CN103810427A - Mining method and system for malicious code hiding behaviors - Google Patents

Abstract

The invention relates to a mining method and system for malicious code hiding behaviors. The method includes the steps that malicious codes are operated in a virtual environment; whether related instructions and functions related with hiding behavior routes are included in instruction information and function information executed by the malicious codes or not is judged; if execution information related with time delay hiding is detected, the malicious codes are made to continuously execute follow-up instructions and functions through ending corresponding time delay behaviors; if execution information related with conditional judgment hiding is detected, the execution information is classified according to conditional judgment, and possible execution routes of the malicious codes are mined through meeting execution conditions of different routes; analyzed various behavior route information executed by the malicious codes is used for generating a malicious code behavior route tree. The malicious code hiding behaviors avoiding analyzing in the modes of time delay hiding and conditional judgment hiding can be effectively mined, the various hiding behavior routes possibly existing are effectively found out, and the capacity for analyzing and mining the malicious code hiding behaviors is improved.

Description

A method and system for mining malicious code hiding behavior

technical field

The invention belongs to the technical field of network security, and in particular relates to a method and system for mining malicious code hiding behaviors.

Background technique

With the continuous advancement of informatization and the continuous development of technology, malicious code technology, one of its important threats, is also constantly improving. In order to avoid analysis and detection, the hiding ability, deformation ability and survivability of malicious code are constantly increasing. Malicious code hides some of its own harmful behaviors through various technical means, so that ordinary analysis and detection tools cannot detect its malicious behaviors in time, thereby causing damage and threatening the security of the Internet and computer systems when necessary.

At present, the means of hiding malicious codes mainly include: (1) hiding its traces in the system, such as process information and so on. (2) It contains normal behavior paths and malicious behavior paths, and only performs malicious behaviors under certain conditions. For example, it hides its malicious behavior when it detects the analysis and detection environment, so as to avoid detection. Traditional dynamic analysis methods usually can only analyze the behavior path currently executed by malicious code, and cannot analyze and detect the existence of hidden behavior and paths well. Therefore, improving the analysis ability of malicious code hiding behavior and path has become an important problem to be solved in malicious code protection.

Among the existing malicious code analysis methods, static analysis can comprehensively analyze all the paths contained in the malicious code, so as to discover its possible hidden behaviors. However, usually, the source code of the malicious code cannot be obtained. Rely on disassembly and decompilation software. However, malicious codes usually use some obfuscation techniques to interfere with such software, making it difficult to restore the code accurately. Although dynamic analysis can obtain its behavior during the execution of malicious code, it is limited to a single execution path, that is, it can only obtain one behavior path displayed during the current execution process. Malicious codes with multiple behavior paths, especially malicious codes that hide a malicious behavior path among multiple harmless behavior paths, cannot be effectively analyzed.

With the development of malicious code analysis and detection technology, malicious code developers are also constantly updating their technical means. In order to avoid analysis and detection, there have been methods to detect virtual analysis environments to hide behaviors, and implement their malicious code only under certain conditions. means of concealment of behavior. It has brought great challenges to malicious code analysis and prevention.

Researching the analysis method of malicious code hiding behavior, so as to comprehensively and effectively analyze the hiding behavior of malicious code, and further effectively guide the detection of malicious code, is an important basic problem in the work of malicious code defense. The main problems in the current malicious code hiding behavior analysis methods are: dynamic analysis only analyzes the behavior of malicious code execution within a period of time, and it is easy to miss some delayed hidden behaviors; the dynamic analysis process can only analyze the currently executed behavior, and cannot The hidden malicious behavior path that appears only under certain conditions can be effectively analyzed, and the malicious code that detects the operating environment and conditions to hide the malicious behavior cannot be effectively analyzed; most of the dynamic analysis is tracking passive analysis, which lacks effective and active exploration of hidden malicious code. method of behavior.

Contents of the invention

The purpose of the present invention is to provide a malicious code hidden behavior mining method and system, by analyzing the delay and conditional control statements that may exist in the malicious code execution code during the dynamic running process, to provide it with a behavior path that satisfies its possible execution conditions, and actively trigger its potential hidden behavior, so as to actively discover the hidden behavior of malicious code and realize hidden behavior analysis.

The main content of the present invention is: run the malicious code to be analyzed in a controllable environment, monitor its execution information, aim at the two hidden behaviors of delayed execution and conditional judgment, and input satisfying Hide the relevant conditions of behavior execution, make it execute related behavior paths, and realize the mining of hidden behaviors.

Specifically, the technical scheme adopted in the present invention is as follows:

A method for mining malicious code hiding behaviors, the steps of which include:

1) Run malicious code in a virtual environment, and monitor the instruction information and function information of malicious code execution one by one;

2) Determine whether there are instructions and functions related to the hidden behavior path in the instruction information and function information executed by the malicious code. The hidden behavior includes delay hiding and condition judgment hiding;

3) If the delay is detected to hide relevant execution information, the malicious code will continue to execute its subsequent instructions and functions by ending the corresponding delay behavior;

4) If the condition is detected and the relevant execution information is hidden, the classification is judged according to the condition, and the possible execution path of the malicious code is discovered by satisfying the execution conditions of its different paths;

5) The various possible behavior path information of the analyzed malicious code execution is represented in the form of a tree to generate a malicious code behavior path tree.

Further, the monitoring method of the instruction information and function information of the malicious code execution described in step 1) is: run the malicious code to be analyzed in a hardware simulation environment, and monitor the instruction sequence of the malicious code execution through dynamic disassembly; Hook function, monitor related function information.

Furthermore, the instructions and functions related to the hidden behavior path described in step 2) can be defined by the user according to the needs. In the present invention, it is mainly divided into two types: delay hiding and conditional judgment hiding.

Further, the delay concealment in step 2) means that the malicious code delays the appearance of the malicious behavior by some means to avoid the dynamic analysis of limited analysis events; the conditional judgment concealment means that the malicious code, before executing the malicious behavior, By judging some execution conditions, such as system and network status, etc., malicious actions are executed only when certain conditions are met.

Further, the delay concealment described in step 3) mainly includes two common delay concealment behaviors, delay by sleep function and delay by cycle.

Further, the method of ending the corresponding delay behavior described in step 3) is: for the sleep function, end the function by adjusting the hardware time to the time after it; for the loop delay, end the loop by modifying the corresponding register flag bit method to achieve.

Further, the hidden condition judgment in step 4) mainly includes two categories: user interaction condition and independent condition judgment, wherein the user interaction condition refers to judging whether there is a user input event (including mouse and keyboard events), and the independent judgment condition is only Judging various system and network conditions that do not require manual intervention during the execution process.

Further, the method for satisfying the execution conditions of different paths described in step 4) is: analyze the conditional judgment statement in the malicious code execution process, and judge the user interaction condition, when the conditional judgment statement waiting for keyboard and mouse events is found, Start the corresponding function call module and send the corresponding keyboard and mouse information to meet its execution conditions; for independent condition judgment, save the system image (snapshot) and judgment expression when the condition judgment statement occurs, and then continue to execute. When the current path is executed, it will Return to the location where the image is saved, change the result of the judgment condition, make it execute other paths to dig out the hidden execution path, if multiple condition judgments are encountered during the execution process, judge the possibility by calculating the results of all judgment expressions in the path conditional value.

A malicious code hiding behavior mining system, which includes:

Hardware emulators for virtual execution environments to run and monitor malicious code;

The instruction information monitoring module is integrated in the instruction translation module of the hardware simulator, which is used to monitor and record the instruction information of malicious code execution during the running process;

The function information monitoring module is integrated in the hardware simulator and connected to the instruction information monitoring and recording module, which is used to monitor the function information of malicious code execution by judging instruction jumps and simulating memory data during the running of malicious code;

The conditional judgment analysis module is connected to the instruction information monitoring module and the function information monitoring module, and is used to detect conditional judgment statements in instructions executed by malicious code and function information;

The conditional input module connects the conditional judgment analysis module and the virtual execution environment of the hardware simulator, and is used to generate the conditional input required to make the code execute different behavior paths during the analysis process;

The running image module is connected to the virtual execution environment of the hardware simulator, the condition judgment analysis module and the condition input module, and is used to record the system and code state image before executing each path when there are multiple possible execution paths;

The behavior tree construction module is connected with the instruction information monitoring module, the function information monitoring module, the condition analysis and judgment module and the condition input module, and is used to construct a malicious code behavior path tree according to different behavior paths of the obtained malicious code.

Advantage of the present invention and positive effect are as follows:

The present invention aims at the problem that the dynamic analysis of malicious codes is limited to a single path within a limited time, by analyzing the hidden behavior methods commonly used by malicious codes, and using the analysis method of monitoring judgment and active mining in a controllable environment, malicious codes can be effectively mined through delay hiding and Conditional judging hides the hidden behavior of the analysis and effectively discovers a variety of hidden behavior paths that may exist, thereby improving the hidden behavior analysis and mining capabilities of malicious code.

Description of drawings

FIG. 1 is a flowchart of a method for mining malicious code hiding behaviors.

Figure 2 is a block diagram of the malicious code hiding behavior mining system.

Detailed ways

The present invention will be further described below through specific embodiments and accompanying drawings.

As shown in Figure 1, the malicious code hidden behavior mining method of the present invention comprises the following steps:

1. Monitor and record the instruction information and function information of the dynamic execution of malicious code.

The invention uses a hardware simulator to dynamically run malicious codes to be analyzed in a virtual operating system, and monitors and records the instructions and function information executed by the malicious codes in the hardware simulator. Instruction monitoring uses the method of disassembly in the intermediate translation module of the hardware simulator to extract instruction by instruction and record the corresponding instruction information. Function information monitoring calculates the corresponding function call address by identifying the system data structure in the virtual memory, and then judges whether the function that needs to be monitored is called by comparing the instruction jump address with the function call address and records the corresponding information.

2. Determine whether there are instructions and functions related to the hidden behavior path.

Through the analysis of the commonly used hiding behaviors of malicious codes, the present invention divides the commonly used hiding behaviors of malicious codes into two categories: delay hiding and conditional judgment hiding. Delay concealment refers to the behavior concealment method that malicious code avoids the detection of the dynamic analysis environment by delaying the execution of malicious behavior. A hidden method of performing malicious actions.

The method of delay hiding usually includes two categories of delay and loop delay using the sleep function. Aiming at the delay of the sleep function, the present invention detects the sleep function by means of a hook function. For loop delay, by monitoring whether there is a loop in the instructions executed by the malicious code, when a loop is found, further analysis is performed.

For conditional judgment concealment, the present invention divides it into two categories: user interaction condition and independent judgment condition according to whether it includes user interaction. During the execution of malicious code, when the conditional judgment statement is monitored, relevant information is recorded, a corresponding image file is built to record various status information of the current system and malicious code execution, and then submitted to the next step for further processing of the conditional judgment statement Analysis and processing.

3. For the detected delayed hidden behavior, the malicious code continues to execute by ending the corresponding delayed behavior.

Perform corresponding processing for the delay concealment behavior detected in step 2. When it is detected that the sleep function is called, the delay time in the stack is read, and then the time of the hardware simulator is adjusted to the corresponding delay time, so that the condition is satisfied, so that the malicious code can further execute subsequent actions.

When a loop is detected to exist. Analyze and identify the forward transfer instruction of the loop control flow. When the transfer instruction is executed again, the loop ends by setting the corresponding flag bit of the EFLAGS register in the virtual CPU to its inverse position, so that the malicious code starts to execute follow-up behavior.

4. For the hidden behavior that may be caused by the detected conditional judgment statement, by satisfying its different conditions, dig out the potential hidden behavior path.

When the condition judgment statement detected in step 2, analyze the judgment condition, and perform different processing according to whether there is user interaction. When user interaction is required, it is judged whether there is a user mouse and keyboard event. At this time, by calling the corresponding The mouse interface function do_mouse and the keyboard interface function do_send_key send corresponding mouse and keyboard messages to meet the execution conditions of subsequent actions. At the same time, before calling the corresponding interface function, record the corresponding system image, and return to this image after analyzing the path, and analyze the behavior information of another path that does not satisfy the interaction, so as to obtain a more comprehensive malicious code behavior. It should be noted here that since most malicious codes judge whether they are in the real environment rather than the analysis environment by detecting whether there is user input, because the probability of malicious behavior that satisfies the user interaction conditions is relatively high, so we first analyze and satisfy behavior under this condition.

If it is an independent judgment condition, that is, a condition that does not require user interaction, analyze the judgment statement and save the current system image. Starting from the first condition judgment statement, save the system image and the current judgment condition, and then analyze possible different subsequent branch paths. After executing a path, return to the system image at the corresponding judgment condition, and then execute different conditional branches. In order to mine different behavior paths that malicious code may execute. It should be noted that if other conditional judgment statements continue to appear after a path, it will be analyzed layer by layer in a recursive manner. In addition, in order to reduce the consumption of impossible paths, the present invention saves all the conditional judgment sentences in the path during the analysis process, and when a new conditional judgment sentence is generated, by calculating all the conditional judgments of the path, only the analysis that satisfies all the path conditions is The real potential paths that result from actual possible data outcomes.

5. Construct the behavior path that the malicious code may execute as a malicious code behavior path tree.

Through the above analysis, the possible hidden behavior of malicious code can be discovered. The present invention expresses various behaviors of malicious codes excavated by dynamic execution in a tree structure. The construction process of the malicious code behavior path tree is as follows: the first message executed by the malicious code starts to generate the behavior tree; after that, the next message executed every time is added to the tree as a child node; The corresponding execution information node marks the delay condition, and then continues to add subsequent child nodes; when the conditional judgment statement is detected, save the conditional judgment information in the corresponding node, and then add different child nodes according to different conditions to represent the subsequent execution subtree, that is After saving the system image, mark the corresponding node. After analyzing a path, return to the corresponding node to add other subtrees until the execution is completed.

The above embodiments are only used to illustrate the technical solution of the present invention and not to limit it. Those of ordinary skill in the art can modify or equivalently replace the technical solution of the present invention without departing from the spirit and scope of the present invention. The scope of protection should be determined by the claims.

Claims (10)

1. A malicious code hiding behavior mining method, the steps comprising: 1) Run malicious code in a virtual environment, and monitor the instruction information and function information of malicious code execution one by one; 2) Determine whether there are instructions and functions related to the hidden behavior path in the instruction information and function information executed by the malicious code. The hidden behavior includes delay hiding and condition judgment hiding; 3) If the delay is detected to hide relevant execution information, the malicious code will continue to execute its subsequent instructions and functions by ending the corresponding delay behavior; 4) If the condition is detected and the relevant execution information is hidden, the classification is judged according to the condition, and the possible execution path of the malicious code is discovered by satisfying the execution conditions of its different paths; 5) The multi-path behavior information of malicious code execution completed by dynamic analysis is represented in the form of a tree to generate a malicious code behavior path tree. 2. The method according to claim 1, characterized in that: said delay concealment includes calling sleep function delay and loop delay. 3. The method according to claim 1, characterized in that: said condition judgment concealment comprises two categories of user interaction condition and independent condition judgment, wherein user interaction condition refers to judging whether there is a user input event, and independent condition is to execute During the process, various system and network conditions that do not require manual intervention are judged. 4. The method according to claim 3, wherein the user input events include mouse and keyboard events. 5. The method according to any one of claims 1 to 3, wherein the processing method for hiding the delay is: when detecting that the sleep function is called, read the delay time in the stack, and then Adjust the time of the hardware simulator to the corresponding delay time, so that the conditions are met, so that the malicious code can further execute subsequent behaviors; when the existence of a loop is detected, the analysis identifies the instruction that the loop control flow moves forward, and when it is executed again During the transfer instruction, the cycle is ended by setting the corresponding flag bit of the EFLAGS register in the virtual CPU to its inverse position, so that the malicious code starts to execute subsequent actions. 6. The method according to any one of claims 1 to 3, wherein the processing method when a condition judgment sentence is detected is: analyze the judgment condition, and record the corresponding system image when a user interaction condition judgment occurs , by calling the mouse interface function do_mouse and the keyboard interface function do_send_key to send corresponding mouse and keyboard messages to meet the execution conditions of subsequent behaviors, after analyzing this path, return to this image, and analyze another behavior information that does not satisfy the interaction; For independent judgment conditions, analyze the judgment statement and save the current system image and judgment conditions to obtain its possible different subsequent branch paths. After executing a path, return to the corresponding system image to execute different conditional branches, so as to mine possible malicious codes. different behavior paths. 7. The method according to claim 6, characterized in that: in the analysis process of independent judgment conditions, if other conditional judgment sentences continue to appear in the follow-up of a path, the analysis is carried out layer by layer in a recursive manner. 8. The method as claimed in claim 7, characterized in that: in the analysis process, all conditional judgment sentences in the path are saved, and when a new conditional judgment sentence is generated, all conditional judgments of the path are calculated, and only analysis that satisfies all conditions is performed. The path condition is the real potential path generated by the actual possible data results, so as to reduce the consumption of impossible paths. 9. The method according to claim 1, wherein the construction process of the malicious code behavior path tree is as follows: the first information executed by the malicious code is used as the initial parent node to start generating the behavior tree; thereafter, each executed The next piece of information is added to the tree as a child node; when the delayed hidden information is detected, the delay condition is marked in the corresponding execution information node, and then continue to add subsequent child nodes; when the condition judgment statement is detected, it is saved in the corresponding node Conditional judgment information, and then add different child nodes according to different conditions to represent the subsequent execution subtree, that is, mark the corresponding node after saving the system image, and return to the corresponding node to add other subtrees after analyzing and playing a path until the execution is completed. 10. A malicious code hiding behavior mining system, characterized in that it comprises: Hardware emulators for virtual execution environments to run and monitor malicious code; The instruction information monitoring module is integrated in the instruction translation module of the hardware simulator, which is used to monitor and record the instruction information of malicious code execution during the running process; The function information monitoring module is integrated in the hardware simulator and connected to the instruction information monitoring and recording module, which is used to monitor the function information of malicious code execution by judging instruction jumps and simulating memory data during the running of malicious code; The conditional judgment analysis module is connected to the instruction information monitoring module and the function information monitoring module, and is used to detect conditional judgment statements in instructions executed by malicious code and function information; The conditional input module connects the conditional judgment analysis module and the virtual execution environment of the hardware simulator, and is used to generate the conditional input required to make the code execute different behavior paths during the analysis process; The running image module is connected to the virtual execution environment of the hardware simulator, the condition judgment analysis module and the condition input module, and is used to record the system and code state image before executing each path when there are multiple possible execution paths; The behavior tree construction module is connected to the instruction information monitoring module, function information monitoring module, condition analysis and judgment module and condition input module, and is used to construct a malicious code behavior path tree according to different behavior paths of the obtained malicious code.

Images