Cuckoo cluster deployment method, Cuckoo cluster-based detection method and device

Abstract

The present application provides a Cuckoo cluster deployment method, a Cuckoo cluster-based detection method, and a device. The Cuckoo cluster deployment method includes: installing a virtual machine and a virtual machine management tool on a machine to be deployed; the virtual machine management tool is used to manage the virtual machine; obtaining multiple images corresponding to at least two operating systems; importing the multiple images corresponding to each operating system into the virtual machine to install at least two operating systems on the virtual machine; obtaining multiple Cuckoo programs; configuring the correspondence between the multiple images corresponding to each operating system and the multiple Cuckoo programs; wherein one image corresponds to one Cuckoo program; determining the identification information corresponding to each Cuckoo program; the identification information is used to implement the call of the Cuckoo program. This deployment method is used to achieve effective maintenance of the Cuckoo cluster and improve the detection speed and detection effect of the Cuckoo cluster.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a Cuckoo cluster deployment method, and a Cuckoo cluster-based detection method and device. Background Art

[0002] Cuckoo is an open source sandbox technology that enables sandbox deployment. With the development of the Internet, every company has a large number of files that need to be sandboxed every day.

[0003] Cuckoo offers two deployment modes: stand-alone and cluster. Stand-alone deployment can cause program congestion, resulting in slower detection speeds and poorer detection results. Cluster deployment uses a distributed deployment model, where each distributed node (i.e., each sandbox) maintains consistency and cannot perform targeted operations on the sandbox. Consequently, when some sandboxes fail or report an anomaly, it is impossible to effectively identify and repair the sandbox, preventing effective cluster maintenance. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a Cuckoo cluster deployment method, a Cuckoo cluster-based detection method, and a device to achieve effective maintenance of the Cuckoo cluster and improve the detection speed and detection effect of the Cuckoo cluster.

[0005] In a first aspect, an embodiment of the present application provides a method for deploying a cuckoo cluster, comprising: installing a virtual machine and a virtual machine management tool on a machine to be deployed; the virtual machine management tool is used to manage the virtual machine; obtaining multiple images corresponding to at least two operating systems; importing the multiple images corresponding to each operating system into the virtual machine to install the at least two operating systems on the virtual machine; obtaining multiple cuckoo programs; configuring a correspondence between the multiple images corresponding to each operating system and the multiple cuckoo programs; wherein one image corresponds to one cuckoo program; determining identification information corresponding to each cuckoo program; the identification information is used to implement the calling of the cuckoo program.

[0006] The embodiment of the present application adopts a cluster deployment mode based on Cuckoo technology, which can improve the detection speed and detection effect compared to the single-machine deployment mode. In the cluster deployment mode, a distributed deployment method is no longer used. Instead, a correspondence between multiple images corresponding to each operating system and multiple Cuckoo programs is configured. Therefore, on the one hand, the entire Cuckoo cluster no longer corresponds to a single operating system, but multiple operating systems; on the other hand, each sandbox is independent and can perform targeted operations on the sandbox. When some sandboxes are broken or the sandbox reports an abnormality, it can effectively judge and repair the sandbox, thereby achieving effective maintenance of the cluster.

[0007] As a possible implementation method, obtaining multiple images corresponding to at least two operating systems includes: obtaining iso files (CD image files) corresponding to the at least two operating systems; based on the iso files corresponding to the at least two operating systems, creating images corresponding to the at least two operating systems; the images corresponding to the at least two operating systems include software and files for monitoring the corresponding operating systems.

[0008] In an embodiment of the present application, the effective production of the image corresponding to the running system is achieved through the CD image file corresponding to the running system; and the produced image includes software and files for monitoring the corresponding running system, which can realize the monitoring of the running system and improve the security of the cluster.

[0009] As a possible implementation manner, obtaining multiple cuckoo programs includes: obtaining multiple initial cuckoo programs; configuring databases corresponding to the at least two operating systems in the multiple initial cuckoo programs; installing an operating environment corresponding to the cuckoo program; and installing and running the multiple initial cuckoo programs in the operating environment to generate the multiple cuckoo programs.

[0010] In an embodiment of the present application, the initial cuckoo program is first obtained, then the database corresponding to the operating system is configured, and the operating environment corresponding to the cuckoo program is installed, and finally, multiple initial cuckoo programs are installed and run in the operating environment to achieve effective generation of the cuckoo program.

[0011] As a possible implementation manner, configuring the correspondence between the multiple images corresponding to each operating system and the multiple cuckoo programs includes: determining the image corresponding to each cuckoo program; determining the operating system corresponding to each cuckoo program according to the operating system corresponding to the image corresponding to each cuckoo program; determining the virtual machine type corresponding to each cuckoo program according to the operating system corresponding to each cuckoo program; and writing information about the image corresponding to each cuckoo program, information about the operating system corresponding to each cuckoo program, and the virtual machine type corresponding to each cuckoo program into a configuration file of each cuckoo program.

[0012] In an embodiment of the present application, by determining the image, operating system and virtual machine type corresponding to each cuckoo program, the image information, operating system information and virtual machine type are written into the configuration file of the cuckoo program, thereby achieving effective and accurate configuration of the correspondence between the image and the cuckoo program.

[0013] As a possible implementation manner, the deployment method further includes: making snapshots corresponding to the at least two operating systems; and writing the snapshots of the operating systems corresponding to the respective Cuckoo programs into configuration files of the respective Cuckoo programs.

[0014] In an embodiment of the present application, a snapshot of the running system can be used to restore the state of the running system. By writing the snapshot of the running system into a configuration file, subsequent state restoration based on the snapshot is facilitated.

[0015] As a possible implementation manner, determining the identification information corresponding to each cuckoo program includes: determining the port corresponding to each cuckoo program and determining the IP (Internet Protocol) of the machine to be deployed; and determining the IP of the machine to be deployed and the port corresponding to each cuckoo program as the identification information corresponding to each cuckoo program.

[0016] In the embodiment of the present application, each cuckoo program can be called quickly and effectively through the IP address of the machine to be deployed and the port corresponding to each cuckoo program.

[0017] In a second aspect, an embodiment of the present application provides a detection method based on a Cuckoo cluster, wherein the Cuckoo cluster includes multiple Cuckoo programs, virtual machines, and multiple images installed on the virtual machines, wherein the multiple images correspond to at least two operating systems, and there is a corresponding relationship between the multiple images and the multiple Cuckoo programs, wherein one image corresponds to one Cuckoo program, and each Cuckoo program corresponds to identification information; the detection method includes: obtaining a file to be detected; determining the operating system corresponding to the file to be detected according to the file type of the file to be detected; determining the image corresponding to the file to be detected according to the operating system corresponding to the file to be detected; determining the Cuckoo program corresponding to the file to be detected according to the image corresponding to the file to be detected and the corresponding relationship; calling the Cuckoo program corresponding to the file to be detected through the identification information corresponding to the Cuckoo program corresponding to the file to be detected, so that the Cuckoo program corresponding to the file to be detected detects the file to be detected and obtains a detection result.

[0018] In an embodiment of the present application, a Cuckoo cluster deployed using the deployment method provided in the first aspect can detect files. During the detection process, the operating system is first determined, then the corresponding image is determined, and then the corresponding Cuckoo program is determined using the corresponding relationship. Finally, the corresponding Cuckoo program is called based on the identification information, and the corresponding Cuckoo program is used to detect the file to be detected. Based on the cluster deployment method, the detection speed and detection effect are improved.

[0019] As a possible implementation method, the detection method also includes: determining the processing thread corresponding to the file to be detected based on the file type of the file to be detected and the preset correspondence between the thread and the file type; correspondingly, performing the following steps through the processing thread: determining the operating system corresponding to the file to be detected based on the file type of the file to be detected; determining the image corresponding to the file to be detected based on the operating system corresponding to the file to be detected; determining the cuckoo program corresponding to the file to be detected based on the image corresponding to the file to be detected and the correspondence; calling the cuckoo program corresponding to the file to be detected through the identification information corresponding to the cuckoo program corresponding to the file to be detected, so that the cuckoo program corresponding to the file to be detected detects the file to be detected and obtains a detection result.

[0020] In an embodiment of the present application, a concurrent thread processing method is adopted, and the correspondence between different threads and file types is preset. Different threads are used to realize the detection of files to be detected of corresponding file types, thereby further improving the detection speed and detection effect.

[0021] In a third aspect, an embodiment of the present application provides a Cuckoo cluster deployment device, comprising: various functional modules for implementing the Cuckoo cluster deployment method described in the first aspect and any possible implementation method of the first aspect.

[0022] In a fourth aspect, an embodiment of the present application provides a cuckoo cluster-based detection device, comprising: various functional modules for implementing the cuckoo cluster-based detection method described in the second aspect and any possible implementation method of the second aspect.

[0023] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a processor; a memory communicatively connected to the processor; the memory stores instructions executable by the processor, and the instructions are executed by the processor so that the processor can execute the Cuckoo cluster deployment method described in the first aspect and any possible implementation of the first aspect, or the Cuckoo cluster-based detection method described in the second aspect and any possible implementation of the second aspect.

[0024] In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is run by a computer, the computer program executes the Cuckoo cluster deployment method described in the first aspect and any possible implementation of the first aspect, or the Cuckoo cluster-based detection method described in the second aspect and any possible implementation of the second aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 A flowchart of a Cuckoo cluster deployment method provided in an embodiment of the present application;

[0027] Figure 2 A flowchart of a Cuckoo cluster-based detection method provided in an embodiment of the present application;

[0028] Figure 3 The file detection process based on the Cuckoo cluster provided in the embodiment of this application;

[0029] Figure 4A schematic diagram of the structure of a deployment device for a Cuckoo cluster provided in an embodiment of the present application;

[0030] Figure 5 A schematic diagram of the structure of a detection device based on a Cuckoo cluster provided in an embodiment of the present application;

[0031] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0032] Icons: 400 - deployment device of Cuckoo cluster; 410 - configuration module; 420 - first acquisition module; 500 - detection device based on Cuckoo cluster; 510 - second acquisition module; 520 - detection module; 600 - electronic device; 610 - processor; 620 - memory. DETAILED DESCRIPTION

[0033] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0034] The technical solution provided in the embodiments of the present application can be applied to various application scenarios that require the use of sandboxes for file detection, for example: enterprises use sandboxes to detect files every day.

[0035] The sandbox used in the embodiment of the present application is a sandbox based on Cuckoo technology. In Cuckoo technology, Cuckoo is deployed on a machine. When detection is required, the file to be detected is transferred to the machine, and the machine then calls the Cuckoo program to detect the file to be detected.

[0036] The sandbox detection of the cuckoo program needs to be based on some operating environment, operating system, virtual machine, etc. Therefore, cuckoo needs to be deployed to realize file detection.

[0037] In the embodiment of the present application, a Cuckoo cluster deployment method is adopted. In the deployed Cuckoo cluster, multiple operating systems are involved, which can be applied to file detection of various detection requirements such as multiple file types. Moreover, each Cuckoo program is independent and can be operated in a targeted manner.

[0038] Furthermore, the technical solution of the embodiments of the present application involves two parts: one is the deployment of the Cuckoo cluster, and the other is the application of the deployed Cuckoo cluster. The hardware operating environment of the Cuckoo cluster deployment solution can be the machine where Cuckoo is to be deployed, or it can be another machine used for deployment. The hardware operating environment of the Cuckoo cluster application solution is the machine where the Cuckoo cluster is deployed.

[0039] The above-mentioned machines may be electronic devices, such as computers, servers and other hardware devices.

[0040] In the following embodiments, the deployment scheme of the Cuckoo cluster is first introduced, and then the detection scheme based on the deployed Cuckoo cluster is introduced.

[0041] Please refer to Figure 1 , is a flow chart of a Cuckoo cluster deployment method provided in an embodiment of the present application, the deployment method comprising:

[0042] Step 110: Install the virtual machine and virtual machine management tool on the machine to be deployed. The virtual machine management tool is used to manage the virtual machine.

[0043] Step 120: Obtain multiple images corresponding to at least two operating systems.

[0044] Step 130: Import the multiple images corresponding to the respective operating systems into the virtual machine, so as to install at least two operating systems on the virtual machine.

[0045] Step 140: Obtain multiple cuckoo programs.

[0046] Step 150: Configure the corresponding relationship between multiple images corresponding to each operating system and multiple Cuckoo programs, wherein one image corresponds to one Cuckoo program.

[0047] Step 160: Determine the identification information corresponding to each cuckoo program. The identification information is used to implement the call of the cuckoo program.

[0048] The embodiment of the present application adopts a cluster deployment mode based on Cuckoo technology, which can improve the detection speed and detection effect compared to the single-machine deployment mode. In the cluster deployment mode, a distributed deployment method is no longer used. Instead, a correspondence between multiple images corresponding to each operating system and multiple Cuckoo programs is configured. Therefore, on the one hand, the entire Cuckoo cluster no longer corresponds to a single operating system, but multiple operating systems; on the other hand, each sandbox is independent and can perform targeted operations on the sandbox. When some sandboxes are broken or the sandbox reports an abnormality, it can effectively judge and repair the sandbox, thereby achieving effective maintenance of the cluster.

[0049] Next, the detailed implementation of the deployment solution is introduced.

[0050] In step 110, the machine to be deployed can be understood as the machine on which the Cuckoo cluster needs to be deployed, and can be the enterprise's file detection terminal, such as a detection server.

[0051] In the embodiment of the present application, since multiple operating systems are involved and different operating systems may need to be installed on different virtual machines, in step 110, multiple types of virtual machines may need to be installed to accommodate different operating systems.

[0052] As an optional implementation manner, the operating systems involved in the embodiments of the present application include but are not limited to: Windows 7, Windows 10, Ubuntu, and CentOS, etc., which are not exhaustive here.

[0053] Furthermore, in step 110, for Ubuntu (a Linux operating system mainly based on desktop applications) system, VirtualBox (an open source virtual machine software) is installed; for CentOS (Community Enterprise Operating System, community enterprise operating system), KVM (switcher, the abbreviation of keyboard (Keyboard), display (Video), mouse (Mouse)) is installed.

[0054] In addition to installing the virtual machine, you also need to install the virtual machine management tool to manage the virtual machine. As an optional implementation method, VirtualBox needs to install VirtualBox Mangage, and KVM virtual machines need to install Virsh.

[0055] After installing the virtual machine management tool, you can also check whether the virtual network card needs to be started. If it needs to be started, start it; if it is not needed, do not start it.

[0056] After the installation of the virtual machine and the virtual machine management tool is completed in step 110 , in step 120 , a plurality of images corresponding to at least two operating systems are obtained.

[0057] In step 120 , a plurality of images corresponding to at least two operating systems may be acquired in real time, or a plurality of images corresponding to at least two operating systems may be acquired in advance.

[0058] It can be understood that if the multiple images corresponding to at least two operating systems are images obtained in real time, then step 120 can be understood as the image production process; if the multiple images corresponding to at least two operating systems are pre-stored images, then in step 120, it is only necessary to request the images from the image storage party.

[0059] Regardless of whether it is a real-time production process or a pre-production process, as an optional implementation method, the production process of multiple images corresponding to at least two operating systems includes: obtaining iso files (CD image files) corresponding to at least two operating systems; based on the iso files corresponding to at least two operating systems, producing images corresponding to at least two operating systems; the images corresponding to at least two operating systems include software and files for monitoring the corresponding operating systems.

[0060] In this embodiment, the ios files corresponding to each operating system can be directly obtained from the official website of the operating system or from other resource channels.

[0061] As an optional implementation, when making the image corresponding to the running system, it is also necessary to install a virtual machine, and then complete the making of the system image on the virtual machine. The implementation of the installation of the virtual machine here can refer to the implementation of step 110.

[0062] Furthermore, if the machine used to create the image for the operating system is the same machine used to deploy the cluster, there is no need to repeatedly install the virtual machine in step 110. Only the virtual machine management tool needs to be installed. If the machine used to create the image for the operating system is different from the machine used to deploy the cluster, the virtual machine still needs to be installed in step 110.

[0063] Furthermore, after the virtual machine is installed, CPU (Central Processing Unit) virtualization is enabled on the machine (the machine for making the image), and then the corresponding system is installed on each virtual machine and activated.

[0064] After activating the system, you can start making an image. For example, if it is a Windows system, you need to turn off the firewall, automatic updates, UAC, and Windows defender; then install Python 2.7, and install PIL through Python; put the agent.py file in Cuckoo under C:\Users\[USER]\AppData\Roaming\MicroSoft\Windows\StartMenu\Programs\Startup\, and change the suffix to .pyw. Here, users refers to the user name; and install commonly used office software, such as Adobe, Office, zip decompression files and other commonly used office software. If it is an Ubuntu system, the Ubuntu system needs to turn off the firewall, then put the agent.py file in Cuckoo into the Ubuntu system, and set it to start automatically at boot.

[0065] The various setting processes described above are generally for the purpose of enabling subsequent monitoring of the running system. Therefore, the software or files involved in the setting process can be understood as software and files for monitoring the corresponding running system.

[0066] The above-mentioned production process is only an example, and other production methods may be used. For details, reference may be made to the mirror production technology in the art.

[0067] After the above-mentioned production process, the image of the operating system is equivalent to being completed. At this time, the produced image of the operating system (image file) can be exported as the result of the image production.

[0068] In an embodiment of the present application, the effective production of the image corresponding to the running system is achieved through the CD image file corresponding to the running system; and the produced image includes software and files for monitoring the corresponding running system, which can realize the monitoring of the running system and improve the security of the cluster.

[0069] After the images are acquired in step 120 , in step 130 , the multiple images corresponding to the respective operating systems are imported into the virtual machine to install at least two operating systems on the virtual machine.

[0070] In order to expand the entire Cuckoo cluster, you can copy the image before importing it into the virtual machine to obtain more images.

[0071] Therefore, as an optional implementation, multiple images corresponding to each operating system are copied into multiple copies, for example, 10 copies are copied each.

[0072] After copying multiple copies, the name of the image is modified to ensure that each image name is unique, and then imported into the virtual machine. Importing the image into the virtual machine can be understood as installing the image on the virtual machine. Therefore, the import process can refer to the installation process of the aforementioned embodiment.

[0073] After importing the image into a virtual machine, you can also assign different IP addresses to the images corresponding to each running system. For example, a VirtualBox virtual machine is assigned an IP address in the 192.168.56.x network segment, and a KVM virtual machine is assigned an IP address in the 192.168.112.x network segment.

[0074] After assigning an IP address, you can start the system. After starting the system, you can also use commands to create snapshots of each system. Snapshots represent the system's operating status and can be used to restore the system to a previous state. These snapshots can be temporarily saved and used later.

[0075] After the installation of the operating system is completed in step 130 , in step 140 , a plurality of cuckoo programs are obtained.

[0076] Step 140 is similar to step 120. The process of acquiring multiple cuckoo programs can be a real-time acquisition process, or multiple pre-stored cuckoo programs can be directly acquired.

[0077] Regardless of whether it is a real-time acquisition process or acquiring multiple pre-stored cuckoo programs, as an optional implementation method, the configuration process of multiple cuckoo programs includes: acquiring multiple initial cuckoo programs; configuring at least two databases corresponding to the operating systems in the multiple initial cuckoo programs; installing the operating environment corresponding to the cuckoo program; installing and running the multiple initial cuckoo programs in the operating environment to generate multiple cuckoo programs.

[0078] In this embodiment, the multiple initial cuckoo programs can be understood as uninstalled program files, which need to be run later to obtain the installed cuckoo program. The initial cuckoo program is usually pre-installed in the machine to be deployed or provided by the user.

[0079] The databases corresponding to at least two operating systems can be considered system dependencies. The system can only run properly after the corresponding databases are installed. Different systems often require different database dependencies. To ensure the system can run properly, all possible databases can be configured in the initial Cuckoo program.

[0080] For example, the configured databases include: MongoDB, PostgreSQL database, Pydeep, Yara, tcpdump, Volatility, etc.

[0081] As an optional implementation, the Cuckoo program runs on Python 2.7. Python 2.7 may have already been installed when the image was created. Therefore, you can directly install the Python 2.7 environment. By creating a Python virtual environment, the Cuckoo program can run in that virtual environment.

[0082] Then, the initial cuckoo program is installed in the Python environment and run to obtain the final cuckoo program. As an optional implementation, if the program is run as the root user, the file is located in / root / .cuckoo. If another user (such as user) is used, the file is located in / home / user / .cuckoo.

[0083] In an embodiment of the present application, the initial cuckoo program is first obtained, then the database corresponding to the operating system is configured, and the operating environment corresponding to the cuckoo program is installed, and finally, multiple initial cuckoo programs are installed and run in the operating environment to achieve effective generation of the cuckoo program.

[0084] In step 140 , if the number of cuckoo programs does not meet the number requirement of the multiple images, for example, is less than the number of the multiple images, the cuckoo programs may be copied to obtain the same number of cuckoo programs as the multiple images.

[0085] Generally speaking, in the above-mentioned cuckoo program generation process, only one cuckoo program file is finally generated. By copying the one cuckoo program file, a required number of cuckoo programs can be obtained.

[0086] In step 150, a correspondence between a plurality of images corresponding to each operating system and a plurality of cuckoo programs is configured.

[0087] As an optional implementation, step 150 includes: determining the image corresponding to each cuckoo program; determining the operating system corresponding to each cuckoo program based on the operating system corresponding to the image corresponding to each cuckoo program; determining the virtual machine type corresponding to each cuckoo program based on the operating system corresponding to each cuckoo program; and writing information about the image corresponding to each cuckoo program, information about the operating system corresponding to each cuckoo program, and the virtual machine type corresponding to each cuckoo program into a configuration file of each cuckoo program.

[0088] In this embodiment, the configuration information in the configuration files of multiple cuckoo programs is processed to achieve the configuration of the corresponding relationship.

[0089] To determine the image corresponding to each cuckoo program, you can sort all the cuckoo programs and all the images, and then match the cuckoo programs and images with the same order. For example, if there are 30 cuckoo programs and 30 images, the first cuckoo program corresponds to the first image, and so on.

[0090] After determining the image corresponding to each cuckoo program, the operating system corresponding to the image corresponding to each cuckoo program is the operating system corresponding to each cuckoo program. Furthermore, the virtual machine type corresponding to the operating system corresponding to each cuckoo program is the virtual machine type corresponding to each cuckoo program.

[0091] After determining the above correspondences, the information of the image corresponding to each cuckoo program, the information of the operating system corresponding to each cuckoo program, and the virtual machine type corresponding to each cuckoo program are written into the configuration file of each cuckoo program, so that the correspondence between each cuckoo program and the image can be recorded.

[0092] The information of the running system may include the system name and system type; the information of the image may include the image IP and image name.

[0093] In an embodiment of the present application, by determining the image, operating system and virtual machine type corresponding to each cuckoo program, the image information, operating system information and virtual machine type are written into the configuration file of the cuckoo program, thereby achieving effective and accurate configuration of the correspondence between the image and the cuckoo program.

[0094] As described in the previous embodiment, when creating an image, a snapshot of the running system can also be created, and the created snapshot can also be stored in the corresponding relationship. Therefore, the deployment method can also include: creating snapshots corresponding to at least two running systems (which can be pointed to in the above process); writing the snapshots of the running systems corresponding to each Cuckoo program into the configuration file of each Cuckoo program.

[0095] That is, in this embodiment, the snapshot of the running system is also written into the configuration file.

[0096] In an embodiment of the present application, a snapshot of the running system can be used to restore the state of the running system. By writing the snapshot of the running system into a configuration file, subsequent state restoration based on the snapshot is facilitated.

[0097] From the configuration process of the above correspondence, it can be seen that after the configuration is completed, one image corresponds to one Cuckoo program.

[0098] In step 160, identification information corresponding to each cuckoo program is determined, and the identification information is used to implement the calling of the cuckoo program.

[0099] Through the introduction of the above embodiments, it can be understood that a Cuckoo cluster includes multiple Cuckoo programs, multiple types of virtual machines, and multiple images; and when performing detection, it is necessary to first determine which Cuckoo application to use. Therefore, by setting identification information, it is convenient to subsequently call the Cuckoo program or perform other targeted processing.

[0100] As an optional implementation, step 160 includes: determining the port corresponding to each cuckoo program and determining the IP of the machine to be deployed; and determining the IP of the machine to be deployed and the port corresponding to each cuckoo program as identification information corresponding to each cuckoo program.

[0101] In this embodiment, the IP address and port number of the machine to be deployed are used as identification information for the Cuckoo program. When determining the IP address corresponding to each Cuckoo program, the port number on the machine to be deployed can be sequentially assigned to each Cuckoo program. Alternatively, a pre-defined relationship between ports and Cuckoo programs can be established, and the port number corresponding to the Cuckoo program can be determined based on this relationship. Other embodiments are also possible, and are not limited here.

[0102] In the embodiment of the present application, each cuckoo program can be called quickly and effectively through the IP address of the machine to be deployed and the port corresponding to each cuckoo program.

[0103] After the identification information is determined, it can be stored, and the deployment of the entire Cuckoo cluster can be completed.

[0104] Furthermore, in the deployed Cuckoo cluster, there are multiple Cuckoo programs, virtual machines and multiple images installed on the virtual machines. The multiple images correspond to at least two operating systems. There is a corresponding relationship between the multiple images and the multiple Cuckoo programs, wherein one image corresponds to one Cuckoo program, and each Cuckoo program has corresponding identification information.

[0105] Based on the above Cuckoo cluster, files can be detected to obtain sandbox reports.

[0106] Please refer to the following Figure 2 , is a flow chart of a detection method based on a Cuckoo cluster provided in an embodiment of the present application, the detection method comprising:

[0107] Step 210: Obtain the file to be detected.

[0108] Step 220: Determine the operating system corresponding to the file to be detected according to the file type of the file to be detected.

[0109] Step 230: Determine the image corresponding to the file to be detected according to the operating system corresponding to the file to be detected.

[0110] Step 240: Determine the cuckoo program corresponding to the file to be detected based on the image corresponding to the file to be detected and the corresponding relationship.

[0111] Step 250: calling the cuckoo program corresponding to the file to be detected through the identification information corresponding to the cuckoo program corresponding to the file to be detected, so that the cuckoo program corresponding to the file to be detected detects the file to be detected and obtains a detection result.

[0112] In an embodiment of the present application, a Cuckoo cluster deployed using the deployment method provided in the aforementioned embodiment can perform file detection. During the detection process, the operating system is first determined, then the corresponding image is determined, and then the corresponding Cuckoo program is determined using the corresponding relationship. Finally, the corresponding Cuckoo program is called based on the identification information, and the corresponding Cuckoo program performs the detection on the file to be detected. This cluster-based deployment method improves detection speed and effectiveness.

[0113] In step 210, the file to be detected may be a file uploaded by the system (detection system) API (Application Programming Interface). The file to be detected may be one file or multiple files.

[0114] After obtaining the file to be detected, the type of the file to be detected can be determined. As an optional implementation, the file type can be determined using Python's magic module. If the file type meets the program's requirements and the file size does not exceed 30MB, the program continues to execute. Otherwise, a prompt message indicating a file error can be returned.

[0115] After determining the file type of the file to be detected, since the sandbox program runs slowly, in order to increase the throughput of program processing, after step 210, Python's Celery can be used to run the subsequent steps in multiple processes. As an optional implementation method, each process only processes one file type.

[0116] For example, the percentage of Celery processes running can be determined based on the percentage of file types. Specifically, 10 processes can be set for processing PE files (exe, dll), 5 processes for Office files, 1 process for ELF files, and 5 processes for other files. This is just an example; different implementations can be used in different application scenarios.

[0117] Therefore, as an optional implementation, the detection method further includes: determining a processing thread corresponding to the file to be detected based on the file type of the file to be detected and a preset correspondence between the thread and the file type; correspondingly, executing steps 220 to 250 through the processing thread.

[0118] In an embodiment of the present application, a concurrent thread processing method is adopted, and the correspondence between different threads and file types is preset. Different threads are used to realize the detection of files to be detected of corresponding file types, thereby further improving the detection speed and detection effect.

[0119] In addition to determining the file type of the file to be detected, some embodiments can also determine whether the file is malicious. If it is, the subsequent steps are skipped; if not, the subsequent steps are continued. For example, static features can be obtained using the Python pefile module, and then third-party modules such as Yara and Clamav can be used to determine whether the file is malicious.

[0120] In addition, if the uploaded file is a compressed package (such as zip, rar), it will be decompressed using a decompression tool. The decompressed files will be distributed to different Celery processes for different files for testing. Files that do not meet the testing conditions will be discarded.

[0121] In step 220, the operating system corresponding to the file to be detected is determined according to the file type of the file to be detected, for example, files such as exe, word, and xlse run under the Windows system, and ELF files run under the Linux system.

[0122] After determining the operating system, in step 230, the image corresponding to the file to be detected is determined based on the operating system corresponding to the file to be detected. In conjunction with the description of the above embodiment, one operating system may correspond to multiple images. Therefore, in step 230, multiple images are determined, but the final image is not determined.

[0123] In step 240, the cuckoo program corresponding to the file to be detected is determined based on the image corresponding to the file to be detected and the corresponding relationship.

[0124] As an optional implementation, multiple cuckoo programs corresponding to multiple images are found, and then the identification information of the cuckoo programs is used to query whether each cuckoo program is idle. If a cuckoo program is idle, it is determined as the cuckoo program corresponding to the file to be detected; if there is no idle cuckoo program, wait for a period of time (for example, 10 seconds) and then continue to check whether there is an idle cuckoo program until an idle cuckoo program is found, and it is determined as the cuckoo program corresponding to the file to be detected.

[0125] After the corresponding Cuckoo program is determined, the Cuckoo program can be directly called using the identification information corresponding to the Cuckoo program in step 250. It is understood that the identification information is only used as information for finding the Cuckoo program. Once the Cuckoo program is found, the file to be tested needs to be transferred to the Cuckoo program, and then the Cuckoo program runs to detect the file to be tested.

[0126] In addition, the images, virtual machine types, snapshots, etc. introduced in the above embodiments are all some information that needs to be called during the operation of the cuckoo program. The specific calling method can refer to the cuckoo technology in this field and will not be introduced in detail here.

[0127] As an example, the specific detection process based on the Cuckoo program and the Cuckoo cluster may include:

[0128] Get the IP address of an idle cuckoo, start a thread, transfer the file to the cuckoo sandbox for execution, and then the program requests the cuckoo API through a polling mechanism to query the sandbox running status until the status is reported and the cuckoo operation ends.

[0129] After receiving the program request, Cuckoo reads the label and snapshot name of the corresponding system image from the configuration file. It checks the system status through the virtual machine command. If it is stopped, it starts the system image.

[0130] When the virtual machine receives the request from Cuckoo, it operates the system through the virtual machine management tool (if the virtual machine is VirtualBox, it uses the VirtualBoxManage management tool to operate the system image; if the virtual machine is KVM, it uses the Virsh command to operate the system image). Before the file runs in the sandbox, the system image is started. After the file runs in the sandbox, the system image is shut down through the command.

[0131] After starting the system image through the virtual machine manager, Cuckoo will transfer the corresponding file to the system and run the file through the command line. It will also monitor the processing of the file by injecting some monitor files into the running process and return all monitoring information to the host (the host of the machine to be deployed).

[0132] When the sandbox is finished running, Cuckoo will collect all the information, organize it into a sandbox report and temporarily store it in MongoDB. Then, it will read the sandbox report information through the Cuckoo API and finally delete the result through the Cuckoo API to make the sandbox reach the most concise state.

[0133] The above detection process can be Figure 3 As shown, in Figure 3 This involves file processing and type judgment, as well as the positioning of cuckoo programs, thread distribution mechanism, and the correspondence between cuckoo programs, virtual machine types, and images.

[0134] It is understandable that based on the deployed Cuckoo cluster, more feasible detection methods can be adopted, such as: Figure 3 The thread distribution mechanism shown can be flexibly changed, etc., and is not limited in the embodiments of the present application.

[0135] Based on the same invention concept, please refer to Figure 4 In the embodiment of the present application, a deployment device 400 of a cuckoo cluster is also provided. Figure 1 The deployment method shown includes: a configuration module 410 and a first acquisition module 420.

[0136] The configuration module 410 is used to: install a virtual machine and a virtual machine management tool on the machine to be deployed; the virtual machine management tool is used to manage the virtual machine; the first acquisition module 420 is used to: obtain multiple images corresponding to at least two operating systems; the configuration module 410 is also used to: import the multiple images corresponding to each operating system into the virtual machine to install the at least two operating systems on the virtual machine; obtain multiple cuckoo programs; the configuration module 410 is also used to: configure the correspondence between the multiple images corresponding to each operating system and the multiple cuckoo programs; wherein, one image corresponds to one cuckoo program; determine the identification information corresponding to each cuckoo program; the identification information is used to implement the call of the cuckoo program.

[0137] In an embodiment of the present application, the first acquisition module 420 is specifically used to: obtain the iso files corresponding to the at least two operating systems respectively; based on the iso files corresponding to the at least two operating systems respectively, create images corresponding to the at least two operating systems respectively; the images corresponding to the at least two operating systems respectively include software and files for monitoring the corresponding operating systems.

[0138] In an embodiment of the present application, the first acquisition module 420 is specifically used to: obtain multiple initial cuckoo programs; configure databases corresponding to the at least two operating systems in the multiple initial cuckoo programs; install the operating environment corresponding to the cuckoo program; install and run the multiple initial cuckoo programs in the operating environment to generate the multiple cuckoo programs.

[0139] In the embodiment of the present application, the configuration module 410 is specifically used to: determine the image corresponding to each cuckoo program; determine the operating system corresponding to each cuckoo program based on the operating system corresponding to the image corresponding to each cuckoo program; determine the virtual machine type corresponding to each cuckoo program based on the operating system corresponding to each cuckoo program; write the information of the image corresponding to each cuckoo program, the information of the operating system corresponding to each cuckoo program, and the virtual machine type corresponding to each cuckoo program into the configuration file of each cuckoo program.

[0140] In an embodiment of the present application, the configuration module 410 is further used to: create snapshots corresponding to the at least two operating systems; and write the snapshots of the operating systems corresponding to each Cuckoo program into the configuration files of each Cuckoo program.

[0141] In an embodiment of the present application, the configuration module 410 is specifically used to: determine the port corresponding to each cuckoo program, and determine the IP of the machine to be deployed; and determine the IP of the machine to be deployed and the port corresponding to each cuckoo program as the identification information corresponding to each cuckoo program.

[0142] Cuckoo cluster deployment device 400, and Figure 1 The deployment method shown corresponds to each functional module corresponding to each step of the deployment method. Therefore, the implementation of each functional module refers to the implementation of the aforementioned method and will not be repeated here.

[0143] Based on the same invention concept, please refer to Figure 5 In the embodiment of the present application, a detection device 500 based on a cuckoo cluster is also provided. Figure 2 The detection method shown corresponds to and includes: a second acquisition module 510 and a detection module 520 .

[0144] The second acquisition module 510 is used to obtain a file to be detected. The detection module 520 is used to determine the operating system corresponding to the file to be detected based on the file type of the file to be detected; determine the image corresponding to the file to be detected based on the operating system corresponding to the file to be detected; determine the Cuckoo program corresponding to the file to be detected based on the image corresponding to the file to be detected and the corresponding relationship; and call the Cuckoo program corresponding to the file to be detected using the identification information corresponding to the Cuckoo program corresponding to the file to be detected, so that the Cuckoo program corresponding to the file to be detected detects the file to be detected and obtains a detection result.

[0145] In an embodiment of the present application, the detection module 520 is also used to: determine the processing thread corresponding to the file to be detected according to the file type of the file to be detected and the preset correspondence between the thread and the file type; correspondingly, the detection module 520 implements the following process through the processing thread: determine the operating system corresponding to the file to be detected according to the file type of the file to be detected; determine the image corresponding to the file to be detected according to the operating system corresponding to the file to be detected; determine the cuckoo program corresponding to the file to be detected according to the image corresponding to the file to be detected and the correspondence; call the cuckoo program corresponding to the file to be detected through the identification information corresponding to the cuckoo program corresponding to the file to be detected, so that the cuckoo program corresponding to the file to be detected detects the file to be detected and obtains the detection result.

[0146] The detection device 500 based on the cuckoo cluster corresponds to the aforementioned detection method, and each functional module corresponds to each step of the aforementioned detection method. Therefore, the implementation method of each functional module refers to the implementation method of each step and will not be repeated here.

[0147] Please refer to Figure 6 The embodiment of the present application also provides an electronic device 600, which can serve as the hardware operating environment of the aforementioned deployment method or detection method; the electronic device 600 includes: a processor 610; and a memory 620 communicatively connected to the processor 610.

[0148] Among them, the memory 620 stores instructions that can be executed by the processor 610, and the instructions are executed by the processor 610 so that the processor 610 can execute the Cuckoo cluster deployment method or the Cuckoo cluster-based detection method described in the aforementioned embodiment.

[0149] The processor 610 and the memory 620 may be connected via a communication bus.

[0150] An embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is run by a computer, the deployment method of the Cuckoo cluster or the detection method based on the Cuckoo cluster described in the aforementioned embodiment is executed.

[0151] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0152] In addition, the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0153] Furthermore, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0154] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any actual relationship or order between these entities or operations.

[0155] The above description is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, various modifications and variations of the present application are possible. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for deploying a cuckoo cluster, characterized in that: include: Install virtual machines and virtual machine management tools on the machines to be deployed; The virtual machine management tool is used to manage the virtual machine; Obtain multiple images corresponding to at least two operating systems; Importing multiple images corresponding to the respective operating systems into the virtual machine to install the at least two operating systems on the virtual machine; Get multiple cuckoo programs; Configuring a correspondence between multiple images corresponding to each operating system and the multiple Cuckoo programs; wherein one image corresponds to one Cuckoo program; Determine identification information corresponding to each cuckoo program; the identification information is used to implement the call of the cuckoo program; After determining the identification information corresponding to each cuckoo program, the method further includes: determining a processing thread corresponding to the file to be detected according to the file type of the file to be detected and a preset correspondence between the thread and the file type; Correspondingly, the processing thread performs the following steps: determining a running system corresponding to the file to be detected according to the file type of the file to be detected; determining an image corresponding to the file to be detected according to the running system corresponding to the file to be detected; determining a Cuckoo program corresponding to the file to be detected according to the image corresponding to the file to be detected and the corresponding relationship; calling the Cuckoo program corresponding to the file to be detected according to the identification information corresponding to the Cuckoo program corresponding to the file to be detected, so that the Cuckoo program corresponding to the file to be detected detects the file to be detected and obtains a detection result; Among them, determining the cuckoo program corresponding to the file to be detected according to the image corresponding to the file to be detected and the corresponding relationship includes: searching for multiple cuckoo programs corresponding to multiple images, querying whether each cuckoo program is idle in combination with the identification information of the cuckoo program, and if there is an idle cuckoo program, determining it as the cuckoo program corresponding to the file to be detected; if there is no idle cuckoo program, waiting for a preset time, and continuing to check whether there is an idle cuckoo program until there is an idle cuckoo program, and determining it as the cuckoo program corresponding to the file to be detected.

2. The deployment method according to claim 1, characterized in that: The obtaining of multiple images corresponding to at least two operating systems includes: Obtaining iso files corresponding to the at least two operating systems respectively; Based on the iso files corresponding to the at least two operating systems, images corresponding to the at least two operating systems are produced; the images corresponding to the at least two operating systems include software and files for monitoring the corresponding operating systems.

3. The deployment method according to claim 1, wherein: The acquisition of multiple cuckoo programs includes: Get multiple initial cuckoo programs; In the plurality of initial Cuckoo programs, configuring databases corresponding to the at least two operating systems; Install the operating environment corresponding to the cuckoo program; The multiple initial cuckoo programs are installed and run in the running environment to generate the multiple cuckoo programs.

4. The deployment method according to claim 1, wherein: The configuration of the corresponding relationship between the multiple images corresponding to each operating system and the multiple Cuckoo programs includes: Determine the image corresponding to each cuckoo program; Determine the operating system corresponding to each Cuckoo program based on the operating system corresponding to the image corresponding to each Cuckoo program; Determine the virtual machine type corresponding to each cuckoo program based on the operating system corresponding to each cuckoo program; Write the image information corresponding to each cuckoo program, the operating system information corresponding to each cuckoo program, and the virtual machine type corresponding to each cuckoo program into the configuration file of each cuckoo program.

5. The deployment method according to claim 4, characterized in that: The deployment method further includes: Creating snapshots corresponding to the at least two operating systems; Write the snapshot of the running system corresponding to each cuckoo program into the configuration file of each cuckoo program.

6. The deployment method according to claim 1, characterized in that: Determining the identification information corresponding to each cuckoo program includes: Determine the ports corresponding to each Cuckoo program and the IP address of the machine to be deployed; The IP address of the machine to be deployed and the port corresponding to each cuckoo program are determined as identification information corresponding to each cuckoo program.

7. A detection method based on cuckoo cluster, characterized in that: A Cuckoo cluster includes multiple Cuckoo programs, virtual machines, and multiple images installed on the virtual machines. The multiple images correspond to at least two operating systems. There is a corresponding relationship between the multiple images and the multiple Cuckoo programs, wherein one image corresponds to one Cuckoo program, and each Cuckoo program has corresponding identification information. The detection method includes: Determining a processing thread corresponding to the file to be detected according to the file type of the file to be detected and a preset correspondence between threads and file types; Correspondingly, the following steps are performed by the processing thread: Determining the operating system corresponding to the file to be detected according to the file type of the file to be detected; Determining the image corresponding to the file to be detected according to the operating system corresponding to the file to be detected; Determine the cuckoo program corresponding to the file to be detected according to the image corresponding to the file to be detected and the corresponding relationship; calling the Cuckoo program corresponding to the file to be detected by using the identification information corresponding to the Cuckoo program corresponding to the file to be detected, so that the Cuckoo program corresponding to the file to be detected detects the file to be detected and obtains a detection result; Among them, determining the cuckoo program corresponding to the file to be detected according to the image corresponding to the file to be detected and the corresponding relationship includes: searching for multiple cuckoo programs corresponding to multiple images, querying whether each cuckoo program is idle in combination with the identification information of the cuckoo program, and if there is an idle cuckoo program, determining it as the cuckoo program corresponding to the file to be detected; if there is no idle cuckoo program, waiting for a preset time, and continuing to check whether there is an idle cuckoo program until there is an idle cuckoo program, and determining it as the cuckoo program corresponding to the file to be detected.

8. A deployment device for a cuckoo cluster, characterized in that: include: A configuration module, configured to install a virtual machine and a virtual machine management tool on the machine to be deployed; the virtual machine management tool is configured to manage the virtual machine; An acquisition module, configured to acquire multiple images corresponding to at least two operating systems; The configuration module is further configured to import multiple images corresponding to the respective operating systems into the virtual machine, so as to install the at least two operating systems on the virtual machine; The acquisition module is also used to acquire multiple cuckoo programs; The configuration module is further used to configure the corresponding relationship between the multiple images corresponding to each operating system and the multiple Cuckoo programs; wherein one image corresponds to one Cuckoo program; Determine identification information corresponding to each cuckoo program; the identification information is used to implement the call of the cuckoo program; After determining the identification information corresponding to each cuckoo program, the method further includes: determining a processing thread corresponding to the file to be detected according to the file type of the file to be detected and a preset correspondence between the thread and the file type; Correspondingly, the processing thread performs the following steps: determining a running system corresponding to the file to be detected according to the file type of the file to be detected; determining an image corresponding to the file to be detected according to the running system corresponding to the file to be detected; determining a Cuckoo program corresponding to the file to be detected according to the image corresponding to the file to be detected and the corresponding relationship; calling the Cuckoo program corresponding to the file to be detected according to the identification information corresponding to the Cuckoo program corresponding to the file to be detected, so that the Cuckoo program corresponding to the file to be detected detects the file to be detected and obtains a detection result; Among them, determining the cuckoo program corresponding to the file to be detected according to the image corresponding to the file to be detected and the corresponding relationship includes: searching for multiple cuckoo programs corresponding to multiple images, querying whether each cuckoo program is idle in combination with the identification information of the cuckoo program, and if there is an idle cuckoo program, determining it as the cuckoo program corresponding to the file to be detected; if there is no idle cuckoo program, waiting for a preset time, and continuing to check whether there is an idle cuckoo program until there is an idle cuckoo program, and determining it as the cuckoo program corresponding to the file to be detected.

9. A detection device based on cuckoo cluster, characterized in that: The Cuckoo cluster includes multiple Cuckoo programs, virtual machines, and multiple images installed on the virtual machines. The multiple images correspond to at least two operating systems. There is a corresponding relationship between the multiple images and the multiple Cuckoo programs, wherein one image corresponds to one Cuckoo program, and each Cuckoo program has corresponding identification information. The detection device includes: Acquisition module, used to obtain the file to be detected; The detection module is configured to determine a processing thread corresponding to the file to be detected based on the file type of the file to be detected and a preset correspondence between threads and file types; and correspondingly, perform the following steps through the processing thread: Determining the operating system corresponding to the file to be detected according to the file type of the file to be detected; determining the image corresponding to the file to be detected according to the operating system corresponding to the file to be detected; determining the Cuckoo program corresponding to the file to be detected according to the image corresponding to the file to be detected and the corresponding relationship; calling the Cuckoo program corresponding to the file to be detected using the identification information corresponding to the Cuckoo program corresponding to the file to be detected, so that the Cuckoo program corresponding to the file to be detected detects the file to be detected and obtains a detection result; Among them, determining the cuckoo program corresponding to the file to be detected according to the image corresponding to the file to be detected and the corresponding relationship includes: searching for multiple cuckoo programs corresponding to multiple images, querying whether each cuckoo program is idle in combination with the identification information of the cuckoo program, and if there is an idle cuckoo program, determining it as the cuckoo program corresponding to the file to be detected; if there is no idle cuckoo program, waiting for a preset time, and continuing to check whether there is an idle cuckoo program until there is an idle cuckoo program, and determining it as the cuckoo program corresponding to the file to be detected.

10. An electronic device, characterized in that: include: processor; a memory communicatively connected to the processor; The memory stores instructions that can be executed by the processor, and the instructions are executed by the processor so that the processor can execute the Cuckoo cluster deployment method as described in any one of claims 1-6, or the Cuckoo cluster-based detection method as described in claim 7.

11. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a computer, the computer program executes the Cuckoo cluster deployment method according to any one of claims 1 to 6 or the Cuckoo cluster-based detection method according to claim 7.

Images