Malicious application detection method, device, storage medium and processor

Abstract

This application discloses a method, device, storage medium, and processor for detecting malicious applications. The method includes: processing a target application in a sandbox system to obtain target information for the target application; matching the target application with a target virtual machine based on the target information, wherein the target virtual machine includes at least a target folder; analyzing the target application based on the target virtual machine to obtain an analysis result; and determining whether the target application is malware based on the analysis result. This application addresses the low malware detection efficiency issue in related technologies.

Description

Technical Field

[0001] The present application relates to the technical field of network threat detection, and more specifically, to a method, device, storage medium, and processor for detecting malicious applications. Background Art

[0002] The sandbox system uses a virtual machine environment to run suspicious software, monitor the behavior of suspicious software, such as related operations on files, registries, networks, processes, etc., and analyze these behaviors to determine whether it is malware. However, the analysis virtual machine used by the sandbox system in the existing technology only has basic system software installed, and the operating environment is too "clean", making it impossible for malware to access specific software and ultimately escape detection in the sandbox environment.

[0003] Currently, no effective solution has been proposed to address the problem of low malware detection efficiency in related technologies. Summary of the Invention

[0004] The main purpose of this application is to provide a method, device, storage medium and processor for detecting malicious applications to solve the problem of low malware detection efficiency in related technologies.

[0005] To achieve the above objectives, according to one aspect of the present application, a method for detecting malicious applications is provided. The method comprises: processing a target application in a sandbox system to obtain target information of the target application; matching a target virtual machine corresponding to the target application based on the target information, wherein the target virtual machine includes at least a target folder; analyzing the target application based on the target virtual machine to obtain an analysis result; and determining whether the target application is malware based on the analysis result.

[0006] Furthermore, the target application is analyzed based on the target virtual machine, and the analysis results obtained include: storing the target executable file in the target folder, wherein there are multiple target executable files, and the target folder at least includes: a folder containing system files and a folder not containing system files; accessing the target executable file through the target application to obtain an access result; analyzing the access result to obtain an analysis result, wherein the analysis result at least includes: the number of times the target executable file has been tampered with and the storage path of the target executable file.

[0007] Furthermore, determining whether the target application is malware based on the analysis result includes: if the analysis result indicates that the target executable file has been tampered with a number of times greater than a preset value, or if the analysis result indicates that the target application contains the target executable file, then determining that the target application is malware.

[0008] Furthermore, before determining whether the target application is malware based on the analysis results, the method further includes: setting the number of target executable files of different types in the target folder; and determining a preset value based on the number of executable files of each type.

[0009] Furthermore, the target information includes at least platform information required to run the target application and file type information of the target application.

[0010] Furthermore, after determining whether the target application is malware based on the analysis result, the method also includes: if the analysis result indicates that the target application is malware, sending indication information to the target object through the sandbox system so that the target object executes the corresponding defense strategy.

[0011] To achieve the above-mentioned objectives, according to another aspect of the present application, a device for detecting malicious applications is provided. The device includes: a first processing unit for processing a target application in a sandbox system to obtain target information of the target application; a first matching unit for matching a target virtual machine corresponding to the target application based on the target information, wherein the target virtual machine at least includes a target folder; a first analyzing unit for analyzing the target application based on the target virtual machine to obtain an analysis result; and a first determining unit for determining whether the target application is malware based on the analysis result.

[0012] Furthermore, the first analysis unit includes: a first storage module, used to store the target executable file in a target folder, wherein there are multiple target executable files, and the target folder at least includes: a folder containing system files and a folder not containing system files; a first access module, used to access the target executable file through the target application and obtain an access result; a first analysis module, used to analyze the access result and obtain an analysis result, wherein the analysis result at least includes: the number of times the target executable file has been tampered with and the storage path of the target executable file.

[0013] Furthermore, the first determination unit includes: a first determination module, which is used to determine that the target application is malware if the analysis result indicates that the target executable file has been tampered with a number of times greater than a preset value, or if the analysis result indicates that the target application contains the target executable file.

[0014] Furthermore, the device also includes: a first setting unit, used to set the number of different types of target executable files in the target folder before determining whether the target application is malware based on the analysis results; a second determination unit, used to determine a preset value based on the number of each type of executable files.

[0015] Furthermore, the target information includes at least platform information required to run the target application and file type information of the target application.

[0016] Furthermore, the device also includes: a first sending unit, which is used to determine whether the target application is malware based on the analysis result, and if the analysis result indicates that the target application is malware, send indication information to the target object through the sandbox system to enable the target object to execute the corresponding defense strategy.

[0017] According to another aspect of an embodiment of the present application, a processor is further provided, and the processor is used to run a program, wherein any one of the above methods is executed when the program is run.

[0018] According to another aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, any one of the above methods is performed.

[0019] This application employs the following steps: processing a target application in a sandbox system to obtain target information for the target application; matching the target application with a target virtual machine based on the target information, wherein the target virtual machine includes at least a target folder; analyzing the target application based on the target virtual machine to obtain an analysis result; and determining whether the target application is malware based on the analysis result. This solves the problem of low malware detection efficiency in related technologies by matching the target application with a target virtual machine based on the target information, analyzing the target application, and determining whether the target application is malware based on the analysis result, thereby achieving the effect of improving malware detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0021] Figure 1 is a flowchart of a method for detecting malicious applications according to an embodiment of the present application;

[0022] Figure 2 This is a block diagram of a sandbox system according to a method for detecting malicious applications provided in an embodiment of the present application;

[0023] Figure 3 2 is a schematic diagram of a malicious application detection device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0025] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] For ease of description, some nouns or terms involved in the embodiments of the present application are explained below:

[0028] Sandbox: A virtual system program. In network security, a sandbox refers to a tool used to test the behavior of untrusted files or applications in an isolated environment.

[0029] According to an embodiment of the present application, a method for detecting malicious applications is provided.

[0030] Figure 1 FIG. 1 is a flow chart of a method for detecting malicious applications according to an embodiment of the present application. Figure 1 As shown, the method includes the following steps:

[0031] Step S101 : Processing a target application in a sandbox system to obtain target information of the target application.

[0032] The target information includes at least the platform information required to run the target application and the file type information of the target application.

[0033] Specifically, the sandbox host accepts the suspicious software submitted by the user as the target application, performs preliminary processing on it, and obtains the target information of the target application. For example, the platform information required by the target application can be Windows, Linux, Android, etc., and the file type information of the target application can be exe, doc, pdf, etc. This application obtains the target information by processing the target application so as to accurately match the corresponding target virtual machines for different types of target applications.

[0034] Step S102: matching a target virtual machine corresponding to the target application according to the target information, wherein the target virtual machine at least includes a target folder.

[0035] Specifically, according to the platform on which the target application runs and the file type of the target application, different analysis virtual machines are selected, and the target application with network threat information is submitted to the virtual machine for execution.

[0036] Step S103: Analyze the target application based on the target virtual machine to obtain an analysis result.

[0037] Figure 2 FIG. 1 is a block diagram of a sandbox system according to a method for detecting malicious applications provided in an embodiment of the present application. Figure 2 As shown, the sandbox system includes a sandbox host, wherein the sandbox host can include multiple virtual machines.

[0038] Optionally, in the malicious application detection device provided in the embodiment of the present application, the target application is analyzed based on the target virtual machine, and the analysis results obtained include: storing the target executable file in the target folder of the target virtual machine, wherein there are multiple target executable files, and the target folder includes at least: a folder containing system files and a folder not containing system files; accessing the target executable file through the target application to obtain an access result; analyzing the access result to obtain an analysis result, wherein the analysis result includes at least: the number of times the target executable file has been tampered with and the storage path of the target executable file.

[0039] For example, a certain number of executable files, such as 120, are placed in the system directory. When the target application is found to attack the executable files in the system directory, the number of times the suspicious target application attacks the system executable files is counted. For example, if the target application tampers with 100 executable files in the system directory, the number of times the executable files are tampered with is 100; or a certain number of executable files, such as 150, are placed in a user-defined folder. When the target application is found to attack the executable files in the custom folder, the number of times the suspicious target application attacks the custom folder is counted. For example, if the target application tampers with 130 executable files in the custom folder, the number of times the executable files are tampered with is 130.

[0040] For example, a bait file containing a specific string, such as abc@def.com, is placed in the custom folder "c:\a\". When the malware collects user information, the suspicious target application will traverse the email-related files in the user's file system and read the file content. The target application will store the email address with the specific string in the bait file in a file in the target path and upload it to the server.

[0041] From the above examples, it can be seen that in the process of sandbox detection of suspicious software, this application places a certain number of files of specific types in a specific location in the analysis virtual machine, thereby inducing the suspicious software to exhibit more behaviors, thereby further improving the sandbox's detection efficiency for malware.

[0042] Step S104: Determine whether the target application is malware based on the analysis result.

[0043] Specifically, the present application identifies suspicious target applications according to preset judgment rules, wherein the judgment rules are pre-configured in the sandbox system based on the suspicious behavior of the target application.

[0044] Optionally, in the malicious application detection device provided in the embodiment of the present application, before determining whether the target application is malware based on the analysis results, the method also includes: setting the number of target executable files of different types in the target folder; and determining a preset value based on the number of executable files of each type.

[0045] For example, when 110 out of 120 executable files have been tampered with, the preset judgment rule is configured as: when the number of tampered executable files exceeds 100 (corresponding to the preset value in this application), the target application is determined to be malware. This application achieves the effect of improving the malware recognition rate by pre-configuring the judgment rules of sandbox behavior.

[0046] Optionally, in the malicious application detection device provided in the embodiment of the present application, determining whether the target application is malware based on the analysis results includes: if the analysis results indicate that the target executable file has been tampered with a number of times greater than a preset value, or if the analysis results indicate that the target application contains the target executable file, then determining that the target application is malware.

[0047] For example, if it is found that the target application stores the email address with a specific string in the bait file into a file in the target path, it is determined that the target application is malware that collects user information.

[0048] For example, if 120 executable files are placed in the system directory and a suspicious target application traverses the executable files in system folders such as "c:\windows\" and "c:\Program Files\", it is found that 100 of the 120 executable files have been tampered with (corresponding to the preset value in this application), then the target application is determined to be malware. Alternatively, if a suspicious target application deliberately avoids executable files in system folders such as "c:\windows\" and "c:\Program Files\", and traverses user-defined folders, it is found that 130 of the 150 executable files have been tampered with (corresponding to the preset value in this application), then the target application is determined to be malware.

[0049] For example, a certain number of different types of data files, such as 120 each of .doc, .xls, .jpg, and .mp3 files, are placed in the file system of the analyzed virtual machine. If a suspicious target application tampers with a certain number of data files in the target virtual machine, such as more than 100 files, it is determined to be ransomware.

[0050] From the above examples, it can be seen that in the process of sandbox detection of suspicious software, this application places a certain number of files of specific types in a specific location in the analysis virtual machine, thereby inducing malware to exhibit more behaviors, thereby further improving the sandbox's detection efficiency for malware.

[0051] Optionally, in the malicious application detection device provided in the embodiment of the present application, after determining whether the target application is malware based on the analysis results, the method also includes: when the analysis results indicate that the target application is malware, sending indication information to the target object through the sandbox system so that the target object executes the corresponding defense strategy.

[0052] Specifically, when the analysis results indicate that the target application is malware, the sandbox host returns the judgment result of the suspicious software to the user, so that the user can promptly understand the current network security risks and take defensive measures in time to further ensure the system security of the network.

[0053] In summary, the malicious application detection method provided in the embodiments of the present application processes a target application in a sandbox system to obtain target information of the target application; matches the target application to a target virtual machine corresponding to the target application based on the target information, wherein the target virtual machine at least includes a target folder; analyzes the target application based on the target virtual machine to obtain an analysis result; and determines whether the target application is malware based on the analysis result. This method solves the problem of low malware detection efficiency in related technologies by analyzing the target application based on the target information and matching the target virtual machine corresponding to the target application, and determining whether the target application is malware based on the analysis result, thereby achieving the effect of improving malware detection efficiency.

[0054] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0055] The embodiment of the present application also provides a malicious application detection device. It should be noted that the malicious application detection device of the embodiment of the present application can be used to execute the malicious application detection method provided in the embodiment of the present application. The malicious application detection device provided in the embodiment of the present application is introduced below.

[0056] Figure 3 Schematic diagram of a detection device for malicious applications according to an embodiment of the present application. Figure 3 As shown, the device includes: a first processing unit 301, a first matching unit 302, a first analyzing unit 303, and a first determining unit 304.

[0057] Specifically, the first processing unit 301 is configured to process the target application in the sandbox system to obtain target information of the target application;

[0058] A first matching unit 302 is configured to match a target virtual machine corresponding to a target application according to target information, wherein the target virtual machine at least includes a target folder;

[0059] A first analyzing unit 303 is configured to analyze the target application based on the target virtual machine to obtain an analysis result;

[0060] The first determining unit 304 is configured to determine whether the target application is malware according to the analysis result.

[0061] In summary, the malicious application detection device provided in the embodiment of the present application processes the target application in the sandbox system through the first processing unit 301 to obtain target information of the target application; the first matching unit 302 matches the target virtual machine corresponding to the target application according to the target information, wherein the target virtual machine at least includes a target folder; the first analysis unit 303 analyzes the target application based on the target virtual machine to obtain an analysis result; the first determination unit 304 determines whether the target application is malware according to the analysis result, which solves the problem of low malware detection efficiency in related technologies, analyzes the target application according to the target information matching the target virtual machine corresponding to the target application, and determines whether the target application is malware according to the analysis result, thereby achieving the effect of improving the detection efficiency of malware.

[0062] Optionally, in the malicious application detection device provided in the embodiment of the present application, the first analysis unit 303 includes: a first storage module, used to store the target executable file in the target folder, wherein there are multiple target executable files, wherein the target folder at least includes: a folder containing system files, and a folder not containing system files; a first access module, used to access the target executable file through the target application to obtain an access result; a first analysis module, used to analyze the access result to obtain an analysis result, wherein the analysis result at least includes: the number of times the target executable file has been tampered with, and the storage path of the target executable file.

[0063] Optionally, in the malicious application detection device provided in the embodiment of the present application, the first determination unit 304 includes: a first determination module, which is used to determine that the target application is malware if the analysis result indicates that the target executable file has been tampered with a number of times greater than a preset value, or if the analysis result indicates that the target application contains the target executable file.

[0064] Optionally, in the malicious application detection device provided in the embodiment of the present application, the device also includes: a first setting unit, used to set the number of different types of target executable files in the target folder before determining whether the target application is malware based on the analysis results; and a second determination unit, used to determine a preset value based on the number of executable files of each type.

[0065] Optionally, in the malicious application detection device provided in the embodiment of the present application, the target information includes at least platform information required to run the target application and file type information of the target application.

[0066] Optionally, in the malicious application detection device provided in an embodiment of the present application, the device also includes: a first sending unit, which is used to determine whether the target application is malware based on the analysis result, and if the analysis result indicates that the target application is malware, send an indication information to the target object through the sandbox system to enable the target object to execute a corresponding defense strategy.

[0067] The detection device for malicious applications includes a processor and a memory. The above-mentioned first processing unit 301, first matching unit 302, first analysis unit 303, first determination unit 304, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to implement corresponding functions.

[0068] The processor contains a kernel, which retrieves the corresponding program unit from the memory. The kernel can be configured with one or more kernel parameters to detect malicious applications.

[0069] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0070] An embodiment of the present invention provides a storage medium storing a program, which implements a method for detecting malicious applications when executed by a processor.

[0071] An embodiment of the present invention provides a processor, which is used to run a program, wherein a method for detecting malicious applications is executed when the program is running.

[0072] An embodiment of the present invention provides a device, which includes a processor, a memory, and a program stored in the memory and capable of running on the processor. When the processor executes the program, the following steps are implemented: processing a target application in a sandbox system to obtain target information of the target application; matching a target virtual machine corresponding to the target application based on the target information, wherein the target virtual machine at least includes a target folder; analyzing the target application based on the target virtual machine to obtain an analysis result; and determining whether the target application is malware based on the analysis result.

[0073] When executing the program, the processor also implements the following steps: storing a target executable file in a target folder, wherein there are multiple target executable files, and the target folder at least includes: a folder containing system files and a folder not containing system files; accessing the target executable file through a target application to obtain an access result; analyzing the access result to obtain an analysis result, wherein the analysis result at least includes: the number of times the target executable file has been tampered with and the storage path of the target executable file.

[0074] When executing the program, the processor further implements the following steps: if the analysis result indicates that the target executable file has been tampered with a number of times greater than a preset value, or if the analysis result indicates that the target application contains the target executable file, then the target application is determined to be malware.

[0075] When executing the program, the processor also implements the following steps: before determining whether the target application is malware based on the analysis results, setting the number of target executable files of different types in the target folder; and determining a preset value based on the number of executable files of each type.

[0076] When executing the program, the processor further implements the following steps: the target information at least includes platform information required to run the target application and file type information of the target application.

[0077] When executing the program, the processor also implements the following steps: after determining whether the target application is malware based on the analysis results, if the analysis results indicate that the target application is malware, the indication information is sent to the target object through the sandbox system so that the target object executes the corresponding defense strategy.

[0078] The devices in this article can be servers, PCs, PADs, mobile phones, etc.

[0079] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program having the following method steps: processing a target application in a sandbox system to obtain target information of the target application; matching a target virtual machine corresponding to the target application based on the target information, wherein the target virtual machine at least includes a target folder; analyzing the target application based on the target virtual machine to obtain an analysis result; and determining whether the target application is malware based on the analysis result.

[0080] When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: storing a target executable file in a target folder, wherein there are multiple target executable files, and wherein the target folder at least includes: a folder containing system files and a folder not containing system files; accessing the target executable file through a target application to obtain an access result; analyzing the access result to obtain an analysis result, wherein the analysis result at least includes: the number of times the target executable file has been tampered with and the storage path of the target executable file.

[0081] When executed on a data processing device, it is also suitable for executing an initialized program having the following method steps: if the analysis result indicates that the target executable file has been tampered with a number of times greater than a preset value, or if the analysis result indicates that the target executable file is included in the target application, then the target application is determined to be malware.

[0082] When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: before determining whether the target application is malware based on the analysis results, setting the number of different types of target executable files in the target folder; and determining a preset value based on the number of executable files of each type.

[0083] When executed on a data processing device, the program is further adapted to execute initialization having the following method steps: the target information at least includes platform information required to run a target application and file type information of the target application.

[0084] When executed on a data processing device, it is also suitable for executing an initialization program having the following method steps: after determining whether the target application is malware based on the analysis results, if the analysis results indicate that the target application is malware, the indication information is sent to the target object through the sandbox system so that the target object executes the corresponding defense strategy.

[0085] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0086] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0087] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0088] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 The steps for the function specified in one or more boxes.

[0089] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0090] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0091] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0092] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0093] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0094] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for detecting malicious applications, characterized in that: include: Processing the target application in the sandbox system to obtain target information of the target application, wherein the target information at least includes platform information required to run the target application and file type information of the target application; matching a target virtual machine corresponding to the target application according to the target information, wherein the target virtual machine at least includes a target folder; Analyzing the target application based on the target virtual machine to obtain an analysis result; determining whether the target application is malware based on the analysis result; The target application is analyzed based on the target virtual machine to obtain analysis results including: storing a target executable file in the target folder, wherein there are multiple target executable files and the target executable files are bait files; accessing the target executable file through the target application to obtain an access result; analyzing the access result to obtain an analysis result, wherein the analysis result at least includes: the number of times the target executable file has been tampered with and the storage path of the target executable file.

2. The method according to claim 1, characterized in that in, The target folder includes at least: a folder containing system files and a folder not containing system files.

3. The method according to claim 2, characterized in that Determining whether the target application is malware according to the analysis result includes: If the analysis result indicates that the target executable file has been tampered with a number of times greater than a preset value, or if the analysis result indicates that the target application includes the target executable file, the target application is determined to be malware.

4. The method according to claim 3, characterized in that Before determining whether the target application is malware according to the analysis result, the method further includes: Set the number of different types of target executable files in the target folder; The preset value is determined according to the number of executable files of each type.

5. The method according to claim 1, wherein After determining whether the target application is malware according to the analysis result, the method further includes: In the case where the analysis result indicates that the target application is the malware, the sandbox system sends indication information to the target object so that the target object executes the corresponding defense strategy.

6. A device for detecting malicious applications, characterized in that: include: a first processing unit, configured to process a target application in a sandbox system to obtain target information of the target application; a first matching unit, configured to match a target virtual machine corresponding to the target application according to the target information, wherein the target virtual machine at least includes a target folder; A first analyzing unit, configured to analyze the target application based on the target virtual machine to obtain an analysis result; a first determining unit, configured to determine whether the target application is malware according to the analysis result; The first analysis unit includes: a first storage module, used to store the target executable file in the target folder, wherein the target executable file is multiple and the target executable file is a bait file; a first access module, used to access the target executable file through the target application and obtain an access result; a first analysis module, used to analyze the access result and obtain an analysis result, wherein the analysis result at least includes: the number of times the target executable file has been tampered with and the storage path of the target executable file.

7. The device according to claim 6, characterized in that The target folder includes at least: a folder containing system files and a folder not containing system files.

8. A processor, characterized in that: The processor is configured to run a program, wherein the program executes the method according to any one of claims 1 to 5 when running.

9. A computer-readable storage medium, characterized in that The storage medium includes a stored program, wherein the program executes the method according to any one of claims 1 to 5.

Images