Sandbox analysis method, device, electronic equipment and storage medium

Abstract

Embodiments of the invention disclose a sandbox analysis method and device, electronic equipment and a storage medium, and relate to the technical field of information security. The sandbox analysis method and device can greatly reduce the detection evasion probability of samples, and effectively improve the sandbox detection capability. The method comprises the steps of monitoring target operation related to system restarting and input in a program sample of a sandbox, and performing corresponding recording; when a virtual machine of the sandbox is shut down, storing a running field of the virtual machine; determining whether the target operation exists in the running of the program sample or not according to recorded data; and under the condition that the target operation exists in the running of the program sample, restarting the virtual machine to continuously perform data acquisition on the program sample. The sandbox analysis method and device can be applied to the sandbox analysis.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a sandbox analysis method, device, electronic equipment and storage medium. Background technique [0002] In the analysis of malware, dynamic sandbox is usually used for analysis, and the operating environment of software is simulated by virtual machine, so that malware can be executed normally in the sandbox and its malicious behavior can be found. [0003] Generally, the maximum analysis time of the sandbox is fixed, such as ten minutes. If the sample has not finished running after ten minutes, the virtual machine in the sandbox will be forced to shut down, and then the collected behavior will be analyzed. If the sample finishes running within ten minutes, it is considered that the behavior collection is completed, and the virtual machine will automatically shut down at this time. [0004] However, the inventors found that some program samples will activel...

AI Technical Summary

Problems solved by technology

[0004] However, the inventors found that some program samples will actively restart the operating system through direct or indirect methods during operation, and continue to perform some malicious behaviors after restarting, but at this time the sandbox system still thinks that the program samples have been The analysis is complete and there is no risk, resulting in many dangerous program samples not being detected, which greatly affects the detection ability of the sandbox

Images