Virus detecting method, device, storage medium and computer equipment

Abstract

The invention discloses a virus detecting method, a virus detecting device, a storage medium, and computer equipment provided by the embodiment. When the file to be detected generates a networking behavior during the operation of importing the file to be detected into the virtual machine, the embodiment may intercept the network request corresponding to the networking behavior to make the networkrequest unable to be sent to the real server, but directly obtain the pre-stored corresponding simulated response data, thereby avoiding the malware in the file to be detected from attacking the hostmachine and other equipment of the external network through the network, also ensuring that the file to be detected may be run to obtain information about all the networking behaviors that may be generated by the file to be detected, and further improving the detection accuracy and detection efficiency of the virus of the file to be detected.

Description

technical field [0001] The invention relates to the field of sample detection, in particular to a virus detection method, device, storage medium and computer equipment. Background technique [0002] In recent years, with the rapid development of computer network technology, there are more and more types of malicious software. The traditional virus detection method that relies on the update of the virus database of anti-virus software can no longer meet the needs of virus detection. The analysis of malicious software is often implemented by using virtual machine technology, so as to improve the security of the virus analysis process and save hardware resources. [0003] Specifically, the virus collection tool uploads the files to be detected (such as various known or unknown virus program codes) to the server (referred to as the host computer) through the network, and the virtual machine in the host computer runs the files to be detected to obtain the files to be detected. T...

AI Technical Summary

Problems solved by technology

[0004] However, in the process of running the file to be detected, the virtual machine is usually connected to the host machine through NAT (Network Address Translation, Network Address Translation), and accesses the external network through the host machine network. If there is malware in the file to be detected, such as figure 1 As shown in the schematic flow diagram of the scenario, the malicious software

Images