Method for establishing virtual machine countermeasure technology based on hardware virtualization technology

Abstract

The invention discloses a method for establishing a virtual machine countermeasure technology based on a hardware virtualization technology. The method comprises the following steps of 1, enabling CPU hardware virtualization characteristic support in a virtual machine; 2, loading a driver program to enter a Host mode; 3, taking over all input output operations and MSR (Model Specific Register) operations, and intercepting all instructions capable of generating VM Exit; 4, performing environment setting for the instructions; 5, running a monitored program; 6, when a VM Exit generation event occurs, in combination with environment information analysis, judging whether an anti-virtual machine behavior exists or not; 7, continuing to monitor a behavior of a sample until the end; and 8, outputting a final analysis result. Through the steps, monitoring of a privileged instruction is finished, an anti-virtual machine technology countermeasure method for malicious codes, which cannot be realized in a conventional method, is realized, the integrity of the sample is not destroyed, and detection is not bypassed by the malicious codes, so that the actual problem of anti-virtual machine technology countermeasure of the malicious codes is solved.

Description

[0001] 1. Technical field [0002] The invention provides a method for establishing a virtual machine countermeasure technology based on hardware virtualization technology, which relates to the virtual machine countermeasure technology in computer security, and belongs to the technical field of information security. [0003] 2. Background technology [0004] With the popularization of electronic equipment and the continuous development of computer technology, the entire society's dependence on the Internet and computers continues to grow. At this time, information security has become an issue that cannot be ignored. However, the mainstream automatic virus vulnerability analysis programs now run on virtual machines. or in the sandbox. In order to avoid the detection of the virtual machine, the malicious program uses its own dormancy technology, virtual machine detection technology, calling garbage instructions and other technologies to interfere with the detection engine. Once ...

AI Technical Summary

Problems solved by technology

At present, most software security vendors at home and abroad cannot fight against anti-virtual machines during the sandbox analysis of samples.

Images