Software analysis method and device, computer device, medium and program product

Abstract

The application relates to a software analysis method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: obtaining request information of software to be analyzed, and sending the request information to a target address; obtaining real response traffic generated by the target address based on the request information, and generating simulation response traffic based on the real traffic; sending the simulation response traffic to the software to be analyzed, and obtaining behavior data generated by the software to be analyzed based on the simulation response traffic. The application solves the problem that malicious software analysis cannot be performed in the case of no Internet environment or loss of effectiveness of the software to be analyzed, and improves the accuracy of malicious software analysis.

Description

Technical Field

[0001] The present application relates to the technical field of malware analysis, and in particular to a software analysis method, apparatus, computer equipment, storage medium, and computer program product. Background Art

[0002] With the development of malware analysis technology, the currently popular analysis methods mainly include static detection and dynamic detection.

[0003] Static analysis usually confirms whether the software is malicious through the signature and feature code scanning of binary files. This method usually relies on feature libraries and is limited to known malware. Currently, malicious programs often bypass detection by packing or obfuscating them. Dynamic analysis usually uses a sandbox to execute malware in an isolated environment, monitors the software running in real time, and then analyzes the software running behavior to determine whether it is malicious. This method relies on the effectiveness of the malware. Most modern malware needs to carry out malicious behavior through the network. When the network address that the malware relies on becomes invalid or the user's analysis environment does not allow networking, etc., this will result in the inability to fully analyze the malware's behavior and thus the inability to detect malicious content.

[0004] However, current static and dynamic detection and analysis methods for malware cannot perform malware analysis in the absence of an Internet environment or when the software to be analyzed loses its effectiveness, resulting in low malware analysis accuracy. Summary of the Invention

[0005] Based on this, it is necessary to provide a software analysis method, apparatus, computer equipment, storage medium and computer program product that can improve the accuracy of malware analysis in response to the above technical problems.

[0006] In a first aspect, the present application provides a software analysis method, the method comprising:

[0007] Obtaining request information of the software to be analyzed, and sending the request information to a target address;

[0008] Acquire real response traffic generated by the target address based on the request information, and generate simulated response traffic based on the real traffic;

[0009] The simulated response traffic is sent to the software to be analyzed, and behavior data generated by the software to be analyzed based on the simulated response traffic is obtained.

[0010] In one embodiment, before sending the request information to the target address, the method includes:

[0011] The request data is parsed to obtain the target address, target port and data content.

[0012] In one embodiment, after sending the request information to the target address, the method further includes:

[0013] If the target address does not respond, the request information is matched with the historical traffic database;

[0014] If the match is successful, the corresponding response traffic in the historical traffic library is recorded to generate simulated response traffic.

[0015] In one embodiment, after sending the request information to the target address, the method further includes:

[0016] If the match is unsuccessful, determining the protocol type based on the request information;

[0017] The simulated response traffic is generated based on the protocol type.

[0018] In one embodiment, after obtaining the behavior data generated by the software to be analyzed based on the simulated response traffic, the method further includes:

[0019] The simulated response traffic is stored in a historical traffic library.

[0020] In one embodiment, before obtaining the request information of the software to be analyzed, the method further includes: storing the software to be analyzed in a virtual environment, and running the software to be analyzed.

[0021] In a second aspect, the present application provides a software analysis device, the device comprising:

[0022] A receiving module is used to obtain request information from the software to be analyzed;

[0023] a recording module, configured to send the request information to a target address, obtain real response traffic generated by the target address based on the request information, record the response traffic, and generate simulated response traffic;

[0024] The forwarding module is configured to send the simulated response traffic to the software to be analyzed and obtain behavior data generated by the software to be analyzed based on the simulated response traffic.

[0025] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method described in the first aspect when executing the computer program.

[0026] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in the first aspect.

[0027] In a fifth aspect, the present application further provides a computer program product, comprising a computer program that, when executed by a processor, implements the steps of the method described in the first aspect.

[0028] The above-mentioned software analysis method, apparatus, computer equipment, storage medium and computer program product obtain request information of the software to be analyzed and send the request information to the target address; obtain the real response traffic generated by the target address based on the request information, and generate simulated response traffic based on the real traffic; send the simulated response traffic to the software to be analyzed, and obtain the behavior data generated by the software to be analyzed based on the simulated response traffic, which solves the problem in related technologies that malware analysis cannot be performed when there is no Internet environment or the software to be analyzed loses its effectiveness, and improves the accuracy of malware analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 An application environment diagram of a software analysis method in one embodiment;

[0030] Figure 2 1 is a flow chart of a software analysis method according to an embodiment;

[0031] Figure 3 A schematic diagram of malware sample detection in one embodiment;

[0032] Figure 4 A flowchart of malware sample detection in one embodiment;

[0033] Figure 5 A flowchart of generating simulated response traffic based on protocol type in one embodiment;

[0034] Figure 6 is a structural block diagram of a software analysis device in one embodiment;

[0035] Figure 7 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0037] In related technologies, in order to ensure that malware runs in an isolated sandbox software and cannot escape from the sandbox, a sandbox is deployed in an offline environment. At this time, the sandbox environment is deployed in an environment without the Internet, and the malicious program cannot connect to the Internet, resulting in the sandbox being unable to detect the malware. Secondly, after some malware detects that it has been injected with a hook, it will determine that it is in a sandbox environment and directly stop the malicious behavior, resulting in the traditional sandbox being unable to detect the malicious behavior. In addition, the malware first needs to connect to the attacker's personal server through the network, and then collect a series of information about the attacked environment and upload the information back to the attacker's server, thereby achieving the malicious behavior of intrusion and collection. When the attacker shuts down the personal server, the malware cannot connect to the attacker's server, and there is no subsequent information collection and transmission behavior, which causes the sandbox to mistakenly judge the malware as non-threatening when analyzing it.

[0038] The software analysis method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The terminal 102 can obtain the request information of the software to be analyzed, send the request information to the target address, obtain the real response traffic generated by the target address based on the request information, generate simulated response traffic based on the real traffic, send the simulated response traffic to the software to be analyzed, and obtain the behavior data generated by the software to be analyzed based on the simulated response traffic. Among them, the terminal 102 can be but is not limited to various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0039] In one embodiment, Figure 2 As shown, a software analysis method is provided, which is applied to Figure 1 Taking the terminal 102 as an example, the process includes the following steps:

[0040] Step S202: Obtain request information of the software to be analyzed, and send the request information to a target address.

[0041] The request information from the software to be analyzed includes the network traffic generated when the software to be analyzed attempts to access the Internet after it is started, and the traffic information received by the virtual device after the network traffic is forwarded to the virtual device. The IP packets in the traffic information are parsed to obtain the target address of the software to be analyzed.

[0042] Specifically, the software to be analyzed is started in a sandbox, and the network card traffic in the sandbox is forwarded to the TUN virtual device through iptables rules. The TUN virtual device receives the traffic information and parses the IP packet (IP Datagram, the protocol unit for controlling transmission of the IP protocol) into TCP / UDP (Transmission Control Protocol) (User Datagram Protocol) data packets. Based on the matching of the data packets, a five-tuple is connected. A session is created based on the connection five-tuple for traffic recording. The target address, port, and data content of the software to be analyzed are obtained by extracting session features. The application layer protocol corresponding to the request information is determined based on the port, the application layer protocol is parsed, and a request is initiated to the target address.

[0043] Step 204: Acquire the real response traffic generated by the target address based on the request information, and generate simulated response traffic based on the real traffic.

[0044] The actual response traffic includes the return packet information during the process of sending the request information to the target address. For example, based on the destination address, destination port, and data information of the first packet in the return packet information, a historical traffic packet similar to the return packet information is matched in the historical traffic database, and the corresponding historical traffic packet is replayed to obtain the simulated response traffic.

[0045] Step 206: Send the simulated response traffic to the software to be analyzed, and obtain the behavior data generated by the software to be analyzed based on the simulated response traffic.

[0046] Exemplarily, by replaying corresponding historical traffic packets in the historical traffic library and performing simulated communication with the program in the software to be analyzed, behavioral data generated by the software to be analyzed based on the simulated response traffic is obtained.

[0047] Through the above steps, the request data of the software to be analyzed is analyzed to obtain the destination address, and communication data is constructed to establish communication with the software to be analyzed, allowing the software to run normally and facilitating the user to obtain and analyze software behavior data. This non-invasive method monitors the behavior of the software to be analyzed, ensuring that the program in the software to be analyzed is not restricted by the environment. Even if the target address of the software to be analyzed cannot be connected or the software to be analyzed is out of date, it can still run and communicate normally. This solves the problem in related technologies that malware analysis cannot be performed without an internet environment or when the software to be analyzed is out of date, and achieves improved malware analysis accuracy.

[0048] In one embodiment, before obtaining the request information of the software to be analyzed, the method further includes: storing the software to be analyzed in a virtual environment, and running the software to be analyzed.

[0049] First, place the software to be analyzed in a virtual machine environment, then start the program within it. For example, the software to be analyzed is placed in a sandbox virtual machine environment, and after starting the program within it, hook functions and event callback functions are injected into the software to establish event log monitoring and event monitoring callbacks. The execution of the software to be analyzed triggers the hooks and event callbacks, collecting the software's operational data.

[0050] In one embodiment, before sending the request information to the target address, the process includes: parsing the request data to obtain the target address, target port, and data content.

[0051] Exemplarily, the request data is parsed through the TUN virtual device, the IP packet is parsed to obtain the TCP / UDP packet, a session is created based on the connection quintuple, traffic is recorded, and session features are extracted and stored when the session is closed, where the session features include the destination address, target port and data content.

[0052] In one embodiment, after sending the request information to the target address, the method further includes: if the target address has no response, matching the request information with the historical traffic library; if the match is successful, recording the corresponding response traffic in the historical traffic library to generate simulated response traffic.

[0053] If the destination address of the request information is reachable, it will communicate with the destination address, record the return packet information and return the real information; if the destination address is unreachable, it will match the historical traffic packets similar to the request information in the historical traffic library according to the destination address, destination port and data content in the request information, simulate the historical traffic packets to generate simulated response traffic, and communicate with the software to be analyzed through the simulated response traffic.

[0054] In one embodiment, after sending the request information to the target address, the method further includes: if the match is unsuccessful, determining the protocol type based on the request information; and generating simulated response traffic based on the protocol type.

[0055] After sending a request to the target address, if the destination address is unreachable and no historical traffic packets similar to the request are found in the historical traffic database, the request port number is analyzed to determine the corresponding protocol type. If the protocol type cannot be identified by the port number, the corresponding protocol type is identified based on the packet header features in the request. The request is parsed for different protocol types and simulated response traffic is generated based on the parsed results.

[0056] Exemplarily, the following protocols can be identified through the port number: dns protocol interaction, http / https protocol interaction, smtp / smtps protocol interaction, pop3 / pop3s protocol interaction, ftp / ftps / tftp protocol interaction, and ntp protocol interaction; if the protocol type cannot be confirmed, a random string is returned to attempt communication; if the data packet in the request information is a tls (Transport Layer Security, secure transmission layer protocol) data packet, the corresponding certificate of the request information is captured for decryption and construction of the response data.

[0057] The method for generating corresponding simulation response traffic based on different protocol types includes: dns protocol interaction, supporting dns forward lookup and reverse lookup, and constructing a local service address return; http / https protocol interaction, parsing the request information, and providing a fake file according to the file extension in the request or static routing; smtp / smtps protocol interaction, supporting receiving emails stored in mbox format, and supporting any identity verification and recording information; pop3 / pop3s protocol interaction, supporting dynamic creation of email content returns, and supporting any identity verification and recording information; ftp / ftps / tftp protocol interaction, supporting downloading and uploading files, based on a local virtual file system, allowing any file to be created and deleted; ntp protocol interaction, some malicious software needs to be triggered at a specific time point, and ntp interaction supports synchronization based on the current timestamp and incremental response timestamp.

[0058] The decryption of the tls data packet includes: dumping tls certificate information through a hook and an encryption function, obtaining the certificate and five-element information when the software to be analyzed initiates a secure transmission layer protocol, and parsing the request information through the certificate and the five-element information.

[0059] In one embodiment, after obtaining the behavior data generated by the simulation response traffic based on the software to be analyzed, the simulation response traffic is stored in a historical traffic library. The session generated by the simulation response traffic is recorded, and the features including the target address, target port, and data content in the simulation response traffic are extracted, and the historical traffic library is updated according to the features. Through the automatic updating of the historical traffic library, the real response traffic is simulated to the maximum extent to communicate, avoiding the communication failure caused by the format error of the simulated response traffic data.

[0060] In one embodiment, Figure 3 is a malicious software sample detection schematic diagram of the embodiment, which is applied to a malicious software analysis system, wherein the malicious software analysis system includes a sandbox behavior analysis subsystem and a network simulation subsystem. Figure 4 is a malicious software sample detection flowchart of the embodiment, as shown in Figure 4 The method includes the following steps:

[0061] Step S401: Send the malware sample uploaded by the user to the sandbox behavior analysis subsystem, start the sandbox virtual machine network card to start the sample, and monitor the sample behavior.

[0062] The sandbox behavior analysis subsystem runs in a virtual machine environment, with HTTP services enabled by default. It provides an interface for uploading sample files, launching sample processes, and monitoring and collecting sample execution data through event callback functions and kernel hooking technology.

[0063] Specifically, when the sample runs, it captures and records API call information and other behavioral data through kernel hooks and event callbacks. It also obtains task completion information after monitoring that the sample and its associated processes have exited, or after monitoring that the task has timed out. Combining this task completion information with behavioral data, it generates an analysis report through data aggregation.

[0064] Step S402: forward the request information of the sandbox network card to the network simulation subsystem through iptables rules, create a TUN virtual device in the network simulation subsystem to parse the original IP data packet in the request information and obtain a TCP / UDP data packet.

[0065] Among them, the network simulation subsystem includes an application layer protocol stack.

[0066] Step S403: Create a session dump context based on the connection quintuple in the TCP / UDP data packet, start traffic recording, and extract and store local session features when the session is closed. The session features include the destination address, port, and data content of the first data packet.

[0067] Step S404: Identify the corresponding application layer protocol according to the target port, and parse the request information through the application layer protocol.

[0068] Step S405: forward the request information to the destination address. If the forwarding request is successful, execute step S406; if the forwarding request fails, execute step S407.

[0069] Step S406: Record the actual traffic during the connection with the destination address, record the return packet information, obtain the response packet and return it to the sandbox behavior analysis subsystem to analyze the sample behavior data.

[0070] Step S407, find a matching historical traffic packet in the historical traffic library based on the destination address, destination port and data content of the first data packet. If the corresponding historical traffic packet is found, execute step S408; if the corresponding historical traffic packet is not found, execute step S409.

[0071] Step S408: simulate and replay historical traffic packets to obtain simulated response traffic, continue to communicate and interact with the malware, obtain a response packet and return it to the sandbox behavior analysis subsystem to analyze the sample behavior data.

[0072] Step S409: perform traffic simulation according to the application layer protocol, implement interaction with the malware, construct response data, obtain a response packet and return it to the sandbox behavior analysis subsystem to analyze the sample behavior data.

[0073] Figure 5 This is a flow chart of generating simulation response traffic based on protocol type in this embodiment. Figure 5 As shown, the following steps are included:

[0074] Step S501, find a matching historical traffic packet in the historical traffic library based on the destination address, destination port and data content of the first data packet. If the corresponding historical traffic packet is found, execute step S502; if the corresponding historical traffic packet is not found, execute step S503.

[0075] Step S502: replay historical traffic packets to obtain simulated response traffic, and continue to communicate and interact with the malware.

[0076] Step S503: Identify whether it is a conventional protocol by the port number, parse the request information by different protocol types, and generate simulated response traffic based on the parsing result.

[0077] The following protocols can be identified by port numbers: DNS, HTTP / HTTPS, SMTP / SMTPS, POP3 / POP3S, FTP / FTPS / TFTP, and NTP. Specifically, port 80 is HTTP, and port 53 is DNS.

[0078] Step S504, access the destination address. If the address is reachable, execute step S505. If the address is unreachable, execute step S506.

[0079] Step S505: record the interactive traffic, store the request data, and store and return the response data.

[0080] Step S506: construct a corresponding data packet according to the identified protocol and return response data.

[0081] This embodiment uploads malware samples to the malware analysis system, dynamically running the malware in an isolated sandbox environment within the sandbox behavior analysis subsystem. When the malware attempts to access the internet, traffic information is forwarded to the network emulation subsystem. The network emulation subsystem establishes a communication channel with the malware through protocol identification and packet emulation, recording malicious network behaviors initiated by the malware. It also automatically updates the historical traffic database, maximizing the simulation of authentic traffic for communication and avoiding communication failures caused by erroneous data formats. This improves traffic authenticity, tricking the malware into performing as many malicious behaviors as possible, and ultimately enhancing malware detection accuracy.

[0082] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0083] Based on the same inventive concept, embodiments of the present application also provide a software analysis device for implementing the software analysis method described above. The implementation solution provided by this device is similar to the implementation solution described in the above method. Therefore, the specific limitations of one or more software analysis device embodiments provided below can be found in the above-mentioned limitations of the software analysis method and will not be repeated here.

[0084] In one embodiment, Figure 6 As shown, a software analysis device is provided, including: a receiving module, a recording module and a forwarding module, wherein:

[0085] A receiving module is used to obtain request information from the software to be analyzed;

[0086] A recording module is used to send the request information to the target address, obtain the real response traffic generated by the target address based on the request information, record the response traffic, and generate simulated response traffic;

[0087] The forwarding module is used to send the simulated response traffic to the software to be analyzed and obtain the behavior data generated by the software to be analyzed based on the simulated response traffic.

[0088] In one embodiment, the software analysis device further includes: a parsing module, wherein:

[0089] The parsing module is used to parse the request data before sending the request information to the target address to obtain the target address, target port and data content.

[0090] In one embodiment, the software analysis device further includes: a first matching module, wherein:

[0091] The first matching module is used to match the request information with the historical traffic library if there is no response from the target address after sending the request information to the target address; if the match is successful, the corresponding response traffic in the historical traffic library is recorded to generate simulated response traffic.

[0092] In one embodiment, the software analysis device further includes: a second matching module, wherein:

[0093] The second matching module is configured to determine the protocol type based on the request information if the match fails after sending the request information to the target address; and generate the simulated response traffic based on the protocol type.

[0094] In one embodiment, the software analysis device further includes an update module, wherein:

[0095] The updating module is configured to obtain the behavior data generated by the software to be analyzed based on the simulated response traffic, and then store the simulated response traffic in a historical traffic database.

[0096] In one embodiment, the software analysis device further includes a transfer module, wherein:

[0097] The transfer module is used to store the software to be analyzed into a virtual environment and run the software to be analyzed before obtaining the request information of the software to be analyzed.

[0098] Each module in the software analysis device can be implemented in whole or in part through software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0099] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps of the software analysis method in any of the above embodiments when executing the computer program.

[0100] Optionally, the computer device may be a terminal, and its internal structure diagram may be as follows: Figure 7As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a software analysis method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad provided on the computer device housing, or an external keyboard, touchpad or mouse.

[0101] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0102] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the software analysis method in any of the above embodiments are implemented.

[0103] In one embodiment, when a computer program is executed by a processor, the following steps of a software analysis method are implemented: obtaining request information of the software to be analyzed, and sending the request information to a target address; obtaining real response traffic generated by the target address based on the request information, and generating simulated response traffic based on the real traffic; sending the simulated response traffic to the software to be analyzed, and obtaining behavioral data generated by the software to be analyzed based on the simulated response traffic.

[0104] In one embodiment, when the computer program is executed by a processor, the following steps of the software analysis method are implemented: before sending the request information to the target address, the request data is parsed to obtain the target address, target port and data content.

[0105] In one embodiment, when the computer program is executed by the processor, the steps of the following software analysis method are implemented: after sending the request information to the target address, if the target address has no response, matching the request information with the historical traffic library; if the match is successful, recording the corresponding response traffic in the historical traffic library to generate simulated response traffic.

[0106] In one embodiment, when the computer program is executed by a processor, the steps of the following software analysis method are implemented: after sending the request information to the target address, the method further includes: if the match is unsuccessful, determining the protocol type based on the request information; and generating the simulated response traffic based on the protocol type.

[0107] In one embodiment, when the computer program is executed by a processor, the following steps of the software analysis method are implemented: after obtaining the behavior data generated by the software to be analyzed based on the simulated response traffic, the simulated response traffic is stored in a historical traffic library.

[0108] In one embodiment, when the computer program is executed by a processor, the following steps of the software analysis method are implemented: before obtaining request information of the software to be analyzed, storing the software to be analyzed in a virtual environment and running the software to be analyzed.

[0109] In one embodiment, a computer program product is provided, comprising a computer program, which implements the steps of the software analysis method in any of the above embodiments when executed by a processor.

[0110] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0111] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0112] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0113] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A software analysis method, characterized in that: The method comprises: Obtaining request information of the software to be analyzed, and sending the request information to a target address; Acquire the real response traffic generated by the target address based on the request information, and generate the simulated response traffic based on the real response traffic; wherein the real response traffic includes the return packet information in the process of sending the request information to the target address; generating the simulated response traffic based on the real response traffic includes: according to the first packet destination address, destination port and data information in the return packet information, matching a historical traffic packet similar to the return packet information in a historical traffic library, replaying the historical traffic packet, and obtaining the simulated response traffic; Sending the simulated response traffic to the software to be analyzed, and obtaining behavior data generated by the software to be analyzed based on the simulated response traffic; After sending the request information to the target address, the method further includes: if the target address has no response, matching the request information with the historical traffic library; if the match is successful, recording the corresponding response traffic in the historical traffic library to generate simulated response traffic; if the match is unsuccessful, determining the protocol type based on the request information; and generating the simulated response traffic based on the protocol type.

2. The method according to claim 1, characterized in that Before sending the request information to the target address, the method includes: The request information is parsed to obtain the target address, target port and data content.

3. The method according to claim 1, characterized in that After obtaining the behavior data generated by the software to be analyzed based on the simulated response traffic, the method further includes: The simulated response traffic is stored in a historical traffic library.

4. The method according to claim 1, wherein Before obtaining the request information of the software to be analyzed, the method further includes: storing the software to be analyzed in a virtual environment, and running the software to be analyzed.

5. A software analysis device, characterized in that: The device comprises: A receiving module is used to obtain request information from the software to be analyzed; a recording module, configured to send the request information to a target address, obtain real response traffic generated by the target address based on the request information, record the response traffic, and generate simulated response traffic; a forwarding module, configured to send the simulated response traffic to the software to be analyzed, and obtain behavior data generated by the software to be analyzed based on the simulated response traffic; The software analysis device further includes a first matching module and a second matching module; the first matching module is configured to, after sending the request information to the target address, if the target address does not respond, match the request information with a historical traffic library; if the match is successful, record the corresponding response traffic in the historical traffic library to generate simulated response traffic; the second matching module is configured to, after sending the request information to the target address, if the match is unsuccessful, determine the protocol type based on the request information; and generate the simulated response traffic based on the protocol type; Among them, the real response traffic includes the return packet information in the process of sending the request information to the target address; the recording of the response traffic to generate the simulated response traffic includes: according to the first packet destination address, destination port and data information in the return packet information, matching the historical traffic packets similar to the return packet information in the historical traffic library, replaying the historical traffic packets, and obtaining the simulated response traffic.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

8. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images