Method and system for dynamic multilevel behavioral analysis of malicious code

Abstract

The invention relates to a method and a system for dynamic multilevel behavioral analysis of malicious code. The method comprises the following steps of running the malicious code in a hardware simulator, and extracting command information executed by the malicious code in a running process; intercepting a key function executed by the malicious code in a simulation memory of the hardware simulator in the running process of the malicious code; constructing a multilevel malicious code behavior diagram according to the obtained command information and the key function information of the malicious code; and utilizing the multilevel malicious code behavior diagram to carry out forward or adverse behavioral analysis from any node according to the analysis requirement. The system comprises the hardware simulator, a command information extraction module, a function information extraction module, a behavior diagram construction module and a behavioral analysis module. According to the method and the system, the analytical ability of a behavior mechanism of the malicious code is improved to provide a sufficient support for detection and prevention of the malicious code.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a dynamic multi-level malicious code behavior analysis method and system. Background technique [0002] Computers and the Internet have gradually become an important part of society and life. At the same time, the potential harm of malicious code, one of the main threats, is becoming increasingly serious, and has become one of the important issues that need to be faced to ensure computer and Internet security. The technology of malicious code is constantly developing, and it is constantly updated with the advancement of computer and Internet technology, making the security problems it faces increasingly severe. Malicious codes continue to produce new variants and even new types, so malicious code analysis has become an enduring research topic that cannot be ignored. How to analyze the malicious code behavior most effectively and fully analyze the malicious c...

AI Technical Summary

Problems solved by technology

[0005] In view of the current malicious code dynamic taint analysis, which has weak taint information organization and utilization capabilities, and is limited to instruction-level data and lacks upper-level information, the purpose of the present invention is to provide a dynamic multi-layer malicious code behavior analysis method and system. By proposing a taint data propagation graph combining instruction level and function level, recording and integrating instructions and upper-level function operations during the dynamic execution of malicious code, so as to realize the extraction and analysis of instruction and function-level behavior sequences during malicious code execution, While the fine-grained instruction information is sufficient, it also provides function information with semantic information, thereby improving the ability to analyze malicious code behavior mechanisms and providing sufficient support for detection and prevention

Images