A kind of API log monitoring method and device

Abstract

The invention provides a method and a device for monitoring application program interface (API) logs. The method comprises the following steps of: judging whether all modules which are generated in the running process of a target sample in progresses and modules which are subjected to dynamic loading subsequently are credible or not; and acquiring each API log generated in the running process of the target sample, if the module to which the API log belongs is credible, stopping recording the API log, and otherwise, recording the API log. By the method and the device, the safety of the modules to which API belongs can be determined accurately.

Description

technical field [0001] The invention relates to the field of computer anti-virus, in particular to an API log monitoring method and device. Background technique [0002] In the field of anti-virus, the incremental samples generated by computers are massive, and the existing automatic analysis of samples can be classified into two categories: [0003] 1. Static automatic analysis: Qualify samples through disassembly code analysis, sample static content comparison, and a system heuristic rule comparison. The advantages of this static automatic analysis technology are: fast, high throughput, can handle a large number of samples every day, and give results; the disadvantage is: the accuracy is average, the malicious behavior of the samples cannot be given, and the encrypted There are many false positives and false negatives in the sample. [0004] 2. Dynamic automatic analysis: execute the sample dynamically, record the dynamic behavior during the running process of the sample...

AI Technical Summary

Problems solved by technology

The advantages of this static automatic analysis technology are: fast, high throughput, can handle a large number of samples every day, and give results; the disadvantage is: the accuracy is average, the malicious behavior of the samples cannot be given, and the encrypted There are many false positives and false negatives in the sample

The advantages of this dynamic automatic analysis technology are: high accuracy, can clearly point out the malicious behavior of samples and can accurately characterize samples; the disadvantages are: low speed, low throughput, if you want to deal with massive samples, you need a lot of hardware resource investment

[0014] 1. There is a potential risk of missing the API flow log of a virus with the same name as the system file;

[0015] 2. For the virus method of replacing system files, the API flow log of the virus will be missed;

[0017] 4. For the file image pointing to the normal file of the system, but the API flow log of the content of the virus in the memory is missing;

[0018] 5. For the virus method of renaming and calling the system file name, a large amount of garbage information will be generated

Images