Sandbox-based malicious program behavior analysis processing method and system

Abstract

The invention provides a sandbox-based malicious program behavior analysis processing method and system, the method is executed in a network programming virtual execution environment, and the method comprises the following steps: starting a sandbox daemon, loading configuration information and loading a sandbox program main component; the task management component performs all necessary initialization operations and monitors a communication interface; the task management component starts to run tasks and generates a working environment for each task; the task instance control component enters a working directory and prepares to start a task; the sandbox virtual machine agent component cooperates with the task instance control component to start a task; the task control instance controls and reports a task state; and the task scheduling component collects the completed tasks, and calls each functional component to process and file the tasks.

Description

technical field [0001] The disclosure belongs to the technical field of malicious program behavior interconnection, and in particular relates to a sandbox-based malicious program behavior analysis and processing method and system. Background technique [0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art. [0003] In recent years, with the rapid development of the Internet, many new devices connected to the Internet have emerged, which has led to a rapid increase in the number of devices connected to the Internet worldwide. The resulting new business models and the need for closer interaction between humans and the world are also Gradually developing, the degree of connection between people and hardware, machines and the Internet continues to increase. It is no exaggeration to say that today's Internet of Things and embedded devices are widely distributed in every corner of...

AI Technical Summary

Problems solved by technology

In addition, the inventors found that the previous malicious codes were often designed for the x86 or x64 architecture, but now with the wide application of personal mobile terminals, the Internet of Things and embedded devices, the hardware platforms of these devices are often not the above two Architecture, but multi-architecture implementations such as MIPS and ARM architectures. This series of changes, coupled with the lack of security design flaws and many other factors, have led to a variety of malicious codes spreading on the Internet today.

In addition, for different hardware architectures and systems, it may be recognized by it so that it cannot expose the running behavior as fully as possible

Moreover, the current malicious samples will communicate with the real network when running. If the traffic generated by the malicious code is directly allowed to go to the real Internet when analyzing the malicious code, the security of other devices on the network cannot be guaranteed.

Images