. By obtaining the return address of the calling function, the detection of the attack code is directly realized without establishing a signature library, and the identification process is simple, which is beneficial to improve the identification efficiency of the attack code.

It can be seen that, compared with the prior art, the attack code detection method provided in this embodiment has the following advantages: it realizes the monitoring of processes on Linux, does not require a learning process, can be used out of the box, does not require a feature library, and can detect attacks on the calling chain. For all return addresses, if the detection is found to be non-compliant, an alarm will be issued, and the scope of application is wider. It is very efficient to monitor the call chain of all processes through the kernel driver.

Further, on the basis of the above embodiment, before obtaining the return address of the calling function, the method further includes:

Obtain the monitoring information of whether the monitoring function is called; wherein, the monitoring function is determined according to the historical calling information of the function by the attack code;

If the monitoring information is that a monitoring function is called, the process that calls the monitoring function is used as the target process.

It should be noted that the monitoring function is determined according to the historical calling information of the function by the attack code, and the function that is called by the attack code is more likely to be called. Since each process is running, space is allocated for the process in the kernel and the application layer, so the call monitoring of the monitoring function can be realized through the kernel and the application layer, and then the detection of the attack code can be triggered.

Further, the acquisition of monitoring information on whether the monitoring function is called includes:

Obtain monitoring information on whether the monitoring function monitored by the kernel is called, wherein the monitoring function monitored by the kernel includes at least one of the following: execve, socketcall, bind, connect;

And/or, obtain monitoring information on whether the monitoring function monitored by the application layer is called, wherein the monitoring function monitored by the application layer includes at least one of the following: execve, execl, execlp, execle, execv, execvp, execvpe, bind, connect, system.

Wherein, obtaining the monitoring information of whether the monitoring function monitored by the kernel is called, specifically includes: (protection driver module) setting the monitoring function monitored by the kernel as a hook point, and detecting whether the monitoring function of the hook point is called through the hook.

Among them, obtaining the monitoring information of whether the monitoring function monitored by the application layer is called, specifically includes: (protection driver module) pre-generate the call check code to check whether the monitoring function is called, and pass LD_PRELOAD or /etc/ld.so .preload injects this call checking code into a process (eg, a web server process), replacing monitoring functions that are easily called by attack code.

Since the monitoring function is a function that is very likely to be called by the attack code, when it is detected that a process calls the set monitoring function, the process has a high probability of being attacked by the attack code, so the process can be called by the attack code. As the target process, it is further determined whether it is attacked by the attack function through the return address of each calling function of the target process.

In this embodiment, the monitoring information of the monitoring function narrows the range of functions that need to be detected for attack code, improves the effectiveness of the attack code detection process, and avoids invalid occupation of system resources.

Further, on the basis of the above embodiments, the obtaining the return address of the calling function includes:

Obtain the function stack frame of the calling function from the kernel, and/or obtain the function stack frame of the calling function from the application layer;

The return address is obtained according to the function stack frame of the calling function.

Since space is allocated to the process at the kernel and the application layer when the process is running, the function stack frame of the calling function of the process can be obtained through both the kernel and the application layer. As shown in Figure 2, the return address of the calling function can be read from each stack frame.

In this embodiment, the function stack frame of the calling function is obtained through the kernel and/or the application layer, and the return address of each calling function is obtained through the function stack frame of the calling function, thereby realizing the judgment of whether there is an attack code in the system .

Further, on the basis of the above embodiments, the obtaining the function stack frame of the calling function from the kernel includes:

When the target process is obtained from the kernel stack and falls into the kernel, the user-mode context structure saved in the kernel stack;

Determine the base address of the first function stack frame within the target process stack range according to the user-mode context structure, as the first base address;

Starting from the first base address, each function stack frame within the stack range of the target process is obtained to obtain the function stack frame of the calling function.

It should be noted that the base address of the function stack frame indicates the starting position of the function stack frame. Since the target process stack range is the function stack frame that is sequentially stored according to the calling relationship of the target process to the function, therefore, from the first base address According to the structural characteristics of the stack itself, you can traverse to each function stack frame from the stack start address to the top of the stack within the range of the target process stack.

The process is in user mode when the application layer is running, and the process is in the kernel mode when it is running in the kernel mode. During the running process of the process, it falls into the kernel state through system calls. When the process falls into the kernel state, the context information during user state execution will be transferred to the kernel, so the information of all calling functions of the process can also be obtained through the kernel. . The user-mode context structure corresponding to the context information during user-mode execution contains the address of each function stack frame in the process stack range, so the base address of the first function stack frame can be obtained through the user-mode context structure, and then the first function stack frame can be obtained from the user mode context structure. The base address of the frame starts to traverse each function stack frame within the process stack range, and each function stack frame within the process stack range can be obtained.

For the kernel, the (protection driver module) can obtain the return function in each function stack frame within the scope of the target process stack through the check function A in the kernel, form a function call chain, and traverse each return address of the function call chain, Determine whether there is any return address that does not belong to the system configuration address. FIG. 3 is a schematic diagram of a process of obtaining a function call chain through a kernel provided by the present embodiment. Referring to FIG. 3 , the process includes:

Get the user-mode context structure pt_regs from the kernel stack of the target process;

Get the current user mode stack frame base address bp from pt_regs;

Traverse all stack frames up along bp, and save the return address of each stack frame to an array, which is the data structure for storing the call chain.

Specifically, for the kernel, (the protection driver module) can obtain the function call chain through the check function A in the kernel, and then obtain the return address of each calling function through the function calling chain, and judge whether the system exists according to the return address of each calling function. attack code. FIG. 4 is a schematic flowchart of attack code detection through the kernel provided in this embodiment. The process includes: when (the protection driver module) hooks the system to call execve, socketcall, bind, and connect, the inspection function A is entered. The check function A first obtains the call chain from the user mode context of the target process hooked to, and the call chain contains the return addresses of all stack frames, and loops to determine whether each return address comes from the ELF file. After judgment, if it is found that the return address is not from the ELF file, it is very likely that the shellcode code is being executed, and an alarm log is generated. If all return addresses are from the ELF file, the check is complete.

In this embodiment, the return address of each calling function is obtained through the kernel stack, so that whether there is an attack code is judged according to the return address, when an attack code is detected, an alarm is generated in time, and the attack code is processed in time to ensure that system security.

Further, on the basis of the foregoing embodiments, the obtaining the function stack frame of the calling function from the application layer includes:

Obtain the base address of the first function stack frame within the range of the target process stack from the user stack of the application layer, as the second base address;

Starting from the second base address, each function stack frame within the stack range of the target process is acquired to obtain the function stack frame of the calling function.

Specifically, within the stack range of the target process are the function stack frames that are sequentially stored according to the calling relationship of the target process to the function. Therefore, starting from the second base address, according to the structural characteristics of the stack itself, it is possible to traverse to the stack within the stack range of the target process. Each function stack frame from the starting address to the top of the stack.

For the application layer, (the protection driver module) can obtain the return function in each function stack frame within the target process stack range by checking the function B, form a function call chain, traverse each return address of the function call chain, and determine whether There is any return address that does not belong to the system configuration address. Among them, the inspection function B is a function that is pre-injected into the target program to be detected by the attack code. The injected check function B directly reads the base address bp of the stack frame, starts to traverse from the base address bp of the stack frame, and obtains the entire function call chain.

In this embodiment, the application layer realizes the acquisition of the return address of each calling function, so as to determine whether there is an attack code according to the return address, and when an attack code is detected, an alarm is generated in time, and the attack code is processed in time to ensure system security.

Further, on the basis of the foregoing embodiments, before the return address does not belong to the system configuration address, the method further includes:

Determine the virtual memory block structure corresponding to the return address through the virtual memory management structure in the memory, and determine whether the return address belongs to the address pointed to by the member describing the mapped file in the virtual memory block structure the system configuration address;

And/or, obtain the memory layout file representing the memory layout from the application layer, obtain the line content where the return address is located from the memory layout file, and determine whether the return address belongs to the line content according to the file path in the line content. The system configuration address.

When the address pointed to by the variable describing the member of the mapped file in the virtual memory block structure does not belong to the system configuration address, and the return address does not belong to the system configuration address, there is an attack code in the system.

When the file path in the line content does not include the file path belonging to the system configuration address, the return address does not belong to the system configuration address, and there is attack code in the system.

Specifically, taking a Linux server as an example, the following methods can be used to determine whether the return address points to the executable file of the system for the memory:

Get the virtual memory management structure mm_struct of the target process;

Traverse the red-black tree nodes on mm_struct to find the vm_area_struct structure (that is, the virtual memory block structure) where the return address is located;

Check whether the vm_file member of the vm_area_struct structure (that is, the member describing the mapped file) variable points to an ELF file, if not, the return address may come from the shellcode being executed.

Among them, the red-black tree node is a binary search tree in the virtual memory management structure mm_struct, and the vm_area_struct structure where the return address is located can be quickly found through the red-black tree node.

Specifically, taking a Linux server as an example, for the application layer, the following method can be used to determine whether the return address points to the executable file of the system:

Read the /proc/self/maps file (that is, the memory layout file).

Parse each line of the memory layout file, where each line of the /proc/self/maps file represents a virtual memory block, and the line content of each line includes the start address and end address of the virtual memory block. If it is an ELF file Memory mapping, and also displays the path to the ELF file;

Determine whether there is a corresponding ELF file path in the line where the return address is located. If not, it means that the return address may come from the shellcode being executed.

In this embodiment, the process of judging whether there is an attack code in the system according to the return address is provided from the memory and application layers, which realizes the detection of the attack code without modeling, the detection process is simple, and the detection efficiency is high.

The present application uses the kernel-driven method to monitor the process call chain, which has better performance than other methods; traverses each return address on the call chain and makes judgments, and can stably detect the shellcode code being executed.

FIG. 5 is a structural block diagram of an attack code detection apparatus provided in this embodiment, referring to FIG. 5 , including an acquisition module 501 and a determination module 502;

Obtaining module 501, for obtaining the return address of the calling function; wherein, the calling function is a function called by the target process of the system;

The determining module 502 is configured to, if the return address does not belong to the system configuration address, there is attack code in the system; the system configuration address is the code segment address of the executable file loaded by the target process.

The attack code detection apparatus provided in this embodiment is applicable to the attack code detection methods provided by the above embodiments, and details are not described herein again.

This embodiment provides an attack code detection device that obtains the return address of a calling function within the range of the process stack in the system. If the return address does not belong to the system configuration address used to store the system executable file, it is determined that there is attack code in the system. By obtaining the return address of the calling function, the detection of the attack code is directly realized without establishing a signature library, and the identification process is simple, which is beneficial to improve the identification efficiency of the attack code.

An attack code detection device is provided according to the present invention. On the basis of the above, before acquiring the return address of the calling function, the method further includes:

Obtain the monitoring information of whether the monitoring function is called; wherein, the monitoring function is determined according to the historical calling information of the function by the attack code;

If the monitoring information is that a monitoring function is called, the process that calls the monitoring function is used as the target process.

According to the present invention, an attack code detection device is provided. On the basis of the above, the obtaining the return address of the calling function includes:

Obtain the function stack frame of the calling function from the kernel, and/or obtain the function stack frame of the calling function from the application layer;

The return address is obtained according to the function stack frame of the calling function.

According to the present invention, an attack code detection device is provided. On the basis of the above, obtaining the function stack frame of the calling function from the kernel includes:

When the target process is obtained from the kernel stack and falls into the kernel, the user-mode context structure saved in the kernel stack;

Determine the base address of the first function stack frame within the target process stack range according to the user-mode context structure, as the first base address;

Starting from the first base address, each function stack frame within the stack range of the target process is obtained to obtain the function stack frame of the calling function.

According to the present invention, an attack code detection device is provided. On the basis of the above, acquiring the function stack frame of the calling function from the application layer includes:

Obtain the base address of the first function stack frame within the range of the target process stack from the user stack of the application layer, as the second base address;

Starting from the second base address, each function stack frame within the stack range of the target process is acquired to obtain the function stack frame of the calling function.

According to the present invention, an attack code detection device is provided. On the basis of the above, before the return address does not belong to the system configuration address, the method further includes:

Determine the virtual memory block structure corresponding to the return address through the virtual memory management structure in the memory, and determine whether the return address belongs to the address pointed to by the member describing the mapped file in the virtual memory block structure the system configuration address;

And/or, obtain the memory layout file representing the memory layout from the application layer, obtain the line content where the return address is located from the memory layout file, and determine whether the return address belongs to the line content according to the file path in the line content. The system configuration address.

FIG. 6 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG. 6 , the electronic device may include: a processor (processor) 610, a communication interface (Communications Interface) 620, a memory (memory) 630 and a communication bus 640, The processor 610 , the communication interface 620 , and the memory 630 communicate with each other through the communication bus 640 . The processor 610 may invoke logic instructions in the memory 630 to execute an attack code detection method, the method comprising:

Obtain the return address of the calling function; wherein, the calling function is a function called by the target process of the system;

If the return address does not belong to the system configuration address, there is attack code in the system; the system configuration address is the code segment address of the executable file loaded by the target process.

In addition, the above-mentioned logic instructions in the memory 630 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

In another aspect, the present invention also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer When executed, the computer can execute the attack code detection method provided by the above methods, and the method includes:

Obtain the return address of the calling function; wherein, the calling function is a function called by the target process of the system;

If the return address does not belong to the system configuration address, there is attack code in the system; the system configuration address is the code segment address of the executable file loaded by the target process.

In another aspect, the present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored, the computer program is implemented by a processor to execute the attack code detection methods provided above, and the method includes:

Obtain the return address of the calling function; wherein, the calling function is a function called by the target process of the system;

If the return address does not belong to the system configuration address, there is attack code in the system; the system configuration address is the code segment address of the executable file loaded by the target process.

The device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in One place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand: it can still be Modifications are made to the technical solutions described in the foregoing embodiments, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (10)

1. an attack code detection method, is characterized in that, comprises: Obtain the return address of the calling function; wherein, the calling function is a function called by the target process of the system; If the return address does not belong to the system configuration address, there is attack code in the system; the system configuration address is the code segment address of the executable file loaded by the target process. 2. attack code detection method according to claim 1, is characterized in that, before obtaining the return address of calling function, described method also comprises: Obtain the monitoring information of whether the monitoring function is called; wherein, the monitoring function is determined according to the historical calling information of the function by the attack code; If the monitoring information is that a monitoring function is called, the process that calls the monitoring function is used as the target process. 3. attack code detection method according to claim 1, is characterized in that, described obtaining the return address of calling function, comprises: Obtain the function stack frame of the calling function from the kernel, and/or obtain the function stack frame of the calling function from the application layer; The return address is obtained according to the function stack frame of the calling function. 4. attack code detection method according to claim 3, is characterized in that, described acquiring the function stack frame of described calling function from kernel, comprising: When the target process is obtained from the kernel stack and falls into the kernel, the user-mode context structure saved in the kernel stack; Determine the base address of the first function stack frame within the target process stack range according to the user-mode context structure, as the first base address; Starting from the first base address, each function stack frame within the stack range of the target process is obtained to obtain the function stack frame of the calling function. 5. The attack code detection method according to claim 3, wherein the obtaining the function stack frame of the calling function from the application layer comprises: Obtain the base address of the first function stack frame within the range of the target process stack from the user stack of the application layer, as the second base address; Starting from the second base address, each function stack frame within the stack range of the target process is acquired to obtain the function stack frame of the calling function. 6. The attack code detection method according to claim 1, characterized in that, before the return address does not belong to the system configuration address, further comprising: Determine the virtual memory block structure corresponding to the return address through the virtual memory management structure in the memory, and determine whether the return address belongs to the address pointed to by the member describing the mapped file in the virtual memory block structure the system configuration address; And/or, obtain the memory layout file representing the memory layout from the application layer, obtain the line content where the return address is located from the memory layout file, and determine whether the return address belongs to the line content according to the file path in the line content. The system configuration address. 7. An attack code detection device, characterized in that, comprising: an acquisition module for acquiring the return address of the calling function; wherein, the calling function is a function called by the target process of the system; The determining module is used for if the return address does not belong to the system configuration address, there is attack code in the system; the system configuration address is the code segment address of the executable file loaded by the target process. 8. An electronic device comprising a memory, a processor and a computer program stored on the memory and running on the processor, wherein the processor implements any one of claims 1 to 6 when the processor executes the program The steps of the attack code detection method described in item. 9. A non-transitory readable storage medium on which a computer program is stored, wherein when the computer program is executed by a processor, the steps of the attack code detection method according to any one of claims 1 to 6 are implemented . 10 . A computer program, characterized in that, when the computer program is executed by a processor, the steps of the attack code detection method according to any one of claims 1 to 6 are implemented.

Images