A dynamic sandbox configuration method, device and computing device based on anti-sandbox

Abstract

The present invention provides a dynamic sandbox configuration method, device and computing equipment based on anti-sandbox, which relates to the field of computer technology. The method includes: constructing an anti-sandbox database for malicious codes of different families; the anti-sandbox database includes anti-sandbox feature information of each family; in response to the sandbox to be configured receiving the malicious code to be detected, determining the target family of the malicious code to be detected; determining the target anti-sandbox feature information of the target family from the anti-sandbox database, and dynamically configuring the sandbox to be configured based on the target anti-sandbox feature information to obtain the target sandbox. This solution can circumvent anti-sandbox detection, and ensure that the malicious code can fully execute its behavior in the sandbox through dynamic configuration, thereby improving the accuracy and comprehensiveness of sandbox detection.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, specifically to the field of malicious code protection, and in particular to a dynamic sandbox configuration method, device and computing equipment based on anti-sandbox. Background Art

[0002] As network attack methods continue to evolve, malicious code becomes more and more complex and hidden, posing a huge challenge to network security. Traditional malicious code detection methods mainly rely on signature matching and static analysis technology, which cannot effectively deal with variant malicious code and zero-day attacks. To this end, dynamic sandbox technology came into being, which provides more comprehensive and detailed detection by running and analyzing the behavior of malicious code in an isolated virtual environment.

[0003] However, malicious code developers are also constantly evolving, adopting an anti-sandbox technology for detecting and circumventing sandbox environments, so that malware can recognize that it is in a sandbox when the sandbox attempts to analyze or perform malicious operations, and take corresponding measures to maintain concealment or bypass the sandbox environment's detection. Existing sandbox systems often find it difficult to achieve comprehensive and effective detection when faced with these complex and ever-changing anti-sandbox technologies, and it is difficult to provide strong support for malicious code protection. Summary of the invention

[0004] In order to solve the above problems, the embodiments of the present invention provide a dynamic sandbox configuration method, device and computer equipment based on anti-sandbox. The method can circumvent anti-sandbox detection and ensure that malicious code can fully execute its behavior in the sandbox through dynamic configuration, thereby improving the accuracy and comprehensiveness of sandbox detection and providing strong support for malicious code protection.

[0005] In a first aspect, an embodiment of the present invention provides a dynamic sandbox configuration method based on an anti-sandbox, comprising:

[0006] Constructing an anti-sandbox database for malicious codes of different families; the anti-sandbox database includes anti-sandbox feature information of each family;

[0007] In response to the sandbox to be configured receiving the malicious code to be detected, determining a target family of the malicious code to be detected;

[0008] The target anti-sandbox feature information of the target family is determined from the anti-sandbox database, and the sandbox to be configured is dynamically configured based on the target anti-sandbox feature information to obtain a target sandbox.

[0009] In a second aspect, an embodiment of the present invention further provides a dynamic sandbox configuration device based on an anti-sandbox, comprising:

[0010] A construction module is used to construct an anti-sandbox database for malicious codes of different families; the anti-sandbox database includes anti-sandbox feature information of each family;

[0011] A matching module, configured to determine a target family of the malicious code to be detected in response to the sandbox to be configured receiving the malicious code to be detected;

[0012] The configuration module is used to determine the target anti-sandbox feature information of the target family from the anti-sandbox database, and dynamically configure the sandbox to be configured based on the target anti-sandbox feature information to obtain a target sandbox.

[0013] In a third aspect, an embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements any of the above-mentioned anti-sandbox-based dynamic sandbox configuration methods.

[0014] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute any of the above-mentioned anti-sandbox-based dynamic sandbox configuration methods.

[0015] In a fifth aspect, an embodiment of the present invention further provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of the method described in any first aspect of this specification.

[0016] The embodiment of the present invention provides a dynamic sandbox configuration method, device and computing device based on anti-sandbox. The method constructs an anti-sandbox database containing anti-sandbox feature information, so that when malicious code to be detected appears, the corresponding target anti-sandbox feature information is obtained from the anti-sandbox database according to the target family to which the malicious code belongs, and then the sandbox is configured according to the target anti-sandbox feature information, so as to realize automatic configuration adjustment in the sandbox system without relying on a large amount of manual intervention, thereby reducing system resources and manpower costs, and at the same time ensuring that the malicious code to be detected can fully execute its behavior in the configured target sandbox, thereby improving the accuracy and comprehensiveness of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1It is a flow chart of a dynamic sandbox configuration method based on anti-sandbox provided by one embodiment of the present invention;

[0019] Figure 2 is a hardware architecture diagram of a computing device provided by an embodiment of the present invention;

[0020] Figure 3 It is a structural diagram of a dynamic sandbox configuration device based on anti-sandbox provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0022] Anti-sandbox technology (hereinafter referred to as anti-sandbox) is a security technology used to detect and evade sandbox environments. It enables malware to recognize that it is in a sandbox when the sandbox attempts to analyze or perform malicious operations, and take corresponding measures to maintain concealment or bypass detection in the sandbox environment.

[0023] like Figure 1 As shown, an embodiment of the present invention provides a dynamic sandbox configuration method based on anti-sandbox, the method comprising:

[0024] Step 100, constructing an anti-sandbox database for malicious codes of different families; the anti-sandbox database includes anti-sandbox feature information of each family;

[0025] Step 102, in response to the sandbox to be configured receiving the malicious code to be detected, determining a target family of the malicious code to be detected;

[0026] Step 104: determine the target anti-sandbox feature information of the target family from the anti-sandbox database, and dynamically configure the sandbox to be configured based on the target anti-sandbox feature information to obtain the target sandbox.

[0027] In the present invention, an anti-sandbox database containing anti-sandbox feature information is constructed so that when a malicious code to be detected appears, the corresponding target anti-sandbox feature information is obtained from the anti-sandbox database according to the target family to which the malicious code belongs, and then the sandbox is configured according to the target anti-sandbox feature information, thereby realizing automatic configuration adjustment in the sandbox system without relying on a large amount of manual intervention, reducing system resources and manpower costs, and at the same time ensuring that the malicious code to be detected can fully execute its behavior in the configured target sandbox, thereby improving the accuracy and comprehensiveness of detection.

[0028] Described below Figure 1 How the various steps are performed.

[0029] Before step 100, the malicious code is obtained by the following methods, including:

[0030] Using at least two capture methods to obtain the first malicious code;

[0031] Analyze the first malicious code to obtain sample features; the analysis includes static analysis and / or dynamic analysis;

[0032] Writing YARA rules based on sample features, and using at least one capture method according to the YARA rules to obtain the second malicious code; wherein different families of malicious codes correspond to different YARA rules;

[0033] A union operation is performed on the first malicious code and the second malicious code to obtain malicious codes of different families.

[0034] Specifically, the capture method includes using an independent honeypot system or threat intelligence platform specifically for capturing malicious code.

[0035] For example, when the capture method uses a honeypot system, a honeypot system is deployed on a virtual machine or physical machine, such as a web server honeypot, a database honeypot, an IoT device honeypot, etc., to simulate a vulnerable environment to capture malicious code samples. The honeypot system should include common operating systems (for example, Windows 10, Ubuntu, and other operating systems) and applications to attract malware; in addition, some common vulnerability ports (such as port 445 (i.e., SMB vulnerability)) should be opened to increase attractiveness. At the same time, the configuration of the honeypot system should be updated regularly to ensure that new malicious code variants can be captured; and the isolation of the honeypot system from the outside world should be ensured to prevent the real network from being infected.

[0036] For example, when the capture method uses a threat intelligence platform (such as VirusTotal) to obtain the latest malicious code samples, the latest malicious code samples can be obtained regularly by subscribing to relevant security notices.

[0037] In the present invention, at least two capture methods are used to obtain the latest malicious code samples, which can ensure the diversity and coverage of malicious code samples. Then, the first malicious code obtained by the above capture method is analyzed to obtain sample features, and YARA rules are written based on the sample features. Then, the above capture method is further captured based on the YARA rules to obtain a second malicious code sample. In this way, by performing a union operation on the first current malicious code sample and the second current malicious code sample, that is, eliminating duplicate malicious codes, a more comprehensive and wider coverage malicious code is further obtained.

[0038] In the present invention, YARA rules can also be updated regularly by obtaining the current malicious code to adapt to the characteristic changes of the malicious code, increase the capture capability, and improve the accuracy of detecting the malicious code. The sample features obtained by dynamic analysis and static analysis are combined to further improve the YARA rules, ensure that the YARA rules can effectively identify different variants of malicious code, and further reduce false positives and false negatives.

[0039] It should be noted that YARA rules are composed of a series of metadata and conditions. The metadata describes the name, string, variable, etc. of the rule, and the condition describes the pattern to be matched, that is, the YARA rule is obtained by combining multiple sample features. YARA rules are used to detect the features of malicious code samples, and different YARA rules are used for different families of malicious code.

[0040] It should be noted that static analysis can be performed by using disassembly tools (such as IDA Pro) to analyze captured malicious samples and identify features in their codes, such as strings, API calls, function call sequences, etc. Dynamic analysis refers to running malicious code in a controlled environment (such as VMware), monitoring its behavior and recording its runtime features.

[0041] In step 100, an anti-sandbox database for malicious codes of different families is constructed, including:

[0042] Dynamically analyze malicious codes of different families and record the anti-sandbox feature information used by the malicious codes; the anti-sandbox feature information includes specific API return values, system time, regional settings, and language type;

[0043] The anti-sandbox feature information is stored in the anti-sandbox database accordingly.

[0044] Specifically, whether the malicious code is running in the sandbox can be determined by at least one of the following methods:

[0045] The first method: Check the hardware characteristics of the system: Get system information by calling Windows API GetSystemInfo and check the number of processors, memory size and other hardware characteristics. If the number of CPUs and memory size are significantly lower than normal, it may indicate that the program is running in a sandbox.

[0046] The second method: Check the disk size: Use the GetDiskFreeSpaceEx function to obtain the disk size and free space. Sandbox environments usually have a smaller disk space. If the total disk size is found to be abnormally small, it may mean that the system is running in a sandbox.

[0047] The third method: Get the hardware ID and serial number through APIs such as GetVolumeInformation and GetSystemFirmwareTable. If an abnormal or virtualized ID is detected, it may be a feature of the sandbox environment.

[0048] The fourth method: The sandbox may place a specific file or registry key in the system as an identifier. Use APIs such as RegOpenKeyEx and GetFileAttributes to check whether the file or registry key in a specific path exists, such as "SOFTWARE\\SandboxIndicator", to determine whether it is in a sandbox;

[0049] Therefore, based on the above method, the anti-sandbox feature information used by the anti-sandbox technology can be confirmed. More specifically, the anti-sandbox feature information also includes but is not limited to the following for system property checks: available hardware IDs (such as CPU ID, motherboard serial number, etc.), driver lists, file systems and directory structures, system services in the sandbox environment; for network activities: DNS requests, IP address checks, open ports of port scans; for user interactions: keyboard and mouse activities, screen capture; for processes and threads: process lists, thread activities; for memory and registry: memory modes, registry key values; for timestamps and dates: system time, file creation time, and modification time; for exception handling: error messages, abnormal behaviors; for API call patterns: API call frequency and API call sequence, etc.

[0050] In the present invention, the anti-sandbox feature information of malicious codes of different families is partitioned and stored, which facilitates the subsequent acquisition of corresponding anti-sandbox feature information from the anti-sandbox database according to the family, and is further conducive to evading anti-sandbox detection with the help of the anti-sandbox feature information.

[0051] After step 100, the method further includes:

[0052] Get current malicious code in real time;

[0053] Perform static and dynamic analysis on the current malicious code to obtain the anti-sandbox feature information of the current malicious code;

[0054] The anti-sandbox database is updated in real time according to the anti-sandbox feature information of the current malicious code to obtain an updated anti-sandbox database.

[0055] In the present invention, by obtaining the latest malicious code in real time, and obtaining anti-sandbox feature information for the current malicious code through static analysis and dynamic analysis, the anti-sandbox database regularly updated with anti-sandbox feature information is used to ensure that the protection system can identify the latest threats and maintain efficient protection capabilities, thereby continuously updating the sandbox configuration, strengthening the detection and defense capabilities of the sandbox, and improving the security of the system and data. At the same time, by combining static analysis and dynamic analysis, the characteristics and behaviors of the malicious code are fully extracted to ensure the reliability of the malicious code detection results and reduce the possibility of false positives and false negatives.

[0056] With respect to step 102, determining the target family of the malicious code to be detected includes:

[0057] Analyze the malicious code to be detected and obtain the target features;

[0058] According to YARA rules and target features, the target family of malicious code to be detected is determined.

[0059] In the present invention, YARA rules are used to detect the characteristics of malicious code samples, and different families of malicious codes have different YARA rules. Therefore, the target family of the malicious code to be detected can be accurately determined based on the YARA rules and the target characteristics.

[0060] In step 104, the anti-sandbox database also includes real behavior information of each family after circumventing the anti-sandbox;

[0061] After getting the target sandbox, it also includes:

[0062] Run the malicious code to be detected in the target sandbox to obtain the malicious code behavior information;

[0063] Determine the target family's real behavior information from the anti-sandbox database;

[0064] Compare the malicious code behavior information with the target's real behavior information to obtain the difference value;

[0065] Determine whether the difference value is greater than a preset threshold;

[0066] If the judgment result is yes, the anti-sandbox database is updated using the malicious code to be detected.

[0067] It should be noted that the real behavior information after circumventing the anti-sandbox refers to the real behavior information of the malicious code when it is running in the sandbox after circumventing the anti-sandbox detection. For example, the real behavior includes creating startup item A, creating startup item B, modifying the user's IE settings, locking the system registry, etc.

[0068] It should be noted that the difference value includes but is not limited to the difference between the number of generated malicious code behaviors and the number of target real behaviors, the number of behaviors in the malicious code behaviors that are different from the target real behaviors, etc.

[0069] In the present invention, the sandbox to be configured can be dynamically configured based on the target anti-sandbox feature information, and anti-sandbox detection can be circumvented without a lot of manual intervention, so that malicious code with special conditions can be run in this way, so that the malicious code can be run in the sandbox, and its relevant real behavior information can be obtained, thereby improving the accuracy and comprehensiveness of the detection. At the same time, since each family has a large number of malicious code samples, after adopting the method of the present invention, the malicious code of the corresponding family can be run in batches through the dynamically configured sandbox, reducing system resources and labor costs.

[0070] Specifically, the anti-sandbox database is updated using the malicious code to be detected, including returning to step 100, dynamically analyzing the malicious code to be detected, recording the anti-sandbox feature information adopted by the malicious code and the real behavior information after circumventing the anti-sandbox; storing the anti-sandbox feature information and the real behavior information after circumventing the anti-sandbox in the anti-sandbox database according to the family, and completing the update.

[0071] In the present invention, after obtaining the target sandbox of the malicious code to be detected, it is necessary to further run the malicious code to be detected in the target sandbox to determine its malicious code behavior information. If the difference between the malicious code behavior information and the target real behavior information stored in the anti-sandbox database is too large, and the difference value is greater than a preset threshold, it is judged that the malicious code to be detected adopts a new anti-sandbox technology. Therefore, it is necessary to update the anti-sandbox database based on the malicious code to be detected to quickly respond to its updates and variants, improve the accuracy of the sandbox configuration, and thereby improve the security protection capability.

[0072] In a more preferred embodiment, the difference value is calculated by the following formula:

[0073]

[0074] in, C is the difference value; M 1 is the number of real behaviors included in the target real behavior information; M 2 is the number of malicious behaviors included in the malicious code behavior information; M0 is the number of identical behaviors between malicious code behavior information and malicious code behavior information; ∆ T The update cycle of the anti-sandbox database; t 2 is the time to determine the malicious code behavior information; t 1 is the time for the anti-sandbox database to store the target's real behavior information; max The function is used to find the maximum value. t 2> t 1.

[0075] In the present invention, the same behaviors and different behaviors included in the target real behavior information and the malicious code behavior information are comprehensively considered, and the time interval for obtaining the target real behavior information and the malicious code behavior information is combined to further determine the difference between the two, so as to more scientifically and accurately judge whether the malicious code to be detected has mutated or whether it has adopted new anti-sandbox technology.

[0076] Specifically, the present invention will be further described below by taking the Agent Tesla Trojan sample as an example, but the protection scope of the present invention is not limited to this embodiment.

[0077] First, the honeypot system and threat intelligence platform are used to obtain the latest Agent Tesla Trojan samples. The sample features, anti-sandbox feature information, and real behavior information after evading the anti-sandbox are obtained by combining static analysis and dynamic analysis. Based on the Trojan features, YARA rules for identifying Agent Tesla Trojan samples are written. Then, the latest Agent Tesla Trojan samples are obtained again based on the YARA rules, and the repeated captured Agent Tesla Trojan samples are eliminated. The anti-sandbox feature information and real behavior information after evading the anti-sandbox are stored according to the family of the latest Agent Tesla Trojan samples after screening, and the anti-sandbox database is constructed and updated in real time. When the sandbox system receives a malicious code analysis request, it detects that the family to which the malicious code belongs is the Agent Tesla Trojan family according to the YARA rules, and queries the corresponding anti-sandbox technology (i.e., anti-sandbox feature information) from the anti-sandbox database. The sandbox system automatically modifies the specified options based on the anti-sandbox feature information, such as specific API return values, system time, system region, language type, etc., to evade anti-sandbox detection. Finally, the sandbox system monitors and records the behavior of the Agent Tesla Trojan, and compares it with the actual behavior after circumventing the anti-sandbox technology stored in the anti-sandbox database. If the difference in behavior does not exceed the preset threshold, then the Trojan family does not use new anti-sandbox technology.

[0078] like Figure 2 , Figure 3As shown, the embodiment of the present invention provides a dynamic sandbox configuration device based on anti-sandbox. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 2 As shown in FIG. 1 , a hardware architecture diagram of a computing device where a dynamic sandbox configuration device based on anti-sandbox is provided in an embodiment of the present invention is located, except that Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown in the figure, the computing device in which the device is located in the embodiment may also generally include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, the CPU of the computing device in which it is located reads the corresponding computer program in the non-volatile memory into the memory and runs it. This embodiment provides a dynamic sandbox configuration device based on anti-sandbox, including:

[0079] A construction module 300 is used to construct an anti-sandbox database for malicious codes of different families; the anti-sandbox database includes anti-sandbox feature information of each family;

[0080] A matching module 302, configured to determine a target family of the malicious code to be detected in response to the sandbox to be configured receiving the malicious code to be detected;

[0081] The configuration module 304 is used to determine the target anti-sandbox feature information of the target family from the anti-sandbox database, and dynamically configure the sandbox to be configured based on the target anti-sandbox feature information to obtain a target sandbox.

[0082] In some specific implementations, the construction module 300 may be used to execute the above step 100 , the matching module 302 may be used to execute the above step 102 , and the configuration module 304 may be used to execute the above step 104 .

[0083] In some specific implementations, the device further includes an acquisition module, which is used to perform the following operations:

[0084] Using at least two capture methods to obtain the first malicious code;

[0085] Analyze the first malicious code to obtain sample features; the analysis includes static analysis and / or dynamic analysis;

[0086] Writing YARA rules based on sample features, and using at least one capture method according to the YARA rules to obtain the second malicious code; wherein different families of malicious codes correspond to different YARA rules;

[0087] A union operation is performed on the first malicious code and the second malicious code to obtain malicious codes of different families.

[0088] In some specific implementations, the construction module 300 is further configured to perform the following operations:

[0089] Dynamically analyze malicious codes of different families, record the anti-sandbox feature information used by the malicious code and the real behavior information after evading the anti-sandbox; the anti-sandbox feature information includes specific API return values, system time, regional settings, and language type;

[0090] The anti-sandbox feature information and the real behavior information after circumventing the anti-sandbox are stored in the anti-sandbox database accordingly.

[0091] In some specific implementations, the matching module 302 is further configured to perform the following operations:

[0092] Analyze the malicious code to be detected and obtain the target features;

[0093] According to YARA rules and target features, the target family of malicious code to be detected is determined.

[0094] In some specific implementations, the device further includes an update module, which is configured to perform the following operations:

[0095] Get current malicious code in real time;

[0096] Perform static and dynamic analysis on the current malicious code to obtain the anti-sandbox feature information of the current malicious code and the real behavior information after evading the anti-sandbox;

[0097] The anti-sandbox database is updated in real time according to the anti-sandbox feature information of the current malicious code and the real behavior information after evading the anti-sandbox, so as to obtain an updated anti-sandbox database.

[0098] In some specific implementations, the update module is further configured to perform the following operations:

[0099] Run the malicious code to be detected in the target sandbox to obtain the malicious code behavior information;

[0100] Determine the target family's real behavior information from the anti-sandbox database;

[0101] Compare the malicious code behavior information with the target's real behavior information to obtain the difference value;

[0102] Determine whether the difference value is greater than a preset threshold;

[0103] If the judgment result is yes, the anti-sandbox database is updated using the malicious code to be detected.

[0104] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on a dynamic sandbox configuration device based on anti-sandbox. In other embodiments of the present invention, a dynamic sandbox configuration device based on anti-sandbox may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0105] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0106] An embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a dynamic sandbox configuration method based on anti-sandbox in any embodiment of the present invention is implemented.

[0107] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes a dynamic sandbox configuration method based on an anti-sandbox in any embodiment of the present invention.

[0108] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes a dynamic sandbox configuration method based on an anti-sandbox as described in any of the above embodiments.

[0109] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0110] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0111] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0112] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0113] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0114] Each embodiment of the present invention has at least the following beneficial effects:

[0115] 1. In one embodiment of the present invention, by dynamically adjusting the sandbox configuration, anti-sandbox detection technology is circumvented to ensure that malicious code can fully execute its behavior in the sandbox, thereby improving the accuracy and comprehensiveness of detection.

[0116] 2. In one embodiment of the present invention, the anti-sandbox technology and avoidance strategies pre-stored in the anti-sandbox database are used to adjust the configuration of the sandbox through an automated script, without the need for a large amount of manual intervention, thereby reducing system resources and labor costs.

[0117] 3. In one embodiment of the present invention, the latest malicious code samples are obtained in real time through the honeypot system and the threat intelligence platform, and their anti-sandbox technology is stored in the database to ensure that the sandbox system can cope with newly emerging malicious code variants and families and maintain efficient protection capabilities.

[0118] 4. In one embodiment of the present invention, the sandbox system can quickly detect and respond to malicious code behavior, and realize rapid analysis and processing of malicious code through automated processes, thereby improving overall detection efficiency.

[0119] 5. In one embodiment of the present invention, by combining static analysis and dynamic analysis, the characteristics and behaviors of malicious code are fully extracted to ensure the high reliability of the detection results and reduce the possibility of false positives and false negatives.

[0120] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0121] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0122] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A dynamic sandbox configuration method based on anti-sandbox, characterized in that: include: Build an anti-sandbox database for different families of malicious code; The anti-sandbox database includes anti-sandbox feature information of each family; In response to the sandbox to be configured receiving the malicious code to be detected, determining a target family of the malicious code to be detected; Determine target anti-sandbox feature information of the target family from the anti-sandbox database, and dynamically configure the sandbox to be configured based on the target anti-sandbox feature information to obtain a target sandbox; The construction of an anti-sandbox database for malicious codes of different families includes: Dynamically analyzing the malicious codes of different families, and recording anti-sandbox feature information used by the malicious codes; wherein the anti-sandbox feature information includes specific API return values, system time, regional settings, and language type; Storing the anti-sandbox feature information in the anti-sandbox database accordingly; Before constructing the anti-sandbox database for malicious codes of different families, it also includes: Using at least two capture methods to obtain the first malicious code; Analyzing the first malicious code to obtain sample features; the analysis includes static analysis and / or dynamic analysis; Writing a YARA rule based on the sample feature, and acquiring the second malicious code using at least one of the capture methods according to the YARA rule; wherein different families of malicious code correspond to different YARA rules; A union operation is performed on the first malicious code and the second malicious code to obtain the malicious codes of different families.

2. The method according to claim 1, characterized in that Determining the target family of the malicious code to be detected includes: Analyze the malicious code to be detected to obtain target features; According to the YARA rules and the target features, a target family of the malicious code to be detected is determined.

3. The method according to claim 1, characterized in that After constructing the anti-sandbox database for malicious codes of different families, it also includes: Get current malicious code in real time; Performing static analysis and dynamic analysis on the current malicious code to obtain anti-sandbox feature information of the current malicious code; The anti-sandbox database is updated in real time according to the anti-sandbox feature information of the current malicious code to obtain an updated anti-sandbox database.

4. The method according to any one of claims 1 to 3, characterized in that: The anti-sandbox database also includes real behavior information of each family after circumventing the anti-sandbox; After obtaining the target sandbox, the method further includes: Running the malicious code to be detected in the target sandbox to obtain malicious code behavior information; Determine the target real behavior information of the target family from the anti-sandbox database; Comparing the malicious code behavior information with the target real behavior information to obtain a difference value; Determine whether the difference value is greater than a preset threshold; If the judgment result is yes, the anti-sandbox database is updated using the malicious code to be detected.

5. A dynamic sandbox configuration device based on anti-sandbox, characterized in that: include: Construction module, used to build anti-sandbox databases for different families of malicious code; The anti-sandbox database includes anti-sandbox feature information of each family; A matching module, configured to determine a target family of the malicious code to be detected in response to the sandbox to be configured receiving the malicious code to be detected; A configuration module, configured to determine target anti-sandbox feature information of the target family from the anti-sandbox database, and dynamically configure the sandbox to be configured based on the target anti-sandbox feature information to obtain a target sandbox; The building block is also used to perform the following operations: Dynamically analyze malicious codes of different families, record the anti-sandbox feature information used by the malicious code and the real behavior information after evading the anti-sandbox; the anti-sandbox feature information includes specific API return values, system time, regional settings, and language type; The anti-sandbox feature information and the real behavior information after circumventing the anti-sandbox are stored in the anti-sandbox database accordingly; Get the module to perform the following operations: Using at least two capture methods to obtain the first malicious code; Analyze the first malicious code to obtain sample features; the analysis includes static analysis and / or dynamic analysis; Writing YARA rules based on sample features, and using at least one capture method according to the YARA rules to obtain the second malicious code; wherein different families of malicious codes correspond to different YARA rules; A union operation is performed on the first malicious code and the second malicious code to obtain malicious codes of different families.

6. A computing device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 4 is implemented.

7. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 4.

8. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 4.

Images