Automatic analyzing system and method for dynamic action of malicious program

Abstract

The invention relates to an automatic analysis system and a method of malice binary program dynamic behavior. The system consists of an initialization unit, a virtual execution unit, a disassembling unit, a behavior monitoring unit and a behavior analysis unit. The method is that: the initialization unit activates a monitored program, and the virtual execution unit and the behavior monitoring unit are then loaded; the disassembling unit acquires the assembler instruction of the binary code flow of an object program, the virtual execution unit slices and generates a corresponding basic block, and the behavior monitoring unit judges whether the basic block contains any malice behavior defined by a rule base; if the basic block does contain a malice behavior, the behavior monitoring unit can transfer the command to the behavior analysis unit and record the malice behavior; after being returned, each instruction in the basic block can be virtually executed; the behavior analysis unit puts forward a malice behavior analysis report after the program execution quits or a user stops the analysis process forcibly. The invention enables complete control and analysis of malice program running behavior in a virtual environment and a detailed report can provide effective buckler aiming at the malice program.

Description

technical field [0001] The invention relates to a malicious program dynamic behavior automatic analysis system and method, and belongs to the related fields of system security and network security. The invention is used for coarse-grained analysis of the dynamic behavior of unknown malicious programs. Background technique [0002] The dynamic behavior analysis of unknown binary programs is a challenging task, which will provide the key information needed to build the core structure and function blueprint of unknown software. Most of the current researches on the analysis of unknown binary programs are manual analysis methods. [0003] The manual analysis of unknown binary programs discovers the internal functions of the program through manual debugging and tracing, which has high requirements on the experience and ability of the analysts, and the analysis results are generally incomplete. With the continuous improvement of malicious programs, the functions are more complex...

AI Technical Summary

Problems solved by technology

[0003] Manual analysis of unknown binary programs discovers the internal functions of the program through manual debugging and tracing, which requires a high level of experience and ability of the analysts, and the analysis results are often incomplete

With the continuous improvement of malicious programs, the functions are more complex, accompanied by a sharp increase in code

This poses a huge challenge to traditional manual analysis

At the same time, the traditional manual debugging technology faces many difficulties in analyzing malicious binary programs, the most important of which is the inability to fully grasp the execution control flow range of the program, so that many codes of malicious programs are executed without the debugger being able to track them.

Images