WO2018019010A1 - 动态行为分析方法、装置、系统及设备 - Google Patents

动态行为分析方法、装置、系统及设备 Download PDF

Info

Publication number
WO2018019010A1
WO2018019010A1 PCT/CN2017/085187 CN2017085187W WO2018019010A1 WO 2018019010 A1 WO2018019010 A1 WO 2018019010A1 CN 2017085187 W CN2017085187 W CN 2017085187W WO 2018019010 A1 WO2018019010 A1 WO 2018019010A1
Authority
WO
WIPO (PCT)
Prior art keywords
information
environment
sample
dynamic behavior
behavior analysis
Prior art date
Application number
PCT/CN2017/085187
Other languages
English (en)
French (fr)
Inventor
王静
马苏安
王继刚
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018019010A1 publication Critical patent/WO2018019010A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection

Definitions

  • the present application relates to, but is not limited to, the field of communications, and in particular, to a dynamic behavior analysis method, apparatus, system and device.
  • APT Advanced Persistent Threat
  • This kind of attack not only uses traditional viruses and Trojans as a means of attack, but also conducts a "pilot attack” in the social engineering way such as mail, and sends a file to the user to carefully construct the 0Day vulnerability. Once the user opens the relevant file, the vulnerability will be triggered, the attack code will be injected into the user system, and subsequent operations such as downloading other viruses and Trojans will be performed to facilitate long-term latent work.
  • Traditional firewalls, enterprise anti-virus software, etc. have very limited ability to detect and protect such malicious files or codes without signature signatures.
  • APT attack detection and defense technology has become a research hotspot of next-generation network security, including two technical difficulties: first, how to quickly detect attacks using unknown vulnerabilities, and second, how to accurately analyze the exploiting principles of attacks.
  • a series of studies have been carried out on how to quickly detect attacks using unknown vulnerabilities, and various methods have been proposed.
  • dynamic behavior analysis techniques based on files or samples are representative.
  • This technology is mainly for the malicious code implantation process in the APT attack process. It dynamically analyzes the dynamic behavior of suspicious sample files entering the protected system through a controllable environment such as sandbox and virtual machine, identifies malicious behavior and attack code, and blocks malicious code. Implantation to prevent subsequent disruptive behavior. This technology can detect and protect against attacks before they occur, thus protecting the protected system from various network attacks.
  • Figure 1 is a schematic diagram of the application of the dynamic behavior analysis technology in an actual scenario.
  • the traffic of the user network is exported to the sample collection device by means of bypass mirroring.
  • the sample collection device analyzes the data traffic of the incoming/outgoing network in real time, and analyzes Extracting suspicious sample files from network traffic into dynamic behavior analysis engine devices, using an independent and protected virtual analysis system to simulate the actual environment and User behavior manipulates suspicious sample files to identify exploits such as exploits, file releases, and system modifications.
  • the dynamic behavior analysis engine device receives the sample file submitted by the sample collection device, and then sends it to different virtual machines for execution according to the file format and version of the sample.
  • the engine device simulates the environment of the user device and provokes malicious behavior of the sample.
  • the engine device supports multi-sample concurrent analysis. Each sample runs in a separate controlled environment.
  • Figure 2 is a schematic diagram of a custom virtual system image example. As shown in Figure 2, it can be customized with different virtual system images according to different deployment environments. .
  • the suspicious sample files are classified into several customized virtual system images and the actual user PC (Personal Computer) environment still has certain Gap, inaccurate user environment can not fully stimulate the malicious behavior of the sample, and false negatives will cause security risks to the user network.
  • PC Personal Computer
  • Embodiments of the present invention provide a dynamic behavior analysis method, apparatus, system, and device to fully stimulate malicious behavior of a sample at the time of detection.
  • a dynamic behavior analysis method including: collecting a sample file and acquiring environment information corresponding to the sample file; configuring or selecting a matching mirror environment according to the environment information; Dynamic behavior analysis of the sample files in the environment.
  • collecting the sample file and acquiring the environment information corresponding to the sample file includes: collecting the sample file and the identifier information in the flow of the sample file; and querying the sample file according to the identifier information Corresponding environmental information.
  • the method before the obtaining the environment information corresponding to the sample file according to the identifier information, the method further includes: receiving environment information of the user equipment transmitted from the user equipment; and performing environment information of the user equipment save.
  • saving the environmental information of the user equipment includes: The environment information corresponding to the user device is saved in the same entry.
  • the obtaining the environment information corresponding to the sample file according to the identifier information comprises: querying the corresponding user equipment according to the identifier information; and using the environment information corresponding to the queried user equipment as the identifier information The query obtains the environment information corresponding to the sample file.
  • receiving the environment information of the user equipment that is transmitted from the user equipment includes: receiving the environment information that is sent by the user equipment when the user equipment first obtains the environment information; or receiving the user equipment to discover the environment information.
  • the method further includes: setting a timer for the saved environment information, and deleting the corresponding environment information after the timer expires.
  • the identifier information includes at least one of the following: an IP (Internet Protocol) address, a MAC (Media Access Control) address, and a mail address.
  • IP Internet Protocol
  • MAC Media Access Control
  • the environment information includes hardware information, software information, and user information
  • the hardware information includes at least one of: operating system information, memory information, and hard disk information of the device
  • the software information includes the following: At least one of: a list of installed software, a version corresponding to each installed software
  • the user information includes at least one of the following: an IP address, a MAC address, a username/ID (Identity), and an email address.
  • the method further includes: determining, according to the identifier information, a priority of analyzing the sample file; Performing dynamic behavior analysis on the sample file in the mirroring environment includes: performing dynamic behavior analysis on the sample file according to the priority.
  • performing dynamic behavior analysis on the sample file according to the priority includes at least one of: sorting the obtained sample files according to priorities, and performing dynamic behavior analysis on the sample files according to the sorting result; When performing dynamic behavior analysis, the higher the priority of the sample file analysis time.
  • configuring or selecting a matching mirroring environment according to the environment information includes: determining, according to the environment information, a software version and a system parameter for running the sample file in a user equipment; and searching according to the software version and system parameter a matching mirroring environment; when the matching mirroring environment is not retrieved, a corresponding mirroring environment is established; and when the matching mirroring environment is retrieved, the retrieved mirroring environment is selected.
  • performing dynamic behavior analysis on the sample file in the mirroring environment comprises: combining the same sample files in a case where the same sample file is sent to a different mirroring environment, Dynamic behavior analysis of the merged sample files is performed using a preset typical mirroring environment.
  • a dynamic behavior analysis apparatus includes: an acquisition module configured to acquire a sample file and obtain environment information corresponding to the sample file; and a matching module configured to be configured according to the environment information Or selecting a matching mirroring environment; the dynamic behavior analysis module is configured to perform dynamic behavior analysis on the sample file in the mirroring environment.
  • the obtaining module includes: an acquiring unit, configured to collect the sample file and obtain identification information in a traffic where the sample file is located; and the query unit is configured to query according to the identifier information to obtain the The environmental information corresponding to the sample file.
  • the apparatus further includes: a receiving module configured to receive environment information of the user equipment transmitted from the user equipment; and a saving module configured to save environment information of the user equipment.
  • the saving module is configured to save the environment information corresponding to the same user equipment into the same item.
  • the querying unit is configured to: query the corresponding user equipment according to the identifier information; and use the environment information corresponding to the queried user equipment as the environment information corresponding to the sample file according to the identifier information. .
  • the receiving module is configured to: receive the environment information that is sent by the user equipment when acquiring the environment information for the first time; or, when the user equipment finds that the environment information of the user equipment is changed, Environment information; or receiving the environmental information periodically sent by the user equipment.
  • the saving module is further configured to: respectively set a timer for the saved environment information, and delete the corresponding environment information after the timer expires.
  • the identification information includes at least one of the following: an IP address, a MAC address, and an email address.
  • the environment information includes hardware information, software information, and user information
  • the hardware information includes at least one of: operating system information, memory information, and hard disk information of the device
  • the software information includes the following: At least one of: a list of installed software, a version corresponding to each installed software
  • the user information includes at least one of the following: an IP address, a MAC address, a username/ID, and an email address.
  • the apparatus further includes: a determining module, configured to determine, according to the identifier information, a priority for analyzing the sample file; the dynamic behavior analysis module further configured to compare the sample according to the priority The file performs dynamic behavior analysis.
  • the dynamic behavior analysis module includes at least one of the following: a sorting unit configured to sort the acquired sample files according to the priority, and perform dynamic behavior analysis on the sample files according to the sorting result; Set to a longer analysis time for sample files with higher priority when performing dynamic behavior analysis.
  • the matching module includes: a determining unit configured to determine, according to the environment information, a software version and a system parameter of the sample file running in the user equipment; and a retrieval unit configured to be according to the software version and system The parameter retrieves the matching mirroring environment; the establishing unit is configured to establish a corresponding mirroring environment when the matching mirroring environment is not retrieved; and the selecting unit is configured to select the retrieved when the matching mirroring environment is retrieved The mirroring environment.
  • the dynamic behavior analysis module in the case of sending the same sample file to a different mirroring environment, is configured to merge the same sample files and use a preset typical image environment. Perform a dynamic behavioral analysis of the merged sample files.
  • another dynamic behavior analysis apparatus comprising: a sample management unit, configured to collect a sample file and identification information from a traffic, and send the identification information to an environmental information storage unit.
  • the environmental information storage unit is set to be based on The identifier information queries environment information corresponding to the sample file, and feeds the environment information to the sample management unit;
  • the sample management unit is further configured to send the sample file and the environment information to a dynamic behavior An analysis engine;
  • the dynamic behavior analysis engine is configured to select a corresponding mirroring environment according to the environment information, and initiate a dynamic behavior analysis process on the sample file in the mirroring environment.
  • a dynamic behavior analysis system including a user equipment and the dynamic behavior analysis apparatus, and the user equipment further includes: a sending module, configured to set environment information of the user equipment itself Sended to the dynamic behavior analysis device.
  • a dynamic behavior analysis apparatus comprising: a processor; a memory configured to store the processor executable instructions; and configured to perform information transmission and reception communication according to control of the processor The transmitting device; wherein the processor is configured to: control the transmitting device to collect a sample file and obtain environment information corresponding to the sample file; configure or select a matching mirroring environment according to the environment information; The dynamic behavior analysis of the sample file in the mirroring environment.
  • a storage medium is also provided.
  • the storage medium is configured to store program code for performing the following steps: collecting a sample file and acquiring environment information corresponding to the sample file; configuring or selecting a matching mirror environment according to the environment information;
  • the sample file is used for dynamic behavior analysis.
  • the environment information corresponding to the sample file is also acquired while collecting the sample file, so that the dynamic behavior analysis of the sample file can be performed according to the environment of the sample file, and the malicious behavior of the sample can be fully stimulated during the detection. It prevents the occurrence of under-reporting due to the difference between the detection environment and the actual environment, overcomes the security risks and improves the security of the user network.
  • FIG. 1 is a schematic diagram of an application of a dynamic behavior analysis technique in an actual scenario
  • FIG. 2 is a schematic diagram of an example of a customized virtual system image
  • FIG. 3 is a flow chart of a dynamic behavior analysis method according to an embodiment of the present invention.
  • FIG. 4 is a flow chart showing the principle of a dynamic behavior analysis method according to an embodiment of the present invention.
  • FIG. 5 is a schematic diagram showing an example of storing information by an environment information storage unit according to an embodiment of the present invention.
  • FIG. 6 is a schematic diagram of an operation example of a client-to-environment information storage unit content according to an embodiment of the present invention.
  • FIG. 7 is a schematic diagram showing an operation flow of sample file analysis according to an embodiment of the present invention.
  • FIG. 8 is a structural block diagram of a dynamic behavior analysis apparatus according to an embodiment of the present invention.
  • FIG. 9 is a structural block diagram of another dynamic behavior analysis apparatus according to an embodiment of the present invention.
  • FIG. 10 is a block diagram showing the hardware structure of a dynamic behavior analysis device according to an embodiment of the present invention.
  • FIG. 11 is a schematic diagram showing the logical function structure of a client software according to an embodiment of the present invention.
  • FIG. 12 is a schematic diagram showing the logical function structure of an environment information storage unit according to an embodiment of the present invention.
  • FIG. 13 is a schematic diagram showing the logical function structure of a sample management unit according to an embodiment of the present invention.
  • FIG. 14 is a schematic diagram showing the logical function structure of a dynamic behavior analysis engine according to an embodiment of the present invention.
  • 15 is a block diagram showing the structure of a dynamic behavior analysis system according to an embodiment of the present invention.
  • the device environment information of the sample belonging user can be automatically obtained, and the dynamic behavior analysis engine can load an accurate sample excitation environment in the virtual image environment, thereby improving the malicious sample. Detection rate.
  • FIG. 3 is a flowchart of a dynamic behavior analysis method according to an embodiment of the present invention. As shown in FIG. 3, the process includes the following steps:
  • Step S302 collecting a sample file and acquiring environment information corresponding to the sample file
  • Step S304 configuring or selecting a matching mirroring environment according to the environment information
  • Step S306 performing dynamic behavior analysis on the sample file in the mirroring environment.
  • the environmental information corresponding to the sample file is also acquired while collecting the sample file, so that the dynamic behavior analysis of the sample file can be performed according to the environment of the sample file, and the malicious behavior of the sample can be fully stimulated during the detection to prevent
  • the occurrence of under-reporting due to the difference between the detection environment and the actual environment overcomes the security risks and improves the security of the user network.
  • the execution body of the foregoing steps may be a server, or an independent dynamic behavior analysis device, etc., but is not limited thereto.
  • the identifier information may be at least one of the following: an IP address, a Media Access Control (MAC) address, and a mail address.
  • the above-mentioned environmental information may include hardware information, software information, and user information, where the hardware information may include, but is not limited to, at least one of the following: operating system information, memory information, and hard disk information of the device; It is not limited to at least one of the following: a list of installed software, a version corresponding to each installed software; the user information may include but is not limited to at least one of the following: an IP address, a MAC address, a username/ID, and an email address. .
  • step S302 environment information corresponding to the sample file may be obtained by:
  • the identifier information is used as the index information to query, and the environment information corresponding to the sample file is obtained.
  • the environment information of each user equipment may be uniformly saved to facilitate the query. Wherein, it can receive transmission from the user equipment
  • the environmental information of the user equipment is saved and the environmental information of the user equipment is saved.
  • the saved environment information may be divided according to the user equipment. For example, the environment information corresponding to the same user equipment may be saved in the same entry.
  • the user equipment it can determine the timing of sending its own environment information by at least one of the following ways:
  • the user equipment may send the environment information when the first time the user equipment obtains the environment information; or the user equipment may send the environment information when the environment information is changed, or the user equipment may also send the Environmental information.
  • the query process may be as follows: firstly, the corresponding user equipment is queried according to the identifier information, and then the environment information corresponding to the queried user equipment is used as the query corresponding to the sample file according to the identifier information.
  • Environmental information may be used as the query corresponding to the sample file according to the identifier information.
  • a timer (aging timer) may be set for each environment information item, and the timer is Delete the corresponding environment information after timeout.
  • performing dynamic behavior analysis on the sample file according to the priority may include, but is not limited to, at least one of the following:
  • the foregoing step S304 may be implemented as follows: determining, according to the environment information, a software version and a system parameter for running the sample file in the user equipment; and retrieving a matching mirroring environment according to the software version and the system parameter; When the matching mirroring environment is not retrieved, a corresponding mirroring environment is established; when the matching mirroring environment is retrieved, the retrieved mirroring environment is selected.
  • step S306 if there is a case where the same sample file is sent to a different mirroring environment, the same sample files may be merged and merged using a preset typical mirroring environment.
  • the sample files are analyzed for dynamic behavior.
  • a dynamic behavior analysis method may include the following: after collecting the sample file, the sample management unit provides a query index to the environment information storage unit to query the device environment information corresponding to the sample.
  • the sample management unit determines the analysis priority and analysis parameters (including device information, analysis duration, etc.) of the sample according to the returned result, and sends the sample file to the dynamic behavior analysis engine.
  • the dynamic behavior analysis engine selects or configures the image to perform the analysis process based on the analysis parameters.
  • the device environment information in the environment information storage unit is loaded by the client software, and the client software monitors the device environment and maintains corresponding storage entries.
  • FIG. 4 is a flow chart showing the principle of a dynamic behavior analysis method according to an embodiment of the present invention. As shown in FIG. 4, the method includes the following steps:
  • Step S402 The client device collects environment information of the device, including but not limited to hardware, software information, and user information, such as an operating system, a memory, a hard disk, a list of installed software, a corresponding software version, and an IP address. MAC address, username/ID, email address, etc.
  • step S404 the client software uploads the collected user equipment environment information to the environment information storage unit for storage, and the information collected by each user equipment is saved in an entry.
  • the sample management unit includes a sample file collection and an environment information query function corresponding to the sample file. While collecting the sample file, the identifier information in the traffic is extracted as the index information to query the entry in the environment information storage unit, and the environment information corresponding to the sample file is obtained, and the identifier information includes but is not limited to the IP address, the MAC address, the email address, and the like. It is selected according to the actual application environment, and is not limited in this embodiment.
  • Step S408 after completing the sample environment information query, the sample management unit determines the sample analysis priority and the analysis parameter, and sends the sample file together with the analysis parameter to the dynamic behavior analysis engine.
  • the analysis parameters include the device information (software and hardware) of the sample corresponding to the user equipment environment, and the sample analysis duration. Wait.
  • the analysis parameters are passed as interface parameters between the sample management unit and the dynamic behavior analysis engine.
  • step S410 the dynamic behavior analysis engine configures or selects a matching image according to the device information corresponding to the sample, and puts the sample into the corresponding image to run, fully exciting the behavior of the sample.
  • FIG. 5 is a schematic diagram of an example of storing information by an environment information storage unit according to an embodiment of the present invention.
  • the environment information storage unit may include the following information:
  • the environmental information storage unit saves the environmental information collected by each client by an entry, and each entry may include the following contents:
  • the environment information storage unit can also use this parameter as an index to retrieve the environmental information entry of the sample corresponding device.
  • the sample management unit can use this parameter information to determine the priority of the sample sent to the dynamic behavior analysis engine and determine the analysis time. For example, the key user sample files in the network are preferentially sent to the analysis engine and given a longer analysis time to ensure that such users have lower false positive rate and false negative rate.
  • the environment information storage unit may use this parameter as an index to retrieve an environmental information entry of the sample corresponding device.
  • the environment information storage unit may use this parameter as an index to retrieve an environmental information entry of the sample corresponding device.
  • Hardware and software information that can be a user device. Including but not limited to: CPU, memory, hard disk, software type, software version, etc.
  • FIG. 6 is a schematic diagram of an operation example of a client-to-environment information storage unit content according to an embodiment of the present invention. As shown in FIG. 6, the client's operation on the environment information storage unit content may include the following contents:
  • the environment information storage unit adds, updates, and deletes the stored information according to the message sent by the client.
  • the way is as follows:
  • Step S602 the client triggers the operation of sending the signaling when the device environment information is detected for the first time (for example, the device starts to join the network) or the device environment information is changed (for example, reallocating the IP address, hardware configuration, software addition, deletion, etc.). .
  • the client can also initiate signaling on the timer period to ensure the accuracy of the device environment information in the environment information storage unit.
  • the signaling message sent by the client may be in two manners. Step S604 is mode one, and steps S606 and S608 are mode two.
  • the client can determine, by itself, new, updated or deleted device environment information.
  • the client collects the device environment information, and sends a new message to the environment information storage unit.
  • the environment information storage unit queries the database according to the device MAC address in the information, and if not, the new file is created, otherwise, it is already Update information in the entry.
  • the verification measure here is to prevent the old storage entry of the device in the environmental information storage unit from causing subsequent query errors; when the device environment information changes, the client collects the latest device environment information and sends the information to the environment information storage unit.
  • the environment information storage unit queries the database according to the device MAC address in the information, and retrieves the information content in the related item update item; when the device is shut off the network, the client sends a delete message, and the environment information storage unit according to the device in the information
  • the MAC address queries the database and retrieves related entries for deletion.
  • the deletion message is a client optional operation message, and the environment information storage unit may set an aging timer for each entry. As described in step S610, the entry content is deleted after the aging timer expires.
  • step S606 the client uploads the device environment information to the environment information storage unit when the condition is met, and does not distinguish between newly created and updated messages.
  • Optional definition delete message the client uploads the device environment information to the environment information storage unit when the condition is met, and does not distinguish between newly created and updated messages.
  • Step S608 the environment information storage unit queries the database according to the device MAC address in the information, updates if there is such an entry, and creates an entry storage environment information if the entry does not exist.
  • the deletion message is a client optional operation message, and the environment information storage unit may set an aging timer for each entry. As described in step S610, the entry content is deleted after the aging timer expires.
  • Step S610 in order to avoid the situation in which the information in the environment information storage unit is outdated due to long time not being updated (for example, the client works abnormally), the environment information storage unit may set each entry.
  • the aging timer deletes the entry content after the aging timer expires.
  • the device environment that is not queried by the subsequent collected samples runs in the default virtual environment.
  • FIG. 7 is a schematic diagram of an operation flow of sample file analysis according to an embodiment of the present invention. As shown in FIG. 7, the operation flow steps of the sample file analysis may be as follows:
  • the sample management unit has the functions of traffic protocol parsing and file restoration.
  • the sample management unit needs to determine the query index for querying the environment information storage unit for the device environment corresponding to the sample. For example, for router bypass traffic, the sample management unit resolves the IP address therein to determine the destination host device to which the sample file is sent. For the traffic bypassed by the switch, the sample management unit resolves the MAC address therein to determine the destination host device to which the sample file is sent. For mail traffic that supports the Simple Mail Transfer Protocol (SMTP) protocol, the sample management unit resolves the recipient address to determine the destination of the sample file transmission.
  • SMTP Simple Mail Transfer Protocol
  • the query index information can be flexibly determined according to actual conditions, and is not limited in this embodiment.
  • Step S704 the sample management unit sends an inquiry message to the environment information storage unit, where the message carries the index information of the query, that is, the IP address, the MAC address, or the email address in the home traffic of the sample file.
  • Step S706 the environment information storage unit retrieves the storage item by using the index information, and finds the device information, the user information, and the user level in the entry.
  • Step S708 the environment information storage unit feeds back the query result to the sample management unit.
  • the sample management unit determines the analysis level of the file according to the user level in the feedback result.
  • Sample files for key users need to be scheduled in the sample analysis queue according to the strategy and need to determine sample analysis parameters. For example, the sample files of key users are sent to the dynamic behavior analysis engine first, and the analysis time is set longer to ensure lower errors. Reporting and false negative rate.
  • the actual application policy may be defined according to the actual situation, and is not limited in this embodiment.
  • Step S712 the sample management unit sends the sample, the device information corresponding to the sample, and the interface parameter determined by the sample to the dynamic behavior analysis engine.
  • the sample management unit optimizes the sample delivery process, and combines the same samples sent to different user device environments to indicate typical device environment information, achieving comprehensive analysis while avoiding large numbers of duplicates of the same sample. analysis. For example, if a pdf document is sent to multiple recipients by mail, the pdf version installed by these recipient devices may have various situations, then the sample management unit indicates the set of pdf versions in the device information, and the dynamic behavior analysis engine is This file is executed in various pdf versions of the image.
  • the dynamic behavior analysis engine configures or selects the corresponding image according to the device information corresponding to the sample, the sample analysis duration, and the like, and runs the sample in the mirror environment to record the sample behavior.
  • the dynamic behavior analysis engine determines the file type of the sample to be tested, and determines the software version and system parameters used to run the file in the user environment to which the sample belongs by using parameters such as device information and sample analysis duration.
  • the dynamic behavior analysis engine retrieves the image based on the above software version and system parameters. If there is a suitable image, the file analysis process is started in this image. Without the appropriate image, the above condition parameter configures a new image environment and starts the file analysis process therein.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the embodiment of the present invention may be embodied in the form of a software product stored in a storage medium (such as a ROM/RAM, a magnetic disk, an optical disk), and includes a plurality of instructions for making a A terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) performs the methods described in various embodiments of the present invention.
  • a dynamic behavior analysis device is provided, which is used to implement the above-mentioned embodiments and implementation manners, and has not been described again.
  • the term “module” may implement a combination of software and/or hardware of a predetermined function.
  • the devices described in the following embodiments may be implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 8 is a structural block diagram of a dynamic behavior analysis apparatus according to an embodiment of the present invention. As shown in FIG. 8, the apparatus includes:
  • the obtaining module 82 is configured to collect the sample file and obtain the environment information corresponding to the sample file.
  • the matching module 84 is connected to the obtaining module 82 and configured to be configured according to the environment information or A matching mirroring environment is selected; the dynamic behavior analysis module 86 is coupled to the matching module 84 and configured to perform dynamic behavior analysis on the sample files in the mirroring environment.
  • the obtaining module 82 may include: an obtaining unit, configured to acquire identifier information in the flow of the sample file and the sample file; and a query unit configured to query the identifier according to the identifier information The environmental information corresponding to the sample file.
  • the apparatus may further include: a receiving module, configured to receive environment information of the user equipment transmitted from the user equipment; and a saving module, connected to the obtaining module 82, configured to set the environment of the user equipment The information is saved.
  • the saving module may be configured to save environment information corresponding to the same user equipment into the same item.
  • the querying unit may be configured to: query the corresponding user equipment according to the identifier information; and use the environment information corresponding to the queried user equipment as the environment corresponding to the sample file according to the identifier information. information.
  • the receiving module may be configured to: receive the environment information that is sent by the user equipment when the first environment information is acquired by the user equipment; or, when the user equipment finds that the environment information of the user equipment is changed, The environmental information is received; or the environmental information periodically sent by the user equipment is received.
  • the saving module may be further configured to: respectively set a timer for the saved environment information, and delete the corresponding environment information after the timer expires.
  • the identification information may include at least one of the following: an IP address, a MAC address, and an email address.
  • the environment information may include hardware information, software information, and user information
  • the hardware information may include, but is not limited to, at least one of: operating system information of the device, memory information, and hard disk information
  • the software information may include, but is not limited to, at least one of the following: a list of installed software, a version corresponding to each installed software
  • the user information may include but is not limited to at least one of the following: an IP address, a MAC address, and a user. Name / ID, email address.
  • the apparatus may further include: a determining module, and the obtaining module 82 and The dynamic behavior analysis module 86 is connected to determine the priority of analyzing the sample file according to the identification information.
  • the dynamic behavior analysis module 86 may be configured to perform dynamic behavior analysis on the sample file according to the priority.
  • the dynamic behavior analysis module 86 may further include at least one of the following: a sorting unit configured to sort the acquired sample files according to the priority, and perform dynamic behavior analysis on the sample files according to the sorting result;
  • the timing unit is set to have a longer analysis time for the sample file with higher priority when performing dynamic behavior analysis.
  • the matching module 84 may include: a determining unit configured to determine, according to the environment information, a software version and a system parameter of the sample file running in the user equipment; and a retrieval unit configured to be according to the software version a mirroring environment matching the system parameter retrieval; establishing a unit, configured to establish a corresponding mirroring environment when the matching mirroring environment is not retrieved; and selecting a unit, configured to select a search when the matching mirroring environment is retrieved The mirroring environment to which it is.
  • the dynamic behavior analysis module 86 may also be configured to merge the same sample files and use a preset typical The mirroring environment performs dynamic behavior analysis on the merged sample files.
  • FIG. 9 is a structural block diagram of another dynamic behavior analysis apparatus according to an embodiment of the present invention.
  • the apparatus includes: a sample management unit. 92.
  • the method is configured to collect the sample file and the identifier information from the traffic, and send the identifier information to the environment information storage unit 94.
  • the environment information storage unit 94 is configured to query the sample file according to the identifier information.
  • the sample management unit 92 is further configured to send the sample file and the environmental information to the dynamic behavior analysis engine 96; the dynamic behavior analysis The engine 96 is configured to select a corresponding mirroring environment according to the environment information, and initiate a dynamic behavior analysis process on the sample file in the mirroring environment.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the above modules are in any combination.
  • the forms are located in different processors.
  • the dynamic behavior analysis device 100 may include one or more (only one shown in the figure) processor 102 (the processor 102 may include but not limited to micro a processing device such as a processor MCU or a programmable logic device FPGA; a memory 104 configured to store the processor-executable instructions; and a transmission device 106 configured to perform information transceiving communication in accordance with control of the processor 102.
  • the structure shown in FIG. 10 is merely illustrative and does not limit the structure of the above electronic device.
  • the dynamic behavior analysis device 100 may also include more or less components than those shown in FIG. 10, or have a different configuration than that shown in FIG.
  • the memory 104 can be configured as a software program and a module for storing application software, such as program instructions/modules corresponding to the dynamic behavior analysis method in the embodiment of the present invention, and the processor 102 executes by executing a software program and a module stored in the memory 104.
  • application software such as program instructions/modules corresponding to the dynamic behavior analysis method in the embodiment of the present invention
  • the processor 102 executes by executing a software program and a module stored in the memory 104.
  • Various functional applications and data processing, that is, the above methods are implemented.
  • Memory 104 may include high speed random access memory, and may also include non-volatile memory such as one or more magnetic storage devices, flash memory, or other non-volatile solid state memory.
  • memory 104 may further include memory remotely located relative to processor 102, which may be coupled to dynamic behavior analysis device 100 via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.
  • Transmission device 106 is arranged to receive or transmit data via a network.
  • the network instance described above may include a wireless network provided by a communication provider of the dynamic behavior analysis device 100.
  • the transmission device 106 includes a Network Interface Controller (NIC) that can be connected to other network devices through a base station to communicate with the Internet.
  • the transmission device 106 can be a Radio Frequency (RF) module configured to communicate with the Internet wirelessly.
  • NIC Network Interface Controller
  • RF Radio Frequency
  • processor 104 is configured to perform the following operations:
  • FIG. 11 is a schematic diagram showing the logical function structure of a client software according to an embodiment of the present invention. As shown in FIG. 11, the logical function of the client is as follows:
  • the device environment information collection module collects user equipment environment information. Including but not limited to hardware, software information, user information, such as the operating system of the device, memory, hard disk, installed software list and corresponding software version, IP address, MAC address, username/ID, email address, etc.
  • the module 1104 is configured to determine the environment status of the user equipment, and trigger the module 1106 to send the device environment information when the device environment information is detected for the first time or the device environment information is found to be changed.
  • the judging module further determines whether the periodic timer expires, and triggers the module 1106 to send the device environment information when the timer expires. After the determining module determines that the user equipment is off the network, the optional triggering module 1106 sends a device environment information deletion command.
  • the judging module may determine, according to the scenario, that the device environment information is newly created, updated, or deleted, and the triggering module 1106 sends the corresponding device information to be sent by the corresponding signaling message.
  • the judging module may also send the device environment information sent by the uploading command to the device 1106 after determining whether to create or update the user equipment environment state, and do not distinguish between newly created and updated messages.
  • Module 1106 The sending module sends the collected device environment information to the environment information storage unit. The corresponding message carrying device environment information is sent according to the indication of the module 1104.
  • FIG. 12 is a schematic diagram showing the logical function structure of an environment information storage unit according to an embodiment of the present invention. As shown in FIG. 12, the logical function of the environment information storage unit is as follows:
  • Module 1202 The receiving module receives device environment information and signaling sent by the client software.
  • the operation module queries the module 1206 according to the device MAC address in the device environment information. Update if there is a corresponding entry, or create it if it does not exist. If the client provides a delete command, the corresponding entry is deleted. The operation module may also set an aging timer for each storage module entry, and delete the corresponding entry in the module 1206 after the timer expires.
  • Module 1206 a storage module that stores the storage information defined in FIG.
  • the operation of the receiving module 1204 indicates a new, update, and delete operation on the stored information.
  • the query operation indication of the receiving module 1208 provides the storage information corresponding to the query index.
  • the module 1208 is configured to receive a query message of the sample management unit, and feed back the query result to the sample management unit according to the stored information of the query index query module 1206 in the message.
  • FIG. 13 is a schematic diagram showing the logical function structure of a sample management unit according to an embodiment of the present invention. As shown in FIG. 13, the logical function of the sample management unit is as follows:
  • Module 1302 Determine a module to determine a query index of the device corresponding device environment information.
  • the query index is derived from the identifier information in the traffic, including but not limited to the IP address, the MAC address, the email address, and the like, and is selected according to the actual application environment. For example, if the sample traffic source is a router, the IP address is used as the query index; if the sample traffic source is the switch, the MAC address is used as the query index; if the sample traffic is from the mail flow, the email address is used as the query index.
  • the module 1304 determines parameters such as the priority of the sample into the analysis queue and the length of the sample analysis according to the policy (configurable, not limited). The determination module sends the determined parameter information along with the sample information to module 1306.
  • the module 1304 is configured to send a query message to the environment information storage unit, carry a query index, and receive the returned device information and user information.
  • the module 1306, the sending module determines the sending order of the samples according to the queue priority parameter, and sends a message to the dynamic behavior analysis engine, where the message carries parameters such as a sample, a device information corresponding to the sample, and a sample analysis duration.
  • FIG. 14 is a schematic diagram showing the logical function structure of a dynamic behavior analysis engine according to an embodiment of the present invention. As shown in FIG. 14, the logic function of the dynamic behavior analysis engine is as follows:
  • the module 1402 is configured to receive a parameter to be inspected by the sample management unit, device information corresponding to the sample, and a sample analysis duration.
  • the module 1404 is configured to determine, according to the sample type, a software version set to run the file in the user environment to which the sample belongs, and determine system parameters, such as a memory size, a CPU frequency, and an operating system version, of the file to be run according to the device information.
  • the determination module retrieves the existing image according to the software version (such as office03, office07, pdf8, etc.) and system parameters, if there is a corresponding combination
  • the appropriate image is selected to perform the file analysis process; if there is no suitable image, the above condition parameters (including software version, system parameters) are sent to the configuration module.
  • Module 1406 A configuration module that configures a new mirroring environment for performing a file analysis process based on the condition parameters.
  • the configuration module is also configured to configure the detection time of the file for the image according to the sample analysis duration parameter.
  • the sending module sends the file to the image specified by the determining module or the new image generated by the configuration module.
  • FIG. 15 is a structural block diagram of a dynamic behavior analysis system according to an embodiment of the present invention.
  • the system includes a user equipment 152 and FIG. 8 or FIG.
  • the dynamic behavior analysis device 154 of 9 the structure may refer to FIG. 8 or FIG. 9, not shown in FIG. 15
  • the user equipment 152 further includes:
  • the sending module 1522 is configured to send the environment information of the user equipment itself to the dynamic behavior analyzing device 154.
  • Embodiments of the present invention also provide a storage medium.
  • the above storage medium may be configured to store program code for performing the following steps:
  • Step S302 collecting a sample file and acquiring environment information corresponding to the sample file
  • Step S304 configuring or selecting a matching mirroring environment according to the environment information
  • Step S306 performing dynamic behavior analysis on the sample file in the mirroring environment.
  • the foregoing storage medium may include, but not limited to, a U disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • mobile hard disk a magnetic disk
  • magnetic disk a magnetic disk
  • optical disk a variety of media that can store program code.
  • the modules or steps of the above embodiments of the present invention may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices, which may be implemented by computing devices.
  • the executed program code is implemented such that they can be stored in a storage device by a computing device, and in some cases, the steps shown or described can be performed in a different order than here, or they can be
  • Each of the integrated circuit modules is fabricated separately, or a plurality of modules or steps thereof are fabricated into a single integrated circuit module.
  • embodiments of the invention are not limited to any specific combination of hardware and software.
  • the environment information corresponding to the sample file is also acquired while collecting the sample file, so that the dynamic behavior analysis of the sample file can be performed according to the environment of the sample file, and the malicious behavior of the sample can be fully stimulated during the detection. It prevents the occurrence of under-reporting due to the difference between the detection environment and the actual environment, overcomes the security risks and improves the security of the user network.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Information Transfer Between Computers (AREA)
  • Automatic Analysis And Handling Materials Therefor (AREA)

Abstract

本文公布一种动态行为分析方法、装置、系统及设备，其中，该方法包括：采集样本文件并获取所述样本文件对应的环境信息；根据所述环境信息配置或者选择匹配的镜像环境；在所述镜像环境中对所述样本文件进行动态行为分析。

Description

动态行为分析方法、装置、系统及设备 技术领域
本申请涉及但不限于通信领域，尤指一种动态行为分析方法、装置、系统及设备。
背景技术
极光攻击、震网攻击、夜龙攻击、RSA令牌种子窃取等重大网络安全事件使得一种具有攻击手法高级、持续时间长、攻击目标明确等特征的攻击类型出现在公众视野中，国际上称之为APT(Advanced Persistent Threat,高级持续性威胁)攻击。这类攻击不仅使用传统的病毒、木马作为攻击手段，更以邮件等社会工程学方式进行“先导攻击”，向用户发送精心构造使用0Day漏洞的文件。一旦用户打开相关文件，漏洞就会被触发，攻击代码注入到用户系统，并进行后续下载其它病毒、木马等操作以利长期潜伏作业。而传统防火墙、企业反病毒软件等对此类无特征签名的恶意文件或代码的检测和防护能力非常有限。
APT攻击检测防御技术已成为新一代网络安全的研究热点，其中包括两项技术难点：一是如何快速检测利用未知漏洞的攻击，二是如何准确分析攻击的漏洞利用原理。对于如何快速检测利用未知漏洞的攻击，国内外对此展开了一系列研究，提出了多种方法，其中具有代表性的是基于文件或样本的动态行为分析技术。此种技术主要针对APT攻击过程中的恶意代码植入过程，通过沙箱、虚拟机等可控环境动态分析进入受保护系统的可疑样本文件的动态行为，识别恶意行为和攻击代码，阻止恶意代码植入，防止后续破坏行为的发生。此种技术能够在攻击发生前进行检测和防护，从而避免受保护系统受到各种网络攻击的影响。
图1是动态行为分析技术在实际场景的应用示意图，如图1所示，用户网络的流量通过旁路镜像方式导出到样本采集设备，样本采集设备实时分析进/出网络的数据流量，解析并提取网络流量中的可疑样本文件送入动态行为分析引擎设备中，利用独立且受保护的虚拟分析系统模拟实际环境和 用户行为操作可疑样本文件，识别可疑样本文件的漏洞利用、文件释放、系统修改等攻击行为。
动态行为分析引擎设备接收样本采集设备提交的样本文件，然后根据样本的文件格式和版本发送到不同的虚拟机进行执行。引擎设备模拟用户设备的环境，激发样本的恶意行为。引擎设备支持多样本并发分析，每个样本运行在独立的受控环境中，图2是定制虚拟系统镜像示例的示意图，如图2所示，可以根据不同的部署环境，搭配定制的虚拟系统镜像。由于用户设备环境(例如操作系统、硬件、安装的软件版本)千差万别，将可疑样本文件归类到若干个定制的虚拟系统镜像中与实际的用户PC(Personal Computer，个人计算机)环境还是有一定的差距，不精确的用户环境无法充分激发样本的恶意行为，漏报会造成用户网络的安全隐患。
发明概述
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本发明实施例提供了一种动态行为分析方法、装置、系统及设备，以充分激发在检测时将样本的恶意行为。
根据本发明的一个实施例，提供了一种动态行为分析方法，包括：采集样本文件并获取所述样本文件对应的环境信息；根据所述环境信息配置或者选择匹配的镜像环境；在所述镜像环境中对所述样本文件进行动态行为分析。
在一实施方式中，采集样本文件并获取所述样本文件对应的环境信息包括：采集所述样本文件和所述样本文件所在的流量中的标识信息；根据所述标识信息查询得到所述样本文件对应的环境信息。
在一实施方式中，在根据所述标识信息查询得到所述样本文件对应的环境信息之前，还包括：接收从用户设备传输的所述用户设备的环境信息；将所述用户设备的环境信息进行保存。
在一实施方式中，将所述用户设备的环境信息进行保存包括：将同一 用户设备对应的环境信息保存至同一条目中。
在一实施方式中，根据所述标识信息查询得到所述样本文件对应的环境信息包括：根据所述标识信息查询相应的用户设备；将查询到的用户设备对应的环境信息作为根据所述标识信息查询得到所述样本文件对应的环境信息。
在一实施方式中，接收从用户设备传输的所述用户设备的环境信息包括：接收用户设备在首次获取到自身环境信息时，发送的所述环境信息；或者，接收用户设备在发现自身环境信息发生改变时，发送的所述环境信息；或者，接收用户设备周期性发送的所述环境信息。
在一实施方式中，在将所述用户设备的环境信息进行保存之后，还包括：为保存的环境信息分别设置定时器，并在定时器超时后删除对应的环境信息。
在一实施方式中，所述标识信息包括以下至少之一：IP(Internet Protocol，网际协议)地址、MAC(Media Access Control，媒体接入控制)地址、邮件地址。
在一实施方式中，所述环境信息包括硬件信息，软件信息和用户信息，其中：所述硬件信息包括以下至少之一：设备的操作系统信息、内存信息、硬盘信息；所述软件信息包括以下至少之一：已安装的软件列表，已安装的每个软件对应的版本；所述用户信息包括以下至少之一：IP地址、MAC地址、用户名/ID(Identity，标识)、邮件地址。
在一实施方式中，在采集所述样本文件并获取所述样本文件所在的流量中的标识信息之后，还包括：根据所述标识信息确定分析所述样本文件的优先级；所述在所述镜像环境中对所述样本文件进行动态行为分析包括：根据所述优先级对所述样本文件进行动态行为分析。
在一实施方式中，根据所述优先级对所述样本文件进行动态行为分析包括以下至少之一：按照优先级对获取到的样本文件进行排序，并依照排序结果对样本文件进行动态行为分析；在进行动态行为分析时，优先级越高的样本文件分析时间越长。
在一实施方式中，根据所述环境信息配置或者选择匹配的镜像环境包括：根据所述环境信息确定用户设备中运行所述样本文件的软件版本和系统参数；根据所述软件版本和系统参数检索匹配的镜像环境；在未检索到所述匹配的镜像环境时，建立相应的镜像环境；在检索到所述匹配的镜像环境时，选择检索到的所述镜像环境。
在一实施方式中，在所述镜像环境中对所述样本文件进行动态行为分析包括：在将相同的样本文件发送至不同的镜像环境中的情况下，将所述相同的样本文件进行合并，并使用预设的典型镜像环境对合并的样本文件进行动态行为分析。
根据本发明的另一实施例，提供了一种动态行为分析装置，包括：获取模块，设置为采集样本文件并获取所述样本文件对应的环境信息；匹配模块，设置为根据所述环境信息配置或者选择匹配的镜像环境；动态行为分析模块，设置为在所述镜像环境中对所述样本文件进行动态行为分析。
在一实施方式中，所述获取模块包括：获取单元，设置为采集所述样本文件并获取所述样本文件所在的流量中的标识信息；查询单元，设置为根据所述标识信息查询得到所述样本文件对应的环境信息。
在一实施方式中，所述装置还包括：接收模块，设置为接收从用户设备传输的所述用户设备的环境信息；保存模块，设置为将所述用户设备的环境信息进行保存。
在一实施方式中，所述保存模块设置为：将同一用户设备对应的环境信息保存至同一条目中。
在一实施方式中，所述查询单元设置为：根据所述标识信息查询相应的用户设备；将查询到的用户设备对应的环境信息作为根据所述标识信息查询得到所述样本文件对应的环境信息。
在一实施方式中，所述接收模块设置为：接收用户设备在首次获取到自身环境信息时，发送的所述环境信息；或者，接收用户设备在发现自身环境信息发生改变时，发送的所述环境信息；或者，接收用户设备周期性发送的所述环境信息。
在一实施方式中，所述保存模块还设置为：为保存的环境信息分别设置定时器，并在定时器超时后删除对应的环境信息。
在一实施方式中，所述标识信息包括以下至少之一：IP地址、MAC地址、邮件地址。
在一实施方式中，所述环境信息包括硬件信息，软件信息和用户信息，其中：所述硬件信息包括以下至少之一：设备的操作系统信息、内存信息、硬盘信息；所述软件信息包括以下至少之一：已安装的软件列表，已安装的每个软件对应的版本；所述用户信息包括以下至少之一：IP地址、MAC地址、用户名/ID、邮件地址。
在一实施方式中，所述装置还包括：确定模块，设置为根据所述标识信息确定分析所述样本文件的优先级；所述动态行为分析模块还设置为根据所述优先级对所述样本文件进行动态行为分析。
在一实施方式中，所述动态行为分析模块包括以下至少之一：排序单元，设置为按照优先级对获取到的样本文件进行排序，并依照排序结果对样本文件进行动态行为分析；定时单元，设置为在进行动态行为分析时，控制优先级越高的样本文件分析时间越长。
在一实施方式中，所述匹配模块包括：确定单元，设置为根据所述环境信息确定用户设备中运行所述样本文件的软件版本和系统参数；检索单元，设置为根据所述软件版本和系统参数检索匹配的镜像环境；建立单元，设置为在未检索到所述匹配的镜像环境时，建立相应的镜像环境；选择单元，设置为在检索到所述匹配的镜像环境时，选择检索到的所述镜像环境。
在一实施方式中，在将相同的样本文件发送至不同的镜像环境中的情况下，所述动态行为分析模块设置为：将所述相同的样本文件进行合并，并使用预设的典型镜像环境对合并的样本文件进行动态行为分析。
根据本发明的另一实施例，还提供了另一种动态行为分析装置，包括：样本管理单元，设置为从流量中采集样本文件和标识信息，并将所述标识信息发送给环境信息存储单元；所述环境信息存储单元，设置为根据 所述标识信息查询所述样本文件对应的环境信息，并将所述环境信息反馈给所述样本管理单元；所述样本管理单元还设置为将所述样本文件和所述环境信息发送给动态行为分析引擎；所述动态行为分析引擎，设置为依据所述环境信息选择相应的镜像环境，并在所述镜像环境中启动对所述样本文件的动态行为分析过程。
根据本发明的再一实施例，提供了一种动态行为分析系统，包括用户设备和上述的动态行为分析装置，所述用户设备还包括：发送模块，设置为将所述用户设备自身的环境信息发送给所述动态行为分析装置。
根据本发明的再一实施例，还提供了一种动态行为分析设备，包括：处理器；设置为存储所述处理器可执行指令的存储器；设置为根据所述处理器的控制进行信息收发通信的传输装置；其中，所述处理器设置为执行以下操作：控制所述传输装置采集样本文件并获取所述样本文件对应的环境信息；根据所述环境信息配置或者选择匹配的镜像环境；在所述镜像环境中对所述样本文件进行动态行为分析。
根据本发明的又一个实施例，还提供了一种存储介质。该存储介质设置为存储用于执行以下步骤的程序代码：采集样本文件并获取所述样本文件对应的环境信息；根据所述环境信息配置或者选择匹配的镜像环境；在所述镜像环境中对所述样本文件进行动态行为分析。
通过本发明实施例，在采集样本文件的同时将样本文件对应的环境信息也进行了获取，从而能够按照样本文件的环境对样本文件进行动态行为分析，能够在检测时将样本的恶意行为充分激发，防止了由于检测环境与实际环境不同而导致的漏报情况的出现，克服了安全隐患，提升了用户网络的安全性。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1是动态行为分析技术在实际场景的应用示意图；
图2是定制虚拟系统镜像示例的示意图；
图3是根据本发明实施例的动态行为分析方法的流程图；
图4是根据本发明实施例的动态行为分析方法原理的流程图；
图5是根据本发明实施例中环境信息存储单元存储信息示例的示意图；
图6是根据本发明实施例中客户端对环境信息存储单元内容的操作示例的示意图；
图7是根据本发明实施例中样本文件分析的操作流程示意图；
图8是根据本发明实施例的动态行为分析装置的结构框图；
图9是根据本发明实施例的另一种动态行为分析装置的结构框图；
图10是根据本发明实施例的动态行为分析设备的硬件结构框图；
图11是根据本发明实施例中客户端软件的逻辑功能结构示意图；
图12是根据本发明实施例中环境信息存储单元的逻辑功能结构示意图；
图13是根据本发明实施例中样本管理单元的逻辑功能结构示意图；
图14是根据本发明实施例中动态行为分析引擎的逻辑功能结构示意图；
图15是根据本发明实施例的动态行为分析系统的结构框图。
详述
下文中将参考附图并结合实施例来详细说明本申请。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明实施例的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
方法实施例
本实施例可以自动获得样本归属用户的设备环境信息，动态行为分析引擎可以在虚拟镜像环境中加载准确的样本激发环境，从而提高恶意样本 的检出率。
在本实施例中提供了一种动态行为分析方法，图3是根据本发明实施例的动态行为分析方法的流程图，如图3所示，该流程包括如下步骤：
步骤S302，采集样本文件并获取所述样本文件对应的环境信息；
步骤S304，根据所述环境信息配置或者选择匹配的镜像环境；
步骤S306，在所述镜像环境中对所述样本文件进行动态行为分析。
通过上述步骤，在采集样本文件的同时将样本文件对应的环境信息也进行了获取，从而能够按照样本文件的环境对样本文件进行动态行为分析，能够在检测时将样本的恶意行为充分激发，防止了由于检测环境与实际环境不同而导致的漏报情况的出现，克服了安全隐患，提升了用户网络的安全性。
在一实施方式中，上述步骤的执行主体可以为服务器，或者独立的动态行为分析设备等，但不限于此。
在一实施方式中，上述标识信息可以是以下至少之一：IP地址、媒体接入控制(Media Access Control，简称为MAC)地址、邮件地址。而上述环境信息可以包括硬件信息，软件信息和用户信息，其中：所述硬件信息可以包括但不限于以下至少之一：设备的操作系统信息、内存信息、硬盘信息；所述软件信息可以包括但不限于以下至少之一：已安装的软件列表，已安装的每个软件对应的版本；所述用户信息可以包括但不限于以下至少之一：IP地址、MAC地址、用户名/ID、邮件地址。
作为一种实施方式，在步骤S302中，可以通过以下方式获取样本文件对应的环境信息：
在采集所述样本文件时，采集所述样本文件所在的流量中的标识信息；
将所述标识信息作为索引信息进行查询，进而得到所述样本文件对应的环境信息。
在一实施方式中，在上述步骤S302之前，可以先将每个用户设备的环境信息进行统一保存，以利于上述查询。其中，可以接收从用户设备传输 的该用户设备的环境信息，并将所述用户设备的环境信息进行保存。而在上述保存过程中，可以按照用户设备对保存的环境信息进行划分，例如可以将同一用户设备对应的环境信息保存至同一条目中。
而对于用户设备而言，其可以通过但不限于以下几种方式至少之一确定发送自身环境信息的时机：
用户设备在首次获取到自身环境信息时，可以发送所述环境信息；或者，用户设备在发现自身环境信息发生改变时，可以发送所述环境信息；或者，用户设备也可以按照一定周期发送所述环境信息。
在一实施方式中，上述查询过程可以如下：先根据所述标识信息查询到相应的用户设备，然后将查询到的用户设备对应的环境信息作为根据所述标识信息查询得到所述样本文件对应的环境信息。
在一实施方式中，为了避免存储的环境信息由于长时间未更新而过时的情况(比如客户端工作异常)，可以为每个环境信息条目设置定时器(老化定时器)，并在该定时器超时后删除对应的环境信息。
作为一种实施方式，还可以为每个样本文件设置优先级。其中，可以在采集所述样本文件并获取所述样本文件所在的流量中的标识信息之后，根据所述标识信息确定分析所述样本文件的优先级，然后根据所述优先级对所述样本文件进行动态行为分析。
在一实施方式中，根据所述优先级对所述样本文件进行动态行为分析可以包括但不限于以下至少之一：
按照优先级对获取到的样本文件进行排序，并依照排序结果对样本文件进行动态行为分析，即优先级高的优先进行动态行为分析；以及
在进行动态行为分析时，优先级越高的样本文件分析时间越长。
作为一种实施方式，上述步骤S304可以按照以下方式实现：根据所述环境信息确定用户设备中运行所述样本文件的软件版本和系统参数；根据所述软件版本和系统参数检索匹配的镜像环境；在未检索到所述匹配的镜像环境时，建立相应的镜像环境；在检索到所述匹配的镜像环境时，选择检索到的所述镜像环境。
作为一种实施方式，上述步骤S306中，如果存在将相同的样本文件发送至不同的镜像环境中的情况，则可以将所述相同的样本文件进行合并，并使用预设的典型镜像环境对合并的样本文件进行动态行为分析。
在以下实施例中，提供了一种动态行为分析方法，该方法可包括如下内容：样本管理单元采集到样本文件后，向环境信息存储单元提供查询索引查询所述样本对应的设备环境信息。样本管理单元依据返回结果确定样本的分析优先级及分析参数(包括设备信息、分析时长等)，连同样本文件发送到动态行为分析引擎。动态行为分析引擎依据分析参数为样本文件选择或者配置镜像执行分析过程。所述环境信息存储单元中的设备环境信息由客户端软件采集后载入，客户端软件监控设备环境，维护相应的存储条目。
下面结合附图对上述方法进行详细说明。
图4是根据本发明实施例的动态行为分析方法原理的流程图，如图4所示，该方法包括如下步骤：
步骤S402，用户设备上安装客户端软件采集设备环境信息，包括但不限于硬件、软件信息、用户信息，例如设备的操作系统、内存、硬盘、安装的软件列表及对应的软件版本、IP地址、MAC地址、用户名/ID、邮件地址等。
步骤S404，客户端软件将采集到的用户设备环境信息上载到环境信息存储单元进行保存，每个用户设备采集到的信息保存到一个条目中。
步骤S406，样本管理单元包括样本文件采集和样本文件对应的环境信息查询功能。在采集样本文件的同时，提取流量中的标识类信息作为索引信息查询环境信息存储单元中的条目，获得样本文件对应的环境信息，标识类信息包括但不限于IP地址、MAC地址、邮件地址等，依据实际应用环境选择使用，本实施例中不做限定。
步骤S408，样本管理单元在完成样本环境信息查询后，确定样本分析优先级及分析参数，将样本文件连同分析参数送入动态行为分析引擎。分析参数包括样本对应用户设备环境的设备信息(软、硬件)、样本分析时长 等。分析参数作为样本管理单元和动态行为分析引擎间的接口参数进行传递。
步骤S410，动态行为分析引擎依据样本对应的设备信息配置或者选择匹配的镜像，将样本投入到对应的镜像中运行，充分激发样本的行为。
图5是根据本发明实施例中环境信息存储单元存储信息示例的示意图，如图5所示，环境信息存储单元存储信息可以包括如下内容：
环境信息存储单元将每个客户端采集的环境信息按条目保存，每个条目可以包括如下内容：
1)用户信息
可为用户名、用户ID、用户邮件地址等。环境信息存储单元也可用此参数作为索引检索到样本对应设备的环境信息条目。
2)用户级别
样本管理单元可用此参数信息决定样本送入动态行为分析引擎的优先级及确定分析时间。例如对于网络中的重点用户样本文件优先送入分析引擎并给定较长的分析时间，确保此类用户误报率和漏报率都比较低。
3)IP地址
可为用户设备的IP地址。环境信息存储单元可用此参数作为索引检索到样本对应设备的环境信息条目。
4)MAC地址
可为用户设备的MAC地址。环境信息存储单元可用此参数作为索引检索到样本对应设备的环境信息条目。
5)设备信息
可为用户设备的硬件和软件信息。包括但不限于：CPU、内存、硬盘、软件类型、软件版本等。
图6是根据本发明实施例中客户端对环境信息存储单元内容的操作示例的示意图，如图6所示，客户端对环境信息存储单元内容的操作可以包括如下内容：
环境信息存储单元依据客户端发送的消息对存储的信息进行增加、更新和删除的操作。方式如下：
步骤S602，客户端在第一次检测到设备环境信息(例如设备启动加入网络)或者发现设备环境信息改变(例如重新分配IP地址、硬件配置、软件增删改等)时会触发上送信令的操作。客户端也可以启动定时器周期上送信令，确保环境信息存储单元中的设备环境信息的准确性。
客户端上送信令消息可以采用两种方式，步骤S604为方式一，步骤S606、S608为方式二。
步骤S602，客户端可以自行判定设备环境信息的新建、更新或者删除。其中，当设备初次启动时，客户端采集设备环境信息，向环境信息存储单元发送新建消息，环境信息存储单元根据信息中的设备MAC地址查询数据库，如果没此条目就新建，反之则在已有条目中更新信息。此处的校验措施是为了防止环境信息存储单元中有此设备旧的存储条目而导致后续查询错误；当设备环境信息发生改变时，客户端采集最新的设备环境信息，向环境信息存储单元发送更新消息，环境信息存储单元依据信息中的设备MAC地址查询数据库，检索到相关条目更新条目中的信息内容；当设备关机离网时，客户端发送删除消息，环境信息存储单元依据信息中的设备MAC地址查询数据库，检索到相关条目进行删除。删除消息为客户端可选操作消息，环境信息存储单元可以为每个条目设置老化定时器，如步骤S610所述，在老化定时器超时后删除条目内容。
步骤S606，客户端在满足步骤S602所述条件时就采集设备环境信息上载到环境信息存储单元中，不做新建、更新的消息区分。可选定义删除消息。
步骤S608，环境信息存储单元依据信息中的设备MAC地址查询数据库，如果存在此条目就更新，如果不存在此条目就新建条目存储环境信息。删除消息为客户端可选操作消息，环境信息存储单元可以为每个条目设置老化定时器，如步骤S610所述，在老化定时器超时后删除条目内容。
步骤S610，为了避免环境信息存储单元中信息由于长时间未更新而过时的情况(比如客户端工作异常)，环境信息存储单元可以为每个条目设置 老化定时器，在老化定时器超时后删除条目内容。后续采集到的样本查询不到的设备环境就在默认的虚拟环境中运行。
图7是根据本发明实施例中样本文件分析的操作流程示意图，如图7所示，样本文件分析的操作流程步骤可以如下：
步骤S702，样本管理单元具有流量协议解析和文件还原的功能。样本管理单元除了从流量中提取样本文件之外还需要确定查询索引用于向环境信息存储单元查询样本对应的设备环境。例如，对于路由器旁路的流量，样本管理单元解析其中的IP地址可以确定样本文件发送的目的主机设备。对于交换机旁路的流量，样本管理单元解析其中的MAC地址可以确定样本文件发送的目的主机设备。对于支持简单邮件传输协议(Simple Mail Transfer Protocol，简称为SMTP)协议的邮件流量，样本管理单元解析其中的收件人地址可以确定样本文件发送的目的地。查询索引信息可以根据实际情况灵活确定，本实施例中不做限定。
步骤S704，样本管理单元向环境信息存储单元发送查询消息，消息中携带查询的索引信息，也即样本文件归属流量中的IP地址、MAC地址或者邮件地址。
步骤S706，环境信息存储单元采用索引信息检索存储条目，找到条目中的设备信息、用户信息、用户级别。
步骤S708，环境信息存储单元向样本管理单元反馈查询结果。
步骤S710，样本管理单元依据反馈结果中的用户级别确定文件的分析等级。对于重点用户的样本文件需要依据策略在样本分析队列中进行调度并需要确定样本分析参数，例如重点用户的样本文件优先送入动态行为分析引擎，并设置较长的分析时间，确保较低的误报和漏报率。实际的应用策略可根据实际情况定义，本实施例中不做限定。
步骤S712，样本管理单元将样本、样本对应的设备信息以及为样本确定的分析时长等接口参数发送给动态行为分析引擎。样本管理单元可优化样本送检过程，对于发送到不同用户设备环境的相同样本做合并处理，指示典型的设备环境信息，达到全面分析的同时避免相同样本进行大量重复 分析。例如一个pdf文档被通过邮件发送到多个收件人，这些收件人设备安装的pdf版本可能有各种情况，那么样本管理单元就在设备信息中指示pdf版本的集合，动态行为分析引擎在各种pdf版本的镜像中执行该文件。
动态行为分析引擎依据样本对应的设备信息、样本分析时长等参数配置或者选择相应的镜像，镜像环境中运行样本，记录样本行为。其中，动态行为分析引擎确定待测样本的文件类型，并通过设备信息、样本分析时长等参数确定样本所属用户环境中用于运行该文件的软件版本和系统参数。动态行为分析引擎依据上述软件版本和系统参数检索镜像，有合适的镜像即在此镜像中启动文件分析过程，没有合适的镜像即上述条件参数配置新的镜像环境并在其中启动文件分析过程。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明实施例的技术方案可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例所述的方法。
装置实施例
在本实施例中提供了一种动态行为分析装置，该装置用于实现上述实施例及实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置可以以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图8是根据本发明实施例的动态行为分析装置的结构框图，如图8所示，该装置包括：
获取模块82，设置为采集样本文件并获取所述样本文件对应的环境信息；匹配模块84，与获取模块82相连，设置为根据所述环境信息配置或者 选择匹配的镜像环境；动态行为分析模块86，与匹配模块84相连，设置为在所述镜像环境中对所述样本文件进行动态行为分析。
在一实施方式中，所述获取模块82可以包括：获取单元，设置为获取所述样本文件和所述样本文件所在的流量中的标识信息；查询单元，设置为根据所述标识信息查询得到所述样本文件对应的环境信息。
在一实施方式中，所述装置还可以包括：接收模块，设置为接收从用户设备传输的所述用户设备的环境信息；保存模块，与获取模块82相连，设置为将所述用户设备的环境信息进行保存。
在一实施方式中，所述保存模块可以设置为将同一用户设备对应的环境信息保存至同一条目中。
在一实施方式中，所述查询单元可以设置为：根据所述标识信息查询相应的用户设备；将查询到的用户设备对应的环境信息作为根据所述标识信息查询得到所述样本文件对应的环境信息。
在一实施方式中，所述接收模块可以设置为：接收用户设备在首次获取到自身环境信息时，发送的所述环境信息；或者，接收用户设备在发现自身环境信息发生改变时，发送的所述环境信息；或者，接收用户设备周期性发送的所述环境信息。
在一实施方式中，所述保存模块还可以设置为：为保存的环境信息分别设置定时器，并在定时器超时后删除对应的环境信息。
在一实施方式中，所述标识信息可以包括以下至少之一：IP地址、MAC地址、邮件地址。
在一实施方式中，所述环境信息可以包括硬件信息，软件信息和用户信息，其中：所述硬件信息可以包括但不限于以下至少之一：设备的操作系统信息、内存信息、硬盘信息；所述软件信息可以包括但不限于以下至少之一：已安装的软件列表，已安装的每个软件对应的版本；所述用户信息可以包括但不限于以下至少之一：IP地址、MAC地址、用户名/ID、邮件地址。
在一实施方式中，所述装置还可以包括：确定模块，与获取模块82和 动态行为分析模块86相连，设置为根据所述标识信息确定分析所述样本文件的优先级；所述动态行为分析模块86可以设置为根据所述优先级对所述样本文件进行动态行为分析。
在一实施方式中，所述动态行为分析模块86还可以包括以下至少之一：排序单元，设置为按照优先级对获取到的样本文件进行排序，并依照排序结果对样本文件进行动态行为分析；定时单元，设置为在进行动态行为分析时，控制优先级越高的样本文件分析时间越长。
在一实施方式中，所述匹配模块84可以包括：确定单元，设置为根据所述环境信息确定用户设备中运行所述样本文件的软件版本和系统参数；检索单元，设置为根据所述软件版本和系统参数检索匹配的镜像环境；建立单元，设置为在未检索到所述匹配的镜像环境时，建立相应的镜像环境；选择单元，设置为在检索到所述匹配的镜像环境时，选择检索到的所述镜像环境。
在一实施方式中，在将相同的样本文件发送至不同的镜像环境中的情况下，所述动态行为分析模块86还可以设置为将所述相同的样本文件进行合并，并使用预设的典型镜像环境对合并的样本文件进行动态行为分析。
在本实施例中，还提供了另一种动态行为分析装置，图9是根据本发明实施例的另一种动态行为分析装置的结构框图，如图9所示，该装置包括：样本管理单元92，设置为从流量中采集样本文件和标识信息，并将所述标识信息发送给环境信息存储单元94；所述环境信息存储单元94，设置为根据所述标识信息查询所述样本文件对应的环境信息，并将所述环境信息反馈给所述样本管理单元92；所述样本管理单元92还设置为将所述样本文件和所述环境信息发送给动态行为分析引擎96；所述动态行为分析引擎96，设置为依据所述环境信息选择相应的镜像环境，并在所述镜像环境中启动对所述样本文件的动态行为分析过程。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述各个模块以任意组合的形式分别位于不同的处理器中。
在本实施例中，还提供了一种动态行为分析设备，图10是根据本发明 实施例的动态行为分析设备的硬件结构框图，如图10所示，动态行为分析设备100可以包括一个或多个(图中仅示出一个)处理器102(处理器102可以包括但不限于微处理器MCU或可编程逻辑器件FPGA等的处理装置)；设置为存储所述处理器可执行指令的存储器104；以及设置为根据所述处理器102的控制进行信息收发通信的传输装置106。本领域普通技术人员可以理解，图10所示的结构仅为示意，其并不对上述电子装置的结构造成限定。例如，动态行为分析设备100还可包括比图10中所示更多或者更少的组件，或者具有与图10所示不同的配置。
存储器104可设置为存储应用软件的软件程序以及模块，如本发明实施例中的动态行为分析方法对应的程序指令/模块，处理器102通过运行存储在存储器104内的软件程序以及模块，从而执行各种功能应用以及数据处理，即实现上述的方法。存储器104可包括高速随机存储器，还可包括非易失性存储器，如一个或者多个磁性存储装置、闪存、或者其他非易失性固态存储器。在一些实例中，存储器104可进一步包括相对于处理器102远程设置的存储器，这些远程存储器可以通过网络连接至动态行为分析设备100。上述网络的实例包括但不限于互联网、企业内部网、局域网、移动通信网及其组合。
传输装置106设置为经由一个网络接收或者发送数据。上述的网络实例可包括动态行为分析设备100的通信供应商提供的无线网络。在一个实例中，传输装置106包括一个网络适配器(Network Interface Controller，NIC)，其可通过基站与其他网络设备相连从而可与互联网进行通讯。在一个实例中，传输装置106可以为射频(Radio Frequency，RF)模块，其设置为通过无线方式与互联网进行通讯。
其中，所述处理器104设置为执行以下操作：
控制所述传输装置106采集样本文件并获取所述样本文件对应的环境信息；
根据所述环境信息配置或者选择匹配的镜像环境；
在所述镜像环境中对所述样本文件进行动态行为分析。
下面结合方法实施例中的实施例进行说明，下面参考附图对方法实施例中的实施例所给出的功能模块进行更详细的说明。图11是根据本发明实施例中客户端软件的逻辑功能结构示意图，如图11所示，客户端的逻辑功能说明如下：
模块1102：设备环境信息采集模块，采集用户设备环境信息。包括但不限于硬件、软件信息、用户信息，例如设备的操作系统、内存、硬盘、安装的软件列表及对应的软件版本、IP地址、MAC地址、用户名/ID、邮件地址等。
模块1104：判断模块，判定用户设备环境状态，在第一次检测到设备环境信息或者发现设备环境信息改变时触发模块1106上送设备环境信息。判断模块还判定周期定时器是否超时，在定时器超时情况下触发模块1106上送设备环境信息。判断模块判定用户设备离网后，可选触发模块1106发送设备环境信息删除命令。
判断模块可以依据上述场景判定设备环境信息的新建、更新或者删除，触发模块1106发出对应的信令消息承载上送的设备环境信息。
判断模块也可以在判定上述新建或者更新用户设备环境状态后触发模块1106发出上送命令承载上送的设备环境信息，不做新建、更新的消息区分。
模块1106：发送模块，将采集到的设备环境信息发送到环境信息存储单元。根据模块1104的指示发送相应的消息承载设备环境信息。
图12是根据本发明实施例中环境信息存储单元的逻辑功能结构示意图，如图12所示，环境信息存储单元的逻辑功能说明如下：
模块1202：接收模块，接收客户端软件发送的设备环境信息及信令。
模块1204：操作模块，依据设备环境信息中的设备MAC地址查询模块1206。如果存在对应的条目就更新，如果不存在此条目就新建。如果客户端提供删除命令，那么就删除对应的条目。操作模块也可以为每个存储模块的条目设置老化定时器，在定时器超时后删除模块1206中对应的条目。
模块1206：存储模块，存储图5定义的存储信息。接收模块1204的操作指示对存储信息进行新建、更新和删除操作。接收模块1208的查询操作指示，提供查询索引对应的存储信息。
模块1208：查询模块，接收样本管理单元的查询消息，依据消息中的查询索引查询模块1206的存储信息，向样本管理单元反馈查询结果。
图13是根据本发明实施例中样本管理单元的逻辑功能结构示意图，如图13所示，样本管理单元的逻辑功能说明如下：
模块1302：确定模块，确定样本对应设备环境信息的查询索引。查询索引来源于流量中的标识类信息，包括但不限于IP地址、MAC地址、邮件地址等，依据实际应用环境选择使用，本申请不做限定。例如，如果样本流量来源是路由器，采用IP地址作为查询索引；如果样本流量来源是交换机，采用MAC地址作为查询索引；如果样本流量来源于邮件流量，采用邮件地址作为查询索引。模块1304返回用户信息和用户等级后，依据策略(可配置，不做限定)确定样本送入分析队列的优先级及样本分析时长等参数。确定模块将确定后的参数信息连同样本信息发送到模块1306。
模块1304，查询模块，向环境信息存储单元发送查询消息，携带查询索引，并接收返回的设备信息及用户信息。
模块1306，发送模块，依据队列优先级参数确定样本的发送顺序，向动态行为分析引擎发送消息，消息中携带样本、样本对应的设备信息及样本分析时长等参数。
图14是根据本发明实施例中动态行为分析引擎的逻辑功能结构示意图，如图14所示，动态行为分析引擎的逻辑功能说明如下：
模块1402：接收模块，接收样本管理单元发送的待检样本、样本对应的设备信息及样本分析时长等参数。
模块1404：确定模块，依据样本类型确定样本所属用户环境中设置为运行该文件的软件版本，依据设备信息确定运行该文件的系统参数，如内存大小、CPU主频、操作系统版本等。确定模块依据软件版本(如office03、office07、pdf8等等)和系统参数检索已存在的镜像，如有对应合 适的镜像即选择此镜像用于执行文件分析过程；如果没有合适的镜像，将上述条件参数(包括软件版本、系统参数)发送给配置模块。
模块1406：配置模块，根据条件参数配置新的镜像环境用于执行文件分析过程。配置模块还设置为根据样本分析时长参数配置镜像对文件的检测时间。
模块1408：发送模块，将文件送入确定模块指定的镜像或者配置模块生成的新的镜像。
系统实施例
在本实施例中，提供了一种动态行为分析系统，图15是根据本发明实施例的动态行为分析系统的结构框图，如图15所示，该系统包括用户设备152和如图8或图9中的动态行为分析装置154(结构可以参考图8或图9，图15中未示出)，所述用户设备152还包括：
发送模块1522，设置为将所述用户设备自身的环境信息发送给所述动态行为分析装置154。
存储介质实施例
本发明的实施例还提供了一种存储介质。在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
步骤S302，采集样本文件并获取所述样本文件对应的环境信息；
步骤S304，根据所述环境信息配置或者选择匹配的镜像环境；
步骤S306，在所述镜像环境中对所述样本文件进行动态行为分析。
在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
本实施例中的示例可以参考上述实施例及实施方式中所描述的示例，本实施例在此不再赘述。
上述的本发明实施例的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明实施例不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的实施例而已，并不用于限制本申请，对于本领域的技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。
工业实用性
通过本发明实施例，在采集样本文件的同时将样本文件对应的环境信息也进行了获取，从而能够按照样本文件的环境对样本文件进行动态行为分析，能够在检测时将样本的恶意行为充分激发，防止了由于检测环境与实际环境不同而导致的漏报情况的出现，克服了安全隐患，提升了用户网络的安全性。

Claims (29)

  1. 一种动态行为分析方法，包括：
    采集样本文件并获取所述样本文件对应的环境信息；
    根据所述环境信息配置或者选择匹配的镜像环境；
    在所述镜像环境中对所述样本文件进行动态行为分析。
  2. 根据权利要求1所述的方法，其中，采集样本文件并获取所述样本文件对应的环境信息包括：
    采集所述样本文件和所述样本文件所在的流量中的标识信息；
    根据所述标识信息查询得到所述样本文件对应的环境信息。
  3. 根据权利要求2所述的方法，其中，在根据所述标识信息查询得到所述样本文件对应的环境信息之前，还包括：
    接收从用户设备传输的所述用户设备的环境信息；
    将所述用户设备的环境信息进行保存。
  4. 根据权利要求3所述的方法，其中，将所述用户设备的环境信息进行保存包括：
    将同一用户设备对应的环境信息保存至同一条目中。
  5. 根据权利要求3所述的方法，其中，根据所述标识信息查询得到所述样本文件对应的环境信息包括：
    根据所述标识信息查询相应的用户设备；
    将查询到的用户设备对应的环境信息作为根据所述标识信息查询得到所述样本文件对应的环境信息。
  6. 根据权利要求3所述的方法，其中，接收从用户设备传输的所述用户设备的环境信息包括：
    接收用户设备在首次获取到自身环境信息时，发送的所述环境信息；或者，
    接收用户设备在发现自身环境信息发生改变时，发送的所述环境信息； 或者，
    接收用户设备周期性发送的所述环境信息。
  7. 根据权利要求3所述的方法，其中，在将所述用户设备的环境信息进行保存之后，还包括：
    为保存的环境信息分别设置定时器，并在定时器超时后删除对应的环境信息。
  8. 根据权利要求2所述的方法，其中，所述标识信息包括以下至少之一：
    网际协议IP地址、媒体接入控制MAC地址、邮件地址。
  9. 根据权利要求1至8中任一项所述的方法，其中，所述环境信息包括硬件信息，软件信息和用户信息，其中：
    所述硬件信息包括以下至少之一：设备的操作系统信息、内存信息、硬盘信息；
    所述软件信息包括以下至少之一：已安装的软件列表，已安装的每个软件对应的版本；
    所述用户信息包括以下至少之一：IP地址、MAC地址、用户名/标识ID、邮件地址。
  10. 根据权利要求2至8中任一项所述的方法，其中，在采集所述样本文件并获取所述样本文件所在的流量中的标识信息之后，还包括：
    根据所述标识信息确定分析所述样本文件的优先级；
    所述在所述镜像环境中对所述样本文件进行动态行为分析包括：根据所述优先级对所述样本文件进行动态行为分析。
  11. 根据权利要求10所述的方法，其中，根据所述优先级对所述样本文件进行动态行为分析包括以下至少之一：
    按照优先级对获取到的样本文件进行排序，并依照排序结果对样本文件进行动态行为分析；
    在进行动态行为分析时，优先级越高的样本文件分析时间越长。
  12. 根据权利要求1至8中任一项所述的方法，其中，根据所述环境信 息配置或者选择匹配的镜像环境包括：
    根据所述环境信息确定用户设备中运行所述样本文件的软件版本和系统参数；
    根据所述软件版本和系统参数检索匹配的镜像环境；
    在未检索到所述匹配的镜像环境时，建立相应的镜像环境；
    在检索到所述匹配的镜像环境时，选择检索到的所述镜像环境。
  13. 根据权利要求1至8中任一项所述的方法，其中，在所述镜像环境中对所述样本文件进行动态行为分析包括：
    在将相同的样本文件发送至不同的镜像环境中的情况下，将所述相同的样本文件进行合并，并使用预设的典型镜像环境对合并的样本文件进行动态行为分析。
  14. 一种动态行为分析装置，包括：
    获取模块，设置为采集样本文件并获取所述样本文件对应的环境信息；
    匹配模块，设置为根据所述环境信息配置或者选择匹配的镜像环境；
    动态行为分析模块，设置为在所述镜像环境中对所述样本文件进行动态行为分析。
  15. 根据权利要求14所述的装置，其中，所述获取模块包括：
    获取单元，设置为采集所述样本文件并获取所述样本文件所在的流量中的标识信息；
    查询单元，设置为根据所述标识信息查询得到所述样本文件对应的环境信息。
  16. 根据权利要求15所述的装置，其中，所述装置还包括：
    接收模块，设置为接收从用户设备传输的所述用户设备的环境信息；
    保存模块，设置为将所述用户设备的环境信息进行保存。
  17. 根据权利要求16所述的装置，其中，所述保存模块设置为：
    将同一用户设备对应的环境信息保存至同一条目中。
  18. 根据权利要求16所述的装置，其中，所述查询单元设置为：
    根据所述标识信息查询相应的用户设备；
    将查询到的用户设备对应的环境信息作为根据所述标识信息查询得到所述样本文件对应的环境信息。
  19. 根据权利要求16所述的装置，其中，所述接收模块设置为：
    接收用户设备在首次获取到自身环境信息时，发送的所述环境信息；或者，
    接收用户设备在发现自身环境信息发生改变时，发送的所述环境信息；或者，
    接收用户设备周期性发送的所述环境信息。
  20. 根据权利要求16所述的装置，其中，所述保存模块还设置为：
    为保存的环境信息分别设置定时器，并在定时器超时后删除对应的环境信息。
  21. 根据权利要求15所述的装置，其中，所述标识信息包括以下至少之一：
    IP地址、MAC地址、邮件地址。
  22. 根据权利要求14至21中任一项所述的装置，其中，所述环境信息包括硬件信息，软件信息和用户信息，其中：
    所述硬件信息包括以下至少之一：设备的操作系统信息、内存信息、硬盘信息；
    所述软件信息包括以下至少之一：已安装的软件列表，已安装的每个软件对应的版本；
    所述用户信息包括以下至少之一：网际协议IP地址、媒体接入控制MAC地址、用户名/标识ID、邮件地址。
  23. 根据权利要求15至21中任一项所述的装置，其中，所述装置还包括：
    确定模块，设置为根据所述标识信息确定分析所述样本文件的优先级；
    所述动态行为分析模块设置为根据所述优先级对所述样本文件进行动态行为分析。
  24. 根据权利要求23所述的装置，其中，所述动态行为分析模块包括以下至少之一：
    排序单元，设置为按照优先级对获取到的样本文件进行排序，并依照排序结果对样本文件进行动态行为分析；
    定时单元，设置为在进行动态行为分析时，控制优先级越高的样本文件分析时间越长。
  25. 根据权利要求14至21中任一项所述的装置，其中，所述匹配模块包括：
    确定单元，设置为根据所述环境信息确定用户设备中运行所述样本文件的软件版本和系统参数；
    检索单元，设置为根据所述软件版本和系统参数检索匹配的镜像环境；
    建立单元，设置为在未检索到所述匹配的镜像环境时，建立相应的镜像环境；
    选择单元，设置为在检索到所述匹配的镜像环境时，选择检索到的所述镜像环境。
  26. 根据权利要求14至21中任一项所述的装置，其中，在将相同的样本文件发送至不同的镜像环境中的情况下，所述动态行为分析模块设置为：
    将所述相同的样本文件进行合并，并使用预设的典型镜像环境对合并的样本文件进行动态行为分析。
  27. 一种动态行为分析装置，包括：
    样本管理单元，设置为从流量中采集样本文件和标识信息，并将所述标识信息发送给环境信息存储单元；
    所述环境信息存储单元，设置为根据所述标识信息查询所述样本文件对应的环境信息，并将所述环境信息反馈给所述样本管理单元；
    所述样本管理单元还设置为将所述样本文件和所述环境信息发送给动 态行为分析引擎；
    所述动态行为分析引擎，设置为依据所述环境信息选择相应的镜像环境，并在所述镜像环境中启动对所述样本文件的动态行为分析过程。
  28. 一种动态行为分析系统，包括用户设备和如权利要求14至27中任一项所述的动态行为分析装置，所述用户设备还包括：
    发送模块，设置为将所述用户设备自身的环境信息发送给所述动态行为分析装置。
  29. 一种动态行为分析设备，包括：
    处理器；
    设置为存储所述处理器可执行指令的存储器；
    设置为根据所述处理器的控制进行信息收发通信的传输装置；
    其中，所述处理器设置为执行以下操作：
    控制所述传输装置采集样本文件并获取所述样本文件对应的环境信息；
    根据所述环境信息配置或者选择匹配的镜像环境；
    在所述镜像环境中对所述样本文件进行动态行为分析。
PCT/CN2017/085187 2016-07-25 2017-05-19 动态行为分析方法、装置、系统及设备 WO2018019010A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610596328.3 2016-07-25
CN201610596328.3A CN107659540B (zh) 2016-07-25 2016-07-25 动态行为分析方法、装置、系统及设备

Publications (1)

Publication Number Publication Date
WO2018019010A1 true WO2018019010A1 (zh) 2018-02-01

Family

ID=61016316

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/085187 WO2018019010A1 (zh) 2016-07-25 2017-05-19 动态行为分析方法、装置、系统及设备

Country Status (2)

Country Link
CN (1) CN107659540B (zh)
WO (1) WO2018019010A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
TWI682644B (zh) * 2019-01-07 2020-01-11 中華電信股份有限公司 網路節點的移動防護方法及網路防護伺服器

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113127869B (zh) * 2019-12-31 2024-02-13 奇安信科技集团股份有限公司 鉴定环境追踪方法及系统
CN113392400A (zh) * 2020-03-12 2021-09-14 北京沃东天骏信息技术有限公司 运行环境的检测方法、装置和系统
CN117093994A (zh) * 2023-09-18 2023-11-21 卫士通(广州)信息安全技术有限公司 一种疑似病毒文件分析方法、系统、设备及可存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1697404A (zh) * 2005-06-10 2005-11-16 广东省电信有限公司研究院 一种交互式的网络蠕虫检测系统和方法
CN101834760A (zh) * 2010-05-20 2010-09-15 杭州华三通信技术有限公司 一种基于ips设备的攻击检测方法及ips设备
CN103778373A (zh) * 2014-01-10 2014-05-07 深圳市深信服电子科技有限公司 病毒检测方法及装置
CN104410617A (zh) * 2014-11-21 2015-03-11 西安邮电大学 一种云平台的信息安全攻防体系架构
CN105187224A (zh) * 2014-06-17 2015-12-23 腾讯科技（深圳）有限公司 入侵检测方法和装置

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101645119B (zh) * 2008-08-07 2012-05-23 中国科学院软件研究所 一种基于虚拟硬件环境的恶意代码自动分析方法及系统
US8479286B2 (en) * 2009-12-15 2013-07-02 Mcafee, Inc. Systems and methods for behavioral sandboxing
US8806646B1 (en) * 2011-04-27 2014-08-12 Twitter, Inc. Detecting malware in mobile sites
US9185128B2 (en) * 2013-08-30 2015-11-10 Bank Of America Corporation Malware analysis methods and systems
CN105260662A (zh) * 2014-07-17 2016-01-20 南京曼安信息科技有限公司 一种未知应用漏洞威胁检测装置及方法
CN105187395B (zh) * 2015-08-10 2018-10-23 济南大学 基于接入路由器进行恶意软件网络行为检测的方法及系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1697404A (zh) * 2005-06-10 2005-11-16 广东省电信有限公司研究院 一种交互式的网络蠕虫检测系统和方法
CN101834760A (zh) * 2010-05-20 2010-09-15 杭州华三通信技术有限公司 一种基于ips设备的攻击检测方法及ips设备
CN103778373A (zh) * 2014-01-10 2014-05-07 深圳市深信服电子科技有限公司 病毒检测方法及装置
CN105187224A (zh) * 2014-06-17 2015-12-23 腾讯科技（深圳）有限公司 入侵检测方法和装置
CN104410617A (zh) * 2014-11-21 2015-03-11 西安邮电大学 一种云平台的信息安全攻防体系架构

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
TWI682644B (zh) * 2019-01-07 2020-01-11 中華電信股份有限公司 網路節點的移動防護方法及網路防護伺服器

Also Published As

Publication number Publication date
CN107659540A (zh) 2018-02-02
CN107659540B (zh) 2021-01-26

Similar Documents

Publication Publication Date Title
US10218740B1 (en) Fuzzy hash of behavioral results
US11558418B2 (en) System for query injection detection using abstract syntax trees
US20200336459A1 (en) Network threat prediction and blocking
EP3430560B1 (en) Using private threat intelligence in public cloud
CN110719291A (zh) 一种基于威胁情报的网络威胁识别方法及识别系统
CN111988339B (zh) 一种基于dikw模型的网络攻击路径发现、提取和关联的方法
CN102970272B (zh) 用于病毒检测的方法、装置和云服务器
WO2018019010A1 (zh) 动态行为分析方法、装置、系统及设备
US9195826B1 (en) Graph-based method to detect malware command-and-control infrastructure
US20080244691A1 (en) Dynamic threat vector update
US10560452B2 (en) Apparatus and method to control transfer apparatuses depending on a type of an unauthorized communication occurring in a network
CN110210213B (zh) 过滤恶意样本的方法及装置、存储介质、电子装置
EP3038006A1 (en) System and method for distributed detection of malware
EP2541835A2 (en) System and method for controlling access to network resources
CN110149318B (zh) 邮件元数据的处理方法及装置、存储介质、电子装置
US20160299971A1 (en) Identifying Search Engine Crawlers
US20210365556A1 (en) Automated malware monitoring and data extraction
CN112073437A (zh) 多维度的安全威胁事件分析方法、装置、设备及存储介质
US9871810B1 (en) Using tunable metrics for iterative discovery of groups of alert types identifying complex multipart attacks with different properties
CN113098852B (zh) 一种日志处理方法及装置
WO2017217247A1 (ja) 悪性イベント検出装置、悪性イベント検出方法および悪性イベント検出プログラム
CN110224975B (zh) Apt信息的确定方法及装置、存储介质、电子装置
WO2022156293A1 (zh) 处理告警日志的方法、装置及存储介质
JP7020362B2 (ja) 探索装置、探索方法及び探索プログラム
Deng et al. Understanding {Malware’s} Network Behaviors using Fantasm

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17833315

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17833315

Country of ref document: EP

Kind code of ref document: A1