Anti-virus debugging method and system based on virtual sandbox
By using the convolutional neural network of the transformer model in the virtual sandbox for anti-virus debugging, the security risks and insufficient automation of anti-virus debugging in the existing technology are solved, and efficient and secure malicious code analysis and processing are achieved.
Patent Information
- Application Number
- CN202411100536.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-12
- Publication Date
- 2024-12-06
AI Technical Summary
The existing anti-virus debugging methods have security risks in direct debugging in the actual operating environment of the target code, and relying on full hardware simulation leads to high costs. The traditional virtual sandbox method relies on manual analysis to lead to insufficient automation and intelligence.
The anti-virus debugging method based on virtual sandbox is adopted, combined with the convolutional neural network of the transformer model for object code analysis, and the virtual processor creation, physical memory layout, operating system kernel data construction and exception processing are realized in the virtual sandbox. Control code execution and artificial intelligence-assisted analysis.
Improves the security and automation of anti-virus debugging, reduces costs, and provides a feasible controlled execution and processing solution for malicious code.
Smart Images
Figure CN119089435A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of anti-virus virtual sandbox, and in particular to an anti-virus debugging method and system based on virtual sandbox. Background Art
[0002] An anti-virus debugging method and system based on a virtual sandbox is an effective means to combat code obfuscation, unpacking and infectious virus detection in the field of information security, especially in the field of anti-virus. The main function of the virtual sandbox is to execute the target code in a controlled manner in a virtual environment constructed by the anti-virus engine to restore the original code, data and behavior, and then effectively identify and process the malicious code. The design and implementation of the virtual sandbox includes two important components, namely virtual environment simulation and controlled execution of the target code.
[0003] In the existing anti-virus debugging methods, there is a problem that if the anti-virus debugging of the code is directly performed in the actual running environment of the target code, there will often be security risks that are difficult to avoid. Therefore, the anti-virus debugging process needs to be simulated to improve the security protection capability, and the simulation of the existing methods mostly relies on full hardware simulation, which inevitably increases the cost of anti-virus debugging. In the existing anti-virus debugging methods based on virtual sandboxes, there is a technical problem that the traditional method for anti-virus debugging basically relies solely on human operation and debugging. Although the virtual sandbox environment provides a relatively safe simulation guarantee, the execution technology is limited to manual step-by-step analysis and code debugging, and is more dependent on the experience and code-based ability of the program controller who actually executes the debugging. Therefore, the traditional method of anti-virus debugging has a technical problem that the automation and intelligence need to be improved. Summary of the invention
[0004] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides an anti-virus debugging method and system based on a virtual sandbox. In the existing anti-virus debugging methods, if the anti-virus debugging of the code is directly performed in the actual running environment of the target code, there will often be security risks that are difficult to avoid. Therefore, the anti-virus debugging process needs to be simulated to improve the security protection capability, while the simulation of the existing methods mostly relies on full hardware simulation, which inevitably increases the cost of anti-virus debugging. The present solution creatively adopts an anti-virus virtual sandbox for anti-virus debugging, and by providing a specific calling interface and overall process for debugging using the virtual sandbox in Linux, macOS and Windows systems, the simulation and code execution of the virtual sandbox at the anti-virus debugging level are realized, thereby providing controlled execution and processing of malicious code. A powerful and safe feasible solution is provided; in the existing anti-virus debugging methods based on virtual sandbox, there is a traditional method for anti-virus debugging that basically relies solely on human operation and debugging. Although the virtual sandbox environment provides a relatively safe simulation guarantee, the execution technology is limited to manual step-by-step analysis and code debugging, and is more dependent on the experience and code-based capabilities of the program controller who actually performs the debugging. Therefore, the traditional method of anti-virus debugging has technical problems that its automation and intelligence need to be improved. This solution creatively uses a convolutional neural network combined with a transformer model to analyze the target code. By training a code analysis model suitable for different operating systems, combined with manual execution and debugging in the virtual sandbox environment, artificial intelligence code analysis is assisted, thereby ensuring the security of the virtual sandbox operating environment while also improving the efficiency and automation of the analysis.
[0005] The technical solution adopted by the present invention is as follows: The present invention provides an anti-virus debugging method based on a virtual sandbox, the method comprising the following steps:
[0006] Step S1: virtual processor creation;
[0007] Step S2: physical memory layout;
[0008] Step S3: operating system kernel data construction;
[0009] Step S4: target code analysis;
[0010] Step S5: Exception handling.
[0011] Furthermore, in step S1, the virtual processor is created to create an independent virtual processor for the execution instance of the target code. Specifically, based on the operating system structure, the code to be debugged is received as the target code for anti-virus debugging, and an independent virtual processor is created for each execution instance of the target code to ensure that the operation of different target codes in the virtual sandbox does not interfere with each other, thereby constructing a target code virtual processor.
[0012] Furthermore, in step S2, the physical memory layout is used to simplify address calculation and improve the calculation and execution efficiency of the physical address space in the virtual sandbox. Specifically, based on the target code virtual processor, in the virtual sandbox process, the virtual address space of the virtual sandbox process is mapped to the physical address space inside the virtual sandbox, and the virtual sandbox physical memory layout data is constructed.
[0013] Furthermore, in step S3, the operating system kernel data is constructed to create the data structure required for the virtual operating system, specifically, the operating system kernel data is constructed based on the virtual sandbox physical memory layout data, including GDT, LDT, IDT, TSS and page table data.
[0014] Further, in step S4, the target code analysis is used to analyze the abnormality, missing or intrusion virus in the target code in combination with artificial intelligence technology to perform virus anti-debugging, specifically reading the target code execution data from the virtual sandbox physical memory layout data and the operating system kernel data, and based on the target code execution data, using a convolutional neural network combined with a transformer model to perform target code analysis to obtain target code virus debugging analysis data, and based on the target code virus debugging analysis data, perform target code execution;
[0015] The target code is executed by setting a correct register environment required by the target code in the virtual sandbox, and performing anti-virus debugging during the execution of the target code according to the virus debugging analysis data of the target code to obtain virus debugging feedback log data;
[0016] The convolutional neural network combined with the transformer model specifically includes a transformer layer, a feedforward layer, a normalization layer, a residual connection layer and a basic convolutional subnet;
[0017] The transformer layer is used to perform feature encoding and capture the internal features and dependencies of the target code;
[0018] The feed-forward layer is used to perform feature processing of nonlinear data;
[0019] The normalization layer is used to renormalize and scale the output specifications of each layer;
[0020] The residual connection layer is used to maintain the contextual representation of feature data between layers and to optimize the gradient vanishing problem;
[0021] The basic convolutional subnet is used to extract local features of the target code and serve as a basic prediction subnet for target code analysis;
[0022] The step of using a convolutional neural network combined with a transformer model to analyze the target code and obtain target code virus debugging analysis data includes:
[0023] Step S41: constructing a transformer layer, specifically constructing a transformer model, and inputting the features of the collected and preprocessed target code data into the transformer model for encoding processing, combining the multi-head self-attention mechanism to capture feature relationships, and obtaining transformer layer feature output;
[0024] The multi-head self-attention mechanism specifically combines the query matrix, the key matrix and the value matrix to generate feature representation;
[0025] Step S42: constructing a feedforward layer, specifically, constructing a fully connected feedforward neural network layer according to the characteristic output of the transformer layer, and activating it with a nonlinear activation function to construct a feedforward layer, and outputting the feedforward layer output data;
[0026] Step S43: constructing a normalization layer, specifically, setting a normalization layer after the feedforward layer and the residual connection layer, and using a Z-score normalization method to normalize the output data of the feedforward layer and the output data of the residual connection layer to obtain normalized data;
[0027] Step S44: constructing a residual connection layer, specifically constructing a residual connection layer and combining the normalized feedforward layer output data to construct the residual connection layer, and applying the residual connection layer to the connection between the layers in the basic convolutional subnet to obtain residual connection output data;
[0028] Step S45: constructing a basic convolutional subnet, specifically constructing a basic convolutional subnet including a convolutional layer, a pooling layer and a fully connected layer, and connecting each layer support of the basic convolutional subnet through a residual connection layer to obtain a convolutional feature output, and constructing a softmax classifier to receive the convolutional feature output to perform data classification of the target code, and predict the classification data of the target code;
[0029] The target code classification data specifically includes no abnormal code, abnormal code and indeterminate code;
[0030] Step S46: training the target code analysis model, specifically, by constructing the transformer layer, constructing the feedforward layer, constructing the normalization layer, constructing the residual connection layer and constructing the basic convolutional subnet, and performing model training according to the pre-collected and pre-processed code data to obtain the target code analysis model;
[0031] Step S47: target code analysis, specifically using the target code analysis model to analyze the target code execution data to obtain target code virus debugging analysis data.
[0032] Further, in step S5, the exception handling is used to monitor the code execution process and handle the monitored code exceptions, specifically, taking over and handling the exceptions of the target code according to the virus debugging feedback log data, realizing the code execution simulation through the anti-virus virtual sandbox, and obtaining the anti-virus debugging exception type reference data;
[0033] The anti-virus debugging exception type reference data specifically refers to the execution exception type obtained through the virtual sandbox code virus inversion process, which is used to adjust and modify the target code in the actual environment.
[0034] The present invention provides an anti-virus debugging system based on a virtual sandbox, comprising a virtual processor creation module, a physical memory layout module, an operating system kernel data construction module, a target code analysis module and an exception handling module;
[0035] The virtual processor creation module is used for virtual processor creation, obtains a target code virtual processor through virtual processor creation, and performs physical memory layout according to the target code virtual processor;
[0036] The physical memory layout module is used for physical memory layout, obtains virtual sandbox physical memory layout data through physical memory layout, and sends the virtual sandbox physical memory layout data to the operating system kernel data construction module and the target code analysis module;
[0037] The operating system kernel data construction module is used for operating system kernel data construction, obtains operating system kernel data through operating system kernel data construction, and sends the operating system kernel data to the target code analysis module;
[0038] The target code analysis module is used for target code analysis, obtains virus debugging feedback log data through target code analysis, and sends the virus debugging feedback log data to the exception handling module;
[0039] The exception handling module is used for exception handling. Through exception handling, anti-virus debugging exception type reference data is obtained to complete the target code execution debugging of the anti-virus virtual sandbox.
[0040] The beneficial effects achieved by the present invention using the above scheme are as follows:
[0041] (1) In view of the technical problem that in the existing anti-virus debugging methods, if the anti-virus debugging of the code is directly performed in the actual running environment of the target code, there are often unavoidable security risks. Therefore, the anti-virus debugging process needs to be simulated to improve the security assurance capability. However, the simulation of the existing methods mostly relies on full hardware simulation, which inevitably increases the cost of anti-virus debugging. This solution creatively adopts an anti-virus virtual sandbox for anti-virus debugging. By providing a specific calling interface and overall process for debugging using the virtual sandbox in Linux, macOS and Windows systems, it realizes the simulation and code execution of the virtual sandbox at the anti-virus debugging level, thereby providing a powerful and safe feasible solution for the controlled execution and processing of malicious code;
[0042] (2) In the existing anti-virus debugging methods based on virtual sandboxes, there is a traditional method for anti-virus debugging that basically relies solely on human operation and debugging. Although the virtual sandbox environment provides a relatively safe simulation guarantee, the execution technology is limited to manual step-by-step analysis and code debugging, and is more dependent on the experience and code basic capabilities of the program controller who actually performs the debugging. Therefore, the traditional anti-virus debugging method has technical problems that the automation and intelligence need to be improved. This solution creatively uses a convolutional neural network combined with a transformer model to analyze the target code. By training a code analysis model suitable for different operating systems, combined with manual execution and debugging in the virtual sandbox environment, artificial intelligence code analysis is assisted, thereby ensuring the security of the virtual sandbox operating environment while also improving the efficiency and automation of the analysis. BRIEF DESCRIPTION OF THE DRAWINGS
[0043] Figure 1 A flowchart of an anti-virus debugging method based on a virtual sandbox provided by the present invention;
[0044] Figure 2 A schematic diagram of an anti-virus debugging system based on a virtual sandbox provided by the present invention;
[0045] Figure 3 This is a schematic diagram of the process of target code analysis in step S4;
[0046] Figure 4 A schematic diagram of an interface for performing virtual sandbox anti-virus debugging exception processing using a Windows system in step S5;
[0047] Figure 5 A schematic diagram of an interface for performing virtual sandbox anti-virus debugging exception handling using the macOS system in step S5;
[0048] Figure 6 This is a schematic diagram of an interface for using the Linux system to perform virtual sandbox anti-virus debugging exception processing in step S5.
[0049] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION
[0050] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.
[0051] In the description of the present invention, it should be understood that terms such as “upper”, “lower”, “front”, “back”, “left”, “right”, “top”, “bottom”, “inside” and “outside” indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as limiting the present invention.
[0052] Example 1, see Figure 1 The present invention provides an anti-virus debugging method based on a virtual sandbox, the method comprising the following steps:
[0053] Step S1: virtual processor creation;
[0054] Step S2: physical memory layout;
[0055] Step S3: operating system kernel data construction;
[0056] Step S4: target code analysis;
[0057] Step S5: Exception handling.
[0058] By performing the above operations, in the existing anti-virus debugging methods, there is a security risk that is often unavoidable if the anti-virus debugging of the code is directly performed in the actual running environment of the target code. Therefore, the anti-virus debugging process needs to be simulated to improve the security assurance capability, while the simulation of the existing methods mostly relies on full hardware simulation, which inevitably increases the cost of anti-virus debugging. The technical problem, this solution creatively adopts an anti-virus virtual sandbox for anti-virus debugging, and provides a specific calling interface and overall process for debugging using the virtual sandbox in Linux, macOS and Windows systems, thereby realizing the simulation and code execution of the virtual sandbox at the anti-virus debugging level, thereby providing a powerful and safe feasible solution for the controlled execution and processing of malicious code.
[0059] Example 2, see Figure 1 and Figure 2 In step S1, the virtual processor is created to create an independent virtual processor for the execution instance of the target code, specifically, according to the operating system structure, the code to be debugged is received as the target code for anti-virus debugging, and an independent virtual processor is created for each execution instance of the target code, so as to ensure that the operation of different target codes in the virtual sandbox does not interfere with each other, and the target code virtual processor is constructed;
[0060] In Linux, a virtual machine object is created through kvm_ioctl(KVM_CREATE_VM), and a virtual processor is created through kvm_ioctl(KVM_CREATE_VCPU);
[0061] In macOS, a virtual processor is created through hv_vm_create;
[0062] In Windows systems, a virtual processor is created specifically through WHvCreateVirtualProcessor.
[0063] Example 3, see Figure 1 and Figure 2 This embodiment is based on the above embodiment. In step S2, the physical memory layout is used to simplify address calculation and improve the calculation and execution efficiency of the physical address space in the virtual sandbox. Specifically, according to the target code virtual processor, in the virtual sandbox process, the virtual address space of the virtual sandbox process is mapped to the physical address space inside the virtual sandbox, and the virtual sandbox physical memory layout data is constructed;
[0064] In the Linux system, the virtual address space of the virtual sandbox process is mapped to the physical address space inside the virtual sandbox through kvm_ioctl(KVM_SET_USER_MEMORY_REGION);
[0065] In the macOS system, the virtual address space of the virtual sandbox process is mapped to the physical address space inside the virtual sandbox through hv_vm_map;
[0066] In Windows systems, the virtual address space of the virtual sandbox process is mapped to the physical address space inside the virtual sandbox through WHvMapGpaRange.
[0067] Example 4, see Figure 1 and Figure 2 This embodiment is based on the above embodiment. In step S3, the operating system kernel data is constructed to create the data structure required for the virtual operating system. Specifically, the operating system kernel data is constructed based on the virtual sandbox physical memory layout data, including GDT, LDT, IDT, TSS and page table data.
[0068] Example 5, see Figure 1 , Figure 2 and Figure 3 This embodiment is based on the above embodiment. In step S4, the target code analysis is used to analyze the abnormality, missing or intrusion virus in the target code in combination with artificial intelligence technology to perform virus anti-debugging. Specifically, the target code execution data is read from the virtual sandbox physical memory layout data and the operating system kernel data, and according to the target code execution data, a convolutional neural network combined with a transformer model is used to perform target code analysis to obtain target code virus debugging analysis data, and according to the target code virus debugging analysis data, the target code is executed;
[0069] The target code is executed by setting a correct register environment required by the target code in the virtual sandbox, and performing anti-virus debugging during the execution of the target code according to the virus debugging analysis data of the target code to obtain virus debugging feedback log data;
[0070] In Linux system, the target code is executed through kvm_ioctl(KVM_RUN);
[0071] In macOS, the target code is executed through hv_vcpu_run;
[0072] In Windows, the target code is executed through WHvRunVirtualProcessor;
[0073] The convolutional neural network combined with the transformer model specifically includes a transformer layer, a feedforward layer, a normalization layer, a residual connection layer and a basic convolutional subnet;
[0074] The transformer layer is used to perform feature encoding and capture the internal features and dependencies of the target code;
[0075] The feed-forward layer is used to perform feature processing of nonlinear data;
[0076] The normalization layer is used to renormalize and scale the output specifications of each layer;
[0077] The residual connection layer is used to maintain the contextual representation of feature data between layers and to optimize the gradient vanishing problem;
[0078] The basic convolutional subnet is used to extract local features of the target code and serve as a basic prediction subnet for target code analysis;
[0079] The step of using a convolutional neural network combined with a transformer model to analyze the target code and obtain target code virus debugging analysis data includes:
[0080] Step S41: constructing a transformer layer, specifically constructing a transformer model, and inputting the features of the collected and preprocessed target code data into the transformer model for encoding processing, combining the multi-head self-attention mechanism to capture feature relationships, and obtaining transformer layer feature output;
[0081] The multi-head self-attention mechanism specifically combines the query matrix, the key matrix and the value matrix to generate feature representation;
[0082] Step S42: constructing a feedforward layer, specifically, constructing a fully connected feedforward neural network layer according to the characteristic output of the transformer layer, and activating it with a nonlinear activation function to construct a feedforward layer, and outputting the feedforward layer output data;
[0083] Step S43: constructing a normalization layer, specifically, setting a normalization layer after the feedforward layer and the residual connection layer, and using a Z-score normalization method to normalize the output data of the feedforward layer and the output data of the residual connection layer to obtain normalized data;
[0084] Step S44: constructing a residual connection layer, specifically constructing a residual connection layer and combining the normalized feedforward layer output data to construct the residual connection layer, and applying the residual connection layer to the connection between the layers in the basic convolutional subnet to obtain residual connection output data;
[0085] Step S45: constructing a basic convolutional subnet, specifically constructing a basic convolutional subnet including a convolutional layer, a pooling layer and a fully connected layer, and connecting each layer support of the basic convolutional subnet through a residual connection layer to obtain a convolutional feature output, and constructing a softmax classifier to receive the convolutional feature output to perform data classification of the target code, and predict the classification data of the target code;
[0086] The target code classification data specifically includes no abnormal code, abnormal code and indeterminate code;
[0087] Step S46: training the target code analysis model, specifically, by constructing the transformer layer, constructing the feedforward layer, constructing the normalization layer, constructing the residual connection layer and constructing the basic convolutional subnet, and performing model training according to the pre-collected and pre-processed code data to obtain the target code analysis model;
[0088] Step S47: target code analysis, specifically using the target code analysis model to analyze the target code execution data to obtain target code virus debugging analysis data.
[0089] By performing the above operations, in the existing anti-virus debugging methods based on virtual sandbox, there is a traditional method for anti-virus debugging that basically relies solely on human operation and debugging. Although the virtual sandbox environment provides a relatively safe simulation guarantee, the execution technology is limited to manual step-by-step analysis and code debugging, and is more dependent on the experience and code-based capabilities of the program controller who actually performs the debugging. Therefore, the traditional method of anti-virus debugging has technical problems that its automation and intelligence need to be improved. This solution creatively uses a convolutional neural network combined with a transformer model to analyze the target code. By training a code analysis model suitable for different operating systems, combined with manual execution and debugging in the virtual sandbox environment, artificial intelligence code analysis is assisted, thereby ensuring the security of the virtual sandbox operating environment while also improving the efficiency and automation of the analysis.
[0090] Example 6, see Figure 1 , Figure 2 , Figure 4 , Figure 5 and Figure 6 , this embodiment is based on the above embodiment. In step S5, the exception handling is used to monitor the code execution process and handle the detected code exceptions, specifically, taking over and handling the exceptions of the target code according to the virus debugging feedback log data, realizing the code execution simulation through the anti-virus virtual sandbox, and obtaining the anti-virus debugging exception type reference data;
[0091] The anti-virus debugging exception type reference data specifically refers to the execution exception type obtained through the code virus inversion process of the virtual sandbox, which is used to adjust and modify the target code in the actual environment;
[0092] See also Figure 6 In Linux, the target code is executed through kvm_ioctl(KVM_RUN) and the exception type is returned when the target code execution triggers an exception;
[0093] See also Figure 5 , in macOS, hv_vcpu_run is used to execute the target code and return the exception type when the target code execution triggers an exception;
[0094] See also Figure 4 In Windows systems, the target code is executed through WhvRunVirtualProcessor and the exception type is returned when the target code execution triggers an exception.
[0095] Embodiment 7, see Figure 1 and Figure 2 , this embodiment is based on the above embodiment, and the present invention provides an anti-virus debugging system based on a virtual sandbox, including a virtual processor creation module, a physical memory layout module, an operating system kernel data construction module, a target code analysis module and an exception handling module;
[0096] The virtual processor creation module is used for virtual processor creation, obtains a target code virtual processor through virtual processor creation, and performs physical memory layout according to the target code virtual processor;
[0097] The physical memory layout module is used for physical memory layout, obtains virtual sandbox physical memory layout data through physical memory layout, and sends the virtual sandbox physical memory layout data to the operating system kernel data construction module and the target code analysis module;
[0098] The operating system kernel data construction module is used for operating system kernel data construction, obtains operating system kernel data through operating system kernel data construction, and sends the operating system kernel data to the target code analysis module;
[0099] The target code analysis module is used for target code analysis, obtains virus debugging feedback log data through target code analysis, and sends the virus debugging feedback log data to the exception handling module;
[0100] The exception handling module is used for exception handling. Through exception handling, anti-virus debugging exception type reference data is obtained to complete the target code execution debugging of the anti-virus virtual sandbox.
[0101] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.
[0102] While the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that many changes, modifications, substitutions and variations can be made to the embodiments without departing from the principles and spirit of the invention.
[0103] The present invention and its embodiments are described above, and such description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if ordinary technicians in the field are inspired by it, without departing from the purpose of the invention, they can design a structure and embodiment similar to the technical solution without creativity, which should belong to the protection scope of the present invention.
Claims
1. An anti-virus debugging method based on a virtual sandbox, characterized in that: The method comprises the following steps: Step S1: Create a virtual processor and construct a target code virtual processor; Step S2: Physical memory layout, constructing and obtaining the virtual sandbox physical memory layout data; Step S3: constructing operating system kernel data, specifically constructing the operating system kernel data according to the virtual sandbox physical memory layout data; Step S4: target code analysis, used to analyze the abnormality, missing or intrusion virus in the target code in combination with artificial intelligence technology, and perform virus anti-debugging, specifically, reading the target code execution data from the virtual sandbox physical memory layout data and the operating system kernel data, and performing target code analysis based on the target code execution data using a convolutional neural network combined with a transformer model to obtain target code virus debugging analysis data, and performing target code execution based on the target code virus debugging analysis data; The target code is executed by setting a correct register environment required by the target code in the virtual sandbox, and performing anti-virus debugging during the execution of the target code according to the virus debugging analysis data of the target code to obtain virus debugging feedback log data; Step S5: Exception handling, obtaining anti-virus debugging exception type reference data.
2. The anti-virus debugging method based on virtual sandbox according to claim 1, characterized in that: In step S1, the virtual processor is created to create an independent virtual processor for the execution instance of the target code. Specifically, according to the operating system structure, the code to be debugged is received as the target code for anti-virus debugging, and an independent virtual processor is created for each execution instance of the target code to ensure that the operation of different target codes in the virtual sandbox does not interfere with each other, and a target code virtual processor is constructed.
3. The anti-virus debugging method based on virtual sandbox according to claim 2, characterized in that: In step S2, the physical memory layout is used to simplify address calculation and improve the calculation and execution efficiency of the physical address space in the virtual sandbox. Specifically, based on the target code virtual processor, in the virtual sandbox process, the virtual address space of the virtual sandbox process is mapped to the physical address space inside the virtual sandbox, and the virtual sandbox physical memory layout data is constructed.
4. The anti-virus debugging method based on virtual sandbox according to claim 3, characterized in that: In step S3, the operating system kernel data is constructed to create a data structure required by the virtual operating system, and the operating system kernel data includes GDT, LDT, IDT, TSS and page table data.
5. The anti-virus debugging method based on virtual sandbox according to claim 4, characterized in that: In step S4, the convolutional neural network combined with the transformer model specifically includes a transformer layer, a feedforward layer, a normalization layer, a residual connection layer, and a basic convolutional subnet; The transformer layer is used to perform feature encoding and capture the internal features and dependencies of the target code; The feed-forward layer is used to perform feature processing of nonlinear data; The normalization layer is used to renormalize and scale the output specifications of each layer; The residual connection layer is used to maintain the contextual representation of feature data between layers and to optimize the gradient vanishing problem; The basic convolutional subnet is used to extract local features of the target code and serve as a basic prediction subnet for target code analysis.
6. The anti-virus debugging method based on virtual sandbox according to claim 5, characterized in that: In step S4, the step of using a convolutional neural network combined with a transformer model to analyze the target code and obtain target code virus debugging analysis data includes: Step S41: constructing a transformer layer, specifically constructing a transformer model, and inputting the features of the collected and preprocessed target code data into the transformer model for encoding processing, combining the multi-head self-attention mechanism to capture feature relationships, and obtaining transformer layer feature output; The multi-head self-attention mechanism specifically combines the query matrix, the key matrix and the value matrix to generate feature representation; Step S42: constructing a feedforward layer, specifically, constructing a fully connected feedforward neural network layer according to the characteristic output of the transformer layer, and activating it with a nonlinear activation function to construct a feedforward layer, and outputting the feedforward layer output data; Step S43: constructing a normalization layer, specifically, setting a normalization layer after the feedforward layer and the residual connection layer, and using a Z-score normalization method to normalize the output data of the feedforward layer and the output data of the residual connection layer to obtain normalized data; Step S44: constructing a residual connection layer, specifically constructing a residual connection layer and combining the normalized feedforward layer output data to construct the residual connection layer, and applying the residual connection layer to the connection between the layers in the basic convolutional subnet to obtain residual connection output data; Step S45: constructing a basic convolutional subnet, specifically constructing a basic convolutional subnet including a convolutional layer, a pooling layer and a fully connected layer, and connecting each layer support of the basic convolutional subnet through a residual connection layer to obtain a convolutional feature output, and constructing a softmax classifier to receive the convolutional feature output to perform data classification of the target code, and predict the classification data of the target code; The target code classification data specifically includes no abnormal code, abnormal code and indeterminate code; Step S46: training the target code analysis model, specifically, by constructing the transformer layer, constructing the feedforward layer, constructing the normalization layer, constructing the residual connection layer and constructing the basic convolutional subnet, and performing model training according to the pre-collected and pre-processed code data to obtain the target code analysis model; Step S47: target code analysis, specifically using the target code analysis model to analyze the target code execution data to obtain target code virus debugging analysis data.
7. The anti-virus debugging method based on virtual sandbox according to claim 6, characterized in that: In step S5, the exception handling is used to monitor the code execution process and handle the detected code exceptions, specifically, taking over and handling the exceptions of the target code according to the virus debugging feedback log data, realizing the code execution simulation through the anti-virus virtual sandbox, and obtaining the anti-virus debugging exception type reference data; The anti-virus debugging exception type reference data specifically refers to the execution exception type obtained through the virtual sandbox code virus inversion process, which is used to adjust and modify the target code in the actual environment.
8. An anti-virus debugging system based on a virtual sandbox, used to implement an anti-virus debugging method based on a virtual sandbox as claimed in any one of claims 1 to 7, characterized in that: It includes a virtual processor creation module, a physical memory layout module, an operating system kernel data construction module, a target code analysis module and an exception handling module.
9. The anti-virus debugging system based on virtual sandbox according to claim 8, characterized in that: The virtual processor creation module is used for virtual processor creation, obtains a target code virtual processor through virtual processor creation, and performs physical memory layout according to the target code virtual processor; The physical memory layout module is used for physical memory layout, obtains virtual sandbox physical memory layout data through physical memory layout, and sends the virtual sandbox physical memory layout data to the operating system kernel data construction module and the target code analysis module; The operating system kernel data construction module is used for operating system kernel data construction, obtains operating system kernel data through operating system kernel data construction, and sends the operating system kernel data to the target code analysis module; The target code analysis module is used for target code analysis, obtains virus debugging feedback log data through target code analysis, and sends the virus debugging feedback log data to the exception handling module; The exception handling module is used for exception handling. Through exception handling, anti-virus debugging exception type reference data is obtained to complete the target code execution debugging of the anti-virus virtual sandbox.