Malicious code behavior analyzer

Abstract

The invention provides a malicious code behavior analyzer which comprises a storage module, a display module, a network data flow collecting and reducing module, a central processor, an integrated management module, a network flow behavior analysis engine, a file static analysis engine, a file dynamic behavior analysis engine, a WEB threat detection module, a network behavior abnormity detection module, a threat detection module, a file threat detection module, a file abnormal behavior module and a sandbox module. According to the analyzer, the network data flow can be recombined and reduced, abnormal network behaviors are detected, suspected files can be reduced, extracted and analyzed, and placed in a sandbox template to monitor and analyze file behaviors dynamically, results of static analysis and dynamic analysis are combined to provide the degree of information safety risk of the suspected files, and the technical problem that high-level malicious code attacks which is increasingly serious cannot be handled is solved.

Description

technical field [0001] The invention relates to the field of electric power technology, in particular to a malicious code behavior analysis device. Background technique [0002] In recent years, network security issues have become increasingly prominent, and hacker intrusions and network attacks are increasing. With the continuous popularization of computer network technology, the number of times the public uses computers is increasing. In particular, the construction of public information infrastructure has promoted the government and enterprises to increasingly rely on various information systems, and some businesses and systems related to the national economy and people's livelihood have encountered unprecedented security challenges. For example, the WikiLeaks website leaked a large amount of confidential government information; Citigroup was attacked by hackers, resulting in the theft of more than 360,000 customer account information; the CSDN website was attacked, resu...

AI Technical Summary

Problems solved by technology

[0004] A malicious code behavior analysis device provided by an embodiment of the present invention realizes reorganization and restoration of network data streams, realizes abnormal detection of network behaviors, restores, extracts and analyzes suspicious files, and places suspicious files in a sandbox template It realizes the dynamic monitoring and analysis of file behavior, and combines the results of static analysis and dynamic analysis to give the information security risk degree of suspicious files, which solves the current technical problem of being unable to cope with increasingly severe high-level malicious code attacks

Images