WO2013037261A1 - 一种检测恶意程序的方法、装置及虚拟机 - Google Patents

一种检测恶意程序的方法、装置及虚拟机 Download PDF

Info

Publication number
WO2013037261A1
WO2013037261A1 PCT/CN2012/080545 CN2012080545W WO2013037261A1 WO 2013037261 A1 WO2013037261 A1 WO 2013037261A1 CN 2012080545 W CN2012080545 W CN 2012080545W WO 2013037261 A1 WO2013037261 A1 WO 2013037261A1
Authority
WO
WIPO (PCT)
Prior art keywords
virtual
virtual memory
mbr
boot record
instruction
Prior art date
Application number
PCT/CN2012/080545
Other languages
English (en)
French (fr)
Inventor
邵坚磊
谭合力
Original Assignee
北京奇虎科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京奇虎科技有限公司 filed Critical 北京奇虎科技有限公司
Priority to US14/344,864 priority Critical patent/US10146938B2/en
Publication of WO2013037261A1 publication Critical patent/WO2013037261A1/zh

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/455—Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines
    • G06F9/45533—Hypervisors; Virtual machine monitors

Definitions

  • the present invention relates to the field of information security technologies, and in particular, to a method, device, and virtual machine for detecting a malicious program. Background technique
  • a malicious program is usually a program that is illegally run on a computer system without authorization.
  • a computer virus is a malicious program that runs on a computer system and poses a threat to the security of the computer system.
  • a rootkit is a kernel-level Trojan virus, which is a software that hides other programs or processes. It may be a combination of one or more software. In a broad sense, a rootkit can also be regarded as a technology.
  • the operating system relies on kernel space to manage and schedule these applications.
  • the kernel space consists of four parts: process management (responsible for allocating CPU time), file access (provisioning the device into a file system, and providing a consistent interface for upper-level program calls), security control (responsible for mandatory processes) Specific permissions and separate memory ranges to avoid conflicts between processes) and memory management (responsible for the allocation, use, release, and reclamation of memory resources while the process is running).
  • the kernel is a data structure. Rootkit technology hides the processes, files, network communications, and other related information of other programs (such as the registry and system logs that may be generated by modification) by modifying the data structure of the kernel.
  • Bootkit is a more advanced rootkit.
  • the Bootkit bypasses the kernel check and starts stealth by infecting the MBR (Master Boot Record).
  • Bootkit is an MBR-based rootkit. It can be considered that all technologies that load and implement kernel hijacking earlier than the Windows kernel at boot time can be called Bootkit, such as later BIOS Rootkit, VBootkit, SMM Rootkit, etc.
  • the general security software for the detection and killing of various malicious programs (such as viruses), the main basis The detection technology of traditional feature codes.
  • various malicious programs will run some unique instruction codes (ie, signature codes) during the running process, and by finding these signatures, malicious programs can be detected.
  • signature codes some unique instruction codes
  • the Bootkit due to the particularity of the MBR virus, it generally resides in the high-end memory (ie, the high address bit in the memory), so the Bootkit can be detected by searching for the signature in the high-end memory.
  • the current problem to be solved is how to detect malformed malicious programs, especially MBR-based bootkits or viruses similar to Bootkit. Summary of the invention
  • the present invention has been made in order to provide a method, apparatus and virtual machine for detecting a malicious program that overcomes the above problems or at least partially solves or alleviates the above problems.
  • a method for detecting a malicious program includes: setting virtual memory;
  • an apparatus for detecting a malicious program including:
  • a first setting module configured to set virtual memory
  • An analog execution module for simulating execution of each instruction in the master boot record MBR in the virtual memory; a detecting module, configured to detect whether the virtual memory is modified after the execution of each instruction by the analog execution module, and if found, to detect a malicious program; otherwise, triggering the analog execution module to continue to simulate executing the next instruction, All the simulations until the master boot record MBR are executed.
  • a virtual machine for detecting a malicious program including:
  • a virtual CPU initialization module for initializing a virtual CPU
  • a virtual memory initialization module for initializing virtual memory, and reading the master boot record MBR and then saving to the virtual memory during initialization;
  • Virtual memory for storing the master boot record MBR
  • a virtual CPU for simulating execution of each instruction in the master boot record MBR in the virtual memory, and detecting whether the virtual memory is modified after executing each instruction, and if found, discovering a malicious program; otherwise, continuing the simulation Execute the next instruction until all instructions of the master boot record MBR are executed.
  • a computer program comprising computer readable code causing the server to perform any of claims 1-6 when run on a server The method of detecting a malicious program.
  • a computer readable medium wherein the computer program according to claim 15 is stored.
  • the application first stores the read master boot record MBR into the set virtual memory by simulation, and then simulates the loading execution process of the master boot record MBR, and When the simulation executes an instruction in the MBR, it detects whether the virtual memory is modified. If it is modified, it finds a malicious program; otherwise, it continues to simulate executing the next instruction until all the instructions of the main boot record MBR are executed. .
  • the present application also implements a virtual machine that implements a virtual CPU, a virtual memory, a disassembly engine, a virtual hard disk, and other related parts, such as a virtual BIOS (Basic Input Output System).
  • Virtual I/O devices, etc. can simulate the implementation of the main boot record MBR load execution process, and detect the existence of malicious programs such as Bootkit.
  • the virtual machine can be used as a separate tool, or can be called as a dynamic library by other programs, and is flexible in use.
  • the implementation of the entire virtual machine is controlled within several hundred Kbytes, which is a lightweight virtual machine.
  • FIG. 1 is a schematic diagram of code in ghost image 3 in the prior art
  • FIG. 2 is a schematic diagram of a variant code of ghosting in the prior art
  • FIG. 3 is a schematic flow chart showing a method of detecting a malicious program according to an embodiment of the present invention
  • FIG. 4 is a view schematically showing a configuration of a device for detecting a malicious program according to an embodiment of the present invention
  • Figure 5 is a schematic block diagram showing a virtual machine in accordance with one embodiment of the present invention
  • Figure 6 is a schematic illustration of a normal MBR operation in accordance with one embodiment of the present invention. Schematic diagram of the displayed results
  • FIG. 7 is a schematic diagram showing the result of MBR operation after ghost 1 is performed according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram showing an MBR operation result after ghost 3 is performed according to an embodiment of the present invention.
  • FIG. 9 is a schematic diagram showing an MBR operation result after a top-level bootkit is performed according to an embodiment of the present invention.
  • Figure 10 is a block diagram schematically showing a server for performing the method according to the present invention.
  • Fig. 11 schematically shows a storage unit for holding or carrying program code implementing the method according to the invention.
  • this application proposes a detection method that can be detected regardless of any deformation of these malicious programs.
  • Power-on self-test-->The motherboard BIOS starts from the floppy disk, hard disk or CD-ROM drive according to the user-specified boot sequence-->The system BIOS reads the master boot record MBR into the memory-->Control is given to the master boot program-->Main
  • the boot program checks the status of the partition table and looks for the active partition --> The master boot program passes control to the boot record of the active partition, and the boot record loads the operating system boot file.
  • the MBR is powered on by the computer. After the self-test of the motherboard is completed, the first read position is located at the 0 head of the hard disk, and the size of the disk is 512 bytes. It does not belong to any operation. The system cannot be read using the disk operation commands provided by the operating system.
  • the virus in the boot area that was flooded with disasters was parasitic in the MBR. Take the ghost virus as an example.
  • the virus is parasitic in the MBR.
  • the virus release driver can destroy most of the security. Full tools and system aids. When the system reboots again, the virus will load before the operating system kernel. When the virus runs successfully, no exceptions are found in the process, system startup add-ons. The virus cannot be cleared even if the system is reinstalled.
  • Ghost viruses reside in the high-end memory of the system, so the prior art searches for high-end memory signatures to locate whether it is a virus.
  • the code in ghost 3 is shown in Figure 1.
  • searching for feature code 0X0413 it is detected whether the high-end memory has been modified to host the virus.
  • this code can achieve the same effect of modifying the high-end memory as in Figure 1, but through the deformation of the instruction, the code of the feature cannot be found. Thus spared the routine security software killing.
  • FIG. 3 there is shown a flow diagram of a method of detecting a malicious program in accordance with one embodiment of the present invention.
  • Step 301 setting virtual memory
  • a memory area is allocated for use as virtual memory, which is a simulation of the actual system's high-end memory.
  • Step 302 reading the master boot record MBR and saving to the virtual memory; during the real boot process, after the power-on self-test, the system BIOS will record the master boot record.
  • the MBR reads in the real high-end memory; in this embodiment, the MBR is read into the virtual memory.
  • Step 303 Simulate executing each instruction in the master boot record MBR in the virtual memory, and detecting whether the virtual memory is modified after executing each instruction; If it is modified, the malicious program is found, the detection process is exited, and the prompt can be prompted; otherwise, if it is not modified, the simulation continues to execute the next instruction until the master boot record
  • All the MBR simulations are executed and the detection process is exited. If all the instructions of the MBR are simulated and no malicious programs are found, the control is given to the boot record of the real active partition in the system, and the operating system startup file is loaded by the boot record.
  • step 303 can be accomplished by a virtual CPU. Specifically, before the virtual memory is set in step 301, the virtual CPU is set, and then in step 303, the execution of the instruction is simulated by the virtual CPU, and the virtual memory is detected.
  • the virtual hard disk may also be set, and the MBR in the virtual memory is copied to the virtual hard disk, and when the instruction in the MBR is simulated, the virtual hard disk is directly executed. Read.
  • a virtual BIOS, virtual I/O device, etc. may also be provided for the detection process.
  • each instruction in the master boot record MBR can also be disassembled and output displayed.
  • the detection method simulates the high-end memory by setting the virtual memory, and by detecting whether the virtual memory is modified, it can find a suspicious malicious program, thereby ignoring any signature conversion technology, as long as this behavior occurs in the actual operation can be detected. .
  • the detection method can largely detect past, present and future MBR-based bootkits.
  • the present application also provides corresponding device embodiments.
  • FIG 4 there is shown a block diagram of an apparatus for detecting a malicious program in accordance with one embodiment of the present invention.
  • the detecting device may include:
  • a first setting module 41 configured to set a virtual memory
  • the reading and saving module 42 is configured to read the main boot record MBR and save the virtual memory to the virtual memory;
  • the simulation execution module 43 is configured to simulate executing each instruction in the master boot record MBR in the virtual memory
  • the detecting module 44 is configured to detect whether the virtual memory is modified after the execution of each instruction by the simulation execution module 43, and if it is modified, discover a malicious program; otherwise, trigger the simulation execution module 43 to continue the simulation execution. An instruction until the execution of all the instructions of the master boot record MBR is completed.
  • the detecting module 44 can determine whether the virtual memory is modified by detecting whether the size of the virtual memory is changed, and if it is changed, the virtual memory is modified; otherwise, it is not modified.
  • the detecting device may further include:
  • the second setting module 45 is configured to set a virtual CPU, and the virtual CPU can trigger execution of the simulation execution module 43 and the detection module 44.
  • the detecting device may further include:
  • the third setting module 46 is configured to set a virtual hard disk, and copy the main boot record MBR in the virtual memory to the virtual hard disk;
  • the simulation execution module 43 reads the master boot record from the virtual hard disk. MBR, and simulates execution of each instruction in the master boot record MBR.
  • the detecting device may further include:
  • the disassembly engine 47 is configured to disassemble each instruction in the master boot record MBR and output a display.
  • the detection device can be used as a separate tool or as a dynamic library to be called by other programs, and is flexible to use.
  • a virtual machine which can implement a virtual CPU, a virtual memory, a disassembly engine, a virtual hard disk, and other related parts, such as a virtual BIOS, a virtual I/O device, and the like.
  • the simulation implements the loading execution process of the master boot record MBR, and detects whether there is a malicious program such as a bootkit.
  • FIG. 5 there is shown a block diagram of a virtual machine in accordance with one embodiment of the present invention.
  • the virtual machine may include:
  • a virtual CPU initialization module 51 configured to initialize the virtual CPU 54;
  • the virtual memory initialization module 52 is configured to initialize the virtual memory 53 and read the master boot record MBR and then save to the virtual memory 53 during initialization;
  • Virtual memory 53 for storing the master boot record MBR
  • the virtual CPU 54 is configured to simulate executing each instruction in the master boot record MBR in the virtual memory 53, and detecting whether the virtual memory is modified after executing each instruction, and if found, discovering a malicious program; otherwise, Continue to simulate executing the next instruction until all instructions of the master boot record MBR are executed.
  • the virtual machine may further include:
  • the virtual hard disk initialization module 55 is configured to initialize the virtual hard disk 56 and copy the master boot record MBR in the virtual memory 53 to the virtual hard disk 56 during initialization, and the virtual CPU 54 reads the master boot from the virtual hard disk 56.
  • the MBR is recorded and simulated; the virtual hard disk 56 is used to store the copied master boot record MBR.
  • the virtual machine may further include:
  • the disassembly engine 57 is configured to disassemble each instruction in the master boot record MBR and output a display.
  • the virtual machine in the real mode will be described as an example.
  • the virtual machine can be applied to a protection mode or other computer mode, and the embodiment is not limited thereto.
  • the above virtual CPU can simulate all real-mode instructions, mainly 8086 instructions, and can also include instructions after 386.
  • the virtual CPU can also simulate the corresponding special instructions.
  • the ghost CPU also simulates the RDTSC instruction in order to prevent the instruction RDTSC from being supported by 586 after being debugged.
  • the system BIOS reads the MBR built into the system, and then passes it to the virtual machine, and the virtual machine initializes.
  • the execution steps of the virtual machine are as follows:
  • Step 1 Initialize the virtual CPU
  • the virtual CPU is initialized.
  • the virtual CPU is a single-core 80x86, and the supported registers are the same as the real machines.
  • support for the initialization of the instruction there is an instruction support list inside the virtual machine, the list can continuously increase the instructions that need to be supported according to actual needs, and the list of supported instructions will be filled in the initialization. Then, point the instruction pointer of the CPU in the virtual machine to the BIOS instruction in the virtual memory (that is, the MBR instruction) 0xf000:0xfff0.
  • Step 2 initializing virtual memory
  • the BIOS data area holds the size of the conventional virtual memory, and in real mode, about 640 KB of memory space can be allocated for virtual memory usage. Then, the MBR read by the system BIOS is stored in the virtual memory.
  • Step 3 Initialize the virtual hard disk and other related parts of the virtual machine
  • the actual hard disk is simulated by allocating a memory space of about 1 MB as a virtual hard disk.
  • the actual hard disk can also be simulated by accessing the virtual hard disk. Then, copy the MBR in virtual memory to the beginning of the virtual disk.
  • other relevant parts of the virtual machine such as virtual BIOS, virtual I/O devices, etc., are initialized.
  • Step 4 running a virtual CPU
  • execution begins from the execution of the BIOS instruction (ie, the MBR instruction).
  • the MBR instruction ie, the MBR instruction.
  • the virtual CPU decodes the instruction, modifies the internal registers and associated memory according to the instruction decoding result, and executes the corresponding process. If the command contains a virus, the virtual CPU not only modifies the internal registers, but also modifies the associated virtual memory; if it does not, it does not modify the associated virtual memory.
  • Step 5 The virtual CPU detects the virtual memory.
  • the above virtual machine can be used as a separate tool or as a dynamic library to be called by other programs.
  • the implementation of the entire virtual machine is controlled within several hundred Kbytes, which is a lightweight virtual machine.
  • FIG. 6 is a schematic diagram showing display results after a normal MBR operation according to an embodiment of the present invention.
  • FIG. 7 a schematic diagram of an MBR operation result after ghost 1 is performed according to an embodiment of the present invention.
  • FIG. 8 it is a schematic diagram of an MBR operation result after ghost 3 is performed according to an embodiment of the present invention.
  • FIG. 9 a schematic diagram of an MBR operation result after a top-level bootkit is performed according to an embodiment of the present invention.
  • MbrVmConsole is the main program
  • MbrVM.ini is a configuration file that specifies the size of the VM memory and the file of the specified virtual hard disk.
  • Mbr.img is the specified virtual hard disk file
  • mbrGood.bin is normal MBR
  • Mbrguiyingl.bin is a ghost 1 MBR
  • Mbrguiying3.bin is a ghost 3 MBR
  • mbrTdl.bin is TDL4 MBR
  • the corresponding file is renamed to mbr.bin for detection.
  • the space for Trojans and other viruses to survive is becoming smaller and smaller, and traditional Trojan technology has been difficult to survive and develop.
  • Bootkit technology gives the virus a large space for survival and development, so that it can do anything without software, no process, no registry modification, etc., only need to write the load code in the MBR. , you can load a complete virus execution system. And even if the format is reloaded, it can still be revived. Therefore, the method and apparatus implemented based on the present application play a decisive role in detecting such viruses as Trojans in the future, and this is a blind spot of almost all antivirus software.
  • the various component embodiments of the present invention may be implemented in hardware, or in a software module running on one or more processors, or in a combination thereof.
  • a microprocessor or digital signal processor may be used in practice to implement some or all of some or all of the means for detecting malicious programs and virtual machines in accordance with embodiments of the present invention.
  • the invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein.
  • Such a program implementing the present invention can be stored On a computer readable medium, or in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.
  • Figure 10 illustrates a server, such as an application server, that can implement a method of detecting a malicious program in accordance with the present invention.
  • the server conventionally includes a processor 1010 and a computer program product or computer readable medium in the form of a memory 1020.
  • the memory 1020 can be an electronic memory such as a flash memory, an EEPROM (Electrically Erasable Programmable Read Only Memory), an EPROM, a hard disk, or a ROM.
  • Memory 1020 has a memory space 1030 for executing program code 1031 of any of the method steps described above.
  • storage space 1030 for program code may include various program code 1031 for implementing various steps in the above methods, respectively.
  • the program code can be read from or written to one or more computer program products.
  • Such computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards, or floppy disks.
  • Such a computer program product is typically a portable or fixed storage unit as described with reference to Figure 11.
  • the storage unit may have a storage section, a storage space, and the like arranged similarly to the storage 1020 in the server of Fig. 10.
  • the program code can be compressed, for example, in an appropriate form.
  • the storage unit includes computer readable code 103, i.e., code readable by a processor, such as, for example, 1010, which when executed by a server causes the server to perform various steps in the methods described above.
  • an embodiment or “an embodiment,” or “one or more embodiments” as used herein means that the particular features, structures, or characteristics described in connection with the embodiments are included in at least one embodiment of the invention.
  • examples of the words “in one embodiment” are not necessarily all referring to the same embodiment.

Landscapes

  • Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Stored Programmes (AREA)
  • Storage Device Security (AREA)

Abstract

公开了一种检测恶意程序的方法、装置和虚拟机。所述方法包括：设置虚拟内存（301）；读取主引导记录（MBR）并保存到所述虚拟内存（302）；模拟执行虚拟内存中主引导记录（MBR）中的每一条指令，并在执行每一条指令后检测所述虚拟内存是否被修改（303）；如果被修改，则发现恶意程序；否则，继续执行下一条指令直到主引导记录MBR的所有指令模拟执行完毕。本方案能够发现变形恶意程序。

Description

一种检测恶意程序的方法、 装置及虚拟机
技术领域
本发明涉及信息安全技术领域，特别涉及一种检测恶意程序的方 法、 装置及虚拟机。 背景技术
恶意程序通常是指未获得授权而非法在计算机系统中运行的程 序。 例如，计算机病毒就是一种运行在计算机系统中的恶意程序，可 对计算机系统的安全性造成威胁。
随着计算机和网络技术的发展， 出现了形式多样的计算机病毒。 其中， Rootkit是一种内核级的木马病毒，它是一种隐藏其他程序或进 程的软件，可能是一个或一个以上的软件组合，广义而言， Rootkit也 可视为一项技术。
在现代操作系统中，应用程序不能直接访问硬件，而是通过调用 操作系统提供的接口来使用硬件，而操作系统依赖内核空间来管理和 调度这些应用。 内核空间由四大部分组成，分别是：进程管理（负责 分配 CPU时间）、 文件访问（把设备调配成文件系统，并提供一个一 致的接口供上层程序调用）、 安全控制（负责强制规定各个进程的具 体的权限和单独的内存范围，避免各进程之间发生冲突）和内存管理 (负责进程运行时对内存资源的分配、 使用、 释放和回收）。 内核是 一种数据结构， Rootkit技术通过修改内核的数据结构来隐藏其他程序 的进程、 文件、 网络通讯和其它相关信息（比如注册表和可能因修改 而产生的系统日志等）。
Bootkit是更高级的 Rootkit , Bootkit通过感染 MBR(Master Boot Record ,磁盘主引导记录）的方式，实现绕过内核检査和启动隐身，即 Bootkit 是一种基于 MBR 的 Rootkit。 可以认为，所有在开机时比 Windows内核更早加载、实现内核劫持的技术，都可以称之为 Bootkit , 例如后来的 BIOS Rootkit 、 VBootkit、 SMM Rootkit等。
目前常规安全软件对于各种恶意程序（如病毒）的査杀，主要基 于传统特征码的检测技术。 这是因为通常情况下各种恶意程序在运行 过程中都会运行一些特有的指令代码（即特征码） ，通过査找到这些 的特征码，就可以检测出恶意程序。 例如对于 Bootkit的检测，由于这 种 MBR病毒的特殊性，其一般会驻留在高端内存（即内存中的高地址 位） ，因此通过搜索高端内存中是否有特征码，就可以检测出 Bootkit。
但是，越来越多的病毒出现了变形，有些通过花指令，有些通过 变形代码，甚至现在大多病毒都是事先加密，运行时动态解密后再运 行。 所以，对于这些变形的病毒而言，在达到同样效果的情况下，指 令是随机变化的，按照上述方法检测时找不到特征码，因此可绕过常 规安全软件的査杀。
综上所述， 目前需要解决的问题是：如何检测出变形的恶意程序， 尤其是基于 MBR的 Bootkit或类似于 Bootkit的病毒。 发明内容
鉴于上述问题，提出了本发明以便提供一种克服上述问题或者至 少部分地解决或者减缓上述问题的检测恶意程序的方法、 装置及虚拟 机。
根据本发明的一个方面，提供了一种检测恶意程序的方法，包括： 设置虚拟内存；
读取主引导记录 MBR并保存到所述虚拟内存；
模拟执行虚拟内存中主引导记录 MBR中的每一条指令，并在执行 完每一条指令后检测所述虚拟内存是否被修改，如果被修改，则发现 恶意程序；否则，继续模拟执行下一条指令，直到主引导记录 MBR的 所有指令模拟执行完毕。
根据本发明的另一个方面，提供了一种检测恶意程序的装置，包 括：
第一设置模块，用于设置虚拟内存；
读取及保存模块，用于读取主引导记录 MBR并保存到所述虚拟内 存；
模拟执行模块，用于模拟执行虚拟内存中主引导记录 MBR中的每 一条指令； 检测模块，用于在所述模拟执行模块执行完每一条指令后检测所 述虚拟内存是否被修改，如果被修改，则发现恶意程序；否则，触发 所述模拟执行模块继续模拟执行下一条指令，直到主引导记录 MBR的 所有指令模拟执行完毕。
依据本发明的另一方面，提供了一种检测恶意程序的虚拟机，包 括：
虚拟 CPU初始化模块，用于初始化虚拟 CPU；
虚拟内存初始化模块，用于初始化虚拟内存，并在初始化的过程 中读取主引导记录 MBR然后保存到所述虚拟内存；
虚拟内存，用于存储主引导记录 MBR；
虚拟 CPU ,用于模拟执行虚拟内存中主引导记录 MBR中的每一条 指令，并在执行完每一条指令后检测所述虚拟内存是否被修改，如果 被修改，则发现恶意程序；否则，继续模拟执行下一条指令，直到主 引导记录 MBR的所有指令模拟执行完毕。
根据本发明的又一个方面，提供了一种计算机程序，其包括计算 机可读代码，当所述计算机可读代码在服务器上运行时，导致所述服 务器执行根据权利要求 1-6中的任一个所述的检测恶意程序的方法。
根据本发明的再一个方面，提供了一种计算机可读介质，其中存 储了如权利要求 15所述的计算机程序。
本发明的有益效果为：
首先，本申请在开机后并在加载操作系统文件之前，通过模拟的 方式先将读取的主引导记录 MBR存到所设置的虚拟内存中，然后模拟 实现主引导记录 MBR的加载执行过程，并且每当模拟执行完 MBR中 的一条指令后，检测所述虚拟内存是否被修改，如果被修改，则发现 恶意程序；否则，继续模拟执行下一条指令，直到主引导记录 MBR的 所有指令模拟执行完毕。
由于实际情况中，基于 MBR的 Bootkit或类似于 Bootkit的病毒等 恶意程序，即使进行了变形，也必须要驻留系统的高端内存，所以必 然会修改高端内存， 因此上述的检测方法通过设置虚拟内存来模拟高 端内存，并通过检测虚拟内存是否被修改，就可以发现可疑的恶意程 序，从而无视任何特征码变换技术，只要实际运行中发生了这个行为 即可被检测出来。 所述的检测方法在很大程度上可以检测出过去、 现 在和未来的基于 MBR的 Bootkit。
其次，本申请还实现了一种虚拟机，所述虚拟机通过实现虚拟 CPU, 虚拟内存、 反汇编引擎、 虚拟硬盘以及其他相关部分，如虚拟 BIOS ( Basic Input Output System ,基本输入输出系统 )、 虚拟 I/O设 备等，可以模拟实现主引导记录 MBR的加载执行过程，并检测出是否 存在 Bootkit等恶意程序。 而且，所述虚拟机既可以作为单独的工具， 也可以作为动态库被其他程序调用，使用灵活。 同时，考虑到性能和 效率等实用性方面，整个虚拟机的实现控制在几百 K字节内，是一种 轻量级的虚拟机。
当然，实施本申请的任一产品不一定需要同时达到以上所述的所 有优点。
上述说明仅是本发明技术方案的概述，为了能够更清楚了解本发 明的技术手段，而可依照说明书的内容予以实施，并且为了让本发明 的上述和其它目的、 特征和优点能够更明显易懂，以下特举本发明的 具体实施方式。 附图说明
通过阅读下文优选实施方式的详细描述，各种其他的优点和益处 对于本领域普通技术人员将变得清楚明了。 附图仅用于示出优选实施 方式的目的，而并不认为是对本发明的限制。 而且在整个附图中，用 相同的参考符号表示相同的部件。 在附图中：
图 1是现有技术中鬼影 3中的代码示意图；
图 2是现有技术中鬼影的一个变种代码的示意图；
图 3 示意性地示出了根据本发明一个实施例的检测恶意程序的方 法流程图；
图 4示意性地示出了根据本发明一个实施例的检测恶意程序的装 置结构图；
图 5示意性地示出了根据本发明一个实施例的虚拟机的结构图； 图 6示意性地示出了根据本发明一个实施例的正常的 MBR运行后 的显示结果示意图；
图 7 示意性地示出了根据本发明一个实施例的中了鬼影 1 后的 MBR运行结果示意图；
图 8是示意性地示出了根据本发明一个实施例的中了鬼影 3后的 MBR运行结果示意图；
图 9是示意性地示出了根据本发明一个实施例的中了顶级 Bootkit 后的 MBR运行结果示意图；
图 10 示意性地示出了用于执行根据本发明的方法的服务器的框 图；以及
图 11示意性地示出了用于保持或者携带实现根据本发明的方法的 程序代码的存储单元。 具体实施例
下面结合附图和具体的实施方式对本发明作进一步的描述。
对于恶意程序的检测，尤其是对基于 MBR 的 Bootkit或类似于
Bootkit的病毒等恶意程序的检测，本申请提出一种检测方法，无论这 些恶意程序有何种变形，都可以被检测出来。
下面首先介绍本申请提出的思路，如下：
正常情况下，计算机系统的开机过程是：
开机通电自检 --〉主板 BIOS根据用户指定的启动顺序从软盘、 硬 盘或光驱进行启动 --〉系统 BIOS将主引导记录 MBR读入内存 --〉控制 权交给主引导程序 --〉主引导程序检査分区表状态，寻找活动的分区 --〉 主引导程序将控制权交给活动分区的引导记录， 由引导记录加载操作 系统启动文件。
由上可知， MBR是电脑通电开机，主板自检完成后，被第一个读 取到的位置，位于硬盘的 0磁头 0磁道 1扇区，它的大小是 512字节， 不属于任何一个操作系统，也不能用操作系统提供的磁盘操作命令来 读取。
DOS时代泛滥成灾的引导区病毒多寄生于 MBR中。以鬼影病毒为 例，该病毒寄生在 MBR中，病毒释放的驱动程序，能够破坏大多数安 全工具和系统辅助工具。 当系统再次重启时，该病毒会早于操作系统 内核先行加载。 而当病毒成功运行后，在进程中、 系统启动加载项里 找不到任何异常。 即使格式化重装系统，也无法将该病毒清除。
鬼影病毒驻留在系统的高端内存中， 因此现有技术通过搜索高端 内存的特征码来定位其是否是病毒。 例如，鬼影 3中的代码如图 1所 示，通过搜索特征码 0X0413来检测是否修改了高端内存来驻留病毒。 而对于变形的鬼影代码，参照图 2所示的一个鬼影变种代码，这段代 码可以达到和图 1一样的修改高端内存的效果，但却通过指令的变形， 找不到特征的代码，从而饶过常规安全软件的査杀。
仔细分析图 1和图 2所示的鬼影病毒，可以发现，无论其是否变 形，只要运行就能够达到修改高端内存的效果。 因此，通过检测高端 内存就可以检测出各种形式的鬼影病毒。 本申请正是利用这一点，通 过设置虚拟内存来模拟高端内存，并通过模拟 MBR的加载执行过程来 检测所述虚拟内存，从而在恶意程序真正运行之前就査找出各种基于 MBR的 Bootkit (如鬼影病毒）或类似于 Bootkit的病毒等恶意程序。
下面通过实施例对本申请所述方法的实现流程进行详细说明。
参照图 3 ,是依据本发明的一个实施例的检测恶意程序的方法的流 程图。
参照上面的计算机系统开机过程，在系统开机后并且在加载操作 系统文件之前，执行以下步骤：
步骤 301 ,设置虚拟内存；
即分配一块内存区域作为虚拟内存使用，所述虚拟内存是对实际 的系统高端内存的模拟。
步骤 302 ,读取主引导记录 MBR并保存到所述虚拟内存； 真实的开机过程中，开机通电自检后，系统 BIOS 将主引导记录
MBR读入真实的高端内存；而在本实施例中，是将 MBR读入所述虚 拟内存中。
步骤 303 ,模拟执行虚拟内存中主引导记录 MBR中的每一条指令， 并在执行完每一条指令后检测所述虚拟内存是否被修改； 如果被修改，则发现恶意程序，退出检测过程，并可以进行提示； 否则，如果未被修改，则继续模拟执行下一条指令，直到主引导记录
MBR的所有指令模拟执行完毕，退出检测过程。 若 MBR的所有指令 都模拟执行完毕也没有发现恶意程序，则将控制权交给系统中真实的 活动分区的引导记录， 由引导记录加载操作系统启动文件。
具体地，可以通过检测所述虚拟内存的大小是否改变来判断是否 被修改，如果改变，则所述虚拟内存被修改；否则，未被修改。 目前 的实际应用中，由于 Bootkit会修改内存以使内存变小，因此在模拟执 行每一条指令之后，可以通过判断虚拟内存是否变小来进行检测。 当 然，本实施例也不排除其他判断内存是否被修改的方法。
此外，在本发明的一个实施例中，可以通过虚拟 CPU来完成上述 步骤 303。 具体地，在步骤 301设置虚拟内存之前，先设置虚拟 CPU , 然后在步骤 303由所述虚拟 CPU模拟指令的执行，并对虚拟内存进行 检测。
基于上述图 3所示实施例的内容：
进一步可选地，在设置了虚拟内存之后，还可以设置虚拟硬盘， 并将虚拟内存中的 MBR拷贝到所述虚拟硬盘中，当模拟执行 MBR中 的指令时，直接从所述虚拟硬盘中进行读取。
进一步可选地，为了整个模拟过程的完整性，还可以设置虚拟 BIOS, 虚拟 I/O设备等其他相关部分，用于所述检测过程。
进一步可选地，为了便于相关人员査看整个模拟过程的执行，还 可以对主引导记录 MBR中的每一条指令进行反汇编，并输出显示。
综上所述，在实际情况中，基于 MBR的 Bootkit或类似于 Bootkit 的病毒等恶意程序，即使进行了变形，也必须要驻留在系统的高端内 存中，所以必然会修改高端内存， 因此上述的检测方法通过设置虚拟 内存来模拟高端内存，并通过检测虚拟内存是否被修改，就可以发现 可疑的恶意程序，从而无视任何特征码变换技术，只要实际运行中发 生了这个行为即可被检测出来。 所述的检测方法在很大程度上可以检 测出过去、 现在和未来的基于 MBR的 Bootkit。 需要说明的是，对于前述的方法实施例，为了简单描述，故将其 都表述为一系列的动作组合，但是本领域技术人员应该知悉，本申请 并不受所描述的动作顺序的限制， 因为依据本申请，某些步骤可以采 用其他顺序或者同时进行。 其次，本领域技术人员也应该知悉，说明 书中所描述的实施例均是示例性的，所涉及的动作并不一定是本申请 所必须的。
基于上述检测方法的实施例，本申请还提供了相应的装置实施例。 参照图 4 ,是依据本发明的一个实施例的检测恶意程序的装置的结 构图。
所述检测装置可以包括：
第一设置模块 41 ,用于设置虚拟内存；
读取及保存模块 42 ,用于读取主引导记录 MBR并保存到所述虚 拟内存；
模拟执行模块 43 ,用于模拟执行虚拟内存中主引导记录 MBR中 的每一条指令；
检测模块 44 ,用于在所述模拟执行模块 43执行完每一条指令后检 测所述虚拟内存是否被修改，如果被修改，则发现恶意程序；否则， 触发所述模拟执行模块 43继续模拟执行下一条指令，直到主引导记录 MBR的所有指令模拟执行完毕。
优选的，所述检测模块 44可通过检测所述虚拟内存的大小是否改 变来判断是否被修改，如果改变，则所述虚拟内存被修改；否则，未 被修改。
进一步可选地，所述检测装置还可以包括：
第二设置模块 45 ,用于设置虚拟 CPU ,所述虚拟 CPU可触发所述 模拟执行模块 43和检测模块 44的执行。
进一步可选地，所述检测装置还可以包括：
第三设置模块 46 ,用于设置虚拟硬盘，并将虚拟内存中的主引导 记录 MBR拷贝到所述虚拟硬盘；
此时，所述模拟执行模块 43 从所述虚拟硬盘读取主引导记录 MBR ,并模拟执行主引导记录 MBR中的每一条指令。
进一步可选地，所述检测装置还可以包括：
反汇编引擎 47 ,用于对主引导记录 MBR中的每一条指令进行反 汇编，并输出显示。
所述检测装置既可以作为单独的工具，也可以作为动态库被其他 程序调用，使用灵活。
对于上述检测装置实施例而言， 由于其与方法实施例基本相似， 所以描述的比较简单，相关之处参见上述方法实施例的部分说明即可。
基于上述内容，为了使本领域技术人员更加了解本申请的实现， 本申请还提供了另一更具体的实施例， 内容如下。
依据本发明的一个实施例，提供了一种虚拟机，所述虚拟机通过 实现虚拟 CPU、 虚拟内存、 反汇编引擎、 虚拟硬盘以及其他相关部分， 如虚拟 BIOS、 虚拟 I/O设备等，可以模拟实现主引导记录 MBR的加 载执行过程，并检测出是否存在 Bootkit等恶意程序。
参照图 5 ,是依据本发明一个实施例的虚拟机的结构图。
具体地，所述虚拟机可以包括：
虚拟 CPU初始化模块 51 ,用于初始化虚拟 CPU 54；
虚拟内存初始化模块 52 ,用于初始化虚拟内存 53 ,并在初始化的 过程中读取主引导记录 MBR然后保存到所述虚拟内存 53；
虚拟内存 53 ,用于存储主引导记录 MBR；
虚拟 CPU 54 ,用于模拟执行虚拟内存 53中主引导记录 MBR中的 每一条指令，并在执行完每一条指令后检测所述虚拟内存是否被修改， 如果被修改，则发现恶意程序；否则，继续模拟执行下一条指令，直 到主引导记录 MBR的所有指令模拟执行完毕。
进一步可选地，所述虚拟机还可以包括：
虚拟硬盘初始化模块 55 ,用于初始化虚拟硬盘 56 ,并在初始化的 过程中将虚拟内存 53中的主引导记录 MBR拷贝到所述虚拟硬盘 56 , 所述虚拟 CPU 54从虚拟硬盘 56读取主引导记录 MBR并模拟执行； 虚拟硬盘 56 ,用于存储拷贝的主引导记录 MBR。 进一步可选地，所述虚拟机还可以包括：
反汇编引擎 57 ,用于对主引导记录 MBR中的每一条指令进行反 汇编，并输出显示。
由于实际应用中 Bootkit病毒多运行于计算机系统的实模式下，因 此下面将以实模式下的虚拟机为例进行详细说明。 当然，所述虚拟机 可应用于保护模式或其他计算机模式下，本实施例不受此限定。
在实模式下，上述虚拟 CPU可模拟实现所有实模式下的指令，主 要为 8086指令 ,还可以包括 386以后的指令。此外，随着木马等 Bootkit 技术的发展，如果木马调用了特殊的指令，所述虚拟 CPU还可以进行 相应特殊指令的模拟。 例如，鬼影病毒为了防止被调试采用了 586以 后才支持的指令 RDTSC ,则虚拟 CPU还会模拟所述 RDTSC指令。
在开机通电自检后，系统 BIOS读取系统内置的 MBR ,然后传给 所述虚拟机，同时虚拟机进行初始化。 虚拟机的执行步骤如下：
步骤 1 ,初始化虚拟 CPU；
首先进行虚拟 CPU初始化，虚拟 CPU为单核的 80x86 ,支持的寄 存器同真实的机器。
此外，支持指令的初始化，虚拟机内部有个指令支持列表，该列 表可根据实际需要，不断增加需要支持的指令，初始化的时候会填充 已经支持的指令列表。 然后，将虚拟机中的 CPU的指令指针指向虚拟 内存中的 BIOS指令开始执行处（即 MBR指令） 0xf000:0xfff0。
步骤 2 ,初始化虚拟内存；
可通过初始化 BIOS数据区，所述 BIOS数据区保存常规的虚拟内 存的大小，在实模式下可分配 640KB左右的内存空间作为虚拟内存使 用。 然后，将系统 BIOS读取的 MBR存入所述虚拟内存中。
步骤 3 ,初始化虚拟硬盘以及虚拟机的其他相关部分；
一般在 DOS下只使用 1MB的磁盘，所以通过分配 1MB 左右的内 存空间作为虚拟硬盘来模拟实际的硬盘。 相应的，还可通过访问所述 虚拟硬盘来模拟访问实际的硬盘。 然后，将虚拟内存中的 MBR拷贝到 所述虚拟磁盘的开始处。 此外，还会初始化虚拟机的其他相关部分，如虚拟 BIOS、虚拟 I/O 设备等。
步骤 4 ,运行虚拟 CPU；
与实际的执行过程类似，开始执行虚拟 CPU后，从 BIOS指令开 始执行处（即 MBR指令）开始执行。 每执行 MBR的一条指令，虚拟 CPU会进行指令译码，根据指令译码结果修改内部的寄存器和相关内 存，并执行相应的流程。 如果指令中包含病毒，则虚拟 CPU不仅会修 改内部的寄存器，还会修改相关的虚拟内存；如果不包含，则不会修 改相关的虚拟内存。
步骤 5 ,虚拟 CPU检测虚拟内存。
每执行一条指令后，虚拟 CPU会检测前面设置的 BIOS数据区保 存的虚拟内存大小，如果发现被改变了，就认为发现了可疑 MBR病毒， 然后退出虚拟机，并进行提示。 如果没有发现则继续执行，如果发现 执行到 CS=0,IP=0X7C00 的时候就检测是否执行到了操作系统引导 区，比如是否是 NTFS或 FAT的文件系统的引导区，如是的，则认为 执行 MBR结束，没有发现可疑的 MBR ,然后退出。
需要说明的是，上述步骤的先后顺序可根据实际需要进行调整， 本申请并不受所描述的动作顺序的限制， 因为依据本申请，某些步骤 可以采用其他顺序或者同时进行。
上述虚拟机既可以作为单独的工具，也可以作为动态库被其他程 序调用，使用灵活。 同时，考虑到性能和效率等实用性方面，整个虚 拟机的实现控制在几百 K字节内，是一种轻量级的虚拟机。
下面以鬼影病毒为例说明本申请的上述内容。
参照图 6 ,是根据本发明一个实施例的正常的 MBR运行后的显示 结果示意图；
参照图 7 ,是根据本发明一个实施例的中了鬼影 1后的 MBR运行 结果示意图；
参照图 8 ,是根据本发明一个实施例的中了鬼影 3后的 MBR运行 结果示意图； 参照图 9 ,是根据本发明一个实施例的中了顶级 Bootkit后的 MBR 运行结果示意图。
φ ,
MbrVmConsole为主程序；
MbrVM.ini为配置文件，用来指定 VM内存大小和指定虚拟硬盘 的文件；
Mbr.img为指定的虚拟硬盘文件；
BIOS下为虚拟机用到的虚拟 BIOS文件；
使用时候，将指定的 MBR DUMP文件 mbr.bin拷贝到虚拟机目录 下，运行 MbrVmconsole即可运行虚拟机进行检测。
mbrGood.bin为正常 MBR；
mbrguiyingl.bin 为鬼影 1 MBR；
mbrguiying3.bin 为鬼影 3 MBR；
mbrTdl.bin 为 TDL4 MBR；
运行时，将相应的文件改名为 mbr.bin 即可进行相应的检测。 综上所述，随着现在杀毒软件技术的日益成熟，木马等病毒生存 的空间越来越狭小，传统的木马技术， 已经很难生存和发展了。 但 Bootkit技术的出现，给病毒一个很大的生存发展空间，使其可以做到 无文件、 无进程、 无注册表修改等任何杀软能检测到的东西，只需要 在 MBR里写入加载代码，就可以加载起一个完整的病毒执行体系。 而 且即使格式化重装，也照样能复活。 所以基于本申请所实现的方法和 装置，在以后检测该方面的木马等病毒中起到决定性的作用，而这正 是目前几乎所有杀毒软件的盲点。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多 个处理器上运行的软件模块实现，或者以它们的组合实现。 本领域的 技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器 ( DSP )来实现根据本发明实施例的检测恶意程序的装置和虚拟机中的 一些或者全部部件的一些或者全部功能。 本发明还可以实现为用于执 行这里所描述的方法的一部分或者全部的设备或者装置程序（例如， 计算机程序和计算机程序产品）。 这样的实现本发明的程序可以存储 在计算机可读介质上，或者可以具有一个或者多个信号的形式。 这样 的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者 以任何其他形式提供。
例如，图 10示出了可以实现根据本发明的检测恶意程序的方法的 服务器，例如应用服务器。 该服务器传统上包括处理器 1010和以存储 器 1020形式的计算机程序产品或者计算机可读介质。 存储器 1020可 以是诸如闪存、 EEPROM (电可擦除可编程只读存储器）、 EPROM、 硬盘或者 ROM之类的电子存储器。 存储器 1020具有用于执行上述方 法中的任何方法步骤的程序代码 1031的存储空间 1030。例如，用于程 序代码的存储空间 1030可以包括分别用于实现上面的方法中的各种步 骤的各个程序代码 1031。 这些程序代码可以从一个或者多个计算机程 序产品中读出或者写入到这一个或者多个计算机程序产品中。 这些计 算机程序产品包括诸如硬盘，紧致盘（ CD )、 存储卡或者软盘之类的 程序代码载体。 这样的计算机程序产品通常为如参考图 11所述的便携 式或者固定存储单元。 该存储单元可以具有与图 10的服务器中的存储 器 1020类似布置的存储段、 存储空间等。 程序代码可以例如以适当形 式进行压缩。 通常，存储单元包括计算机可读代码 103 Γ ,即可以由例 如诸如 1010之类的处理器读取的代码，这些代码当由服务器运行时， 导致该服务器执行上面所描述的方法中的各个步骤。
本文中所称的 "一个实施例" 、 "实施例" 或者 "一个或者多个 实施例" 意味着，结合实施例描述的特定特征、 结构或者特性包括在 本发明的至少一个实施例中。 此外，请注意，这里 "在一个实施例中" 的词语例子不一定全指同一个实施例。
在此处所提供的说明书中，说明了大量具体细节。 然而，能够理 解，本发明的实施例可以在没有这些具体细节的情况下被实践。 在一 些实例中，并未详细示出公知的方法、 结构和技术，以便不模糊对本 说明书的理解。
应该注意的是上述实施例对本发明进行说明而不是对本发明进行 限制，并且本领域技术人员在不脱离所附权利要求的范围的情况下可 设计出替换实施例。 在权利要求中，不应将位于括号之间的任何参考 符号构造成对权利要求的限制。 单词 "包含" 不排除存在未列在权利 要求中的元件或步骤。 位于元件之前的单词 "一" 或 "一个" 不排除 存在多个这样的元件。 本发明可以借助于包括有若干不同元件的硬件 以及借助于适当编程的计算机来实现。 在列举了若干装置的单元权利 要求中，这些装置中的若干个可以是通过同一个硬件项来具体体现。 单词第一、 第二、 以及第三等的使用不表示任何顺序。 可将这些单词 解释为名称。
此外，还应当注意，本说明书中使用的语言主要是为了可读性和 教导的目的而选择的，而不是为了解释或者限定本发明的主题而选择 的。 因此，在不偏离所附权利要求书的范围和精神的情况下，对于本 技术领域的普通技术人员来说许多修改和变更都是显而易见的。 对于 本发明的范围，对本发明所做的公开是说明性的，而非限制性的，本 发明的范围由所附权利要求书限定。

Claims

杈 利 要 求
1、 一种检测恶意程序的方法，包括：
设置虚拟内存；
读取主引导记录 MBR并保存到所述虚拟内存；
模拟执行虚拟内存中主引导记录 MBR中的每一条指令，并在执行 完每一条指令后检测所述虚拟内存是否被修改，如果被修改，则发现 恶意程序；否则，继续模拟执行下一条指令，直到主引导记录 MBR的 所有指令模拟执行完毕。
2、 根据权利要求 1所述的方法，其中，所述检测所述虚拟内存是 否被修改，包括：
检测所述虚拟内存的大小是否改变，如果改变，则所述虚拟内存 被修改；否则，未被修改。
3、 根据权利要求 1或 2所述的方法，其中，所述设置虚拟内存之 前 ,还包括：
设置虚拟 CPU；
则所述模拟执行虚拟内存中主引导记录 MBR中的每一条指令，包 括：
由所述虚拟 CPU模拟执行虚拟内存中主引导记录 MBR中的每一 条指令。
4、 根据权利要求 3所述的方法，其中，
所述设置虚拟 CPU包括：初始化虚拟 CPU；
所述设置虚拟内存包括：初始化 BIOS数据区，所述 BIOS数据区 保存虚拟内存的大小。
5、 根据权利要求 1或 2所述的方法，其中，
所述模拟执行虚拟内存中主引导记录 MBR中的每一条指令之前， 还包括：设置虚拟硬盘；
则所述模拟执行虚拟内存中主引导记录 MBR 中的每一条指令包 括：
将虚拟内存中的主引导记录 MBR拷贝到所述虚拟硬盘；
从所述虚拟硬盘读取主引导记录 MBR ,并模拟执行主引导记录 MBR中的每一条指令。
6、 根据权利要求 1或 2所述的方法，其中，还包括： 对主引导记录 MBR中的每一条指令进行反汇编，并输出显示。
7、 一种检测恶意程序的装置，包括：
第一设置模块，用于设置虚拟内存；
读取及保存模块，用于读取主引导记录 MBR并保存到所述虚拟内 存；
模拟执行模块，用于模拟执行虚拟内存中主引导记录 MBR中的每 一条指令；
检测模块，用于在所述模拟执行模块执行完每一条指令后检测所 述虚拟内存是否被修改，如果被修改，则发现恶意程序；否则，触发 所述模拟执行模块继续模拟执行下一条指令，直到主引导记录 MBR的 所有指令模拟执行完毕。
8、 根据权利要求 7所述的装置，其中：
所述检测模块通过检测所述虚拟内存的大小是否改变来判断是否 被修改，如果改变，则所述虚拟内存被修改；否则，未被修改。
9、 根据权利要求 7或 8所述的装置，其中，还包括：
第二设置模块，用于设置虚拟 CPU ,所述虚拟 CPU触发所述模拟 执行模块和检测模块的执行。
10、 根据权利要求 7或 8所述的装置，其中，还包括：
第三设置模块，用于设置虚拟硬盘，并将虚拟内存中的主引导记 录 MBR拷贝到所述虚拟硬盘；
则所述模拟执行模块从所述虚拟硬盘读取主引导记录 MBR ,并模 拟执行主引导记录 MBR中的每一条指令。
11、 根据权利要求或 8所述的装置，其中，还包括：
反汇编引擎，用于对主引导记录 MBR 中的每一条指令进行反汇 编，并输出显示。
12、 一种检测恶意程序的虚拟机，包括：
虚拟 CPU初始化模块，用于初始化虚拟 CPU；
虚拟内存初始化模块，用于初始化虚拟内存，并在初始化的过程 中读取主引导记录 MBR然后保存到所述虚拟内存；
虚拟内存，用于存储主引导记录 MBR；
虚拟 CPU ,用于模拟执行虚拟内存中主引导记录 MBR中的每一条 指令，并在执行完每一条指令后检测所述虚拟内存是否被修改，如果 被修改，则发现恶意程序；否则，继续模拟执行下一条指令，直到主 引导记录 MBR的所有指令模拟执行完毕。
13、 根据权利要求 12所述的虚拟机，其中，还包括：
虚拟硬盘初始化模块，用于初始化虚拟硬盘，并在初始化的过程 中将虚拟内存中的主引导记录 MBR拷贝到所述虚拟硬盘，所述虚拟 CPU从虚拟硬盘读取主引导记录 MBR并模拟执行；
虚拟硬盘，用于存储拷贝的主引导记录 MBR。
14、 根据权利要求 12或 13所述的虚拟机，其中，还包括： 反汇编引擎，用于对主引导记录 MBR 中的每一条指令进行反汇 编，并输出显示。
15、 一种计算机程序，包括计算机可读代码，当所述计算机可读 代码在服务器上运行时 ,导致所述服务器执行根据权利要求 10-18中的 任一项所述的网站扫描方法。
16、 一种计算机可读介质，其中存储了如权利要求 19所述的计算 机程序。
PCT/CN2012/080545 2011-09-14 2012-08-24 一种检测恶意程序的方法、装置及虚拟机 WO2013037261A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US14/344,864 US10146938B2 (en) 2011-09-14 2012-08-24 Method, apparatus and virtual machine for detecting malicious program

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2011102724432A CN102339371B (zh) 2011-09-14 2011-09-14 一种检测恶意程序的方法、装置及虚拟机
CN201110272443.2 2011-09-14

Publications (1)

Publication Number Publication Date
WO2013037261A1 true WO2013037261A1 (zh) 2013-03-21

Family

ID=45515097

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2012/080545 WO2013037261A1 (zh) 2011-09-14 2012-08-24 一种检测恶意程序的方法、装置及虚拟机

Country Status (3)

Country Link
US (1) US10146938B2 (zh)
CN (1) CN102339371B (zh)
WO (1) WO2013037261A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104462969A (zh) * 2014-12-16 2015-03-25 北京奇虎科技有限公司 查杀恶意应用程序的方法、装置和系统

Families Citing this family (161)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8793787B2 (en) 2004-04-01 2014-07-29 Fireeye, Inc. Detecting malicious network content using virtual environment components
US9106694B2 (en) 2004-04-01 2015-08-11 Fireeye, Inc. Electronic message analysis for malware detection
US8549638B2 (en) 2004-06-14 2013-10-01 Fireeye, Inc. System and method of containing computer worms
US8898788B1 (en) 2004-04-01 2014-11-25 Fireeye, Inc. Systems and methods for malware attack prevention
US8584239B2 (en) 2004-04-01 2013-11-12 Fireeye, Inc. Virtual machine with dynamic data flow analysis
US8881282B1 (en) 2004-04-01 2014-11-04 Fireeye, Inc. Systems and methods for malware attack detection and identification
US7587537B1 (en) 2007-11-30 2009-09-08 Altera Corporation Serializer-deserializer circuits formed from input-output circuit registers
US8171553B2 (en) 2004-04-01 2012-05-01 Fireeye, Inc. Heuristic based capture with replay to virtual machine
US8528086B1 (en) 2004-04-01 2013-09-03 Fireeye, Inc. System and method of detecting computer worms
US8566946B1 (en) 2006-04-20 2013-10-22 Fireeye, Inc. Malware containment on connection
US8997219B2 (en) 2008-11-03 2015-03-31 Fireeye, Inc. Systems and methods for detecting malicious PDF network content
US8832829B2 (en) 2009-09-30 2014-09-09 Fireeye, Inc. Network-based binary file extraction and analysis for malware detection
CN102339371B (zh) * 2011-09-14 2013-12-25 奇智软件（北京）有限公司 一种检测恶意程序的方法、装置及虚拟机
CN102722680B (zh) 2012-06-07 2014-11-05 腾讯科技（深圳）有限公司 清除恶意程序的方法和系统
US10572665B2 (en) 2012-12-28 2020-02-25 Fireeye, Inc. System and method to create a number of breakpoints in a virtual machine via virtual machine trapping events
CN103914650B (zh) * 2012-12-31 2017-12-01 腾讯科技（深圳）有限公司 病毒检测方法和装置
CN103971052B (zh) * 2013-01-28 2017-06-30 腾讯科技（深圳）有限公司 磁盘引导区病毒识别方法及装置
CN103150506B (zh) * 2013-02-17 2016-03-30 北京奇虎科技有限公司 一种恶意程序检测的方法和装置
US9367681B1 (en) 2013-02-23 2016-06-14 Fireeye, Inc. Framework for efficient security coverage of mobile software applications using symbolic execution to reach regions of interest within an application
US9195829B1 (en) 2013-02-23 2015-11-24 Fireeye, Inc. User interface with real-time visual playback along with synchronous textual analysis log display and event/time index for anomalous behavior detection in applications
US8990944B1 (en) 2013-02-23 2015-03-24 Fireeye, Inc. Systems and methods for automatically detecting backdoors
US9176843B1 (en) 2013-02-23 2015-11-03 Fireeye, Inc. Framework for efficient security coverage of mobile software applications
US9009823B1 (en) 2013-02-23 2015-04-14 Fireeye, Inc. Framework for efficient security coverage of mobile software applications installed on mobile devices
US9104867B1 (en) 2013-03-13 2015-08-11 Fireeye, Inc. Malicious content analysis using simulated user interaction without user involvement
US9626509B1 (en) 2013-03-13 2017-04-18 Fireeye, Inc. Malicious content analysis with multi-version application support within single operating environment
US9355247B1 (en) 2013-03-13 2016-05-31 Fireeye, Inc. File extraction from memory dump for malicious content analysis
US9311479B1 (en) 2013-03-14 2016-04-12 Fireeye, Inc. Correlation and consolidation of analytic data for holistic view of a malware attack
US9430646B1 (en) 2013-03-14 2016-08-30 Fireeye, Inc. Distributed systems and methods for automatically detecting unknown bots and botnets
US9251343B1 (en) * 2013-03-15 2016-02-02 Fireeye, Inc. Detecting bootkits resident on compromised computers
US9413781B2 (en) 2013-03-15 2016-08-09 Fireeye, Inc. System and method employing structured intelligence to verify and contain threats at endpoints
US10713358B2 (en) 2013-03-15 2020-07-14 Fireeye, Inc. System and method to extract and utilize disassembly features to classify software intent
US9495180B2 (en) 2013-05-10 2016-11-15 Fireeye, Inc. Optimized resource allocation for virtual machines within a malware content detection system
US9635039B1 (en) 2013-05-13 2017-04-25 Fireeye, Inc. Classifying sets of malicious indicators for detecting command and control communications associated with malware
US10133863B2 (en) 2013-06-24 2018-11-20 Fireeye, Inc. Zero-day discovery system
US9300686B2 (en) 2013-06-28 2016-03-29 Fireeye, Inc. System and method for detecting malicious links in electronic messages
CN103440141A (zh) * 2013-06-28 2013-12-11 株洲南车时代电气股份有限公司 一种显示器在dos系统下的程序写片装置、系统及其方法
US9811665B1 (en) 2013-07-30 2017-11-07 Palo Alto Networks, Inc. Static and dynamic security analysis of apps for mobile devices
US10019575B1 (en) 2013-07-30 2018-07-10 Palo Alto Networks, Inc. Evaluating malware in a virtual machine using copy-on-write
CN104462962B (zh) * 2013-09-13 2018-07-03 北京安赛创想科技有限公司 一种检测未知恶意代码和二进制漏洞的方法
CN103473508B (zh) * 2013-09-17 2016-07-27 肖楠 操作系统内核运行时安全验证方法
US9628507B2 (en) 2013-09-30 2017-04-18 Fireeye, Inc. Advanced persistent threat (APT) detection center
US9736179B2 (en) 2013-09-30 2017-08-15 Fireeye, Inc. System, apparatus and method for using malware analysis results to drive adaptive instrumentation of virtual machines to improve exploit detection
US9294501B2 (en) 2013-09-30 2016-03-22 Fireeye, Inc. Fuzzy hash of behavioral results
US9690936B1 (en) 2013-09-30 2017-06-27 Fireeye, Inc. Multistage system and method for analyzing obfuscated content for malware
US9171160B2 (en) 2013-09-30 2015-10-27 Fireeye, Inc. Dynamically adaptive framework and method for classifying malware using intelligent static, emulation, and dynamic analyses
US10515214B1 (en) 2013-09-30 2019-12-24 Fireeye, Inc. System and method for classifying malware within content created during analysis of a specimen
US9921978B1 (en) 2013-11-08 2018-03-20 Fireeye, Inc. System and method for enhanced security of storage devices
US9747446B1 (en) 2013-12-26 2017-08-29 Fireeye, Inc. System and method for run-time object classification
US9756074B2 (en) 2013-12-26 2017-09-05 Fireeye, Inc. System and method for IPS and VM-based detection of suspicious objects
US9292686B2 (en) 2014-01-16 2016-03-22 Fireeye, Inc. Micro-virtualization architecture for threat-aware microvisor deployment in a node of a network environment
US9262635B2 (en) 2014-02-05 2016-02-16 Fireeye, Inc. Detection efficacy of virtual machine-based analysis with application specific events
US9241010B1 (en) 2014-03-20 2016-01-19 Fireeye, Inc. System and method for network behavior detection
US10242185B1 (en) 2014-03-21 2019-03-26 Fireeye, Inc. Dynamic guest image creation and rollback
US9591015B1 (en) 2014-03-28 2017-03-07 Fireeye, Inc. System and method for offloading packet processing and static analysis operations
US9432389B1 (en) 2014-03-31 2016-08-30 Fireeye, Inc. System, apparatus and method for detecting a malicious attack based on static analysis of a multi-flow object
US9223972B1 (en) 2014-03-31 2015-12-29 Fireeye, Inc. Dynamically remote tuning of a malware content detection system
US9594912B1 (en) 2014-06-06 2017-03-14 Fireeye, Inc. Return-oriented programming detection
US9973531B1 (en) 2014-06-06 2018-05-15 Fireeye, Inc. Shellcode detection
US9438623B1 (en) 2014-06-06 2016-09-06 Fireeye, Inc. Computer exploit detection using heap spray pattern matching
US10084813B2 (en) 2014-06-24 2018-09-25 Fireeye, Inc. Intrusion prevention and remedy system
US10805340B1 (en) 2014-06-26 2020-10-13 Fireeye, Inc. Infection vector and malware tracking with an interactive user display
US9398028B1 (en) 2014-06-26 2016-07-19 Fireeye, Inc. System, device and method for detecting a malicious attack based on communcations between remotely hosted virtual machines and malicious web servers
US10002252B2 (en) 2014-07-01 2018-06-19 Fireeye, Inc. Verification of trusted threat-aware microvisor
US9489516B1 (en) * 2014-07-14 2016-11-08 Palo Alto Networks, Inc. Detection of malware using an instrumented virtual machine environment
US9363280B1 (en) 2014-08-22 2016-06-07 Fireeye, Inc. System and method of detecting delivery of malware using cross-customer data
US10671726B1 (en) 2014-09-22 2020-06-02 Fireeye Inc. System and method for malware analysis using thread-level event monitoring
US9773112B1 (en) 2014-09-29 2017-09-26 Fireeye, Inc. Exploit detection of malware and malware families
US10027689B1 (en) 2014-09-29 2018-07-17 Fireeye, Inc. Interactive infection visualization for improved exploit detection and signature generation for malware and malware families
US9805193B1 (en) 2014-12-18 2017-10-31 Palo Alto Networks, Inc. Collecting algorithmically generated domains
US9690933B1 (en) 2014-12-22 2017-06-27 Fireeye, Inc. Framework for classifying an object as malicious with machine learning for deploying updated predictive models
US10075455B2 (en) 2014-12-26 2018-09-11 Fireeye, Inc. Zero-day rotating guest image profile
US9934376B1 (en) 2014-12-29 2018-04-03 Fireeye, Inc. Malware detection appliance architecture
US9838417B1 (en) 2014-12-30 2017-12-05 Fireeye, Inc. Intelligent context aware user interaction for malware detection
US9690606B1 (en) 2015-03-25 2017-06-27 Fireeye, Inc. Selective system call monitoring
US10148693B2 (en) 2015-03-25 2018-12-04 Fireeye, Inc. Exploit detection system
US9438613B1 (en) 2015-03-30 2016-09-06 Fireeye, Inc. Dynamic content activation for automated analysis of embedded objects
US10474813B1 (en) 2015-03-31 2019-11-12 Fireeye, Inc. Code injection technique for remediation at an endpoint of a network
US10417031B2 (en) 2015-03-31 2019-09-17 Fireeye, Inc. Selective virtualization for security threat detection
US9483644B1 (en) 2015-03-31 2016-11-01 Fireeye, Inc. Methods for detecting file altering malware in VM based analysis
US9654485B1 (en) 2015-04-13 2017-05-16 Fireeye, Inc. Analytics-based security monitoring system and method
US9594904B1 (en) 2015-04-23 2017-03-14 Fireeye, Inc. Detecting malware based on reflection
CN104834861B (zh) * 2015-05-12 2018-10-02 腾讯科技（深圳）有限公司 木马的查杀方法和装置
US10642753B1 (en) 2015-06-30 2020-05-05 Fireeye, Inc. System and method for protecting a software component running in virtual machine using a virtualization layer
US10726127B1 (en) 2015-06-30 2020-07-28 Fireeye, Inc. System and method for protecting a software component running in a virtual machine through virtual interrupts by the virtualization layer
US11113086B1 (en) 2015-06-30 2021-09-07 Fireeye, Inc. Virtual system and method for securing external network connectivity
US10454950B1 (en) 2015-06-30 2019-10-22 Fireeye, Inc. Centralized aggregation technique for detecting lateral movement of stealthy cyber-attacks
US10715542B1 (en) 2015-08-14 2020-07-14 Fireeye, Inc. Mobile application risk analysis
US10176321B2 (en) 2015-09-22 2019-01-08 Fireeye, Inc. Leveraging behavior-based rules for malware family classification
US10033747B1 (en) 2015-09-29 2018-07-24 Fireeye, Inc. System and method for detecting interpreter-based exploit attacks
US10817606B1 (en) 2015-09-30 2020-10-27 Fireeye, Inc. Detecting delayed activation malware using a run-time monitoring agent and time-dilation logic
US10706149B1 (en) 2015-09-30 2020-07-07 Fireeye, Inc. Detecting delayed activation malware using a primary controller and plural time controllers
US10601865B1 (en) 2015-09-30 2020-03-24 Fireeye, Inc. Detection of credential spearphishing attacks using email analysis
US10210329B1 (en) 2015-09-30 2019-02-19 Fireeye, Inc. Method to detect application execution hijacking using memory protection
US9825976B1 (en) 2015-09-30 2017-11-21 Fireeye, Inc. Detection and classification of exploit kits
US9825989B1 (en) 2015-09-30 2017-11-21 Fireeye, Inc. Cyber attack early warning system
US10284575B2 (en) 2015-11-10 2019-05-07 Fireeye, Inc. Launcher for setting analysis environment variations for malware detection
US10846117B1 (en) 2015-12-10 2020-11-24 Fireeye, Inc. Technique for establishing secure communication between host and guest processes of a virtualization architecture
US10447728B1 (en) 2015-12-10 2019-10-15 Fireeye, Inc. Technique for protecting guest processes using a layered virtualization architecture
US10108446B1 (en) 2015-12-11 2018-10-23 Fireeye, Inc. Late load technique for deploying a virtualization layer underneath a running operating system
US10565378B1 (en) 2015-12-30 2020-02-18 Fireeye, Inc. Exploit of privilege detection framework
US10050998B1 (en) 2015-12-30 2018-08-14 Fireeye, Inc. Malicious message analysis system
US10133866B1 (en) 2015-12-30 2018-11-20 Fireeye, Inc. System and method for triggering analysis of an object for malware in response to modification of that object
US10621338B1 (en) 2015-12-30 2020-04-14 Fireeye, Inc. Method to detect forgery and exploits using last branch recording registers
US11552986B1 (en) 2015-12-31 2023-01-10 Fireeye Security Holdings Us Llc Cyber-security framework for application of virtual features
US9824216B1 (en) 2015-12-31 2017-11-21 Fireeye, Inc. Susceptible environment detection system
US10581874B1 (en) 2015-12-31 2020-03-03 Fireeye, Inc. Malware detection system with contextual analysis
US10671721B1 (en) 2016-03-25 2020-06-02 Fireeye, Inc. Timeout management services
US10476906B1 (en) 2016-03-25 2019-11-12 Fireeye, Inc. System and method for managing formation and modification of a cluster within a malware detection system
US10601863B1 (en) 2016-03-25 2020-03-24 Fireeye, Inc. System and method for managing sensor enrollment
US10785255B1 (en) 2016-03-25 2020-09-22 Fireeye, Inc. Cluster configuration within a scalable malware detection system
US10826933B1 (en) 2016-03-31 2020-11-03 Fireeye, Inc. Technique for verifying exploit/malware at malware detection appliance through correlation with endpoints
US10893059B1 (en) 2016-03-31 2021-01-12 Fireeye, Inc. Verification and enhancement using detection systems located at the network periphery and endpoint devices
US10169585B1 (en) 2016-06-22 2019-01-01 Fireeye, Inc. System and methods for advanced malware detection through placement of transition events
US10462173B1 (en) 2016-06-30 2019-10-29 Fireeye, Inc. Malware detection verification and enhancement by coordinating endpoint and malware detection systems
US10430586B1 (en) * 2016-09-07 2019-10-01 Fireeye, Inc. Methods of identifying heap spray attacks using memory anomaly detection
US10592678B1 (en) 2016-09-09 2020-03-17 Fireeye, Inc. Secure communications between peers using a verified virtual trusted platform module
US10491627B1 (en) 2016-09-29 2019-11-26 Fireeye, Inc. Advanced malware detection using similarity analysis
US10795991B1 (en) 2016-11-08 2020-10-06 Fireeye, Inc. Enterprise search
US10587647B1 (en) 2016-11-22 2020-03-10 Fireeye, Inc. Technique for malware detection capability comparison of network security devices
US10552610B1 (en) 2016-12-22 2020-02-04 Fireeye, Inc. Adaptive virtual machine snapshot update framework for malware behavioral analysis
US10581879B1 (en) 2016-12-22 2020-03-03 Fireeye, Inc. Enhanced malware detection for generated objects
US10523609B1 (en) 2016-12-27 2019-12-31 Fireeye, Inc. Multi-vector malware detection and analysis
US10904286B1 (en) 2017-03-24 2021-01-26 Fireeye, Inc. Detection of phishing attacks using similarity analysis
US10791138B1 (en) 2017-03-30 2020-09-29 Fireeye, Inc. Subscription-based malware detection
US10798112B2 (en) 2017-03-30 2020-10-06 Fireeye, Inc. Attribute-controlled malware detection
US10902119B1 (en) 2017-03-30 2021-01-26 Fireeye, Inc. Data extraction system for malware analysis
US10848397B1 (en) 2017-03-30 2020-11-24 Fireeye, Inc. System and method for enforcing compliance with subscription requirements for cyber-attack detection service
US10855700B1 (en) 2017-06-29 2020-12-01 Fireeye, Inc. Post-intrusion detection of cyber-attacks during lateral movement within networks
US10601848B1 (en) 2017-06-29 2020-03-24 Fireeye, Inc. Cyber-security system and method for weak indicator detection and correlation to generate strong indicators
US10503904B1 (en) 2017-06-29 2019-12-10 Fireeye, Inc. Ransomware detection and mitigation
US10893068B1 (en) 2017-06-30 2021-01-12 Fireeye, Inc. Ransomware file modification prevention technique
US10747872B1 (en) 2017-09-27 2020-08-18 Fireeye, Inc. System and method for preventing malware evasion
US10805346B2 (en) 2017-10-01 2020-10-13 Fireeye, Inc. Phishing attack detection
US11108809B2 (en) 2017-10-27 2021-08-31 Fireeye, Inc. System and method for analyzing binary code for malware classification using artificial neural network techniques
US11005860B1 (en) 2017-12-28 2021-05-11 Fireeye, Inc. Method and system for efficient cybersecurity analysis of endpoint events
US11271955B2 (en) 2017-12-28 2022-03-08 Fireeye Security Holdings Us Llc Platform and method for retroactive reclassification employing a cybersecurity-based global data store
US11240275B1 (en) 2017-12-28 2022-02-01 Fireeye Security Holdings Us Llc Platform and method for performing cybersecurity analyses employing an intelligence hub with a modular architecture
CN108875363B (zh) * 2017-12-29 2021-04-30 北京安天网络安全技术有限公司 一种加速虚拟执行的方法、装置、电子设备及存储介质
US10826931B1 (en) 2018-03-29 2020-11-03 Fireeye, Inc. System and method for predicting and mitigating cybersecurity system misconfigurations
US11558401B1 (en) 2018-03-30 2023-01-17 Fireeye Security Holdings Us Llc Multi-vector malware detection data sharing system for improved detection
US11003773B1 (en) 2018-03-30 2021-05-11 Fireeye, Inc. System and method for automatically generating malware detection rule recommendations
US10956477B1 (en) 2018-03-30 2021-03-23 Fireeye, Inc. System and method for detecting malicious scripts through natural language processing modeling
US11314859B1 (en) 2018-06-27 2022-04-26 FireEye Security Holdings, Inc. Cyber-security system and method for detecting escalation of privileges within an access token
US11075930B1 (en) 2018-06-27 2021-07-27 Fireeye, Inc. System and method for detecting repetitive cybersecurity attacks constituting an email campaign
US11228491B1 (en) 2018-06-28 2022-01-18 Fireeye Security Holdings Us Llc System and method for distributed cluster configuration monitoring and management
US11010474B2 (en) 2018-06-29 2021-05-18 Palo Alto Networks, Inc. Dynamic analysis techniques for applications
US11316900B1 (en) 2018-06-29 2022-04-26 FireEye Security Holdings Inc. System and method for automatically prioritizing rules for cyber-threat detection and mitigation
US10956573B2 (en) 2018-06-29 2021-03-23 Palo Alto Networks, Inc. Dynamic analysis techniques for applications
US11182473B1 (en) 2018-09-13 2021-11-23 Fireeye Security Holdings Us Llc System and method for mitigating cyberattacks against processor operability by a guest process
US11763004B1 (en) 2018-09-27 2023-09-19 Fireeye Security Holdings Us Llc System and method for bootkit detection
US12074887B1 (en) 2018-12-21 2024-08-27 Musarubra Us Llc System and method for selectively processing content after identification and removal of malicious content
US11368475B1 (en) 2018-12-21 2022-06-21 Fireeye Security Holdings Us Llc System and method for scanning remote services to locate stored objects with malware
US11258806B1 (en) 2019-06-24 2022-02-22 Mandiant, Inc. System and method for automatically associating cybersecurity intelligence to cyberthreat actors
US11556640B1 (en) 2019-06-27 2023-01-17 Mandiant, Inc. Systems and methods for automated cybersecurity analysis of extracted binary string sets
US11392700B1 (en) 2019-06-28 2022-07-19 Fireeye Security Holdings Us Llc System and method for supporting cross-platform data verification
US11196765B2 (en) 2019-09-13 2021-12-07 Palo Alto Networks, Inc. Simulating user interactions for malware analysis
US11886585B1 (en) 2019-09-27 2024-01-30 Musarubra Us Llc System and method for identifying and mitigating cyberattacks through malicious position-independent code execution
US11637862B1 (en) 2019-09-30 2023-04-25 Mandiant, Inc. System and method for surfacing cyber-security threats with a self-learning recommendation engine
CN111639336A (zh) * 2020-04-16 2020-09-08 中国科学院信息工程研究所 基于文件系统虚拟读写的勒索软件实时检测方法和防御方法
US11416614B2 (en) * 2020-07-01 2022-08-16 Dell Products L.P. Statistical detection of firmware-level compromises
CN112733143A (zh) * 2021-01-11 2021-04-30 安芯网盾(北京)科技有限公司 一种检测系统引导区异常的方法及装置

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1314638A (zh) * 2001-04-29 2001-09-26 北京瑞星科技股份有限公司 检测和清除已知及未知计算机病毒的方法、系统和介质
CN101154258A (zh) * 2007-08-14 2008-04-02 电子科技大学 恶意程序动态行为自动化分析系统与方法
CN102004876A (zh) * 2009-12-31 2011-04-06 郑州信大捷安信息技术有限公司 可容忍非信任组件的安全终端加固模型及加固方法
CN102339371A (zh) * 2011-09-14 2012-02-01 奇智软件（北京）有限公司 一种检测恶意程序的方法、装置及虚拟机

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7356736B2 (en) * 2001-09-25 2008-04-08 Norman Asa Simulated computer system for monitoring of software performance
US7418729B2 (en) * 2002-07-19 2008-08-26 Symantec Corporation Heuristic detection of malicious computer code by page tracking
CN100472547C (zh) * 2006-03-21 2009-03-25 联想(北京)有限公司 一种查杀rootkit的系统及方法
US7845009B2 (en) * 2006-05-16 2010-11-30 Intel Corporation Method and apparatus to detect kernel mode rootkit events through virtualization traps
JP2010049627A (ja) * 2008-08-25 2010-03-04 Hitachi Software Eng Co Ltd コンピュータウィルス検出システム
US8352522B1 (en) * 2010-09-01 2013-01-08 Trend Micro Incorporated Detection of file modifications performed by malicious codes
CN101976319B (zh) * 2010-11-22 2012-07-04 张平 基于行为特征的BIOS固件Rootkit检测方法
US9087199B2 (en) * 2011-03-31 2015-07-21 Mcafee, Inc. System and method for providing a secured operating system execution environment

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1314638A (zh) * 2001-04-29 2001-09-26 北京瑞星科技股份有限公司 检测和清除已知及未知计算机病毒的方法、系统和介质
CN101154258A (zh) * 2007-08-14 2008-04-02 电子科技大学 恶意程序动态行为自动化分析系统与方法
CN102004876A (zh) * 2009-12-31 2011-04-06 郑州信大捷安信息技术有限公司 可容忍非信任组件的安全终端加固模型及加固方法
CN102339371A (zh) * 2011-09-14 2012-02-01 奇智软件（北京）有限公司 一种检测恶意程序的方法、装置及虚拟机

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104462969A (zh) * 2014-12-16 2015-03-25 北京奇虎科技有限公司 查杀恶意应用程序的方法、装置和系统

Also Published As

Publication number Publication date
CN102339371A (zh) 2012-02-01
US10146938B2 (en) 2018-12-04
CN102339371B (zh) 2013-12-25
US20140351935A1 (en) 2014-11-27

Similar Documents

Publication Publication Date Title
CN102339371B (zh) 一种检测恶意程序的方法、装置及虚拟机
JP6842367B2 (ja) ファイル中の悪意のあるコードの検出システム及び方法
RU2589862C1 (ru) Способ обнаружения вредоносного кода в оперативной памяти
US9178900B1 (en) Detection of advanced persistent threat having evasion technology
Bojinov et al. Address space randomization for mobile devices
JP2018041438A5 (zh)
US9740864B2 (en) System and method for emulation of files using multiple images of the emulator state
US20100241815A1 (en) Hybrid Storage Device
US7539986B2 (en) Method for guest operating system integrity validation
US8918879B1 (en) Operating system bootstrap failure detection
CN103077350B (zh) 一种恶意代码的查杀方法和系统
CN102999725B (zh) 恶意代码处理方法和系统
RU2586576C1 (ru) Способ выполнения обращения к процедурам загрузочного драйвера
CN103617069B (zh) 恶意程序检测方法和虚拟机
CN103617391B (zh) 一种检测恶意程序的方法、装置及虚拟机
Kleissner Stoned bootkit
JP6920286B2 (ja) 例外処理
US8572742B1 (en) Detecting and repairing master boot record infections
US9342694B2 (en) Security method and apparatus
RU2592383C1 (ru) Способ формирования антивирусной записи при обнаружении вредоносного кода в оперативной памяти
US7917952B1 (en) Replace malicious driver at boot time
US9836602B2 (en) Method and system for offline scanning of computing devices
WO2025092223A1 (zh) 云固件生成方法和虚拟化平台启动方法、电子设备、介质
RU2596577C2 (ru) Способ создания обработчика системных вызовов
Goel et al. Boot Sector Virus: Causes, Implications & Detection

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 12831309

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 14344864

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 12831309

Country of ref document: EP

Kind code of ref document: A1