Sandbox defense method, device, electronic device and computer-readable storage medium

Abstract

The present application provides a sandbox defense method, device, electronic device and computer-readable storage medium. A specific implementation of the method includes: receiving relevant information of an application to be identified; the relevant information includes the executable file of the application to be identified; when it is detected that the application to be identified uses an overloaded kernel to perform anti-sandbox operations, replacing the system file to be identified that is started based on the application to be identified with the target system file; wherein the system file to be identified includes a file in the sys format running under the Windows operating system. When the method detects an application to be identified that uses an overloaded kernel to perform anti-sandbox operations, it can determine whether it is a malicious application by replacing the system file to be identified that is started based on it, thereby preventing the malicious application from evading sandbox detection.

Description

Technical Field

[0001] The present application relates to the field of computer security, and in particular, to a sandbox defense method, device, electronic device, and computer-readable storage medium. Background Art

[0002] A sandbox is a virtual system program in which a browser or other program can run, and changes made during the run can be deleted later. In network security, a sandbox is a tool used to test the behavior of untrusted files or applications in an isolated environment.

[0003] The sandbox can run applications and detect their dynamic behavior characteristics. It can then identify whether the application is malicious based on the detected dynamic behavior characteristics, and thus determine whether the application needs to be defended. In order to evade sandbox detection, some malicious applications will perform anti-sandbox operations so that their dynamic behavior characteristics cannot be captured by the sandbox, thus escaping the sandbox's defense. Therefore, the sandbox needs to make corresponding defense processing for different anti-sandbox operations.

[0004] In the related art, a sandbox defense technology solution can often only defend against one anti-sandbox operation. For example, since the sandbox cannot interact with the user, the malicious application can implement anti-sandbox operations by judging whether there are characteristics of interactive activities with the user in the current running environment. That is, if the malicious application determines that there is an interactive activity, it will not perform malicious behavior, thereby avoiding the detection of the sandbox. Therefore, the sandbox can defend against such anti-sandbox operations by setting irregular or uninterrupted interactive activities with the user. Here, the above-mentioned interactive activities may include, for example, activities by detecting whether the mouse cursor moves within a preset time length. Or, activities by detecting whether the window handle changes within a preset time length, etc.

[0005] Furthermore, malicious applications can also implement anti-sandbox operations through the unique features of the sandbox. For example, for the Cuckoo sandbox, malicious applications can use its existing application programming interface (Application Programming Interface, referred to as API) "SetErrorMode" to implement anti-sandbox operations. Specifically, since the return value of the parameter of "SetErrorMode" during this call is the value set during the last call, and the parameter of "SetErrorMode" can be set to "the system will automatically fix memory alignment errors and make them invisible to the application" (SEM_NOALIGNMENTFAULTEXCEPT). Therefore, if the Cuckoo sandbox sets the parameter of "SetErrorMode" to a certain value and sets SEM_NOALIGNMENTFAULTEXCEPT, the malicious application only needs to call the application programming interface "SetErrorMode" twice to implement anti-sandbox operations. Here, the malicious application can set a fixed value when calling "SetErrorMode" for the first time, and when calling "SetErrorMode" for the second time, it can determine whether its value is the set fixed value. If not, it can be determined that it is currently under the detection of Cuckoo sandbox, and then the malicious application will not perform malicious behavior, thus evading the detection of Cuckoo sandbox. At this time, this anti-sandbox operation can be prevented by deleting the SEM_NOALIGNMENTFAULTEXCEPT set by the "SetModeError" parameter in the Cuckoo sandbox code.

[0006] In the related art, there is no technical solution for defending against malicious applications that use overloaded kernels to perform anti-sandbox operations under the Windows operating system (Windows system). Summary of the invention

[0007] The purpose of the embodiments of the present application is to provide a sandbox defense method, device, electronic device and computer-readable storage medium to prevent malicious applications that use overloaded kernels to perform anti-sandbox operations under Windows systems from escaping sandbox detection.

[0008] In the first aspect, an embodiment of the present application provides a sandbox defense method, which includes: receiving relevant information of an application to be identified; the relevant information includes the executable file of the application to be identified; when it is detected that the application to be identified uses the overloaded kernel to perform anti-sandbox operations, replacing the system file to be identified that is started based on the application to be identified with the target system file; wherein the system file to be identified includes a file in the sys format running under the Windows operating system. In this way, when an application to be identified that uses the overloaded kernel to perform anti-sandbox operations is detected, it can be determined whether it is a malicious application by replacing the system file to be identified that is started based on it, so that the malicious application cannot evade the detection of the sandbox.

[0009] Optionally, the application to be identified implements the anti-sandbox operation by the following steps: after starting the corresponding zero-ring application, instructing the zero-ring application to reload the kernel; after detecting that the zero-ring application is successfully started, calling the application programming interface corresponding to the reloaded kernel to avoid sandbox detection and implement the anti-sandbox operation. Here, an implementation method for the application to be identified to perform the anti-sandbox operation is provided.

[0010] Optionally, after receiving the relevant information of the application to be identified, the sandbox defense method further includes: calling a preset callback function; the preset callback function starts the target system file by creating a system service; when it is detected that the system file to be identified in the preset callback function is in the sys format, detecting whether the application to be identified uses the overloaded kernel to perform an anti-sandbox operation. In this way, by detecting whether the system file to be identified is in the sys format, it is possible to confirm whether the application to be identified is a malicious application to be defended before detecting whether it has performed an anti-sandbox operation, thereby saving operation procedures.

[0011] Optionally, whether the application to be identified uses the reloaded kernel to perform anti-sandbox operations is detected based on the following steps: when it is detected that the system file to be identified in the preset callback function is in the sys format, it is determined whether there is a preset string in the system file to be identified; when it is determined that the preset string exists in the system file to be identified, it is determined whether there is preset application programming interface information in the import table corresponding to the system file to be identified; when it is detected that the preset application programming interface information exists in the import table, it is determined that the application to be identified uses the reloaded kernel to perform anti-sandbox operations. In this way, it can be determined that the application to be identified is an application that uses the reloaded kernel to perform anti-sandbox operations.

[0012] Optionally, replacing the system file to be identified based on the startup of the application to be identified with the target system file includes: replacing the path information of the system file to be identified with the target path information of the target system file; the target path information is within the monitoring range of the sandbox. In this way, the purpose of replacing the path information of the system file to be identified and the target system file is achieved by replacing both, which simplifies the replacement process to a certain extent and reduces the probability of replacement errors.

[0013] Optionally, the step of detecting whether the application to be identified uses the reloaded kernel to perform anti-sandbox operations also includes: when it is detected that the path information of the system file to be identified is the target path information, determining that the application to be identified uses the reloaded kernel to perform anti-sandbox operations; or when it is detected that the path information of the next system file to be identified is the target path information, determining that the next application to be identified uses the reloaded kernel to perform anti-sandbox operations. In this way, it is possible to determine whether one or more applications to be identified use the reloaded kernel to perform anti-sandbox operations through the path information, and the confirmation process is simpler and more convenient.

[0014] Optionally, the sandbox defense method further includes: performing reverse analysis on the application to be identified or the next application to be identified, and updating the target system file based on the reverse analysis result. In this way, the initial target system file can be improved based on the reverse analysis result to enhance the robustness and applicability of the target system file.

[0015] In the second aspect, the embodiment of the present application provides a sandbox defense device, which includes: a receiving module for receiving relevant information of an application to be identified; the relevant information includes the executable file of the application to be identified; a defense module for replacing the system file to be identified that is started based on the application to be identified with the target system file when it is detected that the application to be identified uses the overloaded kernel to perform anti-sandbox operations; wherein the system file to be identified includes a file in the sys format running under the Windows operating system. In this way, when an application to be identified that uses the overloaded kernel to perform anti-sandbox operations is detected, it can be determined whether it is a malicious application by replacing the system file to be identified that is started based on it, so that the malicious application cannot evade the detection of the sandbox.

[0016] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps in the method provided in the first aspect are performed.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the method provided in the first aspect are performed.

[0018] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A flow chart of a sandbox defense method provided in an embodiment of the present application;

[0021] Figure 2 A structural block diagram of a sandbox defense device provided in an embodiment of the present application;

[0022] Figure 3 A schematic diagram of the structure of an electronic device for executing a sandbox defense method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0024] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0025] It should be noted that the embodiments in this application or the technical features in the embodiments may be combined if there is no conflict.

[0026] In the related art, under the Windows operating system (Windows system), there is a problem that malicious applications that use an overloaded kernel to perform anti-sandbox operations cannot be defended; in order to solve this problem, the present application provides a sandbox defense method, device, electronic device and computer-readable storage medium; further, when an application that uses an overloaded kernel to perform anti-sandbox operations under the Windows system is detected, the system file to be started by the application is replaced so that the application cannot start the system file, resulting in it being unable to call the unhooked API corresponding to the overloaded kernel, thereby detecting that the application is a malicious application, making it impossible for the malicious application to evade sandbox detection.

[0027] In some applications, the above-mentioned sandbox defense method can be applied to terminal devices such as computers and mobile phones, in which a virtual machine can be installed. Then, the sandbox can defend against malicious applications escaping the sandbox detection in the virtual machine environment.

[0028] The defects existing in the solutions in the above-mentioned related technologies are the results obtained by the inventor after practice and careful research. Therefore, the discovery process of the above-mentioned problems and the solutions proposed in the embodiments of the present invention below for the above-mentioned problems should all be the contributions made by the inventor to the present invention during the process of the present invention.

[0029] Please refer to Figure 1 , which shows a flow chart of a sandbox defense method provided by an embodiment of the present application. Figure 1 As shown, the sandbox defense method includes the following steps 101 to 102.

[0030] Step 101, receiving relevant information of an application to be identified; the relevant information includes an executable file of the application to be identified;

[0031] The above-mentioned applications to be identified may include, for example, three-ring applications such as chat applications and music applications.

[0032] In some application scenarios, users can upload relevant information of the application to be identified to the sandbox environment to detect whether it is a malicious application through the sandbox. The above-mentioned relevant information may include the executable file of the application to be identified. In these application scenarios, under the Windows operating system, the executable file may include a file with a suffix of .exe, a file with a suffix of .sys, a file with a suffix of .com, etc. Further, in addition to the executable file of the application to be identified, the above-mentioned relevant information may also include other information of the application to be identified, such as the operating mode, online time, etc.

[0033] Step 102, when it is detected that the application to be identified performs an anti-sandbox operation by overloading the kernel, replacing the system file to be identified that is started based on the application to be identified with the target system file; wherein the system file to be identified includes a file in the sys format running under the Windows operating system;

[0034] After receiving the relevant information of the application to be identified, the terminal device can detect whether the application to be identified is an application that uses the reloaded kernel to perform anti-sandbox operation. Here, the anti-sandbox operation is an operation that avoids sandbox detection.

[0035] In some application scenarios, the process of reloading the kernel in the zero-ring application to obtain the reloaded kernel can be roughly as follows: first read the kernel file (such as the ntkrnlpa.exe file) into the memory, and align the kernel file in the memory in a 0x1000 byte manner to obtain a new kernel, and then repair the relocation of the new kernel and the new System Services Descriptor Table (SSTD table). Then further hook the kernel function KiFastCallEntry so that the three-ring application can use the new kernel (reloaded kernel) to perform related operations. It should be noted that the reloading process of the new kernel is well known to those skilled in the art, and its specific implementation process will not be repeated here.

[0036] When the terminal device detects that the application to be identified performs an anti-sandbox operation by overloading the kernel, the system file to be identified that is started based on the application to be identified can be replaced with the target system file.

[0037] The system files to be identified include files in the sys format running under the Windows operating system. That is, the malicious application to be defended in this embodiment can use files in the sys format to implement anti-sandbox operations under the Windows operating system.

[0038] The target system file has the same file format as the system file to be identified. That is, the target system file is a file in the sys format that can run under the Windows operating system. In some application scenarios, the target system file can be obtained, for example, through the Visual Studio compiler. That is, the initial system file can be compiled by the compiler, and the initial system file can be used as the target system file to replace the system file to be identified.

[0039] In the related art, since a malicious application generally confirms whether it can use the overloaded kernel to perform malicious behavior by confirming whether the malicious system file it wants to start can be started. If the malicious system file can be started based on the malicious application, the malicious application will regard it as being able to use the overloaded kernel to perform malicious behavior, and will then call the API corresponding to the overloaded kernel that is not hooked.

[0040] Therefore, after the system file to be identified is replaced with the target system file, the target system file can be started. In this way, if the application to be identified is malicious, it will usually think that it can currently use the overloaded kernel to perform malicious behavior, and then call the system's original hooked API. In this way, the sandbox (confirming whether it is a malicious application by whether the application to be identified calls the hooked API to perform malicious behavior) can also confirm that the application to be identified is a malicious application and the behavior it performs is malicious behavior. The malicious behavior here can include, for example, downloading malicious advertisements bundled with other applications, stealing user information, and other behaviors that will substantially cause trouble or harm to users.

[0041] After the terminal device detects that the target system file is started based on the application to be identified, it can determine that the application to be identified is a malicious application, and then the ability of the sandbox to identify applications that perform anti-sandbox operations can be improved. In some application scenarios, for example, the user can directly reject the installation operation based on the sandbox feedback result or send a prompt message to the user to prompt the user to replace other applications with the same function to achieve the defense purpose.

[0042] In this embodiment, through the above steps 101 to 102, when an application to be identified that uses an overloaded kernel to perform anti-sandbox operations is detected, it can be determined whether it is a malicious application by replacing the system file to be identified based on its startup, thereby making it impossible for the malicious application to evade sandbox detection.

[0043] In some optional implementations, the application to be identified implements the anti-sandbox operation through the following steps:

[0044] Step 1, after starting the corresponding zero-ring application, instructing the zero-ring application to perform kernel reload;

[0045] In some application scenarios, the application to be identified can be used to start the corresponding zero-ring application, and after the zero-ring application is started, it can be instructed to reload the kernel to obtain a reloaded kernel.

[0046] Step 2, after detecting that the zero-ring application is successfully started, calling the application programming interface corresponding to the overloaded kernel to avoid sandbox detection and implement the anti-sandbox operation.

[0047] After the application to be identified starts the zero-ring application to reload the kernel, it can further detect whether the zero-ring program is successfully started, so that the application to be identified can confirm whether the kernel reload is successful.

[0048] After confirming that the kernel reload is successful, the application to be identified can call the API corresponding to the reloaded kernel. Here, since the API corresponds to the reloaded kernel, it is not hooked.

[0049] In this way, since the application to be identified calls an unhooked API, the behavior performed by it through the API will not be detected by the sandbox, and then it can avoid the detection of the sandbox, thus realizing anti-sandbox operation.

[0050] In this implementation, the application to be identified can achieve the purpose of performing anti-sandbox operations by overloading the kernel by executing the above steps 1 and 2.

[0051] In some optional implementations, after receiving the relevant information of the application to be identified, the sandbox defense method further includes the following steps:

[0052] First, a preset callback function is called; the preset callback function starts the target system file by creating a system service;

[0053] In some application scenarios, the terminal device can call a preset callback function. The preset callback function can start the target system file by creating a system service. In this way, the behavior of starting the target system file by creating a system service will be monitored by the preset callback function. Then, if the target system file in sys format is started by creating a system service, this behavior will also be monitored by the preset callback function. In these applications, the above preset callback function may include, for example, the CreateServiceA function or the CreateServiceW function.

[0054] Then, when it is detected that the system file to be identified in the preset callback function is in the sys format, it is detected whether the application to be identified uses the overloaded kernel to perform an anti-sandbox operation.

[0055] In some application scenarios, a preset callback function can be used to determine whether the file format of the system file to be identified is in the sys format. In these application scenarios, for example, the system file to be identified can be located through the binary file path parameter (BinaryPathName parameter) of the created system service, and then it can be determined whether its file format is in the sys format.

[0056] If it is determined that the system file to be identified is not in the sys format, it can be considered that the application to be identified is not a malicious application to be defended, and then there is no need to perform subsequent detection operations.

[0057] If it is determined that the format of the system file to be identified is the sys format, the above step 102 may be further performed to detect whether the application to be identified utilizes the overloaded kernel to perform an anti-sandbox operation.

[0058] In this implementation, by detecting whether the system file to be identified is in the sys format, it is possible to confirm whether the application to be identified is a malicious application to be defended before detecting whether it has performed an anti-sandbox operation, thereby saving operation procedures.

[0059] In some optional implementations, when executing the above step 102, it may be detected whether the application to be identified uses the overloaded kernel to perform anti-sandbox operations based on the following steps:

[0060] Sub-step 1021, when it is detected that the system file to be identified in the preset callback function is in the sys format, determining whether there is a preset character string in the system file to be identified;

[0061] In some application scenarios, when the terminal device detects that the system file to be identified is in the sys format, it can be regarded as a possible malicious application to be defended, and then it can be further determined whether there is a preset string in the system file to be identified to further determine whether the application to be identified is a malicious application to be defended. The preset string here can include, for example, ntkrnlpa.exe or ntoskrnl.exe, which are strings that are necessarily used in the kernel reload process.

[0062] If it is detected that the preset character string does not exist in the system file to be identified, it can be regarded that the application to be identified is not a malicious application to be defended, and then the subsequent detection operation does not need to be performed.

[0063] If it is detected that a preset character string exists in the system file to be identified, the subsequent detection operation can be continued.

[0064] Sub-step 1022, when it is determined that the preset character string exists in the system file to be identified, determining whether preset application programming interface information exists in the import table corresponding to the system file to be identified;

[0065] When the terminal device detects the presence of a preset string in the system file to be identified, it can be regarded as that the application to be identified may be a malicious application to be defended. Then, it can be further determined whether there is preset application programming interface information in the import table corresponding to the system file to be identified, so as to further determine whether the application to be identified is a malicious application to be defended. Here, since when the kernel is overloaded, the zero-ring application will call the two APIs "NtCreateFile" or "ZwCreateFile" to open the ntkrnlpa.exe file. And the zero-ring application will access the system service descriptor table: SSTD table, so it will also call the API: "KeServiceDescriptorTable" at the same time. Then, the above-mentioned preset application programming interface information can include "NtCreateFile", "KeServiceDescriptorTable" at the same time, or include "ZwCreateFile" and "KeServiceDescriptorTable" at the same time.

[0066] Sub-step 1023, when it is detected that the preset application programming interface information exists in the import table, determining that the application to be identified uses the overloaded kernel to perform an anti-sandbox operation.

[0067] When the terminal device detects the presence of preset application programming interface information in the import table, it can be determined that the application to be identified uses the overloaded kernel to perform an anti-sandbox operation, and then the system file to be identified started based on the application to be identified can be replaced with the target system file.

[0068] In this implementation, through the above sub-steps 1021 to 1023, it can be determined that the application to be identified is an application that uses the overloaded kernel to perform anti-sandbox operations.

[0069] In some optional implementations, replacing the system file to be identified based on the application to be identified with the target system file in the above step 102 may include: replacing the path information of the system file to be identified with the target path information of the target system file; the target path information is within the monitoring range of the sandbox.

[0070] In some application scenarios, the purpose of replacing the path information of the system file to be identified and the target system file can be achieved by replacing the path information of the system file to be identified and the target system file. Specifically, the terminal device can replace the path information of the system file to be identified with the target path information of the target system file.

[0071] In this implementation, the purpose of replacing the to-be-identified system file and the target system file is achieved by replacing their path information, which simplifies the replacement process to a certain extent and reduces the probability of replacement errors.

[0072] In some optional implementations, the step of detecting whether the application to be identified uses the overloaded kernel to perform anti-sandbox operations may also include: when it is detected that the path information of the system file to be identified is the target path information, determining that the application to be identified uses the overloaded kernel to perform anti-sandbox operations; or when it is detected that the path information of the next system file to be identified is the target path information, determining that the next application to be identified uses the overloaded kernel to perform anti-sandbox operations.

[0073] In some application scenarios, after the terminal device replaces the path information of the system file to be identified with the target path information corresponding to the target system file, it can detect whether the application to be identified uses the overloaded kernel to perform anti-sandbox operations through the path information.

[0074] Specifically, if the terminal device detects that the path information of the system file to be identified is not the target path information, it can be determined that the application to be identified did not perform anti-sandbox operations using the overloaded kernel; if it is detected that the path information of the system file to be identified is the target path information, it can be determined that the application to be identified performed anti-sandbox operations using the overloaded kernel.

[0075] In some application scenarios, there may be more than one application to be identified. Therefore, after replacing the path information, it can also be used to detect whether other applications to be identified use the overloaded kernel to perform anti-sandbox operations.

[0076] In this implementation, it is possible to determine whether one or more to-be-identified applications have performed anti-sandbox operations using the overloaded kernel through path information, making the confirmation process simpler and more convenient.

[0077] In some optional implementations, the sandbox defense method further includes: performing a reverse analysis on the application to be identified or the next application to be identified, and updating the target system file based on the reverse analysis result.

[0078] In some application scenarios, the functions of the initial target system file may be imperfect. Therefore, after detecting that the application to be identified is a malicious application, a reverse analysis can be performed based on it, and the initial target system file can be improved based on the reverse analysis results to enhance the robustness and applicability of the target system file. For example, after detecting that the target system file is started based on the application to be identified, the sandbox does not detect the malicious behavior of the application to be identified. In this case, it is necessary to reverse analyze the application to be identified to determine what causes such a situation, encode in the source code of the initial target system file according to the specific cause to solve the problem, and generate a new improved target system file.

[0079] Please refer to Figure 2 , which shows a structural block diagram of a sandbox defense device provided in an embodiment of the present application. The sandbox defense device may be a module, program segment or code on an electronic device. It should be understood that the device is similar to the above-mentioned Figure 1 The method embodiment corresponds to and can be executed Figure 1 The various steps involved in the method embodiment and the specific functions of the device can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here.

[0080] Optionally, the sandbox defense device includes a receiving module 201 and a defense module 202. The receiving module 201 is used to receive relevant information of the application to be identified; the relevant information includes the executable file of the application to be identified; the defense module 202 is used to replace the system file to be identified that is started based on the application to be identified with the target system file when it is detected that the application to be identified uses the overloaded kernel to perform anti-sandbox operation; the system file to be identified includes a file in the sys format running under the Windows operating system.

[0081] Optionally, the application to be identified implements the anti-sandbox operation through the following steps: after starting the corresponding zero-ring application, instructing the zero-ring application to reload the kernel; after detecting that the zero-ring application is successfully started, calling the application programming interface corresponding to the overloaded kernel to avoid sandbox detection and implement the anti-sandbox operation.

[0082] Optionally, the sandbox defense device also includes a callback module, which is used to: call a preset callback function after receiving relevant information of the application to be identified; the preset callback function starts the target system file by creating a system service; when it is detected that the system file to be identified in the preset callback function is in sys format, detect whether the application to be identified uses an overloaded kernel to perform anti-sandbox operations.

[0083] Optionally, whether the application to be identified uses the overloaded kernel to perform anti-sandbox operations is detected based on the following steps: when it is detected that the system file to be identified in the preset callback function is in the sys format, determining whether there is a preset string in the system file to be identified; when it is determined that the preset string exists in the system file to be identified, determining whether there is preset application programming interface information in the import table corresponding to the system file to be identified; when it is detected that the preset application programming interface information exists in the import table, determining that the application to be identified uses the overloaded kernel to perform anti-sandbox operations.

[0084] Optionally, the defense module 202 is further used to: replace the path information of the system file to be identified with the target path information of the target system file; the target path information is within the monitoring range of the sandbox.

[0085] Optionally, the step of detecting whether the application to be identified uses the overloaded kernel to perform anti-sandbox operations also includes: when it is detected that the path information of the system file to be identified is the target path information, determining that the application to be identified uses the overloaded kernel to perform anti-sandbox operations; or when it is detected that the path information of the next system file to be identified is the target path information, determining that the next application to be identified uses the overloaded kernel to perform anti-sandbox operations.

[0086] Optionally, the sandbox defense device further includes an analysis module, and the analysis module is used to: perform reverse analysis on the application to be identified or the next application to be identified, and update the target system file based on the reverse analysis result.

[0087] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system or device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0088] Please refer to Figure 3 , Figure 3A structural diagram of an electronic device for executing a sandbox defense method provided in an embodiment of the present application, the electronic device may include: at least one processor 301, such as a CPU, at least one communication interface 302, at least one memory 303 and at least one communication bus 304. Among them, the communication bus 304 is used to realize direct connection and communication between these components. Among them, the communication interface 302 of the device in the embodiment of the present application is used to communicate signaling or data with other node devices. The memory 303 can be a high-speed RAM memory or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 303 can optionally be at least one storage device located away from the aforementioned processor. Computer-readable instructions are stored in the memory 303. When the computer-readable instructions are executed by the processor 301, the electronic device can execute the above-mentioned Figure 1 The method process is shown.

[0089] Understandably, Figure 3 The structure shown is for illustration only, and the electronic device may also include Figure 3 More or fewer components as shown, or with Figure 3 Different configurations are shown. Figure 3 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0090] The present application embodiment provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the following can be performed: Figure 1 The method process in the method embodiment shown is executed by the electronic device.

[0091] An embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the methods provided by the above-mentioned method embodiments. For example, the method may include: receiving relevant information of an application to be identified; the relevant information includes an executable file of the application to be identified; when it is detected that the application to be identified uses an overloaded kernel to perform an anti-sandbox operation, replacing the system file to be identified that is started based on the application to be identified with a target system file; wherein the system file to be identified includes a file in the sys format running under the Windows operating system.

[0092] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0093] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0094] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0095] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0096] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A sandbox defense method, characterized in that: include: receiving information about the application to be identified; The relevant information includes the executable file of the application to be identified; When it is detected that the application to be identified performs an anti-sandbox operation by overloading the kernel, the system file to be identified started based on the application to be identified is replaced with the target system file; wherein the system file to be identified includes a file in the sys format running under the Windows operating system; Wherein, whether the application to be identified uses the overloaded kernel to perform anti-sandbox operation is detected based on the following steps: When it is detected that the system file to be identified in the preset callback function is in the sys format, determining whether a preset character string exists in the system file to be identified; When it is determined that the preset character string exists in the system file to be identified, determining whether preset application programming interface information exists in the import table corresponding to the system file to be identified; When it is detected that the preset application programming interface information exists in the import table, determining that the application to be identified uses the reloaded kernel to perform an anti-sandbox operation; and The step of replacing the system file to be identified that is started based on the application to be identified with the target system file includes: The path information of the system file to be identified is replaced with the target path information of the target system file; the target path information is within the monitoring range of the sandbox.

2. The method according to claim 1, characterized in that: The application to be identified implements the anti-sandbox operation through the following steps: After starting the corresponding zero-ring application, instructing the zero-ring application to perform a kernel reload; After detecting that the zero-ring application is successfully started, the application programming interface corresponding to the overloaded kernel is called to avoid sandbox detection and implement the anti-sandbox operation.

3. The method according to claim 1 or 2, characterized in that: After receiving the relevant information of the application to be identified, the method further includes: Calling a preset callback function; the preset callback function starts the target system file by creating a system service; When it is detected that the system file to be identified in the preset callback function is in the sys format, it is detected whether the application to be identified uses the overloaded kernel to perform an anti-sandbox operation.

4. The method according to claim 1, characterized in that: The step of detecting whether the application to be identified uses the overloaded kernel to perform anti-sandbox operation also includes: When it is detected that the path information of the to-be-identified system file is the target path information, determining that the to-be-identified application program uses the overloaded kernel to perform an anti-sandbox operation; or When it is detected that the path information of the next system file to be identified is the target path information, it is determined that the next application to be identified uses the reloaded kernel to perform an anti-sandbox operation.

5. The method according to claim 4, characterized in that The method further comprises: Performing reverse analysis on the application to be identified or the next application to be identified, and updating the target system file based on the reverse analysis result.

6. A sandbox defense device, characterized in that: include: A receiving module, used for receiving relevant information of the application to be identified; The relevant information includes the executable file of the application to be identified; A defense module, for replacing a system file to be identified that is started based on the application to be identified with a target system file when it is detected that the application to be identified uses a reloaded kernel to perform an anti-sandbox operation; wherein the system file to be identified includes a file in the sys format running under a Windows operating system; wherein the detection of whether the application to be identified uses the reloaded kernel to perform an anti-sandbox operation is based on the following steps: when it is detected that the system file to be identified that exists in a preset callback function is in the sys format, determining whether a preset string exists in the system file to be identified; when it is determined that the preset string exists in the system file to be identified, determining whether a preset application programming interface information exists in an import table corresponding to the system file to be identified; when it is detected that the preset application programming interface information exists in the import table, determining that the application to be identified uses the reloaded kernel to perform an anti-sandbox operation; and, replacing the system file to be identified that is started based on the application to be identified with the target system file, comprising: replacing the path information of the system file to be identified with the target path information of the target system file; the target path information is within the monitoring range of the sandbox.

7. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 5 is executed.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is performed.

Images