A potential malware analysis method apparatus based on virtualization technology and related

Abstract

The invention discloses a potential malware analysis method based on virtualization technology and a related device. The method comprises the following steps: when an abnormal interrupt occurs to a program running in a virtualization environment, judging whether the abnormal interrupt is a hook abnormal interrupt or not; if so, the abnormal behavior type of hook abnormal interruption is determined; when the exception behavior type is read / write permission exception, the EPT entry corresponding to hook exception interrupt is replaced with normal code page to check the integrity of normal code page. When the abnormal behavior type is execution exception, the program data is obtained by executing the corresponding surrogate function according to the objective function of the hook code page, so as to perform malware analysis according to the program data. The normal code page is replaced with the hook code page by the type of hook abnormal interrupt, so that program data can be obtained when executing the proxy function corresponding to the hook code page through integrity check, malware analysis is realized under the integrity check, and the analysis efficiency is improved.

Description

technical field

[0001] The present application relates to the field of computer technology, and in particular to a potential malware analysis method based on virtualization technology, a potential malware analysis device, a server, and a computer-readable storage medium. Background technique

[0002] With the continuous development of information technology, malicious software is a huge threat in the field of network security. Whenever malicious software spreads through the network and causes a large outbreak, countless information is leaked and data is damaged. In the process of fighting against malware, a large number of malware uses encryption, obfuscation, and virtual machine protection technologies to encrypt and anti-debugging logic codes, which brings great disadvantages to binary analysts.

[0003] In the current technology, the system descriptor table in the system is hooked, and when the program runs to some sensitive functions, the information of the program is o...

Examples

Embodiment Construction

[0045] The core of this application is to provide a potential malware analysis method based on virtualization technology, a potential malware analysis device, a server, and a computer-readable storage medium, and replace the normal code page with the hook code page by hooking the type of abnormal interruption, so that Through the integrity check, the program data is obtained when the proxy function corresponding to the hooked code page is executed, and malware analysis is realized under the integrity check, which improves the analysis efficiency.

[0046] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of this application, not all of them. Base...

technical field

[0001] The present application relates to the field of computer technology, and in particular to a potential malware analysis method based on virtualization technology, a potential malware analysis device, a server, and a computer-readable storage medium. Background technique

[0002] With the continuous development of information technology, malicious software is a huge threat in the field of network security. Whenever malicious software spreads through the network and causes a large outbreak, countless information is leaked and data is damaged. In the process of fighting against malware, a large number of malware uses encryption, obfuscation, and virtual machine protection technologies to encrypt and anti-debugging logic codes, which brings great disadvantages to binary analysts.

[0003] In the current technology, the system descriptor table in the system is hooked, and when the program runs to some sensitive functions, the information of the program is o...

Examples

Embodiment Construction

[0045] The core of this application is to provide a potential malware analysis method based on virtualization technology, a potential malware analysis device, a server, and a computer-readable storage medium, and replace the normal code page with the hook code page by hooking the type of abnormal interruption, so that Through the integrity check, the program data is obtained when the proxy function corresponding to the hooked code page is executed, and malware analysis is realized under the integrity check, which improves the analysis efficiency.

[0046] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments It is a part of the embodiments of this application, not all of them. Base...

Images