A sample sandbox analysis method and device

Abstract

The invention provides a sample sandbox analysis method and device, and the method comprises the steps of obtaining suspicious samples, and sending the suspicious samples to available containers in asandbox container group through a submission interface; calling the available container to complete execution of the suspicious sample; and judging whether the suspicious sample is a malicious sampleaccording to the behavior information of the suspicious sample in the available container. According to the invention, the containers in the sandbox container group are used for replacing a traditional virtual machine to complete sandbox analysis of suspicious samples, and hundreds to thousands of containers in the sandbox container group can be deployed due to the fact that resources occupied bythe containers are small, so that the detection and analysis of large-scale malicious samples can be completed on the premise that the resource occupancy rate is low.

Description

technical field [0001] The invention relates to the field of malicious sample detection, in particular to a sample sandbox analysis method and device. Background technique [0002] In recent years, as network security issues have become increasingly prominent, people have increasingly applied sandbox technology to malicious sample detection, that is, submitting suspicious samples to the sandbox for dynamic simulation operation can not only avoid unknown malicious behaviors from affecting real The destruction of the system can also capture and analyze the behavior information of suspicious samples, thus providing a new solution for the detection of malicious samples. [0003] The current sandbox detection of malicious samples usually uses virtual machine technology, that is, a device is deployed as multiple virtual machine systems, and suspicious samples are input into the virtual machine systems for behavior analysis to determine whether suspicious samples are malicious samp...

AI Technical Summary

Problems solved by technology

[0004] However, due to the CPU, memory, and hard disk requirements of the virtual machine system itself, it has high requirements for equipment and high performance loss. Usually, only 10 to 40 virtual machine systems can be deployed on one device. Therefore, it cannot cope with large-scale Detection and analysis of suspicious samples, resulting in low efficiency and performance of sample sandbox analysis

Images