Method and device for automatically identifying malicious codes during software running

Abstract

The invention provides a method and device for automatically identifying malicious codes during software running. The method comprises the steps: starting and replacing, and enabling a CPU to start ahardware virtualization function, and enabling a current operating system to run in a Guest mode; replacing the value of the specific register in the Guest mode with a first monitoring function; or, initializing the value of the specific register of the CPU in the Guest mode as a first monitoring function; the CPU starts a hardware virtualization function, and the current operating system is set to run in a Guest mode; a first collection step, wherein the first monitoring function collects a behavior set of the to-be-detected software when the to-be-detected software runs in the Guest mode; and a detection step: detecting the behavior set by utilizing a pre-constructed malicious code behavior detection model, and automatically identifying whether the to-be-detected software contains malicious codes or not. According to the scheme of the invention, the running behavior of the software can be comprehensively monitored, and the malicious code can be automatically identified based on the running behavior of the software.

Description

technical field [0001] The invention relates to the field of computer information security, in particular to a method and device for automatically identifying malicious codes when software is running. Background technique [0002] Current methods for identifying malicious code generally include methods such as file static detection, heuristic detection, and AI learning. Although the technology has a certain effect on identifying malicious codes, there are many false alarms. Since the active defense technology cannot accurately identify malicious codes, it can only blindly report suspicious behaviors to the police, which will increase user distress. [0003] The existing active defense technology mainly monitors the behavior of the program through the standard interface provided by the system or through the hook (Hook). However, more and more operating systems pay more and more attention to their own security, and Patch kernel code is no longer allowed. , which makes it imp...

AI Technical Summary

Problems solved by technology

[0005] In order to solve the above-mentioned technical problems, the present invention proposes a method and device for automatically identifying malicious codes when the software is running, to solve the problem that the security software in the prior art has a low recognition ability for identifying malicious codes due to the inability to effectively monitor the program behavior. , technical problems with many false positives

Images