Malicious program behavior capture method based on Qemu

Abstract

The invention relates to a malicious program behavior capture method based on the Qemu. The method is characterized in that a malicious program behavior capture module is directly inserted into a source code of the Qemu, a client operating system is installed on the Qemu, and then behavior capture is carried out on malicious program samples on the client operating system through the malicious program behavior capture module running in the Qemu. The method has the advantages that the malicious program behavior capture module is directly inserted into the source code of the Qemu, completely isolated from the samples running on the client operating system and located on the lower layer of the operating system, and in theory, the malicious program samples can not detect or escape the malicious program behavior capture module easily.

Description

technical field [0001] The invention belongs to the field of computer security, and further relates to the field of malicious program behavior analysis, in particular to a method for capturing malicious program behavior based on a Qemu simulator. Background technique [0002] In the field of malicious program analysis, the purpose of performing behavioral analysis on malicious programs is to obtain behavior reports of malicious programs to assist analysts in understanding the behavior of malicious programs or to detect malicious programs. At present, the detection of malicious programs mainly uses traditional security solutions based on sample signatures and abnormal attack behavior patterns, such as firewalls, intrusion protection systems, anti-virus software, network gateways, etc., which have the following problems: [0003] First, it cannot effectively respond to attacks that exploit 0day vulnerabilities. The 0day vulnerability is a new vulnerability. The static charact...

AI Technical Summary

Problems solved by technology

[0017] The technical problem to be solved by the present invention is to propose a method for capturing malicious program behavior of the Qemu emulator, which is difficult to be detected and inaccurate, aiming at the current sandbox that is easy to be bypassed, incomplete, and inaccurate in capturing malicious program behavior. bypass

Images