Method for processing hidden process based on hardware simulator

Abstract

The invention belongs to the technical field of network security and particularly relates to a method for processing a hidden process based on a hardware simulator. By establishing a running environment of malicious codes in hidden codes in a hardware simulating environment and operating and controlling instructions simulating a CPU and various accessing operations simulating a memory, marked by a CR3 value in a CR3 register, the hidden process is detected, the running process of the hidden process is monitored, and the running information of the malicious codes in the hidden process is recorded by a data acquisition module; and the invention also provides a mirror image which extracts the malicious codes directly from a virtual memory. All instructions of a virtual CPU and various hardware operations of a hardware simulating device are executed in simulation after translation and are not executed in a real machine by using code segments directly, and the running time of the instruction in the instruction running process can be accurately calculated, thus realizing fully transparent analysis of the malicious codes in the hidden process.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a method for processing hidden processes based on a hardware simulator. Background technique [0002] With the continuous development and progress of society, computers are more and more widely used in various fields of society. Due to the widespread existence of software vulnerabilities and the lack of security awareness of users, Trojan horses spread faster and faster, the scope of infection continues to expand, and the damage caused is becoming more and more serious. At the same time, due to the continuous deepening of the research on the underlying technology, more and more means of hiding the process are used by Trojan horses. Due to the limitations of analysis efficiency and implementation environment, traditional security protection methods are difficult to shorten the response cycle, and the response speed has gradually been unable to adapt to this n...

AI Technical Summary

Problems solved by technology

[0019] To sum up, the main flaws in the current detection of hidden processes are: hidden processes and malicious codes are at the same level, and are easy to be detected by malicious codes and generate corresponding countermeasures; excessive reliance on the integrity of operating system kernel data, virtualization-based analysis technology virtualization The degree of transformation is not high, and the accuracy rate is not high

And the method for analyzing malicious code in the hidden process is to use the method of Hook system API to monitor the process, malicious code can make it invalid by reading the system file on the hard disk and covering the code in the memory; the virtual machine that the virtual machine adjustment method adopts, Rely on local CPU, not simulate multiple CPUs

Images