An automatic sample behavior collection method and a device and a system therefor

Abstract

The embodiments of the invention provide an automatic sample behavior collection method and a device and a system therefor. The method comprises the steps that when receiving to-be-processed samples, a log collector applies to a task distributor for a behavior collection unit having the same type as the to-be-processed samples; when the task distributor returns the behavior collection unit, the log collector triggers the behavior collection unit to process the to-be-processed samples and record behavior in logs; the log collector reads logs from the behavior collection unit after a first preset period of time and notifies the task distributor to release the behavior collection unit. The device and the system are used for implementing the automatic sample behavior collection method. Virtual resources of automatic sample behavior collection can be managed and allocated, so that the stable operation of the automatic sample behavior collection system is guaranteed.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of network security, and in particular to an automatic sample behavior collection method and its device and system. Background technique [0002] The automatic sample behavior collection system is mainly used for resource management and software behavior collection in the virtual local area. Usually, the behavior collection system puts the behavior collection program and the samples to be analyzed in a controllable operating environment at the same time, starts the samples to be analyzed and the behavior collection program, and collects the behavior sequences collected by the behavior collection program and uploads them to related systems for further analysis. In order to realize the behavior collection of a large number of samples, it is necessary to organize and manage the virtual environment used to complete the behavior collection. [0003] Since the samples to be analyzed may...

AI Technical Summary

Problems solved by technology

However, the above patent application does not consider the possibility that malicious samples may damage the guest operating system and network environment on which it is running.

If the malicious sample destroys the client operating system through system vulnerabilities, no behavior information of the sample can be collected at this time; and if the malicious sample uses ARP attack to attack the connected network environment, the entire business system may be paralyzed

In addition, there is no patent or literature that proposes a virtualized resource management and allocation strategy suitable for automated sample behavior collection

Images