Sandbox-based malicious sample detection method, system, host, electronic device and storage medium

Abstract

The embodiment of the present invention discloses a sandbox-based malicious sample detection method, system, host, electronic device and storage medium, which relates to the field of network security technology. The method includes: performing static detection on suspicious samples input by users to determine the file configuration information required for the operation of the suspicious samples; obtaining client configuration information; building the operating environment configuration required for the operation of the suspicious samples based on the file configuration information and the client configuration information to simulate the real operating environment of the suspicious samples; running the suspicious samples and monitoring the behavioral information during the operation of the suspicious samples; generating the detection results of the suspicious samples based on the behavioral information. The present invention facilitates the effective detection of malicious software developed by a specific production ring system by simulating the real operating environment of suspicious samples in a sandbox; it is suitable for malware detection scenarios, especially the detection of modular malware developed by a specific production ring system.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a sandbox-based malicious sample detection method, system, host, electronic device and storage medium. Background Art

[0002] To launch cyberattacks and intrusions against their targets, APT (Advanced Persistent Threat) organizations typically conduct preliminary information detection on production environment systems in a specific scenario, and then develop corresponding malware based on the information they learn about the production environment systems.

[0003] However, during the process of implementing the present invention, the inventors discovered that currently, common sandboxes typically simulate the operating environment of suspicious samples through their built-in default environment, which includes the host computer's software and hardware configuration environment. However, the operating environment configurations of clients serving different production environments vary, making it difficult to effectively detect malware (a type of malicious sample, sometimes simply referred to as a malicious sample) developed in a specific production environment system. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a sandbox-based malicious sample detection method, system, host, electronic device, and storage medium, which facilitate effective detection of malware developed in specific production environment systems.

[0005] In order to achieve the above-mentioned purpose of the invention, the following technical solutions are adopted:

[0006] In a first aspect, an embodiment of the present invention provides a sandbox-based malicious sample detection method, characterized in that the method includes the steps of: receiving a suspicious sample input by a user; performing static detection on the suspicious sample to determine the file configuration information required for the operation of the suspicious sample; and obtaining client configuration information; building the operating environment configuration required for the operation of the suspicious sample based on the file configuration information and the client configuration information to simulate the actual operating environment of the suspicious sample; running the suspicious sample and monitoring the behavioral information of the suspicious sample during the operation process; and generating a detection result of the suspicious sample based on the behavioral information.

[0007] Optionally, the file configuration information includes: dependent file names, dependent file directories, dependent dynamic link libraries, and / or dependent software loading information required for the suspicious sample to run.

[0008] Optionally, building the operating environment configuration required for the suspicious sample to run based on the file configuration information and the client configuration information includes: matching the file configuration information with the sandbox preset environment to determine whether relevant file configuration information exists in the sandbox preset environment; if not, obtaining the corresponding file configuration information from the target client; adding the file configuration information to the sandbox preset environment to build the operating environment configuration required for the suspicious sample to run.

[0009] Optionally, running the suspicious sample and monitoring the behavior information of the suspicious sample during the running process includes: loading and running the suspicious sample, and monitoring the memory information of the suspicious sample during the running process of the suspicious sample; and obtaining the process behavior information of the suspicious sample from the memory information of the suspicious sample.

[0010] Optionally, when obtaining the process behavior information of the suspicious sample from the memory information of the suspicious sample, it also includes: obtaining the operating environment configuration required for the suspicious sample to execute the corresponding process behavior information from the memory information of the suspicious sample; detecting whether the suspicious sample calls or relies on a specific configuration environment to execute the corresponding process; the specific configuration environment is the environment configuration required for the suspicious sample to execute the corresponding process; judging whether the specific configuration environment exists in the currently constructed sandbox environment configuration; if not, terminating the operation of the suspicious sample, iteratively executing the specific configuration environment required for the suspicious sample to execute the corresponding process obtained from the target client according to a preset iterative algorithm, and resuming the execution of the suspicious sample until the suspicious sample runs normally and successfully.

[0011] Optionally, after the suspicious sample runs normally and successfully, the monitoring of the behavioral information during the operation of the suspicious sample also includes: detecting whether there is a process that is collecting system information, information of application software running on the system, and log information of the user operating system or application software; recording the operational behavior to generate the detection result of the suspicious sample based on the operational behavior.

[0012] In the second aspect, the present invention also provides an embodiment of a sandbox-based malicious sample detection system, including: a receiving program unit for receiving suspicious samples input by users; a static detection program unit for performing static detection on the suspicious samples to determine the file configuration information required for the operation of the suspicious samples; and an acquisition program unit for obtaining client configuration information; a sandbox environment building program unit for building the operating environment configuration required for the operation of the suspicious samples according to the file configuration information and the client configuration information to simulate the real operating environment of the suspicious samples; a running program unit for running the suspicious samples and monitoring the behavior information of the suspicious samples during the operation process; and a generation program unit for generating the detection results of the suspicious samples based on the behavior information.

[0013] In a third aspect, an embodiment of the present invention also provides a malicious sample analysis host, on which a virtual machine is installed, and the virtual machine is used to: receive suspicious samples input by users; perform static detection on the suspicious samples to determine the file configuration information required for the operation of the suspicious samples; and obtain client configuration information; build the operating environment configuration required for the operation of the suspicious samples based on the file configuration information and the client configuration information to simulate the real operating environment of the suspicious samples; run the suspicious samples and monitor the behavioral information during the operation of the suspicious samples; and generate analysis results of the suspicious samples based on the behavioral information.

[0014] In a fourth aspect, an embodiment of the present invention provides an electronic device comprising: one or more processors; a memory; one or more executable programs stored in the memory, and the one or more processors read the executable program code stored in the memory and run the program corresponding to the executable program code to execute any detection method described in the first aspect.

[0015] In a fifth aspect, an embodiment of the present invention provides a computer-readable storage medium, which stores one or more programs, and the one or more programs can be executed by one or more processors to implement any detection method described in the first aspect.

[0016] The embodiments of the present invention provide a sandbox-based malicious sample detection method, system, host, electronic device, and storage medium. When it is necessary to detect malicious software developed by a specific production environment system, static detection is performed on suspicious samples put into the sandbox by the user to determine the file configuration information required for the operation of the suspicious sample; and client configuration information is obtained; and the operating environment configuration required for the operation of the suspicious sample is established based on the file configuration information and the client configuration information. In this way, the real operating environment of the suspicious sample can be simulated, thereby facilitating the effective detection of malicious software developed by the specific production environment system. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 This is a flow chart of a sandbox-based malicious sample detection method according to an embodiment of the present invention;

[0019] Figure 2 This is a flow chart of a sandbox-based malicious sample detection method according to another embodiment of the present invention;

[0020] Figure 3 This is a flow chart of a sandbox-based malicious sample detection method according to another embodiment of the present invention;

[0021] Figure 4 This is a schematic block diagram of the architecture of a sandbox-based malicious sample detection system according to an embodiment of the present invention;

[0022] Figure 5 The figure is a schematic block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0024] It should be understood that the embodiments described are only a portion of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative work are within the scope of protection of the present invention.

[0025] The sandbox-based malicious sample detection method provided by the embodiment of the present invention can be applied to malware detection scenarios, especially the detection of modular malware developed for specific production environment systems, and can also be applied to software testing scenarios. For example, malware developed for production environment systems such as banking systems, oil production systems, and manufacturing office systems. Based on the automatic acquisition of client operating environment configuration information serving a specific production environment, a real operating environment for simulating suspicious samples in a specific production environment is built in the sandbox, which facilitates the effective detection of modular malware developed for a specific production environment, such as modular malware such as Regin and Flame.

[0026] It should be noted that the method can be solidified in a certain manufactured physical product in the form of software, and when a user uses the product, the method flow of the present application can be reproduced.

[0027] Figure 1 This is a flow chart of a malicious sample detection method based on a sandbox according to an embodiment of the present invention; Figure 1 As shown, the detection method may include the steps of:

[0028] S110: Receive suspicious samples input by the user.

[0029] In this embodiment, the suspicious sample to be analyzed is put into a sandbox, where the sandbox may be a virtual machine running on a host.

[0030] S120: Perform static detection on the suspicious sample to determine file configuration information required for the suspicious sample to run; and obtain client configuration information.

[0031] In this embodiment, while the suspicious sample program is not running, the program code can be statically inspected using the sandbox's extensive static detection tools to obtain the necessary environment for the sample to run, such as file configuration information, which may include specific directories and files. In some embodiments, the file configuration information may include dependent file names, dependent file directories, dependent dynamic link libraries, and / or dependent software loading information required for the suspicious sample to run.

[0032] The obtaining of the client configuration information may be: the sandbox automatically interacts with a target client serving a specific production environment to obtain the target client configuration information, for example, application software information such as files, directories, paths, software, etc. on the target client, or hardware information of the target client.

[0033] S130. Build an operating environment configuration required for the suspicious sample to run according to the file configuration information and the client configuration information to simulate the real operating environment of the suspicious sample.

[0034] In this embodiment, after obtaining the file configuration information and target client configuration information required for the suspicious sample, the operating environment configuration required for the suspicious sample to run is built in the sandbox, thereby effectively simulating the real operating environment of the suspicious sample, making it convenient to effectively analyze the malicious sample based on its behavioral information after the suspicious sample runs.

[0035] S140: Run the suspicious sample and monitor the behavior information of the suspicious sample during the running process.

[0036] After building a sandbox environment for simulating the real operating environment of the suspicious sample according to the target client configuration information, the suspicious sample is run to monitor its behavior information during the running process.

[0037] S150: Generate a detection result of the suspicious sample based on the behavior information.

[0038] In this embodiment, a corresponding suspicious sample detection report may be generated based on the detected behavior information to facilitate user review and further analysis.

[0039] The sandbox-based malicious sample detection method provided by the embodiment of the present invention, when it is necessary to detect malicious software developed for a specific production environment system, performs static detection on suspicious samples put into the sandbox by the user to determine the file configuration information required for the operation of the suspicious sample; and obtains the client configuration information; and builds the operating environment configuration required for the operation of the suspicious sample based on the file configuration information and the client configuration information. In this way, the real operating environment of the suspicious sample can be simulated, thereby facilitating the effective detection of malicious software developed for the specific production environment system.

[0040] In some embodiments, the step of building the operating environment configuration required for the suspicious sample to run based on the file configuration information and the client configuration information includes: matching the file configuration information with the sandbox preset environment to determine whether relevant file configuration information exists in the sandbox preset environment; if not, obtaining the corresponding file configuration information from the target client; and adding the file configuration information to the sandbox preset environment to build the operating environment configuration required for the suspicious sample to run.

[0041] The preset sandbox environment refers to the default environment built into the sandbox before the real operating environment for simulating suspicious sample files is built. After the real operating environment for simulating suspicious sample files is built, the preset sandbox environment is changed to the newly built sandbox environment.

[0042] It is understood that the configuration of the suspicious sample's operating environment in the embodiments of the present invention may not be completed in one go, but requires continuous iteration and updating based on the suspicious sample's operating status. Therefore, the meaning of the sandbox preset environment changes depending on the number of iterations of the operating environment. For example, during the first iteration, the sandbox preset environment refers to the sandbox's built-in default environment; during the second iteration, the sandbox preset environment changes to the sandbox environment established for the first time; during the third iteration, the sandbox preset environment changes to the sandbox environment established for the second time, and so on. The sandbox preset environment actually refers to the operating environment configuration last constructed in the sandbox to simulate the suspicious sample's actual operating environment.

[0043] For example, static detection can be used to obtain file configuration information represented by relevant strings such as the dynamic link library required for sample operation, the functions used, and the sample content. The relevant strings can be matched with the sandbox preset environment to obtain part of the file configuration information required for sample operation. If part of the file configuration information, such as special directory paths, cannot be matched in the sandbox preset environment, the directory path configuration information of the files in the target client can be automatically obtained by linking with the target client serving a specific production environment. For example, through static detection of the sample, whether "C:\Users\username\AppData\Roaming\Microsoft\Caches\Files" exists in the sandbox preset environment. Since this directory is a directory required for the suspicious sample to run in a specific target client serving a specific production environment, and the matching result shows that the directory does not exist in the sandbox preset environment, all files in the directory can be automatically obtained by linking with the target client and adding them to the sandbox preset environment to effectively simulate the operating environment configuration required for the suspicious sample to run in a specific production environment.

[0044] After setting up the operating environment of the suspicious sample in a specific production environment, in some embodiments, running the suspicious sample and monitoring the behavior information of the suspicious sample during the running process includes:

[0045] The suspicious sample is loaded and run, and during the running of the suspicious sample, the memory information of the suspicious sample is monitored; and process behavior information of the suspicious sample is obtained from the memory information of the suspicious sample.

[0046] Please see Figure 2 As shown, in some embodiments, when obtaining the process behavior information of the suspicious sample from the suspicious sample memory information, it also includes: obtaining the operating environment configuration required for the suspicious sample to execute the corresponding process behavior information from the suspicious sample memory information;

[0047] Detecting whether the suspicious sample invokes or relies on a specific configuration environment when executing a corresponding process; the specific configuration environment is an environment configuration required for the suspicious sample to execute the corresponding process;

[0048] Determine whether the specific configuration environment exists in the currently built sandbox environment configuration;

[0049] If not, the operation of the suspicious sample is terminated, and the specific configuration environment required for the suspicious sample to execute the corresponding process is obtained from the target client through iterative execution according to the preset iterative algorithm, and the execution of the suspicious sample is resumed until the suspicious sample runs normally and successfully.

[0050] In this embodiment, once it is detected that a specific configuration environment is required during the operation, such as determining whether a specified directory, specified file, etc. exists, and the specific configuration environment does not exist in the current sandbox environment, the sample operation is terminated; the sandbox automatically links with the target client to obtain the corresponding files, paths and other specific configuration information to build an updated operating environment in the sandbox; then the suspicious sample operation is resumed, its behavior continues to be monitored, and the operating environment configuration information required for its process behavior is determined from the sample memory information, and the steps of linking with the target client to obtain the required operating environment configuration information are iteratively executed until the suspicious sample runs normally and successfully.

[0051] Please see Figure 2 As shown, in this embodiment, when a suspicious sample is running in a sandbox, if it is monitored that the suspicious sample needs to be combined with a specific operating environment such as a specific file or software to continue running, since the required file configuration environment is not detected during the static detection process and the previously built sandbox environment does not contain this file configuration environment, the sandbox records the file configuration environment, and the sandbox iterates back to the step of obtaining the configuration information for building the operating environment configuration, and links with the target client serving the specific production environment and automatically obtains the required corresponding operating environment configuration information, and then builds a new sandbox environment, resumes the operation of the suspicious sample, and iteratively executes the above steps, as shown in FIG. Figure 2 As shown, the problem of malware detection requiring a specific operating environment to run is solved.

[0052] Please see Figure 3 As shown, after the suspicious sample runs normally and successfully, the monitoring of the behavioral information during the operation of the suspicious sample (S140) also includes: S142, detecting whether there is a process that is collecting system information, application software information running on the system, and log information of the user operating system or application software; S144, recording the operation behavior to generate the detection result of the suspicious sample based on the operation behavior.

[0053] When the sample can be successfully run, the sandbox can also generate a detection report based on the behavior of the detected suspicious sample and save it in a user-specified folder. The user can use the report to obtain information such as the malicious sample's file name, malicious behavior, and the environment required for the sample to run.

[0054] For example, after resuming the operation of the suspicious sample, its behavior is detected, specifically, whether there is a process in the system that is collecting system information, collecting browser information, collecting email information, using computer peripherals to collect audio and video information, screenshots, keyboard recording, and other data theft behaviors. If so, it is determined that the suspicious sample has malicious behavior and the suspicious sample is a malicious sample.

[0055] The sandbox-based malicious sample detection method provided by the embodiment of the present invention obtains its configuration information by linking with the target client serving a specific production environment, and builds the operating environment configuration required for the suspicious sample to run according to the file configuration information and client configuration information obtained by static detection. It can effectively simulate the real operating environment of the suspicious sample, and thus can solve the problem that malicious software developed by a specific production environment system cannot be detected because it cannot run normally in the sandbox, and facilitates the effective detection of malicious software developed by a specific production environment system.

[0056] Example 2

[0057] Figure 4 This is a schematic block diagram of the architecture of a malicious sample detection system based on a sandbox according to an embodiment of the present invention. Figure 4 As shown, based on the same technical concept as the aforementioned embodiments, the present invention also provides an embodiment of a sandbox-based malicious sample detection system, including: a receiving program unit 210, for receiving suspicious samples input by users; a static detection program unit 220, for performing static detection on the suspicious samples, and determining the file configuration information required for the operation of the suspicious samples; and an acquisition program unit 230, for obtaining client configuration information; a sandbox environment building program unit 240, for building the operating environment configuration required for the operation of the suspicious samples according to the file configuration information and the client configuration information, so as to simulate the real operating environment of the suspicious samples; a running program unit 250, for running the suspicious samples and monitoring the behavior information of the suspicious samples during the operation process; and a generation program unit 260, for generating the detection results of the suspicious samples based on the behavior information.

[0058] The system of this embodiment can be used to perform Figure 1 The technical solution of the method embodiment shown has similar implementation principles and technical effects to those of embodiment 1, which will not be described in detail here and can be referenced by each other.

[0059] In addition, it is understandable that Figure 4 The illustrated system is also suitable for executing the steps and processes described in other embodiments of Example 1. For example, the program execution unit 250 is specifically configured to detect, after the suspicious sample successfully executes normally, whether a process is currently collecting system information, information about application software running on the system, and log information from the user's operating system or application software; record such operations, and generate a detection result for the suspicious sample based on these operations. For the sake of brevity, please refer to the relevant description of Example 1, and the remaining embodiments will not be repeated here.

[0060] The sandbox-based malicious sample detection system provided by the embodiment of the present invention works by linking with a target client serving a specific production environment to obtain its configuration information. Based on the file configuration information obtained through static detection and the client configuration information, the system builds the operating environment configuration required for the suspicious sample to run. This effectively simulates the real operating environment of the suspicious sample, thereby resolving the problem of malware developed for a specific production environment system being unable to be detected due to its inability to run normally in the sandbox. This facilitates the effective detection of malware developed for a specific production environment system. The system is suitable for modular malware detection scenarios developed for a specific production environment system.

[0061] Another embodiment of the present invention provides a malicious sample analysis host, wherein a virtual machine is installed on the host, and the virtual machine is used to form a sandbox environment, and the virtual machine is used to:

[0062] Receive suspicious samples submitted by users;

[0063] Performing static detection on the suspicious sample to determine file configuration information required for the suspicious sample to run; and obtaining client configuration information;

[0064] Building the operating environment configuration required for the suspicious sample to run according to the file configuration information and the client configuration information to simulate the real operating environment of the suspicious sample;

[0065] Running the suspicious sample and monitoring behavior information during the running of the suspicious sample;

[0066] An analysis result of the suspicious sample is generated based on the behavior information.

[0067] In addition, it can be understood that the malware analysis host provided in the embodiment of the present invention is also suitable for executing the step processes in other embodiments of the embodiment one. For the sake of brevity, they will not be repeated here. Please refer to the description of the embodiment one.

[0068] Example 3

[0069] An embodiment of the present invention also provides an electronic device, comprising: one or more processors; a memory; one or more executable programs stored in the memory, the one or more processors reading the executable program code stored in the memory, and running the program corresponding to the executable program code to execute any detection method described in embodiment 1.

[0070] Figure 5 FIG. 1 is a schematic diagram of the structure of an embodiment of an electronic device of the present invention, which can implement any method described in Embodiment 1 of the present invention, such as Figure 5 As shown, as an optional embodiment, the above-mentioned electronic device may include: a shell 41, a processor 42, a memory 43, a circuit board 44 and a power supply circuit 45, wherein the circuit board 44 is placed inside the space enclosed by the shell 41, and the processor 42 and the memory 43 are arranged on the circuit board 44; the power supply circuit 45 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 43 is used to store executable program code; the processor 42 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 43, so as to execute the detection method described in any of the above-mentioned embodiments one.

[0071] The specific execution process of the above steps by the processor 42 and the steps further executed by the processor 42 by running the executable program code can be found in the description of the first embodiment of the detection method of the present invention, and will not be repeated here.

[0072] The electronic device exists in various forms, including but not limited to: (1) Mobile communication devices: These devices are characterized by having mobile communication functions and are mainly aimed at providing voice and data communications. Such terminals include: smart phones, multimedia phones, functional phones, and low-end phones. (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have mobile Internet access features. Such terminals include: PDA, MID and UMPC devices, such as iPad. (3) Portable entertainment devices: These devices can display and play multimedia content. Such devices include: audio and video playback modules (such as iPod), handheld game consoles, e-books, as well as smart toys and portable car navigation devices. (4) Servers: Devices that provide computing services. The server's composition includes processors, hard disks, memory, system buses, etc. The server is similar to the general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, manageability, etc. (5) Other electronic devices with data interaction functions.

[0073] Another embodiment of the present invention provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the detection method described in any one of the above-mentioned embodiments.

[0074] In summary, based on the descriptions of the above embodiments, the sandbox-based malicious sample detection method and system disclosed in the embodiments of the present invention can resolve the problem of malware developed for a specific production environment system being unable to be detected due to its inability to operate normally in a sandbox, thereby facilitating the effective detection of malware developed for a specific production environment system. Moreover, the analysis and detection process is fully automated, requiring almost no human intervention, reducing the operational difficulty of malicious sample detection. This method is suitable for modular malware detection scenarios developed for specific production environments.

[0075] It should be noted that, in this document, when descriptions of relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprise," "include," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0076] Each embodiment in this specification is described in a related manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

[0077] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium, and when executed, the program can include the processes in the above-described method embodiments. The storage medium can also be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0078] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. A sandbox-based malicious sample detection method, characterized in that: The method is configured to detect malware developed for a specific production environment system, and includes the steps of: Receive suspicious samples submitted by users; Performing static detection on the suspicious sample to determine file configuration information required for the suspicious sample to run; and, obtaining client configuration information; Building the operating environment configuration required for the suspicious sample to run according to the file configuration information and the client configuration information, so as to simulate the actual operating environment of the suspicious sample in a specific production environment; Running the suspicious sample and monitoring behavior information during the running of the suspicious sample; generating a detection result of the suspicious sample based on the behavior information; Running the suspicious sample and monitoring the behavior information during the running of the suspicious sample includes: Loading and running the suspicious sample, and monitoring memory information of the suspicious sample during the running of the suspicious sample; Acquiring process behavior information of the suspicious sample from the memory information of the suspicious sample; When the process behavior information of the suspicious sample is obtained from the memory information of the suspicious sample, the method further includes: obtaining the operating environment configuration required for the suspicious sample to execute the corresponding process behavior information from the memory information of the suspicious sample; Detecting whether the suspicious sample invokes or relies on a specific configuration environment when executing a corresponding process; the specific configuration environment is an environment configuration required for the suspicious sample to execute the corresponding process; Determine whether the specific configuration environment exists in the currently built sandbox environment configuration; If not, suspend the execution of the suspicious sample, iteratively execute the specific configuration environment required for the execution of the corresponding process of the suspicious sample obtained from the target client according to a preset iterative algorithm, and resume the execution of the suspicious sample until the suspicious sample runs normally and successfully; The file configuration information includes: dependent file names, dependent file directories, dependent dynamic link libraries, and dependent software loading information required for the suspicious sample to run; The configuration of the operating environment required for running the suspicious sample according to the file configuration information and the client configuration information includes: Matching the file configuration information with the sandbox preset environment to determine whether relevant file configuration information exists in the sandbox preset environment; If it does not exist, obtain the corresponding file configuration information from the target client; The file configuration information is added to the sandbox preset environment to build the operating environment configuration required for the suspicious sample to run.

2. The detection method according to claim 1, wherein After the suspicious sample successfully runs normally, monitoring the behavior information during the running of the suspicious sample further includes: detecting whether there is a process that is collecting system information, information about application software running on the system, and log information of the user operating system or application software; The operation behavior is recorded to generate a detection result of the suspicious sample according to the operation behavior.

3. A malicious sample analysis host, characterized in that: A virtual machine is installed on the host, and the virtual machine is used to: Receive suspicious samples submitted by users; Performing static detection on the suspicious sample to determine file configuration information required for the suspicious sample to run; and, obtaining client configuration information; Building the operating environment configuration required for the suspicious sample to run according to the file configuration information and the client configuration information to simulate the real operating environment of the suspicious sample; Running the suspicious sample and monitoring behavior information during the running of the suspicious sample; generating an analysis result of the suspicious sample based on the behavior information; Running the suspicious sample and monitoring the behavior information during the running of the suspicious sample includes: Loading and running the suspicious sample, and monitoring memory information of the suspicious sample during the running of the suspicious sample; Acquiring process behavior information of the suspicious sample from the memory information of the suspicious sample; When the process behavior information of the suspicious sample is obtained from the memory information of the suspicious sample, the method further includes: obtaining the operating environment configuration required for the suspicious sample to execute the corresponding process behavior information from the memory information of the suspicious sample; Detecting whether the suspicious sample invokes or relies on a specific configuration environment when executing a corresponding process; the specific configuration environment is an environment configuration required for the suspicious sample to execute the corresponding process; Determine whether the specific configuration environment exists in the currently built sandbox environment configuration; If not, suspend the execution of the suspicious sample, iteratively execute the specific configuration environment required for the execution of the corresponding process of the suspicious sample obtained from the target client according to a preset iterative algorithm, and resume the execution of the suspicious sample until the suspicious sample runs normally and successfully; The file configuration information includes: dependent file names, dependent file directories, dependent dynamic link libraries, and dependent software loading information required for the suspicious sample to run; The configuration of the operating environment required for running the suspicious sample according to the file configuration information and the client configuration information includes: Matching the file configuration information with the sandbox preset environment to determine whether relevant file configuration information exists in the sandbox preset environment; If it does not exist, obtain the corresponding file configuration information from the target client; The file configuration information is added to the sandbox preset environment to build the operating environment configuration required for the suspicious sample to run.

4. An electronic device, characterized in that: include: One or more processors; Memory; One or more executable programs are stored in the memory, and the one or more processors read the executable program code stored in the memory and run the program corresponding to the executable program code to execute the detection method described in any one of claims 1 to 2.

5. A computer-readable storage medium, characterized in that The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the detection method according to any one of claims 1 to 2.

Images