A sample dynamic detection method and device

Abstract

The present invention discloses a method and device for dynamic sample detection, which relates to the field of network security technology. In the process of running the sample to be detected, potential malicious samples can be effectively identified, so as to use such potential malicious samples to detect and identify whether they are variant samples, thereby avoiding the variant samples from being missed or underreported. The main technical scheme of the present invention is: obtaining the sample to be detected, compiling the sample to be detected into a first machine code; determining whether the first machine code contains controllable variables; if the first machine code contains controllable variables, determining that the sample to be detected is a potential malicious sample. The present invention is mainly used to dynamically detect whether a sample is a potential malicious sample.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a sample dynamic detection method and device. Background Art

[0002] At present, the sample detection technology mainly extracts keywords from common webshells as comparison features. If the keywords match, the corresponding samples can be found to complete the detection operation. Among them, webshell is a code execution environment in the form of web page files such as asp, php, jsp or cgi, which is mainly used for website management, server management, permission management and other operations.

[0003] However, the language itself is very flexible and can be written in a variety of ways. For variant samples that have been encrypted, encoded, spliced, etc., it is difficult to detect and identify them if the existing feature comparison detection scheme is used, resulting in these variant samples being missed. Summary of the invention

[0004] In view of this, the present invention provides a sample dynamic detection method and device, the main purpose of which is to dynamically track and identify whether it contains dangerous controllable variables during the running of the sample to be detected. If so, it is determined to be a potential malicious sample, so as to use such potential malicious samples to detect and identify whether they are variant samples, thereby avoiding variant samples from being missed and reported.

[0005] The first aspect of the present application provides a sample dynamic detection method, the method comprising:

[0006] Obtaining a sample to be detected, and compiling the sample to be detected into a first machine code;

[0007] Determining whether the first machine code contains a controllable variable;

[0008] If the first machine code includes a controllable variable, the sample to be detected is determined to be a potential malicious sample.

[0009] In some modified implementations of the first aspect of the present application, the method further includes:

[0010] In the process of running a sample set including the sample to be detected, a tag is added to the controllable variable in the sample set, and the tag is used to uniquely identify the corresponding controllable variable.

[0011] In some modified implementations of the first aspect of the present application, the determining whether the first machine code includes a controllable variable includes:

[0012] It is determined whether the first machine code includes the mark.

[0013] In some modified implementations of the first aspect of the present application, after determining that the first machine code includes a controllable variable, the method further includes:

[0014] Extracting a second machine code corresponding to a preset dangerous function from the first machine code;

[0015] Determining whether the second machine code contains the controllable variable;

[0016] If the second machine code includes the controllable variable, the sample to be detected is determined to be a target malicious sample.

[0017] In some modified implementations of the first aspect of the present application, the determining whether the second machine code includes a controllable variable includes:

[0018] It is determined whether the second machine code includes the mark.

[0019] In some modified implementations of the first aspect of the present application, after extracting the second machine code corresponding to the preset hazard function from the first machine code, the method further includes:

[0020] Obtaining parameters contained in the second machine code;

[0021] Determine whether the parameter value of the parameter is a character string corresponding to a preset high-risk command;

[0022] If so, it is determined that the preset dangerous function corresponding to the second machine code contains illegal content, and the sample to be detected is a target malicious sample.

[0023] In some modified implementations of the first aspect of the present application, the type of the preset hazard function includes:

[0024] At least one of a code execution class, a file inclusion class, a command execution class, and an array call class.

[0025] In some modified implementations of the first aspect of the present application, if the sample to be detected is a target malicious sample, the determination is based on the controllable variable contained in the second machine code, then the method further includes:

[0026] Obtaining the type of the controllable variable;

[0027] Based on the preset hazard function and the type of the controllable variable, a first target risk level of the target malicious sample is determined, wherein the first target risk level is determined based on the risk levels corresponding to the preset hazard function and the type of the controllable variable, or the first target risk level is determined based on the risk level corresponding to both the preset hazard function and the type of the controllable variable.

[0028] In some modified implementations of the first aspect of the present application, if the sample to be detected is a target malicious sample, the method further includes:

[0029] Based on the preset danger function and the character string corresponding to the preset high-risk command, a second target risk level of the target malicious sample is determined, wherein the second target risk level is determined based on the risk levels corresponding to the preset danger function and the character string corresponding to the preset high-risk command, or the second target risk level is determined based on the risk level corresponding to the preset danger function and the controllable variable.

[0030] In some modified implementations of the first aspect of the present application, the method further includes:

[0031] Output warning information, wherein the warning information includes the risk level.

[0032] The second aspect of the present application provides a sample dynamic detection device, which includes:

[0033] An acquisition unit, used for acquiring a sample to be detected, and compiling the sample to be detected into a first machine code;

[0034] A judging unit, used for judging whether the first machine code contains a controllable variable;

[0035] A determination unit is used to determine that the sample to be detected is a potential malicious sample when the first machine code contains a controllable variable.

[0036] In some modified implementations of the second aspect of the present application, the device further includes:

[0037] The marking unit is used to add a mark to the controllable variable in the sample set during the operation of the sample set including the sample to be detected, wherein the mark is used to uniquely identify the corresponding controllable variable.

[0038] In some modified implementations of the second aspect of the present application, the judgment unit is further specifically used to: judge whether the first machine code contains the mark.

[0039] In some modified implementations of the second aspect of the present application, the device further includes:

[0040] an extraction unit, configured to extract a second machine code corresponding to a preset hazard function from the first machine code after determining that the first machine code contains a controllable variable;

[0041] The judging unit is further configured to judge whether the second machine code contains the controllable variable;

[0042] The determining unit is further configured to determine that the sample to be detected is a target malicious sample when the second machine code includes the controllable variable.

[0043] In some modified implementations of the second aspect of the present application, the judgment unit is further specifically used to: judge whether the second machine code contains the mark.

[0044] In some modified implementations of the second aspect of the present application, after extracting the second machine code corresponding to the preset hazard function from the first machine code, the apparatus further includes:

[0045] The acquisition unit is further configured to acquire parameters contained in the second machine code after extracting the second machine code corresponding to the preset hazard function from the first machine code;

[0046] The judging unit is further configured to judge whether the parameter value of the parameter is a character string corresponding to a preset high-risk command;

[0047] The determination unit is further configured to, when it is determined that the parameter value of the parameter is a character string corresponding to a preset high-risk command, determine that the preset dangerous function corresponding to the second machine code contains illegal content, and regard the sample to be detected as a target malicious sample.

[0048] In some modified implementations of the second aspect of the present application, the type of the preset dangerous function includes: at least one of: a code execution class, a file inclusion class, a command execution class, and an array call class.

[0049] In some modified implementations of the second aspect of the present application, the device further includes:

[0050] The acquisition unit is further configured to acquire the type of the controllable variable when the sample to be detected is a target malicious sample determined based on the controllable variable contained in the second machine code;

[0051] The determination unit is also used to determine a first target risk level of the target malicious sample based on the preset hazard function and the type of the controllable variable, wherein the first target risk level is determined based on the risk levels corresponding to the preset hazard function and the type of the controllable variable, or the first target risk level is determined based on the risk level corresponding to both the preset hazard function and the type of the controllable variable.

[0052] In some modified implementations of the second aspect of the present application, the device further includes:

[0053] The determination unit is also used to determine a second target risk level of the target malicious sample based on the preset risk function and the character string corresponding to the preset high-risk command when the sample to be detected is a target malicious sample based on the parameter value contained in the second machine code, which is determined to be a character string corresponding to a preset high-risk command, wherein the second target risk level is determined based on the risk level corresponding to the preset risk function and the character string corresponding to the preset high-risk command, or the second target risk level is determined based on the risk level corresponding to the preset risk function and the controllable variable.

[0054] In some modified implementations of the second aspect of the present application, the device further includes:

[0055] The alarm unit is used to output alarm information, wherein the alarm information includes the risk level.

[0056] A third aspect of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the sample dynamic detection method described above is implemented.

[0057] A fourth aspect of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the sample dynamic detection method as described above when executing the computer program.

[0058] By means of the above technical solution, the technical solution provided by the present invention has at least the following advantages:

[0059] The present invention provides a method and device for dynamic detection of samples. In the process of running the target sample, the present invention compiles the target sample into a machine code recognizable by the kernel as the first machine code, so as to further determine whether the first machine code contains controllable variables. Since the variable value of the controllable variable is obtained from the user's input content, there is a suspicion of danger. Therefore, if it is determined that the first machine code contains controllable variables, the sample to be detected is determined to be a potential malicious sample. Compared with the prior art, the technical problem that the existing detection scheme will miss detection and miss reporting of variant samples is solved. In the process of running the sample to be detected, the present invention dynamically tracks and identifies whether it contains dangerous controllable variables. If so, it is determined to be a potential malicious sample, so as to use such a potential malicious sample to detect and identify whether it is a variant sample, so as to avoid variant samples being missed.

[0060] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0062] Figure 1 A flow chart of a sample dynamic detection method provided by an embodiment of the present invention;

[0063] Figure 2 A flow chart of another sample dynamic detection method provided by an embodiment of the present invention;

[0064] Figure 3 A block diagram of a sample dynamic detection device provided by an embodiment of the present invention;

[0065] Figure 4 A block diagram of another sample dynamic detection device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0066] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0067] The embodiment of the present invention provides a method for dynamic sample detection. Figure 1 As shown, the method is to dynamically track and identify whether there is a potential risk during the running of the sample to be detected, so as to further determine whether it is a potential malicious sample. For this, the embodiment of the present invention provides the following specific steps:

[0068] 101. Obtain a sample to be detected, and compile the sample to be detected into a first machine code.

[0069] The sample to be detected provided by the embodiment of the present invention may be but is not limited to a PHP sample. If a PHP sample is taken as an example, the target sample can be further run in a PHP sandbox. A sandbox (Sandboxie) refers to a tool for testing the behavior of untrusted files or applications in an isolated environment of network security.

[0070] In the embodiment of the present invention, during the process of running the target sample, the target sample will be compiled into a machine code (OPCODE) recognizable by the kernel, which is the most basic unit of program execution. Different functions, variables, and operations in the complete machine code corresponding to the target sample have their corresponding machine codes.

[0071] 102. Determine whether the first machine code contains a controllable variable.

[0072] Among them, controllable variables refer to variables whose values ​​are obtained from user input, such as $a=$_POST['info']. Since user input is uncontrollable and unknown, such as redundant characters, unknown customization, or even redundant separators, the value of the variable is equivalent to coming from an unknown security source, so it can be assumed that such variables are dangerous.

[0073] 103. If the first machine code includes a controllable variable, it is determined that the sample to be detected is a potential malicious sample.

[0074] In the embodiment of the present invention, for example, taking a PHP sample as an example, a PHP sample is exemplified as follows:

[0075]

[0076] Explanation of the PHP sample: $a is a controllable variable, $b is the concatenation of $a and the string "ddd", and $b is also considered a controllable variable, and is finally brought into the system function for execution. Based on this, if the controllable variable $a is detected in the first machine code corresponding to the PHP sample, it is determined that there is a certain degree of danger, so the sample to be detected will be determined as a potential malicious sample.

[0077] The embodiment of the present invention provides a method for dynamic detection of samples. In the process of running the target sample, the embodiment of the present invention compiles the target sample into a machine code recognizable by the kernel as the first machine code, so as to further determine whether the first machine code contains controllable variables. Since the variable value of the controllable variable is obtained from the user's input content, there is a suspicion of danger. Therefore, if it is determined that the first machine code contains controllable variables, the sample to be detected is determined to be a potential malicious sample. Compared with the prior art, the technical problem that the existing detection scheme will miss detection and miss reporting of variant samples is solved. In the process of running the sample to be detected, the embodiment of the present invention dynamically tracks and identifies whether it contains dangerous controllable variables. If so, it is determined to be a potential malicious sample, so as to use such a potential malicious sample to detect and identify whether it is a variant sample, so as to avoid variant samples being missed.

[0078] In order to explain the above embodiment in more detail, the embodiment of the present invention also provides another sample dynamic detection method, such as Figure 2As shown, the method is a detailed statement and supplementary statement of the above embodiment, and the embodiment of the present invention provides the following specific steps:

[0079] 201. In a process of running a sample set including samples to be detected, a tag is added to a controllable variable in the sample set, where the tag is used to uniquely identify the corresponding controllable variable.

[0080] In the embodiment of the present invention, a controllable variable refers to a variable whose value is obtained from user input content, such as $a=$_POST['info']. Since the user input content is uncontrollable and unknown, such as redundant characters, unknown customization, or even redundant separators, the value of the variable is equivalent to coming from an unknown and unsafe source, so such variables can be assumed to be dangerous. For example, a tag is added to the controllable variable $a.

[0081] 202. Obtain a sample to be detected, compile the sample to be detected into a first machine code, and determine whether the first machine code contains a mark.

[0082] In the embodiment of the present invention, since the controllable variable has been marked, the determination of whether the first machine code contains the controllable variable can be further performed by determining whether the first machine code contains the mark. This process is simple and efficient.

[0083] It should be noted that the embodiment of the present invention uses a hook function to intercept the first machine code. The hook function is a part of the Windows message processing mechanism, which can be used to capture events occurring in the process, that is, it is equivalent to providing a callback function that can process or filter events. In the embodiment of the present invention, the hook function is used to intercept the first machine code, so as to implement subsequent related analysis operations on the preset dangerous functions in the first machine code, but at this time, the normal operation of the sample to be detected will not be prevented, that is, the normal operation result corresponding to the sample to be detected will not be prevented.

[0084] 203. After determining that the first machine code contains a controllable variable, extract a second machine code corresponding to a preset risk function from the first machine code.

[0085] The types of preset dangerous functions include at least one of: code execution class, file inclusion class, command execution class, and array call class.

[0086] In the embodiment of the present invention, some specific functions (also called preset dangerous functions) are mainly analyzed. These specific functions are functions that implement relevant controls if possible in combination with user input content. For example, the types of specific functions include: at least one of code execution class, file inclusion class, command execution class, and array call class. These specific functions are preset dangerous functions referred to in the embodiment of the present invention. Specifically, exemplary examples are listed as follows:

[0087] Code execution functions: eval, assert, preg_replace;

[0088] File contains class functions: include, include_once, require, require_once;

[0089] Command execution functions: system, proc_open, exec, shell_exec, popen, passthru;

[0090] Array call class functions: array_map, array_walk.

[0091] In the process of running the sample to be tested, functions like these, if they carry bad character commands, will have an adverse effect on the sample operation, so they can also be regarded as potentially dangerous functions.

[0092] In the embodiment of the present invention, the machine code corresponding to the sample to be detected is identified as the first machine code. In order to effectively distinguish it, the machine code compiled by the preset dangerous function is identified as the second machine code. In fact, the second machine code is included in the first machine code.

[0093] 204a. Determine whether the second machine code contains a controllable variable.

[0094] In the embodiment of the present invention, since the controllable variable has been marked, this step is further to determine whether the second machine code contains the mark.

[0095] 205a. If the second machine code includes a controllable variable, the sample to be detected is determined to be a target malicious sample.

[0096] In the embodiment of the present invention, if the second machine code contains a controllable variable, then the preset dangerous function corresponding to the second machine code is risky. The explanation is as follows in conjunction with the above-mentioned PHP sample:

[0097] For example, the PHP sample:

[0098]

[0099] Explanation of the PHP sample: $a is a controllable variable, $b is the concatenation of $a and the string "ddd", so this sample is actually a variant sample caused by concatenation. After concatenation, $b is also a controllable variable, and finally brought into the system function for execution, which will further confirm that the sample to be detected is risky, and the potential malicious sample determined in step 103 can be further determined as a target malicious sample. At the same time, the system function is a function with a higher risk.

[0100] 206a. Obtain the type of the controllable variable, and determine the first target risk level of the target malicious sample based on the preset risk function and the type of the controllable variable.

[0101] The first target risk level is determined based on the risk levels corresponding to the preset hazard function and the types of controllable variables, or the first target risk level is determined based on the risk level corresponding to both the preset hazard function and the types of controllable variables.

[0102] Specifically, for example, risk levels corresponding to different preset hazard functions and different types of controllable variables can be separately formulated in advance. If the sample to be detected is a target malicious sample based on the controllable variables contained in the second machine code, then for this judgment, the preset hazard function and the type of controllable variable based on which it is based are obtained, and by looking up the risk levels corresponding to the above-mentioned different preset hazard functions or different types of controllable variables, the risk levels corresponding to the preset hazard functions and the types of controllable variables based on which this judgment is based are obtained, and then the risk levels of the two are combined to obtain the final risk level as the risk level corresponding to the target malicious sample, that is, the first target risk level. Specifically, the combination of the risk levels of the two can be achieved, but is not limited to, by using weights or scoring.

[0103] Or, for example, as a parallel technical solution, the main difference from the above solution is that the corresponding risk levels are not set in advance for the preset hazard function and the different controllable variable types, but are set based on various combinations of different preset hazard functions and different controllable variable types. For example, the preset hazard function 1 and the controllable variable type 1 are used as combination 1, corresponding to risk level 1; the preset hazard function 1 and the controllable variable type 2 are used as combination 2, corresponding to risk level 2, the preset hazard function 2 and the controllable variable type 1 are used as combination 3, corresponding to risk level 3, and so on. Therefore, in this solution, after obtaining the preset hazard function and the type of controllable variable, the corresponding risk level can be easily obtained as the risk level corresponding to the target malicious sample, that is, the first target risk level.

[0104] Below, in the embodiment of the present invention, steps 204b-207b are used as the parallel technical solutions of 204a-206a. In this embodiment, the execution order of the two parallel technical solutions is not restricted. Any one of the solutions can be executed first, and when it cannot be determined that the sample to be detected is the target malicious sample, the other solution can be continued to be executed. Alternatively, the two solutions can be executed in parallel. When any of the solutions determines that the sample to be detected is a malicious sample, the execution of the other solution is stopped. Alternatively, in order to make the detection result more accurate, the detection process can be stopped only when both solutions determine that the sample to be detected is the target malicious sample.

[0105] In this embodiment, if a character string corresponding to a preset high-risk command is detected in the second machine code, it can be directly determined that the sample to be detected is a target malicious sample. Further, the explanation is as follows:

[0106] 204b. Obtain parameters included in the second machine code.

[0107] 205b. Determine whether the parameter value of the parameter is a character string corresponding to a preset high-risk command.

[0108] 206b. If the parameter value of the parameter is a character string corresponding to a preset high-risk command, it is determined that the preset dangerous function corresponding to the second machine code contains illegal content, and the sample to be detected is a target malicious sample.

[0109] In the embodiment of the present invention, steps 204b-206b are explained, wherein the preset high-risk command refers to, for example, the whoami command, the ipconfig command, etc. For example, taking the php sample as an example, as follows:

[0110]

[0111] Explanation of the PHP sample: Although the variable $a is not a controllable variable, its content is the preset high-risk command "whoami". Finally, it is brought into the system function for execution, and the parameter value is the string "whoami", which is illegal. For the embodiment of the present invention, if the parameter value of the function parameter is detected to be the string corresponding to the preset high-risk command, the sample to be detected is further determined to be a target malicious sample.

[0112] 207b. Determine a second target risk level of the target malicious sample based on a preset risk function and a character string corresponding to a preset high-risk command.

[0113] The second target risk level is determined based on the risk levels corresponding to the preset risk function and the character strings corresponding to the preset high-risk commands, or the second target risk level is determined based on the risk level corresponding to the preset risk function and the controllable variable.

[0114] The embodiment of the present invention mainly further determines which risk level corresponds to the target malicious sample based on "which function" and "which character string of the preset high-risk command" (these two factors).

[0115] For example, the risk levels corresponding to the preset dangerous functions and preset high-risk commands can be separately set in advance. Then, when the sample to be detected is a target malicious sample, the preset dangerous function and the preset high-risk command based on which the judgment is based are determined to be the string corresponding to the preset high-risk command, and the risk levels corresponding to the two are further obtained, and finally a risk level is obtained as the risk level of the target malicious sample, that is, the second target risk level. Specifically, the risk levels of the two can be combined, but are not limited to, by weighting or scoring.

[0116] Alternatively, the main difference from the above scheme is that the corresponding risk levels are not set in advance for the strings corresponding to the preset dangerous functions and the preset high-risk commands, but are set based on various combinations of the strings corresponding to different preset dangerous functions and different preset high-risk commands. Therefore, in this scheme, after obtaining the strings corresponding to the preset dangerous functions and the preset high-risk commands, the corresponding risk level can be easily obtained as the risk level of the target malicious sample, that is, the second target risk level.

[0117] 208. Output warning information, where the warning information includes a risk level.

[0118] In the embodiment of the present invention, if the sample to be detected is determined to be a target malicious sample, an alarm message is output, and the alarm message also includes the risk level corresponding to the target malicious sample. Specifically, the human-computer interaction interface output is used for display.

[0119] Furthermore, as a response to the above Figure 1 , Figure 2 In order to realize the method shown in the figure, the embodiment of the present invention provides a sample dynamic detection device. The device embodiment corresponds to the aforementioned method embodiment. For the sake of ease of reading, the device embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the device in this embodiment can correspond to all the contents of the aforementioned method embodiment. The device is used to detect whether a sample is a malicious sample, specifically as follows Figure 3 As shown, the device comprises:

[0120] An acquisition unit 31 is used to acquire a sample to be detected and compile the sample to be detected into a first machine code;

[0121] A judging unit 32, configured to judge whether the first machine code contains a controllable variable;

[0122] The determination unit 33 is configured to determine that the sample to be detected is a potential malicious sample when the first machine code contains a controllable variable.

[0123] Further, such as Figure 4 As shown, the device also includes:

[0124] The marking unit 34 is used to add a mark to the controllable variable in the sample set during the operation of the sample set including the sample to be detected, wherein the mark is used to uniquely identify the corresponding controllable variable.

[0125] Further, such as Figure 4 As shown, the judging unit 32 is further specifically used to judge whether the first machine code contains the mark.

[0126] Further, such as Figure 4 As shown, the device also includes:

[0127] An extraction unit 35 is used to extract a second machine code corresponding to a preset hazard function from the first machine code after determining that the first machine code contains a controllable variable;

[0128] The judging unit 32 is further configured to judge whether the second machine code contains the controllable variable;

[0129] The determining unit 33 is further configured to determine that the sample to be detected is a target malicious sample when the second machine code includes the controllable variable.

[0130] Further, such as Figure 4 As shown, the judging unit 32 is further specifically used to judge whether the second machine code contains the mark.

[0131] Further, such as Figure 4 As shown, the type of the preset dangerous function includes at least one of: code execution class, file inclusion class, command execution class, and array call class.

[0132] Further, such as Figure 4 As shown, the device also includes:

[0133] The acquisition unit 31 is further configured to acquire parameters contained in the second machine code after extracting the second machine code corresponding to the preset hazard function from the first machine code;

[0134] The judging unit 32 is further configured to judge whether the parameter value of the parameter is a character string corresponding to a preset high-risk command;

[0135] The determination unit 33 is further configured to determine that the preset dangerous function corresponding to the second machine code contains illegal content and regard the sample to be detected as a target malicious sample when it is determined that the parameter value of the parameter is a character string corresponding to a preset high-risk command.

[0136] Further, such as Figure 4 As shown, the device also includes:

[0137] The acquisition unit 31 is further configured to acquire the type of the controllable variable when the sample to be detected is a target malicious sample determined based on the controllable variable contained in the second machine code;

[0138] The determination unit 33 is also used to determine a first target risk level of the target malicious sample based on the preset risk function and the type of the controllable variable, wherein the first target risk level is determined based on the risk levels corresponding to the preset risk function and the type of the controllable variable, or the first target risk level is determined based on the risk level corresponding to both the preset risk function and the type of the controllable variable.

[0139] Further, such as Figure 4 As shown, the device also includes:

[0140] The determination unit 33 is also used to determine the second target risk level of the target malicious sample based on the preset risk function and the character string corresponding to the preset high-risk command when the sample to be detected is a target malicious sample based on the parameter value contained in the second machine code, which is determined to be a character string corresponding to a preset high-risk command, wherein the second target risk level is determined based on the risk level corresponding to the preset risk function and the character string corresponding to the preset high-risk command, or the second target risk level is determined based on the risk level corresponding to the preset risk function and the controllable variable.

[0141] Further, such as Figure 4 As shown, the device also includes:

[0142] The alarm unit 36 ​​is used to output alarm information, wherein the alarm information includes the risk level.

[0143] In summary, the embodiment of the present invention provides a method and device for dynamic detection of samples. In the process of running the target sample, the embodiment of the present invention compiles the target sample into a machine code recognizable by the kernel as the first machine code, so as to further determine whether the first machine code contains controllable variables. Since the variable value of the controllable variable is obtained from the user's input content, there is a suspicion of danger. Therefore, if it is determined that the first machine code contains controllable variables, the sample to be detected is determined to be a potential malicious sample. Compared with the prior art, the technical problem that the existing detection scheme will miss detection and miss reporting of variant samples is solved. In the process of running the sample to be detected, the embodiment of the present invention dynamically tracks and identifies whether it contains dangerous controllable variables. If so, it is determined to be a potential malicious sample, so as to use such a potential malicious sample to detect and identify whether it is a variant sample, thereby avoiding the variant sample from being missed.

[0144] The sample dynamic detection device includes a processor and a memory. The acquisition unit, judgment unit and determination unit are all stored in the memory as program units. The processor executes the program units stored in the memory to realize corresponding functions.

[0145] The processor contains a kernel, which calls the corresponding program unit from the memory. One or more kernels can be set, and by adjusting the kernel parameters, the kernel can dynamically track and identify whether the sample to be detected contains dangerous controllable variables during the running process. If so, it is determined to be a potential malicious sample, so as to use such potential malicious samples to detect and identify whether they are variant samples, avoiding variant samples from being missed.

[0146] An embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the sample dynamic detection method described above is implemented.

[0147] An embodiment of the present invention provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the sample dynamic detection method as described above when executing the computer program.

[0148] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0149] In a typical configuration, the device includes one or more processors (CPU), memory and bus. The device may also include input / output interface, network interface and the like.

[0150] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip. The memory is an example of a computer-readable medium.

[0151] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0152] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0153] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0154] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent insertion, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A sample dynamic detection method, characterized in that: The method comprises: Acquire a sample to be detected, and compile the sample to be detected into a first machine code, wherein the first machine code is recognizable by a kernel, and functions, variables, and operations in the sample to be detected have corresponding machine codes in the first machine code; Determining whether the first machine code includes a controllable variable, wherein the value of the controllable variable is obtained from user input content; If the first machine code includes a controllable variable, the sample to be detected is determined to be a potential malicious sample.

2. The method according to claim 1, characterized in that The method further comprises: In the process of running a sample set including the sample to be detected, a tag is added to the controllable variable in the sample set, and the tag is used to uniquely identify the corresponding controllable variable.

3. The method according to claim 2, characterized in that The determining whether the first machine code includes a controllable variable includes: It is determined whether the first machine code includes the mark.

4. The method according to claim 2, characterized in that: After determining that the first machine code contains a controllable variable, the method further includes: Extracting a second machine code corresponding to a preset dangerous function from the first machine code; Determining whether the second machine code contains the controllable variable; If the second machine code includes the controllable variable, the sample to be detected is determined to be a target malicious sample.

5. The method according to claim 4, characterized in that The determining whether the second machine code includes a controllable variable includes: It is determined whether the second machine code includes the mark.

6. The method according to claim 4, characterized in that After extracting the second machine code corresponding to the preset hazard function from the first machine code, the method further includes: Obtaining parameters contained in the second machine code; Determine whether the parameter value of the parameter is a character string corresponding to a preset high-risk command; If so, it is determined that the preset dangerous function corresponding to the second machine code contains illegal content, and the sample to be detected is determined as a target malicious sample.

7. The method according to any one of claims 4 or 6, characterized in that: The type of the preset dangerous function includes: at least one of a code execution class, a file inclusion class, a command execution class, and an array call class.

8. The method according to claim 7, characterized in that If the sample to be detected is a target malicious sample, it is determined based on the controllable variable contained in the second machine code, then the method further includes: Obtaining the type of the controllable variable; Based on the preset hazard function and the type of the controllable variable, a first target risk level of the target malicious sample is determined, wherein the first target risk level is determined based on the risk levels corresponding to the preset hazard function and the type of the controllable variable, or the first target risk level is determined based on the risk level corresponding to both the preset hazard function and the type of the controllable variable.

9. The method according to claim 7, characterized in that: If the sample to be detected is a target malicious sample, it is determined based on the parameter value included in the second machine code being a character string corresponding to a preset high-risk command, the method further includes: Based on the preset danger function and the character string corresponding to the preset high-risk command, a second target risk level of the target malicious sample is determined, wherein the second target risk level is determined based on the risk levels corresponding to the preset danger function and the character string corresponding to the preset high-risk command, or the second target risk level is determined based on the risk level corresponding to the preset danger function and the controllable variable.

10. The method according to claim 9, characterized in that The method further comprises: Output warning information, wherein the warning information includes the risk level.

11. A sample dynamic detection device, characterized in that: The device comprises: an acquisition unit, configured to acquire a sample to be detected, and compile the sample to be detected into a first machine code, wherein the first machine code is recognizable by a kernel, and functions, variables, and operations in the sample to be detected have corresponding machine codes in the first machine code; a judging unit, configured to judge whether the first machine code contains a controllable variable, wherein the value of the controllable variable is obtained from user input content; A determination unit is used to determine that the sample to be detected is a potential malicious sample when the first machine code contains a controllable variable.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the sample dynamic detection method according to any one of claims 1 to 10 is implemented.

13. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the sample dynamic detection method according to any one of claims 1 to 10 when executing the computer program.

Images