Malicious software dynamic analysis-oriented automatic interaction method for data between virtual machine and host

Abstract

The invention relates to a malicious software dynamic analysis-oriented automatic interaction method for data between a virtual machine and a host, which comprises the following steps of: S1, initializing the virtual machine, copying a daemon and a dynamic execution program to the virtual machine, and storing a current virtual machine snapshot; s2, resetting the virtual machine to the stored virtual machine snapshot, compressing a to-be-detected sample program, sending the compressed to-be-detected sample program to the virtual machine, and starting a daemon; s3, the virtual machine decompresses the compressed sample, and a dynamic execution program is used for testing; s4, the host program sends a keyboard event to simulate keyboard keys, and file copying is executed; and S5, when the host program detects that the virtual machine daemon program is ended, decompressing the compressed track flow file to a specified directory, finishing transmission of the decompressed track flow file, resetting the state of the virtual machine until the snapshot is stored, analyzing the track flow file, and finishing analysis and test of the malicious software. A network port and a shared directory do not need to be opened, risks caused in the transmission process are reduced, and the implementation is safer.

Description

Technical Field

[0001] The present invention relates to an automatic data interaction method between a virtual machine and a host computer for dynamic analysis of malicious software, and belongs to the technical field of network security. Background Art

[0002] With the development of network information technology, the application of the Internet has brought many conveniences to people, such as daily office work, social networking, shopping, and paying bills. This has led to the existence of a large amount of user privacy information and files on the Internet. Network security issues have attracted more and more attention from researchers. Among the many network security threats, malware has become the focus of research in the field of network security due to its high degree of harm and wide range of impact. Once malware exists in a computer system or device, it will cause significant losses to user data assets or computing resources.

[0003] A virtual machine (VM) is a computing environment created through software simulation, allowing a single physical computer to run multiple independent operating systems and applications. A VM can provide isolated computing resources on a single hardware platform, simulating multiple independent computer systems, thereby improving hardware resource utilization and flexibility.

[0004] In the field of network security, virtual machines are widely used to analyze and test malware, simulating network environments and avoiding damage to real systems. By examining malware behavior in an isolated environment, we can better understand its working mechanisms and develop effective defense measures. However, complex analysis tasks often require data exchange between the virtual machine and the host. In particular, dynamic analysis files are generally large in size and time-consuming to analyze, often requiring copying to the host for analysis. Currently, the main methods of data exchange include: using drag-and-drop functions to transfer files, using shared folders, using the clipboard to transfer data, and using file transfer tools such as SSH and FTP to transfer files. However, these methods require manual operation, pose risks of virus transmission and network vulnerability exploitation, cannot obtain virtual machine status, and have slow transfer speeds. They cannot meet the requirements of safe, efficient, and automated malware analysis. Summary of the Invention

[0005] In response to the shortcomings of the existing technology, the present invention provides a method and system for automated data interaction between virtual machines and hosts for dynamic analysis of malware. The method tests malware through dynamic execution programs and virtual machine daemons, records process information, monitors the status of related directories and files, and detects malware behavior. It automatically realizes the regular transmission of virtual machine status and the secure transmission of large files without human intervention.

[0006] Explanation of terms:

[0007] 1. PID: Process Identifier PID (Process Identifier) ​​is a unique identifier assigned by the operating system to each process, which is used to distinguish and manage different processes.

[0008] 2. Base64: Base64 is a method of representing binary data based on 64 printable characters. It is one of the most common encoding methods for transmitting 8-bit bytecode on the Internet.

[0009] The technical solutions of the present invention are as follows:

[0010] The present invention provides a method for automatic data interaction between a virtual machine and a host computer for dynamic analysis of malware, comprising:

[0011] S1: Initialize the virtual machine, copy the daemon and dynamic execution program to the virtual machine, and save the current virtual machine snapshot;

[0012] The dynamic execution program is used to start the sample program to be detected and record the assembly instructions and register values ​​during the execution of the sample program to be detected; wherein the sample program to be detected represents the suspected malware to be detected;

[0013] The daemon is used to start dynamic execution programs, monitor specified directories, and interact with the host. The computer where the virtual machine and analysis program are deployed is called the host, and the analysis program is called the host program. The host program has functions such as initializing the virtual machine, sending samples, decompressing, analyzing traces, and reading virtual machine messages.

[0014] S2: Reset the virtual machine to the saved virtual machine snapshot, compress the sample program to be tested and send it to the virtual machine, and start the daemon program;

[0015] S3: The virtual machine decompresses the compressed sample, i.e., the compressed sample program to be tested, and uses the dynamic execution program for testing;

[0016] S4: The host program sends a keyboard event to simulate keyboard keystrokes and execute file copying;

[0017] S5: The host program detects the end of the virtual machine daemon program and decompresses the compressed trace stream file to the specified directory (a directory created in the host to store the decompressed trace stream file). After the decompressed trace stream file is transferred, the virtual machine state is reset to the saved snapshot, the trace stream file is parsed, and the malware analysis and testing is completed.

[0018] Preferably, according to the present invention, the method of initializing a virtual machine, copying a daemon program and a dynamic execution program to the virtual machine, and saving a snapshot of the current virtual machine includes:

[0019] Add an environment variable named ShareInfo to the specified registry path in the virtual machine (HKEY_CURRENT_USER\Environment) with an empty value; copy the daemon and dynamic execution program to the virtual machine;

[0020] Create a test directory in the virtual machine to store the decompressed sample program to be tested. The test directory contains multiple files, such as doc, pdf, c, etc.; create a compressed directory to store the compressed trace stream files to facilitate deletion and copying operations; set the blank position of the compressed directory, that is, set the x and y coordinates of any blank space in the compressed directory window, where x represents the width of the compressed directory window and y represents the height of the compressed directory window. Set the x coordinate to 8 / 10 of the window width and the y coordinate to 8 / 10 of the window height.

[0021] Save the current virtual machine snapshot.

[0022] Preferably, according to the present invention, resetting the virtual machine to a saved virtual machine snapshot, compressing the sample program to be tested and sending it to the virtual machine, and starting the daemon program; including:

[0023] Use compression software to compress the sample program to be tested to prevent it from running inadvertently. After compression, send it to the virtual machine, start the daemon program in the virtual machine, set an interval (60 seconds), read the virtual machine's environment variable ShareInfo once every interval, use base64 to decode the information stored in the environment variable ShareInfo, and obtain the system status and the status of the sample to be tested;

[0024] System status includes the number of times files in a directory are created, written, deleted, modified, or renamed, whether the directory is set to hidden, and the size of the execution trace flow file;

[0025] The status of the sample to be tested is the PID and running status of the sample program to be tested.

[0026] According to a preferred embodiment of the present invention, a virtual machine decompresses a compressed sample, i.e., a compressed sample program to be tested, and performs testing using a dynamic execution program; the process includes:

[0027] After the daemon in the virtual machine is started, it decompresses the compressed sample into the test directory;

[0028] The dynamic execution program starts the decompressed compressed sample, that is, starts the sample program to be tested, and records the register values ​​during the execution of the sample program to be tested;

[0029] Record the process ID of the sample program to be tested, and monitor the status of the test directory and the files in the test directory;

[0030] Test directory status to see if the directory is hidden or deleted;

[0031] File status includes file creation, reading, writing, deletion, and renaming;

[0032] Record the test directory status and file status, set an interval (60 seconds), encode the test directory status and file status in base64 at each interval and save them to the environment variables in the registry (HKEY_CURRENT_USER\Environment\ShareInfo item), and send a broadcast message to enable the host to obtain the latest environment variable value; that is, send the Windows parameter setting change broadcast message WM_SETTINGCHANGE to update the Environment parameter value. The specific format is: SendMessage(HWND_BROADCAST,WM_SETTINGCHANGE,0,(LPARAM)"Environment");

[0033] When the detection status reaches the set threshold, the process of the sample program to be detected is forcibly closed. The detection status includes directory hiding, trace flow file size exceeding the set value, and number of deleted files exceeding the set value. The specific value is set according to the situation, such as files in the directory under the C drive are deleted, the directory under the D drive is hidden, the number of deleted files in the D drive exceeds 10, and the trace flow file size exceeds 100G.

[0034] The dynamic execution program saves each assembly instruction and register value during the execution of the sample program to be tested into a trace stream file, and then waits for the trace stream file to be written;

[0035] When it is determined that the trajectory stream file is written, the environment variable ShareInfo is set to the value of the compressed file (an integer value representing the compressed file); delete all files in the compressed directory (the compressed directory is used to store the compressed trajectory stream file), and then call the fast compression algorithm (LZ4) to compress the trajectory stream file to the compressed directory. After the compression is completed, open the compressed directory and set the compressed directory window to maximize. Set the environment variable ShareInfo to the value of the file to be transferred (an integer value representing the compressed file), and write the file size Fsize, that is, the size Fsize of the compressed trajectory stream file, to the environment variable ShareInfo.

[0036] Preferably, according to the present invention, the host program sends a keyboard event to simulate a keyboard key press to execute file copying; including:

[0037] After the host program reads the value of the environment variable ShareInfo as the file to be transferred, it records the file size Fsize, finds the virtual machine window handle, and then sets the virtual machine window to the front and maximizes it. After a set delay (1.5 seconds), click the left mouse button in a blank location in the set compressed directory, send a keyboard event to simulate pressing CTRL+A to select the compressed track stream file, and after a set delay (1.5 seconds), send a keyboard event to simulate pressing CTRL+C.

[0038] Open the host receiving directory and maximize the window. The host receiving directory is the directory created on the host for receiving compressed trajectory stream files.

[0039] After a set delay (0.5 seconds), click the left mouse button in a blank space in the host receiving directory (any blank space in the host receiving directory window) to send a keyboard event simulating the CTRL+V keystroke. This will paste the compressed trace stream file into the host receiving directory.

[0040] In the host receiving directory, the compressed trace stream file size is detected once every interval (30 seconds). If the compressed trace stream file size is detected for several consecutive times (3 times) and is the same as the recorded file size Fsize, it is determined that the compressed trace stream file has been received and the virtual machine daemon is waiting for the end.

[0041] Preferably, according to the present invention, after the daemon detects that the file transfer is complete, the virtual machine daemon is terminated; including:

[0042] The daemon of the virtual machine sets the initial file status value of the compressed trace stream file to 0, and detects whether the compressed trace stream file is occupied. If so, the file status is set to 1 (the file is being transferred). Otherwise, it continues to detect until it is occupied.

[0043] If the file status is 1, continue to detect the compressed trace stream file until the compressed trace stream file is not occupied (the file status is not occupied after the transmission is completed), determine that the compressed trace stream file is transferred, and end the virtual machine daemon.

[0044] The beneficial effects of the present invention are:

[0045] 1. The present invention proposes a method for automated data interaction between a virtual machine and a host, which automatically realizes the periodic transmission of virtual machine status and the secure transmission of large files without human intervention, and realizes the automatic testing and data transmission of malware samples.

[0046] 2. Compared with the existing technology, the present invention does not need to open network ports and shared directories, which reduces the risks caused during the transmission process and achieves greater security.

[0047] 3. The present invention has a fast data transmission speed and a universal method. It can automatically interact with data between virtual machines and hosts when faced with complex analysis tasks and is suitable for large-scale malware detection data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a flowchart of the present invention for dynamic analysis of malware. DETAILED DESCRIPTION

[0049] The present invention will be further described below with reference to embodiments and accompanying drawings, but is not limited thereto.

[0050] Example 1

[0051] A method for automatic data interaction between virtual machines and hosts for dynamic analysis of malware, such as Figure 1 Shown, including:

[0052] S1. Initialize the virtual machine, copy the daemon and dynamic execution program to the virtual machine, and save the current virtual machine snapshot;

[0053] The dynamic execution program is used to start the sample program to be detected and record the assembly instructions and register values ​​during the execution of the sample program to be detected; wherein the sample program to be detected represents the suspected malware to be detected;

[0054] The daemon is used to start dynamic execution programs, monitor specified directories, and interact with the host. The computer where the virtual machine and analysis program are deployed is called the host, and the analysis program is called the host program. The host program has functions such as initializing the virtual machine, sending samples, decompressing, analyzing traces, and reading virtual machine messages.

[0055] S2. Reset the virtual machine to the saved virtual machine snapshot, compress the sample program to be tested and send it to the virtual machine, and start the daemon program;

[0056] S3. The virtual machine decompresses the compressed sample, i.e., the compressed sample program to be tested, and performs testing using a dynamic execution program.

[0057] S4. The host program sends a keyboard event to simulate keyboard keystrokes and execute file copying.

[0058] S5. The host program detects the end of the virtual machine daemon program and decompresses the compressed trace stream file to the specified directory (a directory created in the host to store the decompressed trace stream file). After the decompressed trace stream file is transferred, the virtual machine state is reset to the saved snapshot, the trace stream file is parsed, and the malware analysis and testing is completed.

[0059] Example 2

[0060] The difference between the method for automatic data interaction between a virtual machine and a host for dynamic analysis of malware described in Example 1 is that:

[0061] Initialize the virtual machine, copy the daemon and dynamic execution program to the virtual machine, and save the current virtual machine snapshot; including:

[0062] Add an environment variable named ShareInfo to the specified registry path in the virtual machine (HKEY_CURRENT_USER\Environment) with an empty value; copy the daemon and dynamic execution program to the virtual machine;

[0063] Create a test directory in the virtual machine to store the decompressed sample program to be tested. The test directory contains multiple files, such as doc, pdf, c, etc.; create a compressed directory to store the compressed trace stream files to facilitate deletion and copying operations; set the blank position of the compressed directory, that is, set the x and y coordinates of any blank space in the compressed directory window, where x represents the width of the compressed directory window and y represents the height of the compressed directory window. Set the x coordinate to 8 / 10 of the window width and the y coordinate to 8 / 10 of the window height.

[0064] Save the current virtual machine snapshot.

[0065] Reset the virtual machine to the saved virtual machine snapshot, compress the sample program to be tested and send it to the virtual machine, and start the daemon program; including:

[0066] Use compression software to compress the sample program to be tested to prevent it from running inadvertently. After compression, send it to the virtual machine, start the daemon program in the virtual machine, set an interval (60 seconds), read the virtual machine's environment variable ShareInfo once every interval, use base64 to decode the information stored in the environment variable ShareInfo, and obtain the system status and the status of the sample to be tested;

[0067] System status includes the number of times files in a directory are created, written, deleted, modified, or renamed, whether the directory is set to hidden, and the size of the execution trace flow file;

[0068] The status of the sample to be tested is the PID and running status of the sample program to be tested.

[0069] The virtual machine decompresses the compressed sample, i.e., the compressed sample program to be tested, and uses a dynamic execution program for testing; this includes:

[0070] After the daemon in the virtual machine is started, it decompresses the compressed sample into the test directory;

[0071] The dynamic execution program starts the decompressed compressed sample, that is, starts the sample program to be tested, and records the register values ​​during the execution of the sample program to be tested;

[0072] Record the process ID of the sample program to be tested, and monitor the status of the test directory and the files in the test directory;

[0073] Test directory status to see if the directory is hidden or deleted;

[0074] File status includes file creation, reading, writing, deletion, and renaming;

[0075] Record the test directory status and file status, encode them in base64 and save them to the environment variables in the registry (HKEY_CURRENT_USER\Environment\ShareInfo) at a specified interval (60 seconds), and send a broadcast message to enable the host to obtain the latest environment variable value; that is, send the Windows parameter setting change broadcast message WM_SETTINGCHANGE to update the Environment parameter value. The specific format is: SendMessage(HWND_BROADCAST,WM_SETTINGCHANGE,0,(LPARAM)"Environment");

[0076] When the detection status reaches the set threshold, the process of the sample program to be detected is forcibly closed. The detection status includes directory hiding, trace flow file size exceeding the set value, and number of deleted files exceeding the set value. The specific value is set according to the situation, such as files in the directory under the C drive are deleted, the directory under the D drive is hidden, the number of deleted files in the D drive exceeds 10, and the trace flow file size exceeds 100G.

[0077] The dynamic execution program saves each assembly instruction and register value during the execution of the sample program to be tested into a trace stream file, and then waits for the trace stream file to be written;

[0078] When it is determined that the trajectory stream file is written, the environment variable ShareInfo is set to the value of the compressed file (an integer value representing the compressed file); delete all files in the compressed directory (the compressed directory is used to store the compressed trajectory stream file), and then call the fast compression algorithm (LZ4) to compress the trajectory stream file to the compressed directory. After the compression is completed, open the compressed directory and set the compressed directory window to maximize. Set the environment variable ShareInfo to the value of the file to be transferred (an integer value representing the compressed file), and write the file size Fsize, that is, the size Fsize of the compressed trajectory stream file, to the environment variable ShareInfo.

[0079] The host program sends keyboard events to simulate keyboard keystrokes and execute file copying; including:

[0080] After the host program reads the value of the environment variable ShareInfo as the file to be transferred, it records the file size Fsize, finds the virtual machine window handle, and then sets the virtual machine window to the front and maximizes it. After a set delay (1.5 seconds), click the left mouse button in a blank location in the set compressed directory, send a keyboard event to simulate pressing CTRL+A to select the compressed track stream file, and after a set delay (1.5 seconds), send a keyboard event to simulate pressing CTRL+C.

[0081] Open the host receiving directory and maximize the window. The host receiving directory is the directory created on the host for receiving compressed trajectory stream files.

[0082] After a set delay (0.5 seconds), click the left mouse button in a blank space in the host receiving directory (any blank space in the host receiving directory window) to send a keyboard event simulating the CTRL+V keystroke. This will paste the compressed trace stream file into the host receiving directory.

[0083] In the host receiving directory, the compressed trace stream file size is detected once every interval (30 seconds). If the compressed trace stream file size is detected for several consecutive times (3 times) and is the same as the recorded file size Fsize, it is determined that the compressed trace stream file has been received and the virtual machine daemon is waiting for the end.

[0084] After the daemon detects that the file transfer is complete, it terminates the virtual machine daemon; this includes:

[0085] The daemon of the virtual machine sets the initial file status value of the compressed trace stream file to 0, and detects whether the compressed trace stream file is occupied. If so, the file status is set to 1 (the file is being transferred). Otherwise, it continues to detect until it is occupied.

[0086] If the file status is 1, continue to detect the compressed trace stream file until the compressed trace stream file is not occupied (the file status is not occupied after the transmission is completed), determine that the compressed trace stream file is transferred, and end the virtual machine daemon.

[0087] For the detection of the WannaCry ransomware virus, the analysis results are shown in Table 1.

[0088] Table 1

[0089]

[0090]

[0091] In Table 1, the dynamic execution + data transfer time is about 30 minutes, and the trace flow file size is about 32G bytes.

Claims

1. A method for automatic data interaction between a virtual machine and a host for dynamic analysis of malware, characterized in that: include: S1. Initialize the virtual machine, copy the daemon and dynamic execution program to the virtual machine, and save the current virtual machine snapshot; The dynamic execution program is used to start the sample program to be detected and record the assembly instructions and register values ​​during the execution of the sample program to be detected; wherein the sample program to be detected represents the suspected malware to be detected; The daemon is used to start dynamic execution programs, monitor specified directories, and interact with the host for data; S2. Reset the virtual machine to the saved virtual machine snapshot, compress the sample program to be tested and send it to the virtual machine, and start the daemon program; S3. The virtual machine decompresses the compressed sample, i.e., the compressed sample program to be tested, and performs testing using a dynamic execution program. S4. The host program sends a keyboard event to simulate keyboard keystrokes and execute file copying. S5. The host program detects that the virtual machine daemon has ended, decompresses the compressed trace stream file to the specified directory, transfers the decompressed trace stream file, resets the virtual machine state to the saved snapshot, parses the trace stream file, and completes the analysis and testing of the malware.

2. The method for automatic data interaction between a virtual machine and a host for dynamic analysis of malware according to claim 1, characterized in that: Initialize the virtual machine, copy the daemon and dynamic execution program to the virtual machine, and save the current virtual machine snapshot; including: Add an environment variable named ShareInfo to the specified path in the virtual machine's registry, with the variable value empty; copy the daemon and dynamic execution program to the virtual machine; Create a test directory in the virtual machine to store the decompressed sample program to be tested. The test directory contains multiple files. Create a compressed directory to store the compressed trace stream file. Set the blank position of the compressed directory, that is, set the x and y coordinates of any blank position in the compressed directory window, where x represents the width of the compressed directory window and y represents the height of the compressed directory window. Save the current virtual machine snapshot.

3. The method for automatic data interaction between a virtual machine and a host for dynamic analysis of malware according to claim 2, characterized in that: Reset the virtual machine to the saved virtual machine snapshot, compress the sample program to be tested and send it to the virtual machine, and start the daemon program; including: Use compression software to compress the sample program to be tested, send it to the virtual machine after compression, start the daemon in the virtual machine, set an interval, read the virtual machine's environment variable ShareInfo once every interval, use base64 to decode the information stored in the environment variable ShareInfo, and obtain the system status and the status of the sample to be tested; System status includes the number of times files in a directory are created, written, deleted, modified, or renamed, whether the directory is set to hidden, and the size of the execution trace flow file; The status of the sample to be tested is the PID and running status of the sample program to be tested.

4. The method for automatic data interaction between a virtual machine and a host for dynamic analysis of malware according to claim 3, characterized in that: The virtual machine decompresses the compressed sample, i.e., the compressed sample program to be tested, and uses a dynamic execution program for testing; this includes: After the daemon in the virtual machine is started, it decompresses the compressed sample into the test directory; The dynamic execution program starts the decompressed compressed sample, that is, starts the sample program to be tested, and records the register values ​​during the execution of the sample program to be tested; Record the process ID of the sample program to be tested, and monitor the status of the test directory and the files in the test directory; Test directory status to see if the directory is hidden or deleted; File status includes file creation, reading, writing, deletion, and renaming; Record the test directory status and file status, set the interval time, encode the test directory status and file status in base64 and save them to the environment variables of the registry at each interval, and send a broadcast message to enable the host to obtain the latest environment variable value; When the detection status reaches the set threshold, the process of the sample program to be detected is forcibly closed. The detection status includes the directory being hidden, the track flow file size exceeding the set value, and the number of deleted files exceeding the set value. The dynamic execution program saves each assembly instruction and register value during the execution of the sample program to be tested into a trace stream file, and then waits for the trace stream file to be written; When it is determined that the writing of the trajectory stream file is completed, the environment variable ShareInfo is set to the compressed file; all files in the compressed directory are deleted, and then the fast compression algorithm is called to compress the trajectory stream file into the compressed directory. After the compression is completed, the compressed directory is opened and the compressed directory window is maximized. The environment variable ShareInfo is set to the file to be transferred, and the file size Fsize, that is, the size Fsize of the compressed trajectory stream file, is written to the environment variable ShareInfo.

5. The method for automatic data interaction between a virtual machine and a host for dynamic analysis of malware according to claim 4, characterized in that: The host program sends keyboard events to simulate keyboard keystrokes and execute file copying; including: After the host program reads the value of the environment variable ShareInfo as the file to be transferred, it records the file size Fsize, finds the virtual machine window handle, and then sets the virtual machine window to the front and maximizes it. After a set delay, click the left mouse button in a blank location in the set compressed directory, send a keyboard event to simulate pressing CTRL+A to select the compressed trajectory stream file, and after a set delay, send a keyboard event to simulate pressing CTRL+C. Open the host receiving directory and maximize the window. The host receiving directory is the directory created on the host for receiving compressed trajectory stream files. After the delay setting time, click the left mouse button in a blank location in the host receiving directory to send a keyboard event simulating the CTRL+V key press. At this time, the compressed trajectory stream file will be pasted into the host receiving directory. In the host receiving directory, the compressed trace stream file size is detected once at intervals. If the compressed trace stream file size is the same as the recorded file size Fsize for several consecutive times, it is determined that the compressed trace stream file has been received and the virtual machine daemon is waiting to end.

6. The method for automatic data interaction between a virtual machine and a host for dynamic analysis of malware according to claim 5, characterized in that: After the daemon detects that the file transfer is complete, it terminates the virtual machine daemon; this includes: The daemon of the virtual machine sets the initial value of the file status of the compressed trace stream file to 0, and detects whether the compressed trace stream file is occupied. If so, the file status is set to 1, otherwise it continues to detect until it is occupied. If the file status is 1, continue to detect the compressed trace stream file until the compressed trace stream file is not occupied, determine that the compressed trace stream file is transmitted, and end the virtual machine daemon.

Images