Sandbox construction method based on mimicry thought

Abstract

The invention discloses a sandbox construction method based on a mimicry thought. The sandbox construction method can actively defend malicious attacks on a file system. According to the invention, aflow transmission module, a sandbox heterogeneous module, a mimicry decision module and a monitoring platform module are designed, and the mimicry sandbox is constructed by constructing the sandbox heterogeneous module. The sandbox is subjected to isomerization processing in the aspects of an operating system, malicious software detection behaviors, the virtual degree of the sandbox, detection report contents, caustic responsibility requirements of file analysis and detection and the like, so that the sandbox has an active defense capability. When flow passes through the sandbox system module,the sandbox system module selects k isomers from all sandbox isomers for flow processing, after a processing result is judged by the mimicry judgment module, the judgment result is used for modifyingthe abnormal rate of each isomer, when the abnormal rate of a certain isomer is higher than a certain value, offline self-cleaning operation is carried out on the isomer, and finally, a judgment result is transmitted to the monitoring platform, and returned to the service system.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a method for constructing a sandbox based on the idea of ​​mimicry. Background technique [0002] The sandbox system, also known as the unknown threat detection system, mainly detects and protects files at the application level to prevent malicious and harmful files from entering the enterprise system or spreading in the enterprise network, thereby avoiding security hazards. The sandbox system is mainly deployed on the security boundary, such as "internal and external network boundaries", "logically independent two DMZ area boundaries", "physical boundaries", etc. "Intranet and internal network boundaries" mainly refer to the boundary between the Internet and the enterprise intranet The border is the most vulnerable to attacks; "the border of two DMZ areas that are logically independent" generally refers to the internal border abstracted from the enterprise i...

AI Technical Summary

Problems solved by technology

It is difficult for the traditional sandbox system to accurately detect malicious traffic and actively defend against malicious attacks on the file system

Images