Method, apparatus, device and medium for preventing malicious code

Abstract

The present application relates to the technical field of information security, and discloses a method, device and equipment for preventing malicious code and a medium. The method comprises the following steps: constructing a virtual environment, encrypting the basic address of function calling in the virtual environment, monitoring and recording the function calling behavior of malicious code in the virtual environment through a preset sandbox, obtaining recording information, detecting new malicious code in the virtual environment according to the recording information, and intercepting the new malicious code through the sandbox. The method directly monitors the function calling, reduces the consumption of system resources, uses the virtual environment to prevent the malicious code from directly affecting the system, and records the behavior of the malicious code as preventive information.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to methods, apparatus, equipment and media for preventing malicious code. Background Technology

[0002] For a long time, the interception of malicious code has been done using sandbox technology. Sandbox technology is an execution environment that restricts the behavior of programs according to certain security policies. It establishes an application execution environment with restricted operation, and puts untrusted programs into the sandbox to limit the damage they may cause to the environment.

[0003] Establishing a restricted application execution environment and placing untrusted programs in a sandbox typically involves monitoring the system's API functions within this space. However, this monitoring can be bypassed by malicious code, or malicious code can find vulnerabilities in the sandbox security mechanism and escape from it. Since the number of API functions called in the system is enormous, the consumption of system resources during detection is also massive. Summary of the Invention

[0004] The main objective of this invention is to provide a method, apparatus, device, and medium for preventing malicious code in order to solve the above-mentioned problems.

[0005] The first aspect of this invention provides a method for preventing malicious code, the method comprising:

[0006] Build a virtual environment;

[0007] The base address of function calls in the virtual environment is encrypted;

[0008] The function call behavior of malicious code in the virtual environment is monitored and recorded by a pre-configured sandbox to obtain the recorded information;

[0009] Based on the recorded information, new malicious code was detected in the virtual environment, and the new malicious code was intercepted through the sandbox.

[0010] Optionally, in a second implementation of the first aspect of the present invention, after encrypting the base address of the function call in the virtual environment, the method further includes:

[0011] The virtual environment is periodically backed up to obtain a virtual environment backup.

[0012] Optionally, in a third implementation of the first aspect of the present invention, after detecting new malicious code in the virtual environment based on the recorded information and intercepting the new malicious code through the sandbox, the method further includes:

[0013] Determine whether a signal indicating that the sandbox failed to intercept the new malicious code has been received;

[0014] If a signal is received, the virtual environment backup is invoked and the virtual environment is restored.

[0015] Optionally, in a fourth implementation of the first aspect of the present invention, encrypting the base address of the function call in the virtual environment includes:

[0016] The basic addresses of function calls in the virtual environment are compiled into ASCII codes and then scrambled and recombined to obtain a first-level encrypted address;

[0017] The first-level encrypted address is asymmetrically encrypted to obtain the second-level encrypted address, wherein the asymmetric encryption uses a public key.

[0018] Optionally, in a fifth implementation of the first aspect of the present invention, encrypting the base address of the function call in the virtual environment includes:

[0019] Limit the usage time of the private key generated based on the public key.

[0020] Optionally, in a sixth implementation of the first aspect of the present invention, the step of detecting new malicious code in the virtual environment based on the recorded information and intercepting the new malicious code through the sandbox includes:

[0021] New malicious code was detected in the virtual environment;

[0022] Based on the recorded information, it is determined whether the behavior of the new malicious code is similar to that of the malicious code.

[0023] If it is similar to the malicious code, the new malicious code will be intercepted through the sandbox;

[0024] If the new malicious code is not similar to the malicious code, the new malicious code will be monitored and recorded through the sandbox to obtain new record information.

[0025] Optionally, in a seventh implementation of the first aspect of the present invention, the behavioral operations of the new malicious code include executing header file code snippets, execution methods, and requesting modification permissions.

[0026] A second aspect of the present invention provides an apparatus for preventing malicious code, comprising:

[0027] The virtual environment building module is used to build virtual environments;

[0028] An encryption module is used to encrypt the base address of function calls in the virtual environment, wherein the encryption includes asymmetric encryption using a public key;

[0029] The monitoring module is used to monitor and record the function call behavior of malicious code in the virtual environment through a pre-set sandbox, and obtain the recorded information;

[0030] The interception module is used to detect new malicious code in the virtual environment based on the recorded information, and to intercept the new malicious code through the sandbox.

[0031] A third aspect of the present invention provides a device for preventing malicious code, comprising: a memory and at least one processor, wherein the memory stores instructions, and the memory and the at least one processor are interconnected via a circuit; the at least one processor invokes the instructions in the memory to cause the device for preventing malicious code to perform the aforementioned method for preventing malicious code.

[0032] A fourth aspect of the present invention provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the above-described method for preventing malicious code.

[0033] In embodiments of the present invention, a method, apparatus, device, and medium for preventing malicious code are provided. The method includes constructing a virtual environment, encrypting the base addresses of function calls within the virtual environment, monitoring and recording the function call behavior of malicious code in the virtual environment using a pre-set sandbox to obtain recorded information, detecting new malicious code in the virtual environment based on the recorded information, and intercepting the new malicious code using the sandbox. This method directly monitors function calls, reducing system resource consumption, uses a virtual environment to prevent malicious code from directly affecting the system, and records the behavior of the malicious code as preventative information. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of the first embodiment of the method for preventing malicious code in this invention;

[0035] Figure 2 This is a schematic diagram of a second embodiment of the method for preventing malicious code in this invention;

[0036] Figure 3 This is a schematic diagram of a third embodiment of the method for preventing malicious code in this invention;

[0037] Figure 4 This is a schematic diagram of the fourth embodiment of the method for preventing malicious code in the present invention;

[0038] Figure 5 This is a schematic diagram of one embodiment of the device for preventing malicious code in this invention;

[0039] Figure 6 This is a schematic diagram of one embodiment of a device for preventing malicious code in this invention. Detailed Implementation

[0040] This invention provides a method, apparatus, device, and medium for preventing malicious code.

[0041] The terms "first," "second," "third," "fourth," etc., used in the specification, claims, and accompanying drawings of this invention, are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" or "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0042] For ease of understanding, the specific process of the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 1 - Appendix Figure 4 One embodiment of the method for preventing malicious code in this invention includes:

[0043] 101. Construct a virtual environment;

[0044] 102. Encrypt the base address of function calls in the virtual environment;

[0045] Furthermore, step 102 can also be performed as follows:

[0046] 1021. The basic address of the function call in the virtual environment is compiled into ASCII code and then scrambled and recombined to obtain the first-level encrypted address;

[0047] 1022. Perform asymmetric encryption on the first-level encrypted address to obtain the second-level encrypted address, wherein the asymmetric encryption uses a public key for encryption;

[0048] 1023. Limit the usage time of the private key generated based on the public key.

[0049] In steps 1021-1023, since some malicious code may attempt to find the mapped base address, it is necessary to hide or encrypt the base address. In this embodiment, a double encryption method is used. The base address is compiled into ASCII code, then scrambled and recombined, and then asymmetric encryption is performed. Of course, the encryption order can be changed and the number of encryption algorithms can be customized, depending on the actual needs and the efficiency and effect of the application. The second-level encrypted address obtained after double encryption will not be easily cracked by malicious code, effectively adding a layer of protection to the system. It should be noted that the public key and private key are one-time use. After use, the corresponding base address will be re-encrypted using a different public key. Similarly, the corresponding private key will change with the public key, thus strengthening the protection of the base address.

[0050] 105. Perform periodic backups of the virtual environment to obtain virtual environment backups;

[0051] 103. Monitor and record the function call behavior of malicious code in the virtual environment through a pre-set sandbox to obtain the recorded information;

[0052] In this embodiment, the malicious code still possesses some powerful and brute-force cracking capabilities to overcome the encryption defenses. Therefore, this malicious code will continue to run in the virtual environment, and the sandbox will monitor and record the behavior of the malicious code. After the recording is completed, the virtual environment will be reset.

[0053] 104. Based on the recorded information, new malicious code is detected in the virtual environment, and the new malicious code is intercepted through the sandbox;

[0054] Furthermore, step 104 can also be performed as follows:

[0055] 1041. New malicious code was detected in the virtual environment;

[0056] 1042. Based on the recorded information, determine whether the behavior of the new malicious code is similar to that of the malicious code;

[0057] 1043. If it is similar to the malicious code, then the new malicious code is intercepted through the sandbox;

[0058] 1044. If the new malicious code is not similar to the malicious code, then the new malicious code is monitored and recorded through the sandbox to obtain new record information.

[0059] In steps 1041-1044, new malicious code includes code that has been previously recorded by the sandbox, code similar to code recorded by the sandbox, and code that has not been recorded. The detected new malicious code falls into the first two categories. Since the execution operations and logic of the new malicious code are known, the sandbox can directly isolate and intercept the new malicious code. The interception method is to disable the functions or corresponding interfaces that the new malicious code wants to call. The behavior of the new malicious code includes executing header file code snippets, execution methods, and requests for modification permissions. As for the new malicious code that has not been recorded, since its execution methods and logic are unknown, it is allowed to operate in the virtual environment, and these behaviors are recorded by the sandbox so that subsequent monitoring and maintenance personnel can use these records to develop countermeasures.

[0060] 106. Determine whether a signal indicating that the sandbox failed to intercept the new malicious code has been received;

[0061] 107. If so, then invoke the virtual environment backup and restore the virtual environment.

[0062] In this embodiment, if no data is received, the sandbox continues its monitoring operation.

[0063] In embodiments of the present invention, a virtual environment is constructed, the base address of function calls in the virtual environment is encrypted, and a pre-set sandbox is used to monitor and record the function call behavior of malicious code in the virtual environment to obtain recorded information. Based on the recorded information, new malicious code in the virtual environment is detected and intercepted by the sandbox. By directly monitoring function calls, the consumption of system resources is reduced. The use of a virtual environment prevents malicious code from directly affecting the system, and the behavior of malicious code is recorded as preventative information.

[0064] The method for preventing malicious code in the embodiments of the present invention has been described above. The apparatus for preventing malicious code in the embodiments of the present invention is described below. Please refer to [link / reference]. Figure 5 One embodiment of the device for preventing malicious code in this invention includes:

[0065] 201. Virtual Environment Construction Module, used to build virtual environments;

[0066] 202. An encryption module, used to encrypt the base address of function calls in the virtual environment, wherein the encryption includes asymmetric encryption using a public key;

[0067] 203. Monitoring module, used to monitor and record the function call behavior of malicious code in the virtual environment through a pre-set sandbox, and obtain the recorded information;

[0068] 204. An interception module, used to detect new malicious code in the virtual environment based on the recorded information, and to intercept the new malicious code through the sandbox.

[0069] In embodiments of the present invention, a virtual environment is constructed, the base address of function calls in the virtual environment is encrypted, and a pre-set sandbox is used to monitor and record the function call behavior of malicious code in the virtual environment to obtain recorded information. Based on the recorded information, new malicious code in the virtual environment is detected and intercepted by the sandbox. By directly monitoring function calls, the consumption of system resources is reduced. The use of a virtual environment prevents malicious code from directly affecting the system, and the behavior of malicious code is recorded as preventative information.

[0070] Another embodiment of the device for preventing malicious code in this invention includes:

[0071] 201. Virtual Environment Construction Module, used to build virtual environments;

[0072] 202. An encryption module, used to encrypt the base address of function calls in the virtual environment, wherein the encryption includes asymmetric encryption using a public key;

[0073] 203. Monitoring module, used to monitor and record the function call behavior of malicious code in the virtual environment through a pre-set sandbox, and obtain the recorded information;

[0074] 204. An interception module, used to detect new malicious code in the virtual environment based on the recorded information, and to intercept the new malicious code through the sandbox.

[0075] Optionally, the encryption module 202 can also perform the following specific actions:

[0076] The basic addresses of function calls in the virtual environment are compiled into ASCII codes and then scrambled and recombined to obtain a first-level encrypted address;

[0077] The first-level encrypted address is asymmetrically encrypted to obtain the second-level encrypted address, wherein the asymmetric encryption uses a public key.

[0078] Limit the usage time of the private key generated based on the public key.

[0079] Optionally, following encryption module 202, the following may also be included:

[0080] The virtual environment is periodically backed up to obtain a virtual environment backup.

[0081] Optionally, the interception module 204 can also be specifically used for:

[0082] New malicious code was detected in the virtual environment;

[0083] Based on the recorded information, it is determined whether the behavior of the new malicious code is similar to that of the malicious code. The behavior of the new malicious code includes executing header file code snippets, execution methods, and requesting modification permissions.

[0084] If it is similar to the malicious code, the new malicious code will be intercepted through the sandbox;

[0085] If the new malicious code is not similar to the malicious code, the new malicious code will be monitored and recorded through the sandbox to obtain new record information.

[0086] Optionally, following intercept module 204, the following may also be included:

[0087] Determine whether a signal indicating that the sandbox failed to intercept the new malicious code has been received;

[0088] If so, the virtual environment backup is invoked and the virtual environment is restored.

[0089] In embodiments of the present invention, a virtual environment is constructed, the base address of function calls in the virtual environment is encrypted, and a pre-set sandbox is used to monitor and record the function call behavior of malicious code in the virtual environment to obtain recorded information. Based on the recorded information, new malicious code in the virtual environment is detected and intercepted by the sandbox. By directly monitoring function calls, the consumption of system resources is reduced. The use of a virtual environment prevents malicious code from directly affecting the system, and the behavior of malicious code is recorded as preventative information.

[0090] above Figure 5 The device for preventing malicious code in the embodiments of the present invention will be described in detail from the perspective of modular functional entities. The device for preventing malicious code in the embodiments of the present invention will be described in detail from the perspective of hardware processing.

[0091] Figure 6This is a schematic diagram of a device for preventing malicious code according to an embodiment of the present invention. The device 300 can vary significantly due to different configurations or performance characteristics. It may include one or more central processing units (CPUs), such as CPU 310, one or more processors, and memory 320. It may also include one or more storage media 330 for storing applications 333 or data 332, such as one or more mass storage devices. The memory 320 and storage media 330 can be temporary or persistent storage. The program stored in the storage media 330 may include one or more modules (not shown in the diagram), each module including a series of instruction operations on the device 300. Furthermore, the processor 310 may be configured to communicate with the storage media 330 and execute the series of instruction operations in the storage media 330 on the device 300.

[0092] The device 300 for preventing malicious code may also include one or more power supplies 340, one or more wired or wireless network interfaces 350, one or more input / output interfaces 330, and / or one or more operating systems 331, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. Those skilled in the art will understand that... Figure 6 The illustrated device architecture for preventing malicious code does not constitute a limitation on malicious code-based devices, which may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0093] The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium, wherein the computer-readable storage medium stores instructions that, when the instructions are executed on a computer, cause the computer to perform the steps of the method based on preventing malicious code.

[0094] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system, device, or unit described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0095] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device, such as a personal computer, server, or network device, to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0096] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for preventing malicious code, characterized in that, The methods for preventing malicious code include: Build a virtual environment; The base address of function calls in the virtual environment is encrypted; The function call behavior of malicious code in the virtual environment is monitored and recorded by a pre-configured sandbox to obtain the recorded information; Based on the recorded information, new malicious code was detected in the virtual environment, and the new malicious code was intercepted through the sandbox; The encryption of the base address of function calls in the virtual environment includes: The basic addresses of function calls in the virtual environment are compiled into ASCII codes and then scrambled and recombined to obtain the first-level encrypted addresses. The first-level encrypted address is asymmetrically encrypted to obtain the second-level encrypted address, wherein the asymmetric encryption uses a public key.

2. The method for preventing malicious code according to claim 1, characterized in that, After encrypting the base address of the function call in the virtual environment, the method further includes: The virtual environment is periodically backed up to obtain a virtual environment backup.

3. The method for preventing malicious code according to claim 2, characterized in that, After detecting new malicious code in the virtual environment based on the recorded information and intercepting the new malicious code through the sandbox, the process further includes: Determine whether a signal indicating that the sandbox failed to intercept the new malicious code has been received; If a signal is received, the virtual environment backup is invoked and the virtual environment is restored.

4. The method for preventing malicious code according to claim 1, characterized in that, The encryption of the base address of function calls in the virtual environment also includes: Limit the usage time of the private key generated based on the public key.

5. The method for preventing malicious code according to claim 1, characterized in that, The step of detecting new malicious code in the virtual environment based on the recorded information and intercepting the new malicious code through the sandbox includes: New malicious code was detected in the virtual environment; Based on the recorded information, it is determined whether the behavior of the new malicious code is similar to that of the malicious code. If it is similar to the malicious code, the new malicious code will be intercepted through the sandbox; If the new malicious code is not similar to the malicious code, the new malicious code will be monitored and recorded through the sandbox to obtain new record information.

6. The method for preventing malicious code according to claim 5, characterized in that, The new malicious code's actions include executing header file code snippets, execution methods, and requesting modification permissions.

7. A device for preventing malicious code, characterized in that, The device for preventing malicious code includes: The virtual environment building module is used to build virtual environments; An encryption module is used to encrypt the base address of function calls in the virtual environment, wherein the encryption includes asymmetric encryption using a public key; The monitoring module is used to monitor and record the function call behavior of malicious code in the virtual environment through a pre-set sandbox, and obtain the recorded information; The interception module is used to detect new malicious code in the virtual environment based on the recorded information, and to intercept the new malicious code through the sandbox; The encryption of the base address of function calls in the virtual environment includes: The basic addresses of function calls in the virtual environment are compiled into ASCII codes and then scrambled and recombined to obtain a first-level encrypted address. The first-level encrypted address is asymmetrically encrypted to obtain the second-level encrypted address, wherein the asymmetric encryption uses a public key.

8. A device for preventing malicious code, characterized in that, The device for preventing malicious code includes: a memory and at least one processor, wherein the memory stores instructions and the memory and the at least one processor are interconnected via a line; The at least one processor invokes the instructions in the memory to cause the device to perform the method for preventing malicious code as described in any one of claims 1-6.

9. A computer-readable storage medium storing a computer program thereon, characterized in that, When the computer program is executed by a processor, it implements the method for preventing malicious code as described in any one of claims 1-6.

Images