Method, device, equipment, medium and program product for analyzing malicious applications

Abstract

The present disclosure provides a method for parsing malware, which can be applied to the field of information security. The method for parsing malicious applications includes: obtaining multiple unknown instructions of the malicious application and multiple known instructions of a white sample application; using statistics, obtaining a first call frequency of multiple unknown instructions being called during the operation of the malicious application and a second call frequency of multiple known instructions being called during the operation of the white sample application; determining at least one target instruction in the multiple unknown instructions that matches the multiple known instructions based on the first call frequency and the second call frequency; and parsing the at least one target instruction to obtain operation-related data of the malicious application. The present disclosure also provides a malware parsing device, equipment, storage medium, and program product.

Description

Technical Field

[0001] The present disclosure relates to the field of information security, specifically to the field of information security of mobile applications, and more specifically to a method, apparatus, device, medium, and program product for parsing malicious applications. Background Art

[0002] When performing security analysis on mobile applications, developers often encounter malicious applications that have been hardened with VMP (Virtual Machine Protect). The dex files of these hardened malicious applications are unreadable, making it impossible to analyze their malicious behavior. Summary of the Invention

[0003] In view of the above problems, the present disclosure provides a method, apparatus, device, medium and program product for parsing malicious applications.

[0004] According to a first aspect of the present disclosure, a method for parsing a malicious application is provided, comprising: obtaining a plurality of unknown instructions of the malicious application and a plurality of known instructions of a white sample application; utilizing statistics to obtain a first calling frequency at which the plurality of unknown instructions are called during the operation of the malicious application and a second calling frequency at which the plurality of known instructions are called during the operation of the white sample application; determining, based on the first calling frequency and the second calling frequency, at least one target instruction among the plurality of unknown instructions that matches the plurality of known instructions; and parsing the at least one target instruction to obtain operation-related data of the malicious application.

[0005] According to an embodiment of the present disclosure, determining at least one target instruction among the multiple unknown instructions that matches the multiple known instructions based on the first calling frequency and the second calling frequency includes: determining a first order in which the multiple unknown instructions are called based on the first calling frequency, and determining a second order in which the multiple known instructions are called based on the second calling frequency; and determining at least one target instruction among the unknown instructions that matches the multiple known instructions based on the first order and the second order; wherein the white sample application and the malicious application are the same type of application.

[0006] According to an embodiment of the present disclosure, the method of obtaining a first calling frequency of the multiple unknown instructions being called during the running of the malicious application by utilizing statistics includes: obtaining the instruction addresses of each of the multiple unknown instructions to obtain multiple instruction addresses; setting break points at positions corresponding to the multiple instruction addresses in the malicious application; obtaining calling data of the multiple unknown instructions through the break points; and obtaining a first calling frequency of the multiple unknown instructions being called based on the calling data.

[0007] According to an embodiment of the present disclosure, obtaining the instruction addresses of each of the multiple unknown instructions to obtain multiple instruction addresses includes: obtaining an interpreter of the malicious application; parsing the executable file of the malicious application through the interpreter to obtain code data corresponding to the multiple unknown instructions in the executable file; and analyzing the code data to obtain the multiple instruction addresses.

[0008] According to an embodiment of the present disclosure, obtaining the interpreter of the malicious application includes: calling the multiple unknown instructions to obtain calling addresses of the multiple unknown instructions; and determining the interpreter according to the calling addresses.

[0009] According to an embodiment of the present disclosure, obtaining a plurality of unknown instructions of a malicious application includes: when the malicious application includes a reinforcement policy, analyzing the reinforcement policy to obtain the plurality of unknown instructions.

[0010] According to an embodiment of the present disclosure, obtaining multiple unknown instructions of a malicious application further includes: obtaining an installation package of the malicious application; when it is determined that the installation package includes a code extraction shell, unshelling the installation package; and analyzing the unshelled installation package to obtain the multiple unknown instructions.

[0011] A second aspect of the present disclosure provides a device for parsing malicious applications, including: an acquisition module for acquiring multiple unknown instructions of the malicious application and multiple known instructions of a white sample application; a statistical module for using statistics to obtain a first call frequency of the multiple unknown instructions being called during the operation of the malicious application and a second call frequency of the multiple known instructions being called during the operation of the white sample application; a determination module for determining at least one target instruction among the multiple unknown instructions that matches the multiple known instructions based on the first call frequency and the second call frequency; and a parsing module for parsing the at least one target instruction to obtain operation-related data of the malicious application.

[0012] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned method of parsing malicious applications.

[0013] A fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned method for parsing malicious applications.

[0014] A fifth aspect of the present disclosure further provides a computer program product, including a computer program, which implements the above-mentioned method for parsing malicious applications when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0016] Figure 1 Schematically illustrates an application scenario diagram of the method, apparatus, device, medium, and program product for parsing malicious applications according to an embodiment of the present disclosure;

[0017] Figure 2 A schematic diagram illustrating a method for parsing malicious applications according to an embodiment of the present disclosure is shown;

[0018] Figure 3 A flowchart of a method for parsing malicious applications according to an embodiment of the present disclosure is schematically shown;

[0019] Figure 4 A flowchart of obtaining multiple unknown instructions of a malicious application according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 5 A flowchart of counting the calling frequencies of multiple unknown instructions according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 6 Schematically shows a flow chart of obtaining multiple instruction addresses according to an embodiment of the present disclosure;

[0022] Figure 7 Schematically shows a flow chart of determining a target instruction according to a call frequency according to an embodiment of the present disclosure;

[0023] Figure 8 A structural block diagram of an apparatus for parsing malicious applications according to an embodiment of the present disclosure is schematically shown; and

[0024] Figure 9A block diagram of an electronic device suitable for implementing a method for parsing malicious applications according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0025] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0026] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0027] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0028] When expressions such as "at least one of A, B and C, etc." are used, they should generally be interpreted in accordance with the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0029] It should be noted that the method and device for parsing malicious applications provided by the present disclosure can be used in the field of information security, in the field of mobile application security in the financial field, and in any field other than the financial field. The present disclosure does not limit the application field of the method and device for parsing malicious applications provided.

[0030] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, disclosure, and application of user personal information complies with relevant laws and regulations, employs necessary confidentiality measures, and does not violate public order and good morals. In the technical solutions disclosed herein, user authorization or consent is obtained before obtaining or collecting user personal information.

[0031] An embodiment of the present disclosure provides a method for parsing a malicious application, comprising: obtaining multiple unknown instructions of the malicious application and multiple known instructions of a white sample application; utilizing statistics to obtain a first calling frequency at which the multiple unknown instructions are called during the operation of the malicious application and a second calling frequency at which the multiple known instructions are called during the operation of the white sample application; determining at least one target instruction among the multiple unknown instructions that matches the multiple known instructions based on the first calling frequency and the second calling frequency; and parsing the at least one target instruction to obtain operation-related data of the malicious application.

[0032] Figure 1 The application scenario diagram of the method, apparatus, device, medium and program product for parsing malicious applications according to an embodiment of the present disclosure is schematically shown.

[0033] like Figure 1 As shown, the application scenario 100 according to this embodiment may include mobile terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used as a medium for providing a communication link between the mobile terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or optical fiber cables.

[0034] Users can use mobile terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on mobile terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0035] The mobile terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, and laptop computers.

[0036] The server 105 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by users using the mobile terminal devices 101, 102, and 103. The background management server may analyze and process received data such as user requests, and feed back processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0037] It should be noted that the method for parsing malicious applications provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the apparatus for parsing malicious applications provided in the embodiment of the present disclosure can generally be set in the server 105. The method for parsing malicious applications provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the mobile terminal devices 101, 102, 103 and / or the server 105. Accordingly, the apparatus for parsing malicious applications provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the mobile terminal devices 101, 102, 103 and / or the server 105.

[0038] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0039] The following will be based on Figure 1 The scene described by Figures 2 to 7 The method for parsing malicious applications in the disclosed embodiment is described in detail.

[0040] Figure 2 A schematic diagram of a method for parsing malicious applications according to an embodiment of the present disclosure is shown.

[0041] Since the running process of an application can be understood as a process in which multiple instructions are called and executed, the running-related data of the application can be analyzed according to the calling conditions of the multiple instructions.

[0042] For malicious applications that have been hardened by VMP, the installation package must first be unpacked and then analyzed for hardening strategies to obtain unknown instructions. Since the instructions of hardened malicious applications are usually unreadable, these instructions can be considered unknown instructions.

[0043] For unknown instructions, the interpreter provided by the malicious application is used to parse the instructions to determine the instruction address of the unknown instruction. After the instruction address of the unknown instruction is determined, the number of times the unknown instruction is called is counted.

[0044] Typically, applications of the same type call the same instructions during operation. Using the call patterns of various known instructions in whitelist applications of the same type as a reference sample, we compare the call patterns of various unknown instructions in the malicious application. We then match the unknown instructions with the known instructions one by one to determine their meaning. The unknown instructions whose meanings are successfully determined are recorded as target instructions, which can be used to further analyze the malicious application's operation data.

[0045] Compared to traditional analysis methods that rely on code tracing and function mapping analysis, the method for analyzing malicious applications provided by this disclosure analyzes the execution process of malicious applications solely through instruction call frequency, effectively improving the efficiency of information security analysis. Furthermore, increasing the number of whitespace samples can effectively improve instruction matching accuracy and enhance the efficiency of analyzing malicious application behavior.

[0046] Figure 3 A flowchart of a method for parsing malicious applications according to an embodiment of the present disclosure is schematically shown.

[0047] like Figure 3 As shown, the method for parsing malicious applications in this embodiment includes operations S310 to S340.

[0048] In operation S310 , a plurality of unknown instructions of a malicious application and a plurality of known instructions of a white sample application are acquired.

[0049] In the disclosed embodiment, malicious applications include illegal applications and unrecognizable applications. Since malicious applications are usually written in custom bytecodes, for conventional security analysis methods, the instructions called by malicious applications during operation are usually unreadable unknown instructions.

[0050] The white sample application is a known safe application. The instructions called by the white sample application during operation are readable and known instructions. There can be one or more white samples.

[0051] The malicious application used to obtain commands and the white sample application are of the same type. For example, if the malicious application is an email application, the white sample application used to obtain known commands is also an email application. If the malicious application is a music application, the white sample application used to obtain known commands is also a music application.

[0052] In operation S320 , statistics are used to obtain a first calling frequency of a plurality of unknown instructions being called during the running of the malicious application and a second calling frequency of a plurality of known instructions being called during the running of the white sample application.

[0053] In the embodiment of the present disclosure, multiple instructions may be called during the running of an application. When an application runs a certain function, the relevant instructions may be called a corresponding number of times at a certain moment.

[0054] The first call frequency includes the frequency at which the plurality of unknown instructions are each called. The second call frequency includes the frequency at which the plurality of known instructions are each called. The called frequency includes the number of times the instructions are called.

[0055] In operation S330 , at least one target instruction matching a plurality of known instructions among the plurality of unknown instructions is determined based on the first call frequency and the second call frequency.

[0056] In the embodiment of the present disclosure, the target instruction is an instruction that matches any known instruction among multiple unknown instructions. Since the instructions called by the same type of application programs when executing the same function are similar, the instruction meaning of the unknown instruction can be determined based on the known instructions.

[0057] Determine the target instruction, match multiple known instructions with multiple unknown instructions based on the calling frequencies of multiple unknown instructions in the first calling frequency and the calling frequencies of multiple known instructions in the second calling frequency, and determine the instruction that matches the known instruction from the multiple unknown instructions.

[0058] For example, matching may be performed based on the relative high and low calling frequencies of multiple instructions, or matching may be performed based on the calling frequencies of multiple instructions when running different functions.

[0059] In operation S340 , at least one target instruction is parsed to obtain execution-related data of the malicious application program.

[0060] In the embodiment of the present disclosure, the running process of the application can be understood as the process of calling and executing multiple instructions. After clarifying the meaning of the unknown instructions of the malicious application, the execution content of the malicious application during runtime can be analyzed based on the meaning of the instructions.

[0061] Because the hardened malicious application's executable file is unreadable, it's impossible to directly access the malicious application's runtime content. This disclosure uses a frequency matching method to reference white samples to determine the instructions called during the malicious application's runtime, and then analyzes the malicious application's execution content based on the called instructions. Furthermore, when there are multiple white samples, expanding the reference samples can improve instruction matching accuracy, thereby increasing the efficiency of malicious application analysis.

[0062] Figure 4 A flowchart for obtaining multiple unknown instructions of a malicious application according to an embodiment of the present disclosure is schematically shown.

[0063] like Figure 4 As shown, operation S310 of this embodiment obtains multiple unknown instructions of a malicious application, including operation S410.

[0064] In operation S410 , when the malicious application includes a hardening policy, the hardening policy is analyzed to obtain a plurality of unknown instructions.

[0065] In the disclosed embodiments, malicious applications use VMP hardening technology to protect their running functions, which are executed by calling corresponding instructions. For example, for an email application, the running function includes a function for sending an email. When the corresponding instruction of this function is called, the application executes the operation of sending the email.

[0066] VMP hardening strategies typically include: applying VMP protection to a class of functions with the same registration address, such as hardening all OnCreate() functions, and converting function attributes from Java to Native. Alternatively, functions requiring hardening, such as those implementing core business functions, are abstracted into a shell function and then subjected to VMP protection.

[0067] In the case where the malicious application includes a hardening policy, the hardening policy is analyzed to obtain the hardened function, thereby obtaining the unknown instruction corresponding to the hardened function.

[0068] In the embodiment of the present disclosure, when the malicious application has a code extraction shell, operations S420 to S440 are further included before operation S410.

[0069] In operation S420 , an installation package of the malicious application is obtained.

[0070] In operation S430, if it is determined that the installation package includes a code extraction shell, the installation package is unpacked.

[0071] In operation S440 , the unpacked installation package is analyzed to obtain a plurality of unknown instructions.

[0072] If the installation package contains a code extraction shell, the complete executable file of the malicious application cannot be obtained until the package is unpacked. The executable file includes a dex file, and parsing the dex file can reveal the malicious application's VMP hardening policy. Analyzing the unpacked installation package includes analyzing the malicious application's hardening policy.

[0073] Exemplarily, the FART automatic unpacking machine can be used to unpack the code.

[0074] If the installation package of a malicious application does not include a code extraction shell, the complete dex file can be directly obtained from the installation package, and then the VMP hardening policy in the dex file can be analyzed to obtain multiple unknown instructions.

[0075] Figure 5 The flowchart of counting the calling frequencies of multiple unknown instructions according to an embodiment of the present disclosure is schematically shown.

[0076] like Figure 5As shown, operation S320 of this embodiment utilizes statistics to obtain a first calling frequency of multiple unknown instructions being called during the running of the malicious application, including operations S510 to S540.

[0077] In operation S510 , instruction addresses of respective unknown instructions are acquired to obtain multiple instruction addresses.

[0078] In operation S520 , break points are respectively set at locations corresponding to the plurality of instruction addresses in the malicious application.

[0079] In operation S530 , call data of a plurality of unknown instructions are obtained through the interruption point.

[0080] In operation S540 , a first calling frequency of calling the plurality of unknown instructions is obtained by counting the calling data.

[0081] In the disclosed embodiment, a breakpoint is set at the corresponding location of the malicious application. When the malicious application runs to this location, the program execution is interrupted. After setting a breakpoint at the instruction address of each unknown instruction in the memory, when the program execution is interrupted, it indicates that the unknown instruction is being called.

[0082] After setting a breakpoint, when an instruction is called, the program is interrupted and call data is output. This call data can be the bytecode associated with the instruction, which is recorded in the application's log. For example, the log can be a custom opcode statistics log. For an instruction, the application will output the same bytecode associated with the instruction when the program is interrupted at different times. Therefore, the log can be used to count the number of times each bytecode is recorded to determine the frequency of each instruction call.

[0083] Before counting call frequencies, you need to filter out invalid information from the statistical log. For example, read the custom opcode statistical log one by one, filter out system error messages recorded in the statistical log, and retain the call information of successful instruction calls. By filtering out invalid information, you can improve the efficiency and accuracy of matching unknown instructions with known instructions.

[0084] By setting a breakpoint in a malicious application, the calls of multiple unknown instructions can be recorded during the execution of the malicious application. Setting a breakpoint in a malicious application can also cause the malicious application to perform specific operations and record the calls of unknown instructions during the operation, thus enabling dynamic debugging of the malicious application.

[0085] Figure 6 The flowchart of obtaining multiple instruction addresses according to an embodiment of the present disclosure is schematically shown.

[0086] like Figure 6 As shown, operation S510 obtains the instruction addresses of each of a plurality of unknown instructions to obtain a plurality of instruction addresses, including operations S5101 to S5103.

[0087] In operation S5101, an interpreter of a malicious application is acquired.

[0088] The interpreter is a component that implements the addressing, decoding, and execution processes of the Smali instruction set. Because the core code of VMP-hardened malicious applications is written in custom bytecode, the unknown instructions obtained through analysis are all unreadable garbled code. These unknown instructions must be decoded by the malicious application's interpreter.

[0089] Obtaining the interpreter of the malicious application includes calling multiple unknown instructions, obtaining the calling addresses of the multiple unknown instructions; and determining the interpreter according to the calling addresses.

[0090] Since the VMP-hardened function is bound to the address where the interpreter is located, the interpreter can be located by calling unknown instructions.

[0091] For example, by modifying the RegisterNative method in the ART source code, a statement is added to print the function name and call address. When calling a native function, both the name of the native function being called and the address of the calling native function are printed. When calling an unknown instruction corresponding to a running function hardened by VMP, the printed call address is the address of the interpreter, thus locating the interpreter.

[0092] Typically, applications reinforced by VMP also include anti-debugging strategies. Anti-debugging strategies are used to prevent dynamic debugging of the interpreter. Therefore, before obtaining the interpreter of the malicious application in operation S5101, it is also necessary to use a customized ART file to bypass the anti-debugging strategy of the original application. For example, modify the code in the art-runtime-art method.cc file that calls the JNI function. Before the JNI function is called, put the system of the malicious application into sleep mode. When the system is in sleep mode, access the debugging tool to achieve subsequent dynamic debugging of the malicious application.

[0093] In operation S5102, the executable file of the malicious application is parsed by an interpreter to obtain code data corresponding to multiple unknown instructions in the executable file.

[0094] In operation S5103 , the code data is analyzed to obtain a plurality of instruction addresses.

[0095] In the disclosed embodiments, an interpreter parses an executable file and dumps the code associated with an unknown instruction in the executable file. The dumped code is analyzed to obtain multiple instruction addresses. For example, the instruction address in memory is determined based on the CodeItem information located in the first 8 bytes of the code corresponding to the instruction.

[0096] Due to VMP hardening, the malicious application's instruction information cannot be directly obtained. However, through hardening policy analysis, multiple unknown instructions can be obtained. These unknown instructions are written in the malicious application's custom bytecode. To security analysis programs, the malicious application's custom bytecode is unreadable gibberish before the interpreter is determined. Once the interpreter is determined, the malicious application's custom bytecode is compiled using the interpreter to obtain multiple instruction addresses.

[0097] Figure 7 The flowchart of determining the target instruction according to the calling frequency according to an embodiment of the present disclosure is schematically shown.

[0098] like Figure 7 As shown, operation S510 determines at least one target instruction matching a plurality of known instructions from a plurality of unknown instructions according to the first call frequency and the second call frequency, including operations 710 to 720.

[0099] In operation S710 , a first order in which a plurality of unknown instructions are called is determined according to a first calling frequency, and a second order in which a plurality of known instructions are called is determined according to a second calling frequency.

[0100] In the disclosed embodiment, the first sorting and the second sorting may be instruction sorting tables. The first sorting may be a sorting table obtained by sorting the call frequencies of multiple unknown instructions within the first call frequency. The second sorting may be a sorting table obtained by sorting the call frequencies of multiple known instructions within the second call frequency. The sorting may be from high to low or from low to high.

[0101] For example, when the first call frequency includes the call frequencies of 10 unknown instructions, the call frequencies of the 10 unknown instructions are sorted in descending order to obtain a first sort. When the second call frequency includes the call frequencies of 10 known instructions, the call frequencies of the 10 known instructions are sorted in descending order to obtain a second sort. The present disclosure does not limit the specific sorting method, nor does it limit the number of instructions included in the first sort and the second sort. The number of instructions included in the first sort and the number of instructions included in the second sort may be the same or different.

[0102] In operation S720 , at least one target instruction matching a plurality of known instructions among the unknown instructions is determined according to the first sorting and the second sorting.

[0103] Continuing with the above example, the first sorting table includes 10 unknown instructions, which are arranged in descending order of call frequency. The second sorting table includes 10 known instructions, which are arranged in descending order of call frequency. The above 10 unknown instructions and 10 known instructions are the instructions called by the malicious application and the white sample application when performing the same operation, respectively.

[0104] The white sample application and the malicious application are of the same type. When performing the same operation, applications of the same type generally call the same type and frequency of instructions. However, while malicious applications perform their designated operations normally, they may also perform other illegal operations without permission. For example, a malicious email application might record user information and send it while sending and receiving emails, but the operations displayed on the client are no different from those of other security software.

[0105] Exemplarily, the matching method may be to use instructions with the same call frequency ranking as mutually matching instructions. For example, the unknown instruction with the highest call frequency ranking in the first ranking is the target instruction that matches the known instruction with the highest call frequency ranking in the second ranking, and the unknown instruction (target instruction) has the same instruction meaning as the known instruction.

[0106] Illustratively, the embodiment of the present disclosure further discloses another method for determining a target instruction according to a calling frequency.

[0107] Through dynamic debugging, the malicious application and the white sample program are made to perform the same first operation, and the call frequency of each instruction is counted to obtain a first unknown instruction call ranking table and a first known instruction call ranking table. Then, the malicious application and the white sample program are made to perform the same second operation, and the call frequency of each instruction is counted to obtain a second unknown instruction call ranking table and a second known instruction call ranking table.

[0108] The first known instruction call sorting table and the first unknown instruction call sorting table are compared to generate a first mapping table including mapping relationships between unknown instructions and known instructions. The second known instruction call sorting table and the second unknown instruction call sorting table are compared to generate a second mapping table including mapping relationships between unknown instructions and known instructions. The first mapping table and the second mapping table are compared to determine that, if the first mapping table and the second mapping table include known instructions and unknown instructions with the same mapping relationship, the unknown instruction is a target instruction that matches the known instruction.

[0109] Illustratively, the embodiment of the present disclosure further discloses another method for determining a target instruction according to a calling frequency.

[0110] Through dynamic debugging, the malicious application and the first white sample program are made to execute the same first operation, and the call frequency of each instruction is counted to obtain a first unknown instruction call ranking table and a first known instruction call ranking table. Then, the malicious application and the second white sample program are made to execute the same first operation, and the call frequency of each instruction is used to obtain a second unknown instruction call ranking table and a second known instruction call ranking table.

[0111] The first known instruction call sorting table and the first unknown instruction call sorting table are compared to generate a first mapping table including mapping relationships between unknown instructions and known instructions. The second known instruction call sorting table and the second unknown instruction call sorting table are compared to generate a second mapping table including mapping relationships between unknown instructions and known instructions. The first mapping table and the second mapping table are compared to determine that, if the first mapping table and the second mapping table include known instructions and unknown instructions with the same mapping relationship, the unknown instruction is a target instruction that matches the known instruction.

[0112] This disclosure provides a method for parsing malicious applications, which implements the parsing of malicious applications that have been hardened by VMP based on the frequency of instruction calls. Compared to traditional parsing methods, this method determines the meaning of instructions based on instruction call frequency, simplifies the parsing process, saves a considerable amount of time and effort spent on tracing code and analyzing function mapping relationships, and effectively improves the efficiency of parsing malicious applications. Furthermore, by using different comparison methods with white sample applications, matching accuracy is increased. Accurate matching results further help improve the efficiency of analyzing malicious behavior.

[0113] Based on the above method for parsing malicious applications, the present disclosure also provides a device for parsing malicious applications. Figure 8 The device is described in detail.

[0114] Figure 8 The structural block diagram of the apparatus for parsing malicious applications according to an embodiment of the present disclosure is schematically shown.

[0115] like Figure 8 As shown, the apparatus 800 for parsing malicious applications in this embodiment includes an acquisition module 810 , a statistics module 820 , a determination module 830 and a parsing module 840 .

[0116] The acquisition module 810 is used to acquire multiple unknown instructions of the malicious application and multiple known instructions of the white sample application. In one embodiment, the acquisition module 810 can be used to perform the operation S310 described above, which will not be repeated here.

[0117] The statistics module 820 is used to obtain, using statistics, a first call frequency of multiple unknown instructions being called during the execution of the malicious application and a second call frequency of multiple known instructions being called during the execution of the white sample application. In one embodiment, the statistics module 820 can be used to perform the operation S320 described above, which will not be repeated here.

[0118] The determination module 830 is configured to determine at least one target instruction from the plurality of unknown instructions that matches the plurality of known instructions based on the first call frequency and the second call frequency. In one embodiment, the determination module 830 may be configured to perform the operation S330 described above, which will not be described in detail herein.

[0119] The parsing module 840 is used to parse at least one target instruction to obtain the operation-related data of the malicious application. In one embodiment, the parsing module 840 can be used to perform the operation S340 described above, which will not be repeated here.

[0120] According to an embodiment of the present disclosure, the acquisition module 810 includes a first analysis unit, which is used to analyze the hardening policy and obtain a plurality of unknown instructions when the malicious application includes the hardening policy.

[0121] According to an embodiment of the present disclosure, the acquisition module 810 also includes: a first acquisition unit, used to obtain the installation package of the malicious application; an unpacking unit, used to unpack the installation package when it is determined that the installation package includes a code extraction shell; and a second analysis unit, used to analyze the unpacked installation package to obtain multiple unknown instructions.

[0122] According to an embodiment of the present disclosure, the statistical module 820 includes: a second acquisition unit, used to acquire the instruction addresses of each of a plurality of unknown instructions to obtain a plurality of instruction addresses; a setting unit, used to set break points at positions corresponding to the plurality of instruction addresses in the malicious application; an acquisition unit, used to obtain call data of a plurality of unknown instructions through the break points; and a statistical unit, used to obtain a first call frequency of the plurality of unknown instructions being called based on the call data.

[0123] According to an embodiment of the present disclosure, the second acquisition unit includes: a third acquisition unit, used to obtain an interpreter of the malicious application; a parsing unit, used to parse the executable file of the malicious application through the interpreter to obtain code data corresponding to multiple unknown instructions in the executable file; and a third analysis unit, used to analyze the code data to obtain multiple instruction addresses.

[0124] The third acquiring unit includes: a calling unit, used to call multiple unknown instructions and obtain calling addresses of the multiple unknown instructions; and a first determining unit, used to determine the interpreter according to the calling addresses.

[0125] According to an embodiment of the present disclosure, the determination module 830 includes: a second determination unit, used to determine a first order in which multiple unknown instructions are called based on a first call frequency, and to determine a second order in which multiple known instructions are called based on a second call frequency; and a third determination unit, used to determine at least one target instruction in the unknown instructions that matches multiple known instructions based on the first order and the second order; wherein the white sample application and the malicious application are the same type of application.

[0126] According to an embodiment of the present disclosure, any multiple modules in the acquisition module 810, the statistics module 820, the determination module 830, and the analysis module 840 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 810, the statistics module 820, the determination module 830, and the analysis module 840 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation modes of software, hardware, and firmware, or in an appropriate combination of any of them. Alternatively, at least one of the acquisition module 810, the statistics module 820, the determination module 830, and the analysis module 840 can be at least partially implemented as a computer program module, which can perform the corresponding function when the computer program module is executed.

[0127] Figure 9 A block diagram of an electronic device suitable for implementing a method for parsing malicious applications according to an embodiment of the present disclosure is schematically shown.

[0128] like Figure 9 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. The processor 901 may, for example, include a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0129] Various programs and data required for the operation of the electronic device 900 are stored in the RAM 903. The processor 901, the ROM 902, and the RAM 903 are connected to each other via a bus 904. The processor 901 executes the various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 902 and / or the RAM 903. It should be noted that the programs may also be stored in one or more memories other than the ROM 902 and the RAM 903. The processor 901 may also execute the various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0130] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card or a modem. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed in the drive 910 as needed, so that a computer program read therefrom can be installed into the storage portion 908 as needed.

[0131] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when executed, implements the method according to the embodiments of the present disclosure.

[0132] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0133] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is executed in a computer system, the program code is used to cause the computer system to implement the item recommendation method provided by the embodiments of the present disclosure.

[0134] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the processor 901 executes the computer program. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0135] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0136] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 909, and / or installed from a removable medium 911. When the computer program is executed by the processor 901, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0137] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages include, but are not limited to, languages such as Java, C++, python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0138] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0139] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or couplings are intended to fall within the scope of this disclosure.

[0140] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A method for parsing a malicious application, comprising: Acquire multiple unknown instructions of a malicious application and multiple known instructions of a white sample application, where the white sample application and the malicious application are of the same type of application; Obtaining, by statistics, a first calling frequency of the plurality of unknown instructions being called during the running of the malicious application and a second calling frequency of the plurality of known instructions being called during the running of the white sample application, wherein the first calling frequency includes the number of times the plurality of unknown instructions are called; Determining, based on the first call frequency and the second call frequency, at least one target instruction among the plurality of unknown instructions that matches the plurality of known instructions; parsing the at least one target instruction to obtain operation-related data of the malicious application; Wherein, determining at least one target instruction matching the plurality of known instructions from the plurality of unknown instructions according to the first call frequency and the second call frequency includes: The malicious application and the white sample program are caused to execute the same first operation, and the calling frequency of each instruction is counted to obtain a first unknown instruction calling sorting table and a first known instruction calling sorting table; The malicious application and the white sample program are caused to execute the same second operation, and the calling frequency of each instruction is counted to obtain a second unknown instruction calling sorting table and a second known instruction calling sorting table; Comparing the first known instruction call sorting table with the first unknown instruction call sorting table to generate a first mapping table; Comparing the second known instruction call sorting table with the second unknown instruction call sorting table to generate a second mapping table; In a case where the first mapping table and the second mapping table include known instructions and unknown instructions having the same mapping relationship, the unknown instruction is determined to be a target instruction that matches the known instruction.

2. The method according to claim 1, wherein The determining, based on the first call frequency and the second call frequency, at least one target instruction among the plurality of unknown instructions that matches the plurality of known instructions includes: Determining a first order in which the plurality of unknown instructions are called according to the first call frequency, and determining a second order in which the plurality of known instructions are called according to the second call frequency; and At least one target instruction in the unknown instructions that matches the plurality of known instructions is determined according to the first sorting and the second sorting.

3. The method according to claim 1, wherein The utilizing statistics to obtain a first calling frequency of the plurality of unknown instructions being called during the running of the malicious application program includes: Obtaining the instruction address of each of the plurality of unknown instructions to obtain a plurality of instruction addresses; respectively setting breakpoints at locations corresponding to the multiple instruction addresses in the malicious application; Obtaining call data of the plurality of unknown instructions through the interruption point; and According to the calling data, first calling frequencies of the multiple unknown instructions being called are obtained by statistics.

4. The method according to claim 3, wherein: The acquiring the instruction addresses of the plurality of unknown instructions to obtain the plurality of instruction addresses includes: Obtaining an interpreter for the malicious application; Parsing the executable file of the malicious application using the interpreter to obtain code data corresponding to the multiple unknown instructions in the executable file; and The code data is analyzed to obtain the multiple instruction addresses.

5. The method according to claim 4, wherein The obtaining of the interpreter of the malicious application comprises: Calling the multiple unknown instructions to obtain calling addresses of the multiple unknown instructions; and The interpreter is determined according to the calling address.

6. The method according to claim 1, wherein The method of obtaining multiple unknown instructions of the malicious application includes: In the case that the malicious application includes a hardening policy, the hardening policy is analyzed to obtain the multiple unknown instructions.

7. The method according to claim 6, wherein: The method of obtaining multiple unknown instructions of the malicious application further includes: Obtaining the installation package of the malicious application; If it is determined that the installation package includes a code extraction shell, performing a shelling process on the installation package; and The unpacked installation package is analyzed to obtain the multiple unknown instructions.

8. A device for analyzing malicious applications, comprising: an acquisition module, configured to acquire a plurality of unknown instructions of a malicious application and a plurality of known instructions of a white sample application, wherein the white sample application and the malicious application are of the same type of application; a statistics module, configured to obtain, by using statistics, a first calling frequency of the plurality of unknown instructions being called during the running of the malicious application and a second calling frequency of the plurality of known instructions being called during the running of the white sample application, wherein the first calling frequency includes the number of times the plurality of unknown instructions are called; a determining module, configured to determine, based on the first call frequency and the second call frequency, at least one target instruction among the plurality of unknown instructions that matches the plurality of known instructions; as well as a parsing module, configured to parse the at least one target instruction to obtain operation-related data of the malicious application; Among them, the determination module is also used to make the malicious application and the white sample program perform the same first operation, count the calling frequency of each instruction to obtain a first unknown instruction call sorting table and a first known instruction call sorting table; make the malicious application and the white sample program perform the same second operation, count the calling frequency of each instruction to obtain a second unknown instruction call sorting table and a second known instruction call sorting table; compare the first known instruction call sorting table and the first unknown instruction call sorting table to generate a first mapping table; compare the second known instruction call sorting table and the second unknown instruction call sorting table to generate a second mapping table; when the first mapping table and the second mapping table include known instructions and unknown instructions with the same mapping relationship, determine that the unknown instruction is a target instruction that matches the known instruction.

9. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors are enabled to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to perform the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images