A potential malware analysis method apparatus based on virtualization technology and related

Abstract

The invention discloses a potential malware analysis method based on virtualization technology and a related device. The method comprises the following steps: when an abnormal interrupt occurs to a program running in a virtualization environment, judging whether the abnormal interrupt is a hook abnormal interrupt or not; if so, the abnormal behavior type of hook abnormal interruption is determined; when the exception behavior type is read / write permission exception, the EPT entry corresponding to hook exception interrupt is replaced with normal code page to check the integrity of normal code page. When the abnormal behavior type is execution exception, the program data is obtained by executing the corresponding surrogate function according to the objective function of the hook code page, so as to perform malware analysis according to the program data. The normal code page is replaced with the hook code page by the type of hook abnormal interrupt, so that program data can be obtained when executing the proxy function corresponding to the hook code page through integrity check, malware analysis is realized under the integrity check, and the analysis efficiency is improved.

Description

technical field [0001] The present application relates to the field of computer technology, and in particular to a potential malware analysis method based on virtualization technology, a potential malware analysis device, a server, and a computer-readable storage medium. Background technique [0002] With the continuous development of information technology, malicious software is a huge threat in the field of network security. Whenever malicious software spreads through the network and causes a large outbreak, countless information is leaked and data is damaged. In the process of fighting against malware, a large number of malware uses encryption, obfuscation, and virtual machine protection technologies to encrypt and anti-debugging logic codes, which brings great disadvantages to binary analysts. [0003] In the current technology, the system descriptor table in the system is hooked, and when the program runs to some sensitive functions, the information of the program is o...

AI Technical Summary

Problems solved by technology

[0004] However, the system integrity check is introduced in the current system. When the system descriptor table is hooked, the hooked function will be found, causing the software to exit or not run the code that needs to be analyzed, and the software cannot be analyzed.

In the existing technology, it is also possible to crack the system integrity check, but it will lead to security risks and instability problems. The algorithms protected by KPP in different versions are inconsistent and difficult to achieve universality. May cause the corresponding blue screen problem

The final consequence is that the target function of the software cannot be analyzed, in other words, the maliciously executed software program cannot be analyzed

Images