Program code execution behavior monitoring method and computer equipment

Abstract

The invention provides a program code monitoring method which comprises the steps that computer equipment executes a first code corresponding to a first program code in a virtual execution environment, the first code belongs to an external code, and the external code is a code called in the first program code except an internal code; the external code comprises a system code provided by an operating system of the computing equipment, and the internal code is a code of a process generated by the first program code; in the process of executing the first code, if the second code belongs to the internal code, before the second code is executed, the computer equipment switches the execution environment of the first program code into a simulation execution environment, and the second code is a code to be executed; the second code is executed in the simulated execution environment. According to the method, under the condition that the aim of monitoring the instruction level of the program code is achieved, the performance overhead is reduced, and the operation efficiency of the system is improved.

Description

technical field

[0001] The present application relates to the field, and more specifically, relates to a method for monitoring program code execution behavior and computer equipment. Background technique

[0002] With the development of computer technology, computer security has become the focus of attention. With the continuous development of advanced persistent threat (APT) attacks, advanced malicious codes are also changing with each passing day. Therefore, how to analyze a program code so as to determine whether the program code is a malicious program becomes a problem to be solved.

[0003] The techniques for analyzing program code are mainly divided into static program analysis and dynamic program analysis. Static program analysis refers to the technology of analyzing the static features and functional modules of the program code without running the program code. Static program analysis techniques, for example, analyze the statistical characteristics of instructions...

Images