WO2020019505A1

WO2020019505A1 - Malicious software detection method and related device

Info

Publication number: WO2020019505A1
Application number: PCT/CN2018/108474
Authority: WO
Inventors: 郑彪
Original assignee: 平安科技（深圳）有限公司
Priority date: 2018-07-27
Filing date: 2018-09-28
Publication date: 2020-01-30
Also published as: CN109101815B; CN109101815A

Abstract

Embodiments of the present application disclose a malicious software detection method and a related device. The method comprises: acquiring first configuration information of each sandbox of one or more sandboxes and second configuration information of software under test, and determining, according to the first configuration information of each sandbox and the second configuration information, a target sandbox matching the software of the one or more sandboxes; calling the target sandbox to perform symbol execution analysis on the software, so as to acquire an equivalent execution path corresponding to each function of the software; calling the target sandbox to execute a target equivalent execution path, and recording an execution trajectory and a called system resource corresponding to the target equivalent execution path executed by the software; determining, according to the execution trajectory and the called system resource, whether the software has a malicious behavior; if the software has a malicious behavior, determining that the software is malicious software, and outputting the malicious behavior corresponding to the software. The present application improves the granularity of malicious software detection.

Description

Malware detection method and related equipment

This application claims priority from a Chinese patent application filed on July 27, 2018 with the Chinese Patent Office, application number 201810851519.9, and application name "A Malware Detection Method and Related Equipment", the entire contents of which are incorporated herein by reference Applying.

Technical field

The present application relates to the field of computer technology, and in particular, to a malware detection method and related equipment.

Background technique

With the rapid development of computer technology and the widespread application of various websites, mobile terminals, and app services on mobile terminals, the security issues of server systems have received more and more attention, and various types of malware have emerged endlessly. At present, malware detection on the market is mainly divided into dynamic and static: static detection requires the collection of characteristic information of known malware in advance, and it is not effective in detecting the latest malware and variants of existing malware; dynamic detection It mainly runs samples in the sandbox environment and collects the behavior characteristics of the software to determine whether it will cause harm. At present, most malwares have the ability to detect the sandbox environment. There is a large difference between the sandbox environment and the actual production environment. Malware does not trigger malicious behavior, and its ability to detect malware behavior is too weak and fine-grained.

Summary of the Invention

The embodiments of the present application provide a malware detection method and related equipment, which can analyze the malicious behavior of the malware, which is helpful to improve the fine granularity of the malware detection.

In a first aspect, an embodiment of the present application provides a method for detecting malware, which includes:

Acquiring the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software under test, and according to the first configuration information of each sandbox and the second configuration information in the A target sandbox matching the software to be tested is determined in the one or more sandboxes;

Calling the target sandbox to perform symbolic execution analysis on the software under test to obtain an equivalent execution path corresponding to each function of the software under test;

Calling the target sandbox to execute the target equivalent execution path, and recording the execution trajectory corresponding to the target equivalent execution path executed by the software under test and the system resources called, where the target equivalent execution path is the target to be tested One or more of the equivalent execution paths corresponding to each function of the software;

Determining whether a malicious behavior exists in the software under test according to the execution trace and the invoked system resources;

When the malicious behavior exists in the software under test, it is determined that the software under test is malicious software, and the malicious behavior corresponding to the software under test is output.

In a second aspect, an embodiment of the present application provides a malware detection apparatus. The malware detection apparatus includes a unit for executing the method in the first aspect.

According to a third aspect, an embodiment of the present application provides a server. The server includes a processor, a network interface, and a memory. The processor, the network interface, and the memory are connected to each other. The network interface is controlled by the processor. The memory is used for receiving and sending messages, and the memory is configured to store a computer program that supports a server to execute the foregoing method, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method of the first aspect.

In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, where the computer program includes program instructions, and the program instructions, when executed by a processor, cause all the The processor executes the method of the first aspect.

With this application, when the server detects that the software under test has malicious behavior, it can determine that the software under test is malicious software and output the malicious behavior corresponding to the software under test, which is beneficial to improving the fine-grained detection of malware.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of an execution tree of a program corresponding to a software under test according to an embodiment of the present application; FIG.

2 is a schematic flowchart of a malware detection method according to an embodiment of the present application;

FIG. 3 is a schematic flowchart of another malware detection method according to an embodiment of the present application; FIG.

4 is a schematic block diagram of a malware detection apparatus according to an embodiment of the present application;

FIG. 5 is a schematic block diagram of a server according to an embodiment of the present application.

detailed description

In the following, the technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

At present, malware detection on the market is mainly divided into dynamic and static: static detection requires the collection of characteristic information of known malware in advance, and it is not effective in detecting the latest malware and variants of existing malware; dynamic detection It mainly runs samples in the sandbox environment and collects the behavior characteristics of the software to determine whether it will cause harm. At present, most malwares have the ability to detect the sandbox environment. There is a large difference between the sandbox environment and the actual production environment. Malicious software does not trigger malicious behaviors. In addition, dynamic detection often only focuses on a few system APIs. The ability to detect malicious software behaviors is too weak and the granularity is insufficient.

In order to solve the above problem, this application proposes a malware detection method, which can obtain the first configuration information of each sandbox and the second configuration information of the software under test in one or more sandboxes, and according to each sandbox The first configuration information and the second configuration information of the target determine the target sandbox that matches the software under test in one or more sandboxes, and then call the target sandbox to perform symbolic analysis on the software under test to obtain the functions of the software under test. The corresponding equivalent execution paths, and call the target sandbox execution target equivalent execution path, and record the execution trajectory and the invoked system resources corresponding to the equivalent execution path of the software to be tested, and then according to the execution trajectory and the invoked system resources Determine whether the software under test has malicious behavior. When the software under test has malicious behavior, determine that the software under test is malicious software, and output the malicious behavior corresponding to the software under test. Not only can it be determined whether the software under test is malicious software, but it can also output the malicious behavior corresponding to the software under test if it is determined that the software under test is malicious, which is conducive to improving the fine granularity of malware detection.

The malware described in this application not only covers viruses, worms, and trojan horses that perform malicious tasks on computer systems, but also includes malicious web pages and malicious plug-ins, which are not complete software programs. However, malicious web pages and malicious plug-ins need to be attached to certain framework software (for example, malicious web pages correspond to browsers, and malicious plug-ins also have corresponding framework software). Security analysis of this plug-in class is also included in the category of malware analysis . For example, a word document containing a macro virus can be considered as the input for analysis and detection, and the office word used to open the document in this application is considered as a component of the setting of the sandbox environment; similarly, if a malicious web page is to be detected, the web page is regarded as In order to analyze the detection input, the general browsers chrome, edge, ie, or firefox are considered as part of the sandbox environment, and other parts are the same as the detection scheme.

The sandbox described in this application is equivalent to a sandbox virtual machine in information security. In information security, a sandbox virtual machine specifically refers to monitoring an execution environment that restricts software behavior with a certain security policy.

The system resources described in this application may include resources provided by non-test software itself, which are required to execute the equivalent target execution path corresponding to the target software. For example, if the software under test is mining, system resources can include graphics card drivers, wallet key analysis, network communications, CPU usage information, file system access reads and writes, and so on. If the software under test is a rebound, the system resources include file system access to read and write, network ports open, network send and receive packets, the registry modified by hiding its own process, and so on. This system resource also includes the target system interface in the target sandbox called during the execution of the target equivalent execution path corresponding to the software under test.

The symbolic execution analysis (hereinafter referred to as symbolic execution) described in this application is an important formal method and an analysis technique researched by the academic community. The key idea of symbolic execution is to change the input into a symbolic value, so that the output value calculated by the program is a function of the symbolic input value, which is a symbolization process. In the embodiment of the present application, all execution paths of the program corresponding to the software under test can be expressed as trees, that is, execution trees. Branches of branches represent the true true and false false branch directions at branch statements. The execution path of the program is usually Is a sequence of true and false. The equivalent execution path of all functions of the software under test obtained by symbolic execution analysis is actually the process of symbolic execution traversing the program execution tree.

For example, the example code of the program corresponding to the software under test is:

inttwice (int v) {

return 2 * v;

}

void testme (int x, int y) {

z = twice (y);

if (z == x) {

if (x> Y + 10) {

ERROR;

The execution tree corresponding to the above example is shown in Figure 1. From Figure 1, it can be seen that the testme () function has three execution paths. The round rectangular box is the three sets of inputs corresponding to the three equivalent execution paths, which are the three sets. Input can traverse the program. The three input arrays are (x = 0; y = 1), (x = 2; y = 1), and (x = 30; y = 15). The purpose of symbolic execution is to be able to generate such an input set, where each input value array (such as x = 0; y = 1) corresponds to an equivalent execution path. The input set composed of all input values is an equivalent execution path of all functions of the software under test described in this application.

Referring to FIG. 2, FIG. 2 is a schematic flowchart of a malware detection method according to an embodiment of the present application. The method is applied to a server in which one or more sandboxes are deployed in advance. As shown in the figure, the malware detection method may be include:

201. The server obtains the first configuration information of each sandbox and the second configuration information of the software to be tested in one or more sandboxes, and according to the first configuration information and the second configuration information of each sandbox in one or more The target sandbox that matches the software under test is determined in each sandbox.

The first configuration information may include the operating system version, kernel information, and link libraries of each sandbox in one or more sandboxes. The second configuration information may include verification information (such as the MD5 value) of the software to be tested. , The operating system version that the software under test can run, the link library that the sample software runs on, etc., the first configuration information and the second configuration information are interrelated. There may be one or more first configuration information. Specifically, each sandbox may correspond to different first configuration information, or multiple sandboxes may correspond to the same first configuration information. The operating system version may include an operating system version type, such as a Windows system or Linux, and may also include an operating system version number, such as Windows 2007 or Windows 2010.

In one embodiment, when the server detects the input of the software to be tested, it can obtain the second configuration information of the software to be tested, and the first configuration information of each sandbox in one or more sandboxes. The configuration information is compared with one or more sandboxes respectively corresponding to the first configuration information. If it is determined that the first configuration information of any sandbox matches the second configuration information, then any one of the sandboxes is determined as the target sandbox.

For example, the server is pre-deployed with 2 sandboxes. The first configuration information is the operating system version of each sandbox. The operating system version of the first sandbox is windows and the operating system version of the second sandbox is linux. The second configuration information is the operating system version of the software under test, and the operating system version is linux. In this case, after the server obtains the operating system version of each sandbox and the operating system version of the software under test, the server can match the determined operating system version linux of the software under test with the operating system version linux of the second sandbox. , The second sandbox can be determined as the target sandbox.

202: The server invokes the target sandbox to perform symbolic execution analysis on the software to be tested to obtain an equivalent execution path corresponding to each function of the software to be tested.

In one embodiment, after the target sandbox matching the software to be tested is determined, the server may input the software to be tested into the target sandbox, invoke the target sandbox to perform symbolic analysis on the software to be tested, and perform the analysis on the symbol. The execution tree process of the corresponding program of the software under test is traversed to obtain an input set of all functions of the software under test. Each input value array in the input set corresponds to an equivalent execution path. The input set is all functions of the software under test. Equivalent execution path.

203: The server calls the target sandbox to execute the target equivalent execution path, and records the execution track corresponding to the target execution equivalent path of the software to be tested and the system resources to be called. The target equivalent execution path is one or more of the equivalent execution paths corresponding to each function of the software under test.

204. The server determines whether the software under test has a malicious behavior according to the execution trace and the system resources invoked.

205. When the software under test has malicious behavior, the server determines that the software under test is malicious software, and outputs the malicious behavior corresponding to the software under test.

In one embodiment, after the server obtains the equivalent execution paths corresponding to the functions of the software under test, the server may further include all functions in the equivalent execution path according to the historical execution frequency of each malware execution path in the preset sample library. One or more equivalent execution paths are determined as target equivalent execution paths, and the historical execution frequency of the target equivalent execution paths is greater than or equal to a preset execution frequency threshold.

For example, the execution frequency threshold is 60, and the historical execution frequencies of the execution paths s1 and s2 in the preset sample database are 70 and 80, respectively. In this case, after the server obtains the equivalent execution path of each function of the software under test, it can execute the execution path in the equivalent execution path of all functions according to the historical execution frequency of each malware execution path in the preset sample library. s1 and execution path s2 are determined as target equivalent execution paths.

Further, after the server determines the target equivalent execution path, the server may call the target sandbox to execute the target equivalent execution path, and record the execution trajectory corresponding to the target execution equivalent path of the software under test and the system resources to be called. Among them, the target equivalent execution path may have one or more. When the target equivalent execution path has n (n is a positive integer), the server needs to call the target sandbox to execute the n target equivalent execution paths. Correspondingly, the server needs to record the execution trajectory corresponding to the execution of each target equivalent execution path in the n target equivalent execution paths and the system resources called. That is, the n target equivalent execution paths correspond to n types of execution trajectories and calls. Of system resources.

Wherein, the resources provided by the non-test software itself required to execute the equivalent target execution path corresponding to the target software are the system resources mentioned above. For example, if the software under test is mining, system resources can include graphics card drivers, wallet key analysis, network communications, CPU usage information, file system access reads and writes, and so on. If the software under test is a rebound, the system resources include file system access to read and write, network ports open, network send and receive packets, the registry modified by hiding its own process, and so on. The system resource also includes a system interface called during execution of the target equivalent execution path corresponding to the software under test.

In one embodiment, a sample library (namely, a preset sample library) including multiple malwares may be established in advance, and the preset sample library stores various malwares, and respective malicious behaviors of the various malwares. The malicious behaviors Including malicious execution traces of malware and system resources called during the execution of the malware. For example, if a malware sample performs a heap spray, it needs to call the virtual function to forge the virtual function table, and there will be a stack variable overflow when the virtual function table is forged. The act of calling the virtual function to falsify the virtual function table is the malicious execution trace of the malware performing a heap spray.

In this case, the server compares the execution trajectory recorded during the execution of each target equivalent execution path with the malicious execution trajectory of each malware in the preset sample library. If the recorded execution trajectory is determined to be any Or the similarity of malicious execution trajectories of multiple malwares (hereinafter referred to as target malware) is higher than the preset trajectory similarity threshold, the system resources called during the target equivalent execution path can be further compared with each of the preset sample libraries. The system resources called during the running of the target malware are compared. If the system resources called during the target equivalent execution path are similar to the system resources called during the running of any target malware, the similarity is higher than the preset resources. Degree threshold, it is determined that the software under test has malicious behavior, and the malicious behavior includes an execution trajectory corresponding to an execution target equivalent execution path and a called system resource. Further, when the server determines that the software under test has the malicious behavior, the server can determine that the software under test is malicious software and output the malicious behavior, so that the user can visually view the malicious behavior of the software under test, which is beneficial to improving the malicious behavior. Fine-grained software detection.

In the embodiment of the present application, the server may call the target sandbox to perform symbolic execution analysis on the software to be tested to obtain the equivalent execution path corresponding to each function of the software under test, and call the target sandbox to execute the target equivalent execution path, and record the target The execution trajectory and the called system resources corresponding to the equivalent execution path of the test software execution target, and then determine whether the software under test has malicious behavior according to the execution trajectory and the called system resources. When the software under test has malicious behavior, determine that the software under test is Malware, and outputting the malicious behavior corresponding to the software under test helps to improve the fine-grained detection of malware.

Referring to FIG. 3, FIG. 3 is a schematic flowchart of another malware detection method according to an embodiment of the present application. The method is applied to a server in which one or more sandboxes are deployed in advance. As shown in the figure, the malware detection method Can include:

301. The server performs assembly instruction level translation and fragmentation processing on one or more sandbox callable system interfaces, and obtains the target system interface after the translation and fragmentation processing.

302. The server stores the target system interface and the system interface corresponding to each sandbox in a system interface library of the sandbox.

In one embodiment, the server may group each sandbox callable system interface, and then divide the assembly instructions corresponding to each group of system interfaces into slices according to a preset rule, and then insert corresponding ones between the slices. Non-functional assembler instructions (the non-functional assembler instructions are used for analysis records or restricted uses), and then realize the assembly instruction level translation and fragment processing for each sandbox callable system interface. Further, a system interface (ie, a target system interface) after each sandbox translation and fragmentation processing is associated with a system interface that the sandbox can call and stored in a system interface library of the sandbox. The preset rule may be slicing with a jump instruction as a flag, and slicing with the jump instruction may ensure the continuity of the storage section operated by the code fragment. Because jumps require increased attention, malicious behaviors generally occur after jumps, so that the execution process of each slice can be analyzed and recorded, and fine-grained segmentation of assembly instructions according to security analysis is achieved, which is conducive to improving malware. Fine-grained detection.

Among them, the above system interface can not only include the operating system interface, but also for large open source software (such as browser chrome, firefox, libre, office, etc.) can also build a software interface assembly level translation processing into the system interface library, especially for some malicious The behavior often involves recording the interfaces for subsequent analysis. For example, translating at the cross-domain api inside the browser can observe the cross-domain behavior of the software under test, so as to observe the phishing behavior of some malicious plugins. In this way, more behavior trajectories of the software to be tested can be detected, that is, whether the software to be tested is malicious software is determined based on more malicious behaviors, thereby improving the accuracy of malware detection.

In one embodiment, when modifying each sandbox, you can also adjust the direction of the transformation according to the specific detection behavior, such as the worm, etc., and pay more attention to how it spreads the infection. You can focus on access and reading The resource interface related to the write operation, and the relevant interface of the mail is called for assembly instruction level translation and fragmentation processing. The information recorded by these interfaces can be used to describe the specific transmission path of the infection of the software under test; monitoring for theft of user passwords For keyboard input, the focus is on the transmission of input signals on the system bus, and the assembly interface-level translation and fragmentation processing of the relevant interface of the system bus.

303. The server obtains the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software under test, and according to the first configuration information and the second configuration information of each sandbox in one or more The target sandbox that matches the software under test is determined in each sandbox.

304. The server invokes the target sandbox to perform symbolic execution analysis on the software to be tested to obtain an equivalent execution path corresponding to each function of the software to be tested.

In one embodiment, when calling the target sandbox to perform symbolic execution analysis on the software under test, the server can detect whether the current execution path of the function obtained by performing the symbol analysis is executed to any system interface in the system interface library that calls the target sandbox. If the current execution path of the function obtained by performing the symbol analysis is executed to any system interface, the current execution path of the function is ended, and an equivalent execution path corresponding to the current execution path of the function is generated. Among them, whether to execute to any system interface or system interface as a constraint is that any software under test must complete certain functions. Once it involves resource scheduling outside the software under test, it must call the system interface. When an execution path needs to call an external resource, aborting the execution path will not affect the integrity of the path. Adopting such constraints can avoid infinite loops, prevent path explosions, and reduce overhead.

305: The server calls the target sandbox to execute the target equivalent execution path, and records the execution trajectory corresponding to the software target execution target equivalent execution path and the system resources to be called. The target equivalent execution path is one or more of the equivalent execution paths corresponding to each function of the software under test.

In one embodiment, the server may input an input value array corresponding to the target equivalent execution path into a sample program of the target sandbox, obtain an execution flow of the target equivalent execution path, and according to a preset jump instruction in the target sandbox. Slicing the execution stream to obtain one or more execution stream fragments, and then performing respective preset operations on the one or more execution stream fragments obtained after the slice processing, can further improve the fine granularity of malware detection. The execution flow is a series of assembly instructions.

Among them, different preset operations can be configured according to each execution stream segment function. For example, if the function corresponding to the execution stream segment is an access resource interface, then the preset operation may be an access operation; if the function corresponding to the execution stream segment is to modify a registry, the preset operation may be a modification operation. This application does not specifically limit this.

In one embodiment, the server slices the execution flow according to a jump instruction preset by the current system of the target sandbox, and after obtaining one or more execution flow fragments, the server may further respectively sing in one or more execution flow fragments. Binary instrumentation is introduced into each execution flow segment of and the binary instrumentation is called to record the execution trajectory after performing the respective preset operation on the one or more execution flow segments, and to call each execution of the corresponding preset operation. System resources to further improve the granularity of malware detection.

In one embodiment, when a binary instrumentation is introduced into each execution flow segment of one or more execution flow segments, where is the specific insertion of the binary instrumentation, and a specific jump instruction may be used to determine the position of the instrumentation. . By way of example, the assembly of the most common unconditional jump jmp instruction is taken as an example. There are four forms of jmp. Jmp 200H and jmp ccx do not need to perform instrumentation, and the risk of jumps within a segment is low. Pay attention to the more dangerous jumps between sections (such as: jmp 100H 200H and JMP DWORD PTR), and then perform binary instrumentation after the jump instructions between sections.

Among them, when performing binary instrumentation, you can also modify the operands, so that the program corresponding to the software under test jumps to a previously prepared memory code segment, executes the function that the developer wants it to perform, and then jumps back to the original segment address. . Among them, the above operands are related to the memory address. That is, modifying the operands can make the corresponding program of the software under test jump to the specified address and execute the prepared memory code segment. For example, "200H" in jmp 200H is the operand.

306. The server determines whether the software under test has a malicious behavior according to the execution trace and the system resources invoked.

307. When the software under test has malicious behavior, the server determines that the software under test is malicious software, and outputs the malicious behavior corresponding to the software under test.

For specific implementations of steps 306 to 307, reference may be made to related descriptions of steps 204 to 205 in the foregoing embodiment, and details are not described herein again.

In one embodiment, when the server analyzes the execution trajectory and the system resources that are called, the server has a strict causal progressive relationship due to the general malicious software attack method. If you analyze the execution trajectory of the software under test, compared with the sample malware in the preset sample library, the execution trajectory is only changed in some steps. Based on the results of the malicious behavior of the sample malware, determine the cause. If the results are the same but the reasons are different, you can determine that a new malicious behavior has been determined. That is, it can be judged that the software under test is a new type of malware, and a new malicious behavior exists.

Among them, when determining whether the software under test is new malware, the attack methods and behaviors of the software under test can also be compared, or the affinity of the software under test can be analyzed to detect whether the software under test is a variant of known malware. .

In one embodiment, after it is determined that a new malicious behavior exists in the software to be tested, a new detection rule corresponding to the new malicious behavior may be generated, and the new malicious behavior and the new detection rule are associated and stored in the server for subsequent distribution. For other detection systems, cloud detection and killing of new variants or new malware can be achieved, so as to detect zero-day vulnerabilities.

In one embodiment, before the server obtains the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software to be tested, it may also obtain sample software feature values of the sample software, and The feature value is compared with the malware feature value of the malware in the preset software library. If the sample software feature value matches the malware feature value, determine that the sample software is malware and detect whether the current detection mode is the preset detection mode. If the current detection mode is a preset detection mode, determine the sample software as the software to be tested, and trigger the acquisition of the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software to be tested. step. Wherein, when the server compares the sample software feature value with the malware feature value of the malware in the preset software library, the server may have a feature similarity between the sample software feature value and any malware feature value greater than or equal to the preset feature similarity. When the degree threshold value is determined, it is determined that the sample software characteristic value matches the characteristic value of any one of the malwares.

In one embodiment, if the server determines that the sample software characteristic values do not match the malware characteristic values, it determines that the sample software is non-malware software, determines the sample software as the software to be tested, and triggers acquiring the one or more Steps of the first configuration information of each sandbox in the sandbox and the second configuration information of the software under test. When the server compares the sample software feature value with the malware feature value of the malware in the preset software library, the server can compare the feature similarity between the sample software feature value and each malware feature value to a preset feature similarity threshold. , It is determined that the sample software characteristic value does not match the malware characteristic value.

The preset detection mode may be preset by a user according to his own detection needs. The preset detection mode can be, for example, an expert detection mode. The expert detection mode can not only detect that the software to be tested is malicious software, but also detect malicious behaviors of the malicious software.

In one embodiment, when the server determines that the sample software is malicious software and the current detection mode is not a preset detection mode, it can directly end the detection and output an alarm message so that the background operation and maintenance personnel can perform subsequent operations. Alternatively, the server may directly delete the software under test.

In the embodiment of the present application, the server may perform assembly instruction-level translation and fragmentation processing on the system interfaces callable by each sandbox in one or more sandboxes to obtain the target system interface after the translation and fragmentation processing, and The target system interface and system interface corresponding to each sandbox are associated and stored in the system interface library of the sandbox. Further, the target sandbox is called to perform symbolic execution analysis on the software to be tested to obtain the equivalent execution path corresponding to each function of the software under test, the target sandbox is called to execute the target equivalent execution path, and the software equivalent to the test is recorded The execution trajectory corresponding to the execution path and the system resources that are called, and whether the software under test has malicious behavior according to the execution trajectory and the system resources that are called. When the software under test has malicious behavior, it determines that the software under test is malicious software and outputs The malicious behavior corresponding to the detection software is helpful to improve the fine granularity of the malware detection.

An embodiment of the present application further provides a malware detection device, which is configured on a server in which one or more sandboxes are deployed in advance. The apparatus includes a module for performing the method described in FIG. 2 or FIG. 3. Specifically, referring to FIG. 4, it is a schematic block diagram of a malware detection apparatus according to an embodiment of the present application. The malware detection apparatus of this embodiment includes:

An obtaining module 40, configured to obtain first configuration information of each sandbox in the one or more sandboxes and second configuration information of software to be tested;

A determining module 41, configured to determine, in the one or more sandboxes, the software to be tested according to the first configuration information and the second configuration information of each sandbox obtained by the obtaining module; Matching target sandbox;

An invoking module 42 for invoking the target sandbox to perform symbolic execution analysis on the software under test to obtain an equivalent execution path corresponding to each function of the software under test;

The calling module 42 is further configured to call the target sandbox to execute the target equivalent execution path, and record the execution trajectory corresponding to the target equivalent execution path executed by the software under test and the system resources to be called. The equivalent execution path is one or more of equivalent execution paths corresponding to respective functions of the software under test;

The determining module 41 is further configured to determine whether the software under test has a malicious behavior according to the execution trace and the invoked system resources. When it is determined that the software under test has the malicious behavior, determine the software under test. The software is malicious software;

An output module 43 is configured to output the malicious behavior corresponding to the software to be tested when the determining module determines that the software to be tested is the malicious software.

In one embodiment, the apparatus further includes:

A processing module 44 is configured to perform assembly instruction level translation and fragmentation processing on each of the sandbox callable system interfaces in the one or more sandboxes to obtain a target system interface after the translation and fragmentation processing;

The storage module 45 is configured to store the target system interface and the system interface corresponding to each sandbox in a system interface library of the sandbox.

In one embodiment, the calling module 42 is specifically configured to detect whether the current execution path of the function obtained by executing the symbol analysis is executed to the target sandbox when the symbol execution analysis is performed on the software under test. Calling any of the system interfaces in the system interface library of the target sandbox; if the current execution path of the function obtained by performing the symbol analysis is executed to the any system interface, the current execution path of the function is ended And generate an equivalent execution path corresponding to the current execution path of the function.

In one embodiment, the calling module 42 is specifically configured to input an input value array corresponding to the target equivalent execution path into a sample program of the target sandbox to obtain an execution flow of the target equivalent execution path. Slicing the execution stream according to a preset jump instruction in the target sandbox to obtain one or more execution stream fragments; performing respective correspondence on the one or more execution stream fragments obtained after the slice processing Preset actions.

In one embodiment, the apparatus further includes: an instrumentation module 46, configured to introduce binary instrumentation into each of the one or more execution flow segments;

Wherein, the calling module 42 is further specifically configured to call the binary instrumentation record to execute the execution track corresponding to the preset operation corresponding to the one or more execution stream fragments, and to execute the corresponding corresponding track. System resources called by a preset operation.

In one embodiment, the obtaining module 40 is further configured to obtain a sample software feature value of the sample software, and compare the sample software feature value with a malware feature value of malware in a preset software library;

The determining module 41 is further configured to, if it is determined that the sample software characteristic value matches the malware characteristic value, determine that the sample software is malware, and then detect whether the current detection mode is a preset detection mode. If the mode is the preset detection mode, the sample software is determined as the software to be tested, and the obtaining of the first configuration information of each sandbox in the one or more sandboxes and the first Steps for configuring information;

The determining module 41 is further configured to determine that the sample software is non-malware software if it is determined that the sample software characteristic value does not match the malware software characteristic value; determine the sample software as the software to be tested, and trigger The step of obtaining the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software to be tested.

In one embodiment, the determining module 41 is further configured to, according to the historical execution frequency of each malware execution path in the preset sample library, assign one or more of the equivalent execution paths corresponding to the functions to each other, etc. The price execution path is determined as a target equivalent execution path, and the historical execution frequency of the target equivalent execution path is greater than or equal to a preset execution frequency threshold.

It should be noted that the functions of the functional modules of the malware detection device described in the embodiments of this application may be specifically implemented according to the method in the method embodiment described in FIG. 2 or FIG. 3, and the specific implementation process may refer to FIG. 2 or The related description of the method embodiment in FIG. 3 is not repeated here.

Please refer to FIG. 5, which is a schematic block diagram of a server provided by an embodiment of the present application, and the server is pre-deployed with one or more sandboxes. As shown in FIG. 5, the server includes a processor 501, a memory 502, and a network interface 503. The processor 501, the memory 502, and the network interface 503 may be connected through a bus or other manners. In FIG. 5 shown in the embodiment of the present application, connection through a bus is taken as an example. The network interface 503 is controlled by the processor to send and receive messages, the memory 502 is used to store a computer program, the computer program includes program instructions, and the processor 501 is used to execute the program instructions stored in the memory 502. Wherein, the processor 501 is configured to call the program instructions to execute: acquiring first configuration information of each sandbox in the one or more sandboxes and second configuration information of software to be tested, and according to the each The first configuration information and the second configuration information of each sandbox determine a target sandbox matching the software to be tested in the one or more sandboxes; calling the target sandbox to the target to be tested The software performs symbolic execution analysis to obtain the equivalent execution path corresponding to each function of the software under test; calls the target sandbox to execute the target equivalent execution path, and records that the software under test executes the target equivalent execution The execution trajectory corresponding to the path and the system resources called, the target equivalent execution path is one or more of the equivalent execution paths corresponding to the respective functions of the software under test; according to the execution trajectory and the called System resources determine whether the software under test has malicious behavior; when the software under test has malicious behavior, determine that the software under test is malicious software, and output the software under test Corresponding member of the malicious behavior.

It should be understood that, in the embodiment of the present application, the processor 501 may be a central processing unit (CPU), and the processor 501 may also be another general-purpose processor or a digital signal processor (Digital Signal Processor, DSP). ), Application specific integrated circuit (ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The memory 502 may include a read-only memory and a random access memory, and provide instructions and data to the processor 501. A part of the memory 502 may further include a non-volatile random access memory. For example, the memory 502 may also store information of a device type.

In specific implementation, the processor 501, the memory 502, and the network interface 503 described in the embodiment of the present application may execute the implementation manner described in the method embodiment shown in FIG. 2 or FIG. 3 provided by the embodiment of the present application, and may also execute The implementation manner of the malware detection device described in the embodiment of the present application is not described herein again.

In another embodiment of the present application, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program, where the computer program includes program instructions, and the program instructions are executed by a processor to implement: obtaining The first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software to be tested are based on the first configuration information of each sandbox and the second configuration information. A target sandbox matching the software under test is determined in the one or more sandboxes; calling the target sandbox to perform symbolic analysis on the software under test to obtain corresponding functions of the software under test The equivalent execution path of the target; calling the target sandbox to execute the target equivalent execution path, and recording the execution trajectory corresponding to the target equivalent execution path of the software under test and the system resources called, the target equivalent execution The path is one or more of equivalent execution paths corresponding to each function of the software under test; the path is determined according to the execution trajectory and the called system resources. The test software is malicious behavior; when the presence of the malicious behavior test software, the test software is determined as malware, malicious acts and the output corresponding to the software under test.

The computer-readable storage medium may be an internal storage unit of the server according to any one of the foregoing embodiments, such as a hard disk or a memory of the server. The computer-readable storage medium may also be an external storage device of the server, such as a plug-in hard disk, a Smart Media Card (SMC), and a Secure Digital (SD) card provided on the server. , Flash card (Flash card) and so on. Further, the computer-readable storage medium may further include both an internal storage unit of the server and an external storage device. The computer-readable storage medium is used to store the computer program and other programs and data required by the server. The computer-readable storage medium may also be used to temporarily store data that has been or will be output.

A person of ordinary skill in the art can understand that all or part of the processes in the methods of the foregoing embodiments can be implemented by using a computer program to instruct related hardware. The program can be stored in a computer-readable storage medium. The program When executed, the processes of the embodiments of the methods described above may be included. The storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random, Access Memory, RAM).

The above disclosure is only a part of the embodiments of this application, and of course, the scope of rights of this application cannot be limited by this. Those skilled in the art can understand all or part of the processes of implementing the above embodiments and make according to the claims of this application. The equivalent changes still fall within the scope of the invention.

Claims

A method for detecting malware, which is applied to a server with one or more sandboxes deployed in advance, and is characterized in that it includes:

Acquiring the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software under test, and according to the first configuration information of each sandbox and the second configuration information in the A target sandbox matching the software to be tested is determined in the one or more sandboxes;

Calling the target sandbox to perform symbolic execution analysis on the software under test to obtain an equivalent execution path corresponding to each function of the software under test;

Calling the target sandbox to execute the target equivalent execution path, and recording the execution trajectory corresponding to the target equivalent execution path executed by the software under test and the system resources called, where the target equivalent execution path is the target to be tested One or more of the equivalent execution paths corresponding to each function of the software;

Determining whether a malicious behavior exists in the software under test according to the execution trace and the invoked system resources;

When the malicious behavior exists in the software under test, it is determined that the software under test is malicious software, and the malicious behavior corresponding to the software under test is output.
The method according to claim 1, wherein before the acquiring the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of software to be tested, the method further comprises :

Perform assembly instruction level translation and fragmentation processing on each of the one or more sandbox callable system interfaces to obtain the target system interface after the translation and fragmentation processing;

Associate the target system interface and the system interface corresponding to each sandbox to a system interface library of the sandbox.
The method according to claim 1 or 2, wherein the invoking the target sandbox performs symbolic execution analysis on the software under test to obtain an equivalent execution path of a function of the software under test, comprising: :

When the target sandbox is invoked to perform symbolic execution analysis on the software under test, it is detected whether the current execution path of the function obtained by executing the symbol analysis is executed to any of the system interface libraries in the target sandbox. Mentioned system interface;

If the current execution path of the function obtained by performing the symbol analysis is executed to the any system interface, the current execution path of the function is ended, and an equivalent execution path corresponding to the current execution path of the function is generated.
The method according to any one of claims 1-3, wherein the invoking the target sandbox to dynamically execute a target equivalent execution path comprises:

Inputting an input value array corresponding to the target equivalent execution path into a sample program of the target sandbox to obtain an execution flow of the target equivalent execution path;

Slice the execution stream according to a preset jump instruction in the target sandbox to obtain one or more execution stream fragments;

Perform respective preset operations on the one or more execution stream fragments obtained after the slice processing.
The method according to claim 4, wherein after slicing the execution stream according to a jump instruction preset by the current system of the target sandbox, after obtaining one or more execution stream fragments, the method The method also includes:

Introducing binary instrumentation into each of the one or more execution flow fragments;

Wherein, recording the execution trajectory and the system resources called corresponding to the equivalent execution path executed by the software under test includes:

Invoking the binary instrumentation records the execution trajectories corresponding to the preset operations corresponding to the one or more execution flow segments, and the system resources called to execute the corresponding corresponding preset operations.
The method according to any one of claims 1 to 5, wherein before the acquiring the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of software to be tested, The method further includes:

Obtaining a sample software characteristic value of the sample software, and comparing the sample software characteristic value with a malware characteristic value of malware in a preset software library;

If the sample software characteristic value matches the malware characteristic value, determine that the sample software is malware; detect whether the current detection mode is a preset detection mode, and if the current detection mode is the preset detection mode, then Determining the sample software as the software to be tested, and triggering the step of acquiring the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software to be tested;

If the sample software characteristic value does not match the malware characteristic value, determine the sample software as non-malware software; determine the sample software as the software to be tested, and trigger the acquiring the one or more Steps of the first configuration information of each sandbox in the sandbox and the second configuration information of the software under test.
The method according to any one of claims 1-6, wherein after the obtaining an equivalent execution path corresponding to each function of the software under test, the method further comprises:

According to the historical execution frequency of each malware execution path in the preset sample library, one or more equivalent execution paths in the equivalent execution paths corresponding to the respective functions are determined as target equivalent execution paths, the target, etc. The historical execution frequency of the price execution path is greater than or equal to a preset execution frequency threshold.
A malware detection device configured on a server with one or more sandboxes pre-deployed, and characterized in that it includes:

An acquisition module, configured to acquire first configuration information of each sandbox in the one or more sandboxes and second configuration information of software to be tested;

A determining module, configured to determine that the one or more sandboxes match the software under test according to the first configuration information and the second configuration information of each sandbox obtained by the obtaining module Target sandbox

An invoking module for invoking the target sandbox to perform symbolic execution analysis on the software under test to obtain an equivalent execution path corresponding to each function of the software under test;

The calling module is further configured to call the target sandbox to execute the target equivalent execution path, and record the execution trajectory corresponding to the target equivalent execution path executed by the software under test and the system resources to be called, the target, etc. The price execution path is one or more of the equivalent execution paths corresponding to the respective functions of the software under test;

The determining module is further configured to determine whether the software under test has malicious behavior according to the execution trace and the invoked system resources, and when it is determined that the software under test has the malicious behavior, determine the software under test Is malware

An output module is configured to output the malicious behavior corresponding to the software to be tested when the determining module determines that the software to be tested is the malware.
The apparatus according to claim 8, further comprising:

The processing module is fast and is used to perform assembly instruction level translation and fragmentation processing on the system interfaces that can be called by each sandbox in the one or more sandboxes to obtain the target system interface after the translation and fragmentation processing;

A storage module, configured to associate the target system interface and the system interface corresponding to each sandbox to a system interface library of the sandbox;
The device according to claim 8 or 9, wherein the invoking module is specifically configured to detect, when the target sandbox is invoked to perform symbolic analysis on the software under test, the symbol analysis result obtained by performing the symbolic analysis. Whether the current execution path of the function is executed to any of the system interfaces in the system interface library that invokes the target sandbox; if the current execution path of the function obtained by performing the symbol analysis is executed to any of the system interfaces, End the current execution path of the function and generate an equivalent execution path corresponding to the current execution path of the function.
The apparatus according to any one of claims 8 to 10, wherein the calling module is specifically configured to input an input value array corresponding to the target equivalent execution path into a sample program of the target sandbox, Obtaining the execution flow of the target equivalent execution path; slicing the execution flow according to a preset jump instruction in the target sandbox to obtain one or more execution flow fragments; The one or more execution stream segments perform respective preset operations.
The device according to claim 11, further comprising: an instrumentation module, configured to introduce binary instrumentation into each of the one or more execution flow fragments; wherein, The calling module is further specifically configured to call the binary instrumentation record to execute an execution track corresponding to the preset operation corresponding to the one or more execution stream fragments, and to execute the corresponding corresponding preset operation. System resources called.
The device according to any one of claims 8 to 12, wherein the obtaining module is further configured to obtain a sample software feature value of the sample software, and compare the sample software feature value with a preset software library. To compare malware characteristic values in malware;

The determining module is further configured to, if it is determined that the sample software characteristic value matches the malware characteristic value, determine that the sample software is malware, and then detect whether the current detection mode is a preset detection mode, and if the current detection mode is For the preset detection mode, the sample software is determined as the software to be tested, and the acquiring of the first configuration information of each sandbox in the one or more sandboxes and the second of the software to be tested is triggered. Steps to configure information;

The determining module is further configured to determine that the sample software is non-malware software if it is determined that the sample software characteristic value does not match the malware software characteristic value; determine the sample software as the software to be tested, and trigger the The steps of obtaining the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software to be tested are described.
The device according to any one of claims 8-13, wherein the determining module is further configured to map each of the functions to a corresponding one according to a historical execution frequency of each malware execution path in a preset sample library. One or more equivalent execution paths in the equivalent execution paths are determined as target equivalent execution paths, and the historical execution frequency of the target equivalent execution paths is greater than or equal to a preset execution frequency threshold.
A server, in which one or more sandboxes are pre-deployed, is characterized in that it includes a processor and a memory, and the processor and the memory are connected to each other, wherein the memory is used to store a computer program, and The computer program includes program instructions, and the processor is configured to call the program instructions to execute: acquiring first configuration information of each sandbox in the one or more sandboxes and second configuration information of software under test And determining a target sandbox that matches the software under test in the one or more sandboxes according to the first configuration information and the second configuration information of each sandbox; calling the target sandbox The box performs symbolic execution analysis on the software under test to obtain an equivalent execution path corresponding to each function of the software under test; calls the target sandbox to execute the target equivalent execution path, and records the execution of the software under test The execution trajectory corresponding to the target equivalent execution path and the system resources to be called, and the target equivalent execution path is the equivalent of each function of the software under test. One or more of execution paths; determining whether the software under test has a malicious behavior according to the execution trajectory and the invoked system resources; determining the software under test when the software under test has the malicious behavior The software is malicious software and outputs the malicious behavior corresponding to the software under test.
The server according to claim 15, wherein the processor is further configured to perform assembly instruction level translation and fragment processing on a system interface callable by each sandbox in the one or more sandboxes. To obtain the target system interface after the translation and sharding processing; associate the target system interface and the system interface corresponding to each sandbox to the system interface library of the sandbox in association with each other.
The server according to claim 15 or 16, wherein the processor is further configured to detect, when the target sandbox is invoked to perform symbolic analysis on the software under test, a symbol obtained by performing the symbolic analysis. Whether the current execution path of the function is executed to any of the system interfaces in the system interface library that invokes the target sandbox; if the current execution path of the function obtained by performing the symbol analysis is executed to any of the system interfaces, End the current execution path of the function and generate an equivalent execution path corresponding to the current execution path of the function.
The server according to any one of claims 15-17, wherein the processor is further configured to input an input value array corresponding to the target equivalent execution path into a sample program of the target sandbox, To obtain the execution flow of the target equivalent execution path; slice the execution flow according to a preset jump instruction in the target sandbox to obtain one or more execution flow fragments; The one or more execution stream segments perform respective preset operations.
The server according to claim 18, wherein the processor is further configured to introduce a binary instrumentation into each of the one or more execution flow fragments; call the binary instrumentation Record the execution trajectories corresponding to performing the respective corresponding preset operations on the one or more execution stream fragments, and the system resources called to execute the respective corresponding preset operations.
A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program, the computer program includes program instructions, and when the program instructions are executed by a processor, the processor executes The method according to any one of 1-7 is required.