WO2020019505A1 - Procédé de détection de logiciel malveillant et dispositif associé - Google Patents

Procédé de détection de logiciel malveillant et dispositif associé Download PDF

Info

Publication number
WO2020019505A1
WO2020019505A1 PCT/CN2018/108474 CN2018108474W WO2020019505A1 WO 2020019505 A1 WO2020019505 A1 WO 2020019505A1 CN 2018108474 W CN2018108474 W CN 2018108474W WO 2020019505 A1 WO2020019505 A1 WO 2020019505A1
Authority
WO
WIPO (PCT)
Prior art keywords
software
execution
sandbox
target
under test
Prior art date
Application number
PCT/CN2018/108474
Other languages
English (en)
Chinese (zh)
Inventor
郑彪
Original Assignee
平安科技（深圳）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 平安科技（深圳）有限公司 filed Critical 平安科技（深圳）有限公司
Publication of WO2020019505A1 publication Critical patent/WO2020019505A1/fr

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/562—Static detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities

Definitions

  • the present application relates to the field of computer technology, and in particular, to a malware detection method and related equipment.
  • malware detection on the market is mainly divided into dynamic and static: static detection requires the collection of characteristic information of known malware in advance, and it is not effective in detecting the latest malware and variants of existing malware; dynamic detection It mainly runs samples in the sandbox environment and collects the behavior characteristics of the software to determine whether it will cause harm. At present, most malwares have the ability to detect the sandbox environment. There is a large difference between the sandbox environment and the actual production environment. Malware does not trigger malicious behavior, and its ability to detect malware behavior is too weak and fine-grained.
  • the embodiments of the present application provide a malware detection method and related equipment, which can analyze the malicious behavior of the malware, which is helpful to improve the fine granularity of the malware detection.
  • an embodiment of the present application provides a method for detecting malware, which includes:
  • the malicious behavior exists in the software under test, it is determined that the software under test is malicious software, and the malicious behavior corresponding to the software under test is output.
  • an embodiment of the present application provides a malware detection apparatus.
  • the malware detection apparatus includes a unit for executing the method in the first aspect.
  • an embodiment of the present application provides a server.
  • the server includes a processor, a network interface, and a memory.
  • the processor, the network interface, and the memory are connected to each other.
  • the network interface is controlled by the processor.
  • the memory is used for receiving and sending messages, and the memory is configured to store a computer program that supports a server to execute the foregoing method, the computer program includes program instructions, and the processor is configured to call the program instructions to execute the method of the first aspect.
  • an embodiment of the present application provides a computer-readable storage medium.
  • the computer-readable storage medium stores a computer program, where the computer program includes program instructions, and the program instructions, when executed by a processor, cause all the The processor executes the method of the first aspect.
  • the server when the server detects that the software under test has malicious behavior, it can determine that the software under test is malicious software and output the malicious behavior corresponding to the software under test, which is beneficial to improving the fine-grained detection of malware.
  • FIG. 1 is a schematic diagram of an execution tree of a program corresponding to a software under test according to an embodiment of the present application
  • FIG. 2 is a schematic flowchart of a malware detection method according to an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of another malware detection method according to an embodiment of the present application.
  • FIG. 4 is a schematic block diagram of a malware detection apparatus according to an embodiment of the present application.
  • FIG. 5 is a schematic block diagram of a server according to an embodiment of the present application.
  • malware detection on the market is mainly divided into dynamic and static: static detection requires the collection of characteristic information of known malware in advance, and it is not effective in detecting the latest malware and variants of existing malware; dynamic detection It mainly runs samples in the sandbox environment and collects the behavior characteristics of the software to determine whether it will cause harm. At present, most malwares have the ability to detect the sandbox environment. There is a large difference between the sandbox environment and the actual production environment. Malicious software does not trigger malicious behaviors. In addition, dynamic detection often only focuses on a few system APIs. The ability to detect malicious software behaviors is too weak and the granularity is insufficient.
  • this application proposes a malware detection method, which can obtain the first configuration information of each sandbox and the second configuration information of the software under test in one or more sandboxes, and according to each sandbox
  • the first configuration information and the second configuration information of the target determine the target sandbox that matches the software under test in one or more sandboxes, and then call the target sandbox to perform symbolic analysis on the software under test to obtain the functions of the software under test.
  • the corresponding equivalent execution paths, and call the target sandbox execution target equivalent execution path, and record the execution trajectory and the invoked system resources corresponding to the equivalent execution path of the software to be tested, and then according to the execution trajectory and the invoked system resources Determine whether the software under test has malicious behavior.
  • determine that the software under test is malicious software determines that the software under test is malicious software, and output the malicious behavior corresponding to the software under test. Not only can it be determined whether the software under test is malicious software, but it can also output the malicious behavior corresponding to the software under test if it is determined that the software under test is malicious, which is conducive to improving the fine granularity of malware detection.
  • the malware described in this application not only covers viruses, worms, and trojan horses that perform malicious tasks on computer systems, but also includes malicious web pages and malicious plug-ins, which are not complete software programs. However, malicious web pages and malicious plug-ins need to be attached to certain framework software (for example, malicious web pages correspond to browsers, and malicious plug-ins also have corresponding framework software). Security analysis of this plug-in class is also included in the category of malware analysis .
  • a word document containing a macro virus can be considered as the input for analysis and detection, and the office word used to open the document in this application is considered as a component of the setting of the sandbox environment; similarly, if a malicious web page is to be detected, the web page is regarded as
  • the general browsers chrome, edge, ie, or firefox are considered as part of the sandbox environment, and other parts are the same as the detection scheme.
  • the sandbox described in this application is equivalent to a sandbox virtual machine in information security.
  • a sandbox virtual machine specifically refers to monitoring an execution environment that restricts software behavior with a certain security policy.
  • the system resources described in this application may include resources provided by non-test software itself, which are required to execute the equivalent target execution path corresponding to the target software.
  • system resources can include graphics card drivers, wallet key analysis, network communications, CPU usage information, file system access reads and writes, and so on.
  • the software under test is a rebound, the system resources include file system access to read and write, network ports open, network send and receive packets, the registry modified by hiding its own process, and so on.
  • This system resource also includes the target system interface in the target sandbox called during the execution of the target equivalent execution path corresponding to the software under test.
  • symbolic execution The symbolic execution analysis (hereinafter referred to as symbolic execution) described in this application is an important formal method and an analysis technique researched by the academic community.
  • the key idea of symbolic execution is to change the input into a symbolic value, so that the output value calculated by the program is a function of the symbolic input value, which is a symbolization process.
  • all execution paths of the program corresponding to the software under test can be expressed as trees, that is, execution trees. Branches of branches represent the true true and false false branch directions at branch statements.
  • the execution path of the program is usually Is a sequence of true and false.
  • the equivalent execution path of all functions of the software under test obtained by symbolic execution analysis is actually the process of symbolic execution traversing the program execution tree.
  • the example code of the program corresponding to the software under test is:
  • the execution tree corresponding to the above example is shown in Figure 1. From Figure 1, it can be seen that the testme () function has three execution paths. The round rectangular box is the three sets of inputs corresponding to the three equivalent execution paths, which are the three sets. Input can traverse the program.
  • the input set composed of all input values is an equivalent execution path of all functions of the software under test described in this application.
  • FIG. 2 is a schematic flowchart of a malware detection method according to an embodiment of the present application. The method is applied to a server in which one or more sandboxes are deployed in advance. As shown in the figure, the malware detection method may be include:
  • the server obtains the first configuration information of each sandbox and the second configuration information of the software to be tested in one or more sandboxes, and according to the first configuration information and the second configuration information of each sandbox in one or more The target sandbox that matches the software under test is determined in each sandbox.
  • the first configuration information may include the operating system version, kernel information, and link libraries of each sandbox in one or more sandboxes.
  • the second configuration information may include verification information (such as the MD5 value) of the software to be tested. , The operating system version that the software under test can run, the link library that the sample software runs on, etc., the first configuration information and the second configuration information are interrelated. There may be one or more first configuration information. Specifically, each sandbox may correspond to different first configuration information, or multiple sandboxes may correspond to the same first configuration information.
  • the operating system version may include an operating system version type, such as a Windows system or Linux, and may also include an operating system version number, such as Windows 2007 or Windows 2010.
  • the server when it detects the input of the software to be tested, it can obtain the second configuration information of the software to be tested, and the first configuration information of each sandbox in one or more sandboxes.
  • the configuration information is compared with one or more sandboxes respectively corresponding to the first configuration information. If it is determined that the first configuration information of any sandbox matches the second configuration information, then any one of the sandboxes is determined as the target sandbox.
  • the server is pre-deployed with 2 sandboxes.
  • the first configuration information is the operating system version of each sandbox.
  • the operating system version of the first sandbox is windows and the operating system version of the second sandbox is linux.
  • the second configuration information is the operating system version of the software under test, and the operating system version is linux.
  • the server can match the determined operating system version linux of the software under test with the operating system version linux of the second sandbox.
  • the second sandbox can be determined as the target sandbox.
  • the server invokes the target sandbox to perform symbolic execution analysis on the software to be tested to obtain an equivalent execution path corresponding to each function of the software to be tested.
  • the server may input the software to be tested into the target sandbox, invoke the target sandbox to perform symbolic analysis on the software to be tested, and perform the analysis on the symbol.
  • the execution tree process of the corresponding program of the software under test is traversed to obtain an input set of all functions of the software under test.
  • Each input value array in the input set corresponds to an equivalent execution path.
  • the input set is all functions of the software under test. Equivalent execution path.
  • the server calls the target sandbox to execute the target equivalent execution path, and records the execution track corresponding to the target execution equivalent path of the software to be tested and the system resources to be called.
  • the target equivalent execution path is one or more of the equivalent execution paths corresponding to each function of the software under test.
  • the server determines whether the software under test has a malicious behavior according to the execution trace and the system resources invoked.
  • the server determines that the software under test is malicious software, and outputs the malicious behavior corresponding to the software under test.
  • the server may further include all functions in the equivalent execution path according to the historical execution frequency of each malware execution path in the preset sample library.
  • One or more equivalent execution paths are determined as target equivalent execution paths, and the historical execution frequency of the target equivalent execution paths is greater than or equal to a preset execution frequency threshold.
  • the execution frequency threshold is 60
  • the historical execution frequencies of the execution paths s1 and s2 in the preset sample database are 70 and 80, respectively.
  • the server after the server obtains the equivalent execution path of each function of the software under test, it can execute the execution path in the equivalent execution path of all functions according to the historical execution frequency of each malware execution path in the preset sample library.
  • s1 and execution path s2 are determined as target equivalent execution paths.
  • the server may call the target sandbox to execute the target equivalent execution path, and record the execution trajectory corresponding to the target execution equivalent path of the software under test and the system resources to be called.
  • the target equivalent execution path may have one or more.
  • the server needs to call the target sandbox to execute the n target equivalent execution paths.
  • the server needs to record the execution trajectory corresponding to the execution of each target equivalent execution path in the n target equivalent execution paths and the system resources called. That is, the n target equivalent execution paths correspond to n types of execution trajectories and calls. Of system resources.
  • the resources provided by the non-test software itself required to execute the equivalent target execution path corresponding to the target software are the system resources mentioned above.
  • system resources can include graphics card drivers, wallet key analysis, network communications, CPU usage information, file system access reads and writes, and so on.
  • the software under test is a rebound, the system resources include file system access to read and write, network ports open, network send and receive packets, the registry modified by hiding its own process, and so on.
  • the system resource also includes a system interface called during execution of the target equivalent execution path corresponding to the software under test.
  • a sample library (namely, a preset sample library) including multiple malwares may be established in advance, and the preset sample library stores various malwares, and respective malicious behaviors of the various malwares.
  • the malicious behaviors Including malicious execution traces of malware and system resources called during the execution of the malware. For example, if a malware sample performs a heap spray, it needs to call the virtual function to forge the virtual function table, and there will be a stack variable overflow when the virtual function table is forged. The act of calling the virtual function to falsify the virtual function table is the malicious execution trace of the malware performing a heap spray.
  • the server compares the execution trajectory recorded during the execution of each target equivalent execution path with the malicious execution trajectory of each malware in the preset sample library. If the recorded execution trajectory is determined to be any Or the similarity of malicious execution trajectories of multiple malwares (hereinafter referred to as target malware) is higher than the preset trajectory similarity threshold, the system resources called during the target equivalent execution path can be further compared with each of the preset sample libraries. The system resources called during the running of the target malware are compared. If the system resources called during the target equivalent execution path are similar to the system resources called during the running of any target malware, the similarity is higher than the preset resources.
  • target malware the similarity of malicious execution trajectories of multiple malware
  • Degree threshold it is determined that the software under test has malicious behavior, and the malicious behavior includes an execution trajectory corresponding to an execution target equivalent execution path and a called system resource. Further, when the server determines that the software under test has the malicious behavior, the server can determine that the software under test is malicious software and output the malicious behavior, so that the user can visually view the malicious behavior of the software under test, which is beneficial to improving the malicious behavior. Fine-grained software detection.
  • the server may call the target sandbox to perform symbolic execution analysis on the software to be tested to obtain the equivalent execution path corresponding to each function of the software under test, and call the target sandbox to execute the target equivalent execution path, and record the target The execution trajectory and the called system resources corresponding to the equivalent execution path of the test software execution target, and then determine whether the software under test has malicious behavior according to the execution trajectory and the called system resources.
  • the software under test has malicious behavior, determine that the software under test is Malware, and outputting the malicious behavior corresponding to the software under test helps to improve the fine-grained detection of malware.
  • FIG. 3 is a schematic flowchart of another malware detection method according to an embodiment of the present application. The method is applied to a server in which one or more sandboxes are deployed in advance. As shown in the figure, the malware detection method Can include:
  • the server performs assembly instruction level translation and fragmentation processing on one or more sandbox callable system interfaces, and obtains the target system interface after the translation and fragmentation processing.
  • the server stores the target system interface and the system interface corresponding to each sandbox in a system interface library of the sandbox.
  • the server may group each sandbox callable system interface, and then divide the assembly instructions corresponding to each group of system interfaces into slices according to a preset rule, and then insert corresponding ones between the slices.
  • Non-functional assembler instructions (the non-functional assembler instructions are used for analysis records or restricted uses), and then realize the assembly instruction level translation and fragment processing for each sandbox callable system interface.
  • a system interface ie, a target system interface
  • each sandbox translation and fragmentation processing is associated with a system interface that the sandbox can call and stored in a system interface library of the sandbox.
  • the preset rule may be slicing with a jump instruction as a flag, and slicing with the jump instruction may ensure the continuity of the storage section operated by the code fragment. Because jumps require increased attention, malicious behaviors generally occur after jumps, so that the execution process of each slice can be analyzed and recorded, and fine-grained segmentation of assembly instructions according to security analysis is achieved, which is conducive to improving malware. Fine-grained detection.
  • the above system interface can not only include the operating system interface, but also for large open source software (such as browser chrome, firefox, libre, office, etc.) can also build a software interface assembly level translation processing into the system interface library, especially for some malicious
  • the behavior often involves recording the interfaces for subsequent analysis. For example, translating at the cross-domain api inside the browser can observe the cross-domain behavior of the software under test, so as to observe the phishing behavior of some malicious plugins. In this way, more behavior trajectories of the software to be tested can be detected, that is, whether the software to be tested is malicious software is determined based on more malicious behaviors, thereby improving the accuracy of malware detection.
  • each sandbox when modifying each sandbox, you can also adjust the direction of the transformation according to the specific detection behavior, such as the worm, etc., and pay more attention to how it spreads the infection. You can focus on access and reading The resource interface related to the write operation, and the relevant interface of the mail is called for assembly instruction level translation and fragmentation processing. The information recorded by these interfaces can be used to describe the specific transmission path of the infection of the software under test; monitoring for theft of user passwords For keyboard input, the focus is on the transmission of input signals on the system bus, and the assembly interface-level translation and fragmentation processing of the relevant interface of the system bus.
  • the server obtains the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software under test, and according to the first configuration information and the second configuration information of each sandbox in one or more The target sandbox that matches the software under test is determined in each sandbox.
  • the server invokes the target sandbox to perform symbolic execution analysis on the software to be tested to obtain an equivalent execution path corresponding to each function of the software to be tested.
  • the server when calling the target sandbox to perform symbolic execution analysis on the software under test, can detect whether the current execution path of the function obtained by performing the symbol analysis is executed to any system interface in the system interface library that calls the target sandbox. If the current execution path of the function obtained by performing the symbol analysis is executed to any system interface, the current execution path of the function is ended, and an equivalent execution path corresponding to the current execution path of the function is generated.
  • whether to execute to any system interface or system interface as a constraint is that any software under test must complete certain functions. Once it involves resource scheduling outside the software under test, it must call the system interface. When an execution path needs to call an external resource, aborting the execution path will not affect the integrity of the path. Adopting such constraints can avoid infinite loops, prevent path explosions, and reduce overhead.
  • the server calls the target sandbox to execute the target equivalent execution path, and records the execution trajectory corresponding to the software target execution target equivalent execution path and the system resources to be called.
  • the target equivalent execution path is one or more of the equivalent execution paths corresponding to each function of the software under test.
  • the server may input an input value array corresponding to the target equivalent execution path into a sample program of the target sandbox, obtain an execution flow of the target equivalent execution path, and according to a preset jump instruction in the target sandbox. Slicing the execution stream to obtain one or more execution stream fragments, and then performing respective preset operations on the one or more execution stream fragments obtained after the slice processing, can further improve the fine granularity of malware detection.
  • the execution flow is a series of assembly instructions.
  • different preset operations can be configured according to each execution stream segment function. For example, if the function corresponding to the execution stream segment is an access resource interface, then the preset operation may be an access operation; if the function corresponding to the execution stream segment is to modify a registry, the preset operation may be a modification operation. This application does not specifically limit this.
  • the server slices the execution flow according to a jump instruction preset by the current system of the target sandbox, and after obtaining one or more execution flow fragments, the server may further respectively sing in one or more execution flow fragments.
  • Binary instrumentation is introduced into each execution flow segment of and the binary instrumentation is called to record the execution trajectory after performing the respective preset operation on the one or more execution flow segments, and to call each execution of the corresponding preset operation.
  • System resources to further improve the granularity of malware detection.
  • a specific jump instruction may be used to determine the position of the instrumentation.
  • the assembly of the most common unconditional jump jmp instruction is taken as an example.
  • the above operands are related to the memory address. That is, modifying the operands can make the corresponding program of the software under test jump to the specified address and execute the prepared memory code segment. For example, "200H" in jmp 200H is the operand.
  • the server determines whether the software under test has a malicious behavior according to the execution trace and the system resources invoked.
  • the server determines that the software under test is malicious software, and outputs the malicious behavior corresponding to the software under test.
  • steps 306 to 307 For specific implementations of steps 306 to 307, reference may be made to related descriptions of steps 204 to 205 in the foregoing embodiment, and details are not described herein again.
  • the server when the server analyzes the execution trajectory and the system resources that are called, the server has a strict causal progressive relationship due to the general malicious software attack method. If you analyze the execution trajectory of the software under test, compared with the sample malware in the preset sample library, the execution trajectory is only changed in some steps. Based on the results of the malicious behavior of the sample malware, determine the cause. If the results are the same but the reasons are different, you can determine that a new malicious behavior has been determined. That is, it can be judged that the software under test is a new type of malware, and a new malicious behavior exists.
  • the attack methods and behaviors of the software under test can also be compared, or the affinity of the software under test can be analyzed to detect whether the software under test is a variant of known malware. .
  • a new detection rule corresponding to the new malicious behavior may be generated, and the new malicious behavior and the new detection rule are associated and stored in the server for subsequent distribution.
  • cloud detection and killing of new variants or new malware can be achieved, so as to detect zero-day vulnerabilities.
  • the server may also obtain sample software feature values of the sample software, and The feature value is compared with the malware feature value of the malware in the preset software library. If the sample software feature value matches the malware feature value, determine that the sample software is malware and detect whether the current detection mode is the preset detection mode. If the current detection mode is a preset detection mode, determine the sample software as the software to be tested, and trigger the acquisition of the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software to be tested. step.
  • the server when the server compares the sample software feature value with the malware feature value of the malware in the preset software library, the server may have a feature similarity between the sample software feature value and any malware feature value greater than or equal to the preset feature similarity.
  • the degree threshold value it is determined that the sample software characteristic value matches the characteristic value of any one of the malwares.
  • the server determines that the sample software characteristic values do not match the malware characteristic values, it determines that the sample software is non-malware software, determines the sample software as the software to be tested, and triggers acquiring the one or more Steps of the first configuration information of each sandbox in the sandbox and the second configuration information of the software under test.
  • the server compares the sample software feature value with the malware feature value of the malware in the preset software library, the server can compare the feature similarity between the sample software feature value and each malware feature value to a preset feature similarity threshold. , It is determined that the sample software characteristic value does not match the malware characteristic value.
  • the preset detection mode may be preset by a user according to his own detection needs.
  • the preset detection mode can be, for example, an expert detection mode.
  • the expert detection mode can not only detect that the software to be tested is malicious software, but also detect malicious behaviors of the malicious software.
  • the server when the server determines that the sample software is malicious software and the current detection mode is not a preset detection mode, it can directly end the detection and output an alarm message so that the background operation and maintenance personnel can perform subsequent operations. Alternatively, the server may directly delete the software under test.
  • the server may perform assembly instruction-level translation and fragmentation processing on the system interfaces callable by each sandbox in one or more sandboxes to obtain the target system interface after the translation and fragmentation processing, and
  • the target system interface and system interface corresponding to each sandbox are associated and stored in the system interface library of the sandbox.
  • the target sandbox is called to perform symbolic execution analysis on the software to be tested to obtain the equivalent execution path corresponding to each function of the software under test
  • the target sandbox is called to execute the target equivalent execution path
  • the software equivalent to the test is recorded
  • the software under test has malicious behavior, it determines that the software under test is malicious software and outputs
  • the malicious behavior corresponding to the detection software is helpful to improve the fine granularity of the malware detection.
  • An embodiment of the present application further provides a malware detection device, which is configured on a server in which one or more sandboxes are deployed in advance.
  • the apparatus includes a module for performing the method described in FIG. 2 or FIG. 3.
  • FIG. 4 it is a schematic block diagram of a malware detection apparatus according to an embodiment of the present application.
  • the malware detection apparatus of this embodiment includes:
  • An obtaining module 40 configured to obtain first configuration information of each sandbox in the one or more sandboxes and second configuration information of software to be tested;
  • a determining module 41 configured to determine, in the one or more sandboxes, the software to be tested according to the first configuration information and the second configuration information of each sandbox obtained by the obtaining module; Matching target sandbox;
  • An invoking module 42 for invoking the target sandbox to perform symbolic execution analysis on the software under test to obtain an equivalent execution path corresponding to each function of the software under test;
  • the calling module 42 is further configured to call the target sandbox to execute the target equivalent execution path, and record the execution trajectory corresponding to the target equivalent execution path executed by the software under test and the system resources to be called.
  • the equivalent execution path is one or more of equivalent execution paths corresponding to respective functions of the software under test;
  • the determining module 41 is further configured to determine whether the software under test has a malicious behavior according to the execution trace and the invoked system resources. When it is determined that the software under test has the malicious behavior, determine the software under test.
  • the software is malicious software
  • An output module 43 is configured to output the malicious behavior corresponding to the software to be tested when the determining module determines that the software to be tested is the malicious software.
  • the apparatus further includes:
  • a processing module 44 is configured to perform assembly instruction level translation and fragmentation processing on each of the sandbox callable system interfaces in the one or more sandboxes to obtain a target system interface after the translation and fragmentation processing;
  • the storage module 45 is configured to store the target system interface and the system interface corresponding to each sandbox in a system interface library of the sandbox.
  • the calling module 42 is specifically configured to detect whether the current execution path of the function obtained by executing the symbol analysis is executed to the target sandbox when the symbol execution analysis is performed on the software under test. Calling any of the system interfaces in the system interface library of the target sandbox; if the current execution path of the function obtained by performing the symbol analysis is executed to the any system interface, the current execution path of the function is ended And generate an equivalent execution path corresponding to the current execution path of the function.
  • the calling module 42 is specifically configured to input an input value array corresponding to the target equivalent execution path into a sample program of the target sandbox to obtain an execution flow of the target equivalent execution path. Slicing the execution stream according to a preset jump instruction in the target sandbox to obtain one or more execution stream fragments; performing respective correspondence on the one or more execution stream fragments obtained after the slice processing Preset actions.
  • the apparatus further includes: an instrumentation module 46, configured to introduce binary instrumentation into each of the one or more execution flow segments;
  • the calling module 42 is further specifically configured to call the binary instrumentation record to execute the execution track corresponding to the preset operation corresponding to the one or more execution stream fragments, and to execute the corresponding corresponding track.
  • System resources called by a preset operation are further specifically configured to call the binary instrumentation record to execute the execution track corresponding to the preset operation corresponding to the one or more execution stream fragments.
  • the obtaining module 40 is further configured to obtain a sample software feature value of the sample software, and compare the sample software feature value with a malware feature value of malware in a preset software library;
  • the determining module 41 is further configured to, if it is determined that the sample software characteristic value matches the malware characteristic value, determine that the sample software is malware, and then detect whether the current detection mode is a preset detection mode. If the mode is the preset detection mode, the sample software is determined as the software to be tested, and the obtaining of the first configuration information of each sandbox in the one or more sandboxes and the first Steps for configuring information;
  • the determining module 41 is further configured to determine that the sample software is non-malware software if it is determined that the sample software characteristic value does not match the malware software characteristic value; determine the sample software as the software to be tested, and trigger The step of obtaining the first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software to be tested.
  • the determining module 41 is further configured to, according to the historical execution frequency of each malware execution path in the preset sample library, assign one or more of the equivalent execution paths corresponding to the functions to each other, etc.
  • the price execution path is determined as a target equivalent execution path, and the historical execution frequency of the target equivalent execution path is greater than or equal to a preset execution frequency threshold.
  • FIG. 5 is a schematic block diagram of a server provided by an embodiment of the present application, and the server is pre-deployed with one or more sandboxes.
  • the server includes a processor 501, a memory 502, and a network interface 503.
  • the processor 501, the memory 502, and the network interface 503 may be connected through a bus or other manners.
  • connection through a bus is taken as an example.
  • the network interface 503 is controlled by the processor to send and receive messages, the memory 502 is used to store a computer program, the computer program includes program instructions, and the processor 501 is used to execute the program instructions stored in the memory 502.
  • the processor 501 is configured to call the program instructions to execute: acquiring first configuration information of each sandbox in the one or more sandboxes and second configuration information of software to be tested, and according to the each The first configuration information and the second configuration information of each sandbox determine a target sandbox matching the software to be tested in the one or more sandboxes; calling the target sandbox to the target to be tested
  • the software performs symbolic execution analysis to obtain the equivalent execution path corresponding to each function of the software under test; calls the target sandbox to execute the target equivalent execution path, and records that the software under test executes the target equivalent execution
  • the execution trajectory corresponding to the path and the system resources called, the target equivalent execution path is one or more of the equivalent execution paths corresponding to the respective functions of the software under test; according to the execution trajectory and the called System resources determine whether the software under test has malicious behavior; when the software under test has malicious behavior, determine that the software under test is malicious software, and output the software under test Corresponding member of the malicious behavior
  • the processor 501 may be a central processing unit (CPU), and the processor 501 may also be another general-purpose processor or a digital signal processor (Digital Signal Processor, DSP). ), Application specific integrated circuit (ASIC), ready-made programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.
  • a general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
  • the memory 502 may include a read-only memory and a random access memory, and provide instructions and data to the processor 501. A part of the memory 502 may further include a non-volatile random access memory. For example, the memory 502 may also store information of a device type.
  • the processor 501, the memory 502, and the network interface 503 described in the embodiment of the present application may execute the implementation manner described in the method embodiment shown in FIG. 2 or FIG. 3 provided by the embodiment of the present application, and may also execute The implementation manner of the malware detection device described in the embodiment of the present application is not described herein again.
  • a computer-readable storage medium stores a computer program, where the computer program includes program instructions, and the program instructions are executed by a processor to implement: obtaining The first configuration information of each sandbox in the one or more sandboxes and the second configuration information of the software to be tested are based on the first configuration information of each sandbox and the second configuration information.
  • a target sandbox matching the software under test is determined in the one or more sandboxes; calling the target sandbox to perform symbolic analysis on the software under test to obtain corresponding functions of the software under test
  • the equivalent execution path of the target calling the target sandbox to execute the target equivalent execution path, and recording the execution trajectory corresponding to the target equivalent execution path of the software under test and the system resources called, the target equivalent execution
  • the path is one or more of equivalent execution paths corresponding to each function of the software under test; the path is determined according to the execution trajectory and the called system resources.
  • the test software is malicious behavior; when the presence of the malicious behavior test software, the test software is determined as malware, malicious acts and the output corresponding to the software under test.
  • the computer-readable storage medium may be an internal storage unit of the server according to any one of the foregoing embodiments, such as a hard disk or a memory of the server.
  • the computer-readable storage medium may also be an external storage device of the server, such as a plug-in hard disk, a Smart Media Card (SMC), and a Secure Digital (SD) card provided on the server. , Flash card (Flash card) and so on.
  • the computer-readable storage medium may further include both an internal storage unit of the server and an external storage device.
  • the computer-readable storage medium is used to store the computer program and other programs and data required by the server.
  • the computer-readable storage medium may also be used to temporarily store data that has been or will be output.
  • the program can be stored in a computer-readable storage medium.
  • the program When executed, the processes of the embodiments of the methods described above may be included.
  • the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random, Access Memory, RAM).

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Debugging And Monitoring (AREA)

Abstract

Les modes de réalisation de la présente invention concernent un procédé de détection de logiciel malveillant et un dispositif associé. Le procédé consiste : à acquérir des premières informations de configuration de chaque bac à sable parmi un ou plusieurs bac(s) à sable et des secondes informations de configuration de logiciel soumis à un test; et déterminer, selon les premières informations de configuration de chaque bac à sable et les secondes informations de configuration, un bac à sable cible correspondant au logiciel parmi le(s) bac(s) à sable; appeler le bac à sable cible pour mettre en oeuvre une analyse d'exécution de symboles sur le logiciel, de façon à acquérir un chemin d'exécution équivalent correspondant à chaque fonction du logiciel; appeler le bac à sable cible pour exécuter un chemin d'exécution équivalent cible, et enregistrer une trajectoire d'exécution et une ressource système appelée correspondant au trajet d'exécution équivalent cible exécuté par le logiciel; déterminer, en fonction de la trajectoire d'exécution et de la ressource système appelée, si le logiciel présente un comportement malveillant; si le logiciel présente un comportement malveillant, déterminer que le logiciel est un logiciel malveillant, et produire le comportement malveillant correspondant au logiciel. La présente invention permet d'améliorer la granularité de détection de logiciels malveillants.
PCT/CN2018/108474 2018-07-27 2018-09-28 Procédé de détection de logiciel malveillant et dispositif associé WO2020019505A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201810851519.9A CN109101815B (zh) 2018-07-27 2018-07-27 一种恶意软件检测方法及相关设备
CN201810851519.9 2018-07-27

Publications (1)

Publication Number Publication Date
WO2020019505A1 true WO2020019505A1 (fr) 2020-01-30

Family

ID=64848078

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2018/108474 WO2020019505A1 (fr) 2018-07-27 2018-09-28 Procédé de détection de logiciel malveillant et dispositif associé

Country Status (2)

Country Link
CN (1) CN109101815B (fr)
WO (1) WO2020019505A1 (fr)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115080061A (zh) * 2022-06-28 2022-09-20 中国电信股份有限公司 反序列化攻击检测方法、装置、电子设备及介质

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110287700B (zh) * 2019-05-14 2021-06-29 北京邮电大学 一种iOS应用安全分析方法及装置
CN111475808B (zh) * 2020-04-08 2022-07-08 苏州浪潮智能科技有限公司 一种软件安全性分析方法、系统、设备及计算机存储介质
CN111797393B (zh) * 2020-06-23 2023-05-23 安天科技集团股份有限公司 基于gpu恶意挖矿行为的检测方法与装置
CN116861418B (zh) * 2023-09-05 2023-12-22 北京华云安信息技术有限公司 面向32位Windows沙盒的渗透测试方法、装置、设备及存储介质
CN117521087B (zh) * 2024-01-04 2024-03-15 江苏通付盾科技有限公司 一种设备风险行为检测方法、系统及存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103646213A (zh) * 2013-09-26 2014-03-19 北京神州绿盟信息安全科技股份有限公司 一种恶意软件的分类方法和装置
CN106055479A (zh) * 2016-06-01 2016-10-26 中国科学院信息工程研究所 一种基于强制执行的Android应用软件测试方法
CN106570394A (zh) * 2016-11-10 2017-04-19 厦门安胜网络科技有限公司 一种检测恶意程序的方法
CN107832105A (zh) * 2017-11-24 2018-03-23 南昌黑鲨科技有限公司 一种应用程序启动方法、启动装置及计算机可读存储介质

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102034050A (zh) * 2011-01-25 2011-04-27 四川大学 基于虚拟机和敏感Native API调用感知的恶意软件动态检测方法
US9613209B2 (en) * 2011-12-22 2017-04-04 Microsoft Technology Licensing, Llc. Augmenting system restore with malware detection
CN102945347B (zh) * 2012-09-29 2016-02-24 中兴通讯股份有限公司 一种检测Android恶意软件的方法、系统及设备

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103646213A (zh) * 2013-09-26 2014-03-19 北京神州绿盟信息安全科技股份有限公司 一种恶意软件的分类方法和装置
CN106055479A (zh) * 2016-06-01 2016-10-26 中国科学院信息工程研究所 一种基于强制执行的Android应用软件测试方法
CN106570394A (zh) * 2016-11-10 2017-04-19 厦门安胜网络科技有限公司 一种检测恶意程序的方法
CN107832105A (zh) * 2017-11-24 2018-03-23 南昌黑鲨科技有限公司 一种应用程序启动方法、启动装置及计算机可读存储介质

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115080061A (zh) * 2022-06-28 2022-09-20 中国电信股份有限公司 反序列化攻击检测方法、装置、电子设备及介质
CN115080061B (zh) * 2022-06-28 2023-09-29 中国电信股份有限公司 反序列化攻击检测方法、装置、电子设备及介质

Also Published As

Publication number Publication date
CN109101815B (zh) 2023-04-07
CN109101815A (zh) 2018-12-28

Similar Documents

Publication Publication Date Title
WO2020019505A1 (fr) Procédé de détection de logiciel malveillant et dispositif associé
US10887328B1 (en) System and method for detecting interpreter-based exploit attacks
US20210209225A1 (en) Methods and apparatus for control and detection of malicious content using a sandbox environment
US10055585B2 (en) Hardware and software execution profiling
Yin et al. Panorama: capturing system-wide information flow for malware detection and analysis
Bläsing et al. An android application sandbox system for suspicious software detection
US9594904B1 (en) Detecting malware based on reflection
US8296848B1 (en) Control flow redirection and analysis for detecting vulnerability exploitation
Carmony et al. Extract Me If You Can: Abusing PDF Parsers in Malware Detectors.
US20200193031A1 (en) System and Method for an Automated Analysis of Operating System Samples, Crashes and Vulnerability Reproduction
US11409862B2 (en) Intrusion detection and prevention for unknown software vulnerabilities using live patching
US20200012793A1 (en) System and Method for An Automated Analysis of Operating System Samples
EP2881877A1 (fr) Dispositif d'exécution de programme et dispositif d'analyse de programme
US9519789B2 (en) Identifying security vulnerabilities related to inter-process communications
US20220138314A1 (en) Automated generation of a sandbox configuration for malware detection
Tromer et al. Droiddisintegrator: Intra-application information flow control in android apps
US20230376587A1 (en) Online command injection attacks identification
US20230141948A1 (en) Analysis and Testing of Embedded Code
US11283836B2 (en) Automatic decoy derivation through patch transformation
Patel et al. Evaluation of obfuscated Andriod malware
Maasmi Data Collection Probe with Applications State Identifier for ML Based Exfiltration Detection
CN116821904A (zh) 一种基于大数据的移动恶意程序监测系统
CN114510713A (zh) 检测恶意软件的方法、装置、电子设备及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 18927285

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 11/05/2021)

122 Ep: pct application non-entry in european phase

Ref document number: 18927285

Country of ref document: EP

Kind code of ref document: A1