A sandbox monitoring method and device

Abstract

Embodiments of the present invention provide a sandbox monitoring method and device, which are used to reduce the possibility of malicious code reverse engineering by checking known Hook points. The method includes: starting the program to be analyzed in the sandbox; determining the process ID of the program to be analyzed; during the running of the program to be analyzed, determining that the interrupt currently generated or the specific instruction executed is a system call; determining the system call Generated by the process identified by the process ID of the program to be analyzed; obtain the system call and its parameters, and obtain the result of the system call, so that the obtained system call and its parameters and the result of the system call Passed to the sandbox analysis process for analysis.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a sandbox monitoring method and device. Background technique [0002] With the development and popularization of computer technology, computer applications have fully penetrated into people's work and life, and have become an indispensable important tool and home entertainment equipment for people. With the widespread use of computers, corresponding computer security issues will also arise. Faced with the temptation of money, some hackers will take advantage of computer security holes to steal user's computer information and destroy the computer system through corresponding malicious programs, causing huge economic losses to the majority of computer users. [0003] In order to detect related malicious programs, computer security researchers have developed corresponding antivirus tools, such as running a piece of unknown code in a sandbox, and analyzing whether the unkno...

AI Technical Summary

Problems solved by technology

[0004] At present, the sandbox is implemented inside the virtual machine and monitored through hooks (Hook). Hook is a method for monitoring system call sequences by injecting code when executing system calls. However, this monitoring method implements The difficulty is low, and it is easy for malicious code to find that it is running in the sandbox by checking the well-known Hook points, so that the relevant malicious code in the sample will not be executed in the sandbox environment, which will bring security researchers to analyze the malicious code. interference

Images