Method for catching malicious codes

Abstract

The invention discloses a method for catching malicious codes, which belongs to the technical field of network safety. The method comprises the steps of (1) configuring a hardware simulator and loading and starting a target operating system; (2) enabling the hardware simulator to read virtual memory of the target operating system, identifying all courses and an export table in a dynamic library loaded by the courses and obtaining all application program interface (API) addresses in the export table and intercepting network received API functions; (3) marking network received data packages of the courses into stain data packages; (4) enabling the hardware simulator to disassemble commands executed by current courses and calculating stain spread; and (5) judging whether current curse states in the stain spread process produce abnormal behaviors, confirming the current curses as the malicious codes if the abnormal behaviors are produced and extracting mirror images of the malicious codes from an internal memory of the target operating system. The method for catching the malicious codes achieves fully transparent analysis of the malicious codes and has high efficiency and accuracy.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a malicious code capture method based on a hardware simulator and stain propagation. Background technique [0002] With the continuous development and progress of society, computers are more and more widely used in various fields of society. Due to the widespread existence of software vulnerabilities and the lack of security awareness of users, Trojan horses spread faster and faster, the scope of infection continues to expand, and the damage caused is becoming more and more serious. Due to the limitations of analysis efficiency and user technical level, the traditional malicious code capture and analysis methods are difficult to shorten the response cycle, and the response speed has gradually been unable to adapt to this new situation. Therefore, it is necessary to improve the ability to capture and analyze malicious code. [0003] Existing malicious code c...

AI Technical Summary

Problems solved by technology

[0010] To sum up, the main drawbacks of current malicious code sample extraction are: the hidden process and malicious code are at the same level, which is easy to be detected by malicious code and generate corresponding countermeasures; only malicious code samples can be extracted, but the behavior and attack process Insufficient analysis

Images