Malicious code behavior analysis and detection method and device

Abstract

The present invention discloses a method and device for analyzing and detecting malicious code behavior, and belongs to the field of malicious code analysis and detection. The method comprises: based on a preset configuration file, real-time hooking of the malicious code's call to the target API; wherein the configuration file contains at least the target API to be hooked, and the target API comprises an anti-virtual machine API, a file operation API for anti-analysis, and a network communication API for communicating with a malicious server; when the malicious code calls the target API, interrupting the execution of the malicious code; obtaining a return value or parameter for simulating a normal operating environment, so that the malicious code can run normally, and real-time monitoring and recording of the malicious code's behavior data. The present invention can allow the malicious code to run normally without modifying the original file of the malicious code, thereby fully capturing the real behavior of the malicious code, which can not only effectively improve the reliability and integrity of the malicious code analysis, but also reduce the consumption of time and resources.

Description

Technical Field

[0001] The present invention relates to the technical field of malicious code analysis and detection, and in particular to a method and device for analyzing and detecting malicious code behavior. Background Art

[0002] With the rapid development of computer technology, the complexity and concealment of malicious code (Malware) are also increasing. In order to protect sensitive data and system security, security researchers have developed various analysis techniques to detect and analyze the behavior of malicious code. However, in order to counter these protective measures, malicious code developers have also evolved and adopted a series of anti-debugging, anti-virtual machine, anti-sandbox and other technologies, making it more difficult to detect and analyze in a controlled environment.

[0003] Malicious code analysis usually relies on isolated environments such as sandboxes and virtual machines to observe the behavior of malicious code in a safe environment. However, many malicious codes can use specific API calls to detect their operating environment, and when they detect the existence of a virtual machine or sandbox, they will stop or modify their malicious behavior to evade behavioral analysis, making it difficult for security analysts to obtain complete malicious code behavior data. Traditional debugging methods mostly modify the original code of the malicious code to dismantle its self-protection measures, which not only requires a lot of time and system resources, but also easily triggers anti-debugging mechanisms and hash value checks due to file modifications.

[0004] Therefore, there is an urgent need to provide an analysis and detection method for malicious code behavior. Summary of the invention

[0005] In order to solve the problem that traditional debugging methods require a lot of time and system resources by modifying the original code, and are easily triggered by anti-debugging mechanisms and hash value checks due to file modifications, an embodiment of the present invention provides a method and device for analyzing and detecting malicious code behavior.

[0006] On the one hand, a method for analyzing and detecting malicious code behavior is provided, which is applied to a sandbox or a virtual machine, and the method comprises:

[0007] Based on a preset configuration file, the malicious code's call to the target API is hooked in real time; wherein the configuration file contains at least the target API to be hooked for anti-analysis, and the target API includes at least an anti-virtual machine API, a file operation API for anti-analysis, and a network communication API for communicating with a malicious server;

[0008] When the malicious code calls the target API, interrupting the execution of the malicious code;

[0009] A return value or parameter for simulating a normal operating environment is obtained to enable the malicious code to run normally, and the behavior data of the malicious code is monitored and recorded in real time.

[0010] On the other hand, a malicious code behavior analysis and detection device is provided, which is used to implement the steps described in any method embodiment of the specification, and is set in a sandbox or a virtual machine, and the device includes:

[0011] A hook unit, used for hooking the call of the malicious code to the target API in real time based on a preset configuration file; wherein the configuration file contains at least the target API to be hooked for anti-analysis, and the target API includes at least an anti-virtual machine API, a file operation API for anti-analysis, and a network communication API for communicating with a malicious server;

[0012] An interruption unit, used for interrupting the execution of the malicious code when the malicious code calls the target API;

[0013] The running unit is used to obtain a return value or parameter for simulating a normal operating environment so that the malicious code can run normally, and to monitor and record the behavior data of the malicious code in real time.

[0014] On the other hand, a computer device is provided, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of the above-mentioned method.

[0015] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned method are implemented.

[0016] On the other hand, a computer program product is provided, comprising a computer program, wherein the computer program implements the steps of the above method when executed by a processor.

[0017] The technical solution provided by the present invention can at least bring the following beneficial effects:

[0018] When malicious code calls these target APIs for anti-analysis, API Hook technology is used to intercept them. By modifying the returned parameters or return values, the malicious code thinks that it is running in a normal environment, thereby capturing all its behavior data. This can not only bypass the anti-detection mechanism of the malicious code, but also allow it to run normally without modifying the original file of the malicious code, thereby fully capturing the real behavior of the malicious code. Therefore, this solution can not only avoid the self-destruction or countermeasures of malicious code that may be caused by traditional debugging methods, but also effectively improve the reliability and integrity of malicious code analysis, and reduce the consumption of system resources in traditional debugging methods, thereby improving analysis efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 This is a flow chart of a method for analyzing and detecting malicious code behavior provided by an embodiment of the present invention;

[0021] Figure 2 It is a structural diagram of a malicious code behavior analysis and detection device provided by an embodiment of the present invention;

[0022] Figure 3 It is a hardware architecture diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0024] The specific implementation of the above concept is described below.

[0025] Please refer to Figure 1 , an analysis and detection method for malicious code behavior provided by an embodiment of the present invention is applied to a sandbox or a virtual machine, and the method comprises:

[0026] Step 100: Based on a preset configuration file, the malicious code's call to the target API is hooked in real time; wherein the configuration file contains at least the target API to be hooked for anti-analysis, and the target API includes at least an anti-virtual machine API, a file operation API for anti-analysis, and a network communication API for communicating with a malicious server;

[0027] Step 102: When the malicious code calls the target API, the execution of the malicious code is interrupted;

[0028] Step 104: Obtain a return value or parameter for simulating a normal operating environment to enable the malicious code to run normally, and monitor and record the behavior data of the malicious code in real time.

[0029] In the embodiment of the present invention, when malicious code calls these target APIs for anti-analysis, API Hook technology is used to intercept them, and by modifying the returned parameters or return values, the malicious code is made to think that it is running in a normal environment, thereby capturing all its behavior data. This can not only bypass the anti-detection mechanism of the malicious code, but also allow it to run normally without modifying the original file of the malicious code, thereby fully capturing the real behavior of the malicious code. Therefore, this solution can not only avoid the self-destruction or countermeasures of malicious code that may be caused in traditional debugging methods, but also effectively improve the reliability and integrity of malicious code analysis, and reduce the consumption of system resources in traditional debugging methods, thereby improving analysis efficiency.

[0030] Described below Figure 1 How the various steps are performed.

[0031] For step 100:

[0032] As mentioned earlier, malware such as TrickBot has a variety of anti-detection techniques, such as anti-virtual machine, anti-debugging, and anti-sandbox techniques. TrickBot is able to use a variety of API calls to detect whether it is running in a virtual machine or sandbox environment, such as by checking system hardware information, network configuration, the presence or absence of specific files or registry keys, etc. TrickBot may use anti-virtual machine detection APIs to identify its operating environment, or transmit stolen data back to its control server (C2) through network communication APIs. If detected running in a controlled environment, TrickBot usually stops malicious behavior or takes evasive measures, making analysis more difficult.

[0033] Therefore, in the embodiment of the present invention, by presetting a configuration file containing the target API to be hooked, the Hook technology is used to monitor the call of the malicious code to the target API. In order to comprehensively and effectively circumvent the anti-debugging, anti-virtual machine and other detection technologies of the malicious code, the target API includes at least three anti-analysis APIs: anti-virtual machine APIs (such as cpuid, VmwareGetVersion, etc.), file operation APIs for anti-analysis (such as CreateFile, ReadFile, etc.), and network communication APIs for communicating with malicious servers (such as send, recv, etc.).

[0034] Regarding step 102:

[0035] In this step, when the malicious code calls these target APIs, the Hook module intercepts the call and interrupts the execution of the malicious code.

[0036] Since Hook technology only monitors the API and records the call information, it will not prevent the malicious code from continuing to call the target API. In order to modify the return value or parameters of the target API to deceive the malicious code into thinking that it is in a normal physical environment and to fully capture the real behavior of the malicious code in a sandbox or virtual machine, it is necessary to immediately interrupt the execution of the malicious code when the malicious code calls the target API.

[0037] Therefore, this embodiment redirects the API call to a custom processing function through technologies such as memory hooking or IAT table rewriting, so that the execution of the malicious code can be interrupted when the call is made.

[0038] Regarding step 104:

[0039] In some implementations, the return value or parameter is obtained by manual input and pre-configuration.

[0040] Specifically, the return value or parameter is manually input in the following way:

[0041] Parse various data structures passed by malicious code to the target API;

[0042] An interactive window pops up for the analyst and displays the target API call information;

[0043] In response to the analyst inputting a return value or parameter in the interactive window to simulate a normal operating environment, the return value or parameter is sent to the malicious code.

[0044] In this embodiment, in order to enable analysts to quickly understand the target API being called and facilitate manual modification, an interactive interface is developed. When the API call is intercepted, the system will first parse the various data structures passed by the malicious code to the target API, so as to pop up an interactive window for the analyst, and display the detailed call information of the target API to the analyst in the interactive window, including the API name called, the parameters passed, the return value, etc. The analyst can view and modify the parameters or return values ​​through this window, thereby controlling the normal operation of the malicious code. The passing parameters or return values ​​of the target API can be manually modified as needed. In this way, the malicious code can be deceived into being in a normal physical environment, rather than a sandbox or virtual machine.

[0045] In order to improve the efficiency of analysis, some common modification rules and automated scripts can be pre-configured. For example, when calling a specific anti-virtual machine API, the system automatically returns the preset value that the virtual machine does not exist, avoiding frequent manual operations. Similarly, for common file operations and network communications, the system can also automatically complete routine modification operations, retaining the flexibility of manual intervention by analysts. Therefore, the combination of manual input and pre-configuration can not only dynamically modify and control the behavior of malicious code, effectively circumventing anti-debugging, anti-virtual machine and other detection technologies, but also retain the flexibility of manual intervention by analysts, and improve analysis efficiency by pre-configuring modification rules.

[0046] In some implementations, obtaining return values ​​and parameters for simulating a normal operating environment includes:

[0047] When the malicious code calls the anti-virtual machine API, a return value indicating that the virtual machine does not exist is returned;

[0048] When the malicious code calls the file operation API, it modifies the file path and file attributes to simulate the existence of the file;

[0049] When the malicious code calls the network communication API, it simulates the malicious server to communicate.

[0050] For example, when the malicious code calls the anti-virtual machine API, since it is in the virtual machine, the return value is TRUE, indicating that it is currently in the virtual machine. Analysts can modify it to FALSE, so that the malicious code mistakenly believes that there is no virtual machine and continues to run. When calling the file operation API (such as CreateFile), if the malicious code tries to access a non-existent file, the analyst can modify the path or file attributes to simulate the existence of the file and allow the malicious code to continue to run. When the malicious code tries to send data back to its C2 server, the analyst can intercept the network communication API through the API Hook technology and modify the IP address or domain name of the C2 server and replace it with a fake C2 server address. In this way, the malicious code will mistakenly believe that it has successfully sent data back to its control server, but in fact, the data is directed to an environment controlled by security researchers. In this way, analysts can not only capture the communication data of the malicious code, but also further study its network protocol and attack methods.

[0051] In addition, many malicious codes currently encrypt data packets, for example, by calling the system's built-in encryption API (such as AES, Base64, etc.) for encryption operations, or using custom encryption algorithms, and then transmitting the encrypted data packets to their remote servers. Since calling encryption APIs is considered a legitimate system call, traditional protection measures are difficult to identify and intercept these behaviors. Even if the data packets are intercepted, using traditional decryption algorithm libraries to decrypt them will waste a lot of time and computing resources, which greatly reduces the efficiency of malicious code behavior analysis.

[0052] Therefore, in some implementations, the configuration file also contains the encryption API to be hooked;

[0053] Step 104 "Malicious code runs normally, and real-time monitoring and recording of malicious code behavior data" includes:

[0054] Based on the configuration file, the malicious code's call to the encryption API is hooked in real time, and the encryption API call information of the malicious code is recorded; wherein the encryption API call information at least includes the calling sequence of the encryption API, the name, parameters and return value of each encryption API;

[0055] Based on the encrypted API call information, the data packets sent by the malicious code are reversely decrypted to determine the behavior data of the malicious code.

[0056] In this embodiment, there are many types of malicious code, such as mining Trojans, remote control Trojans, secret stealing Trojans, etc. These Trojans will send data packets to the outside, and they are likely to be encrypted. Therefore, by hooking the encrypted API in the system, the various encrypted API information called by the malicious code is accurately recorded. When the malicious code is transmitted back, the data packet is intercepted, and the recorded encrypted API call information is used to quickly reverse decrypt the data packet, and the behavior data of the malicious code is quickly determined.

[0057] It should be noted that encryption APIs include at least AES, DES, Base64, etc. By using Hook technology to monitor encryption API calls in the system, when a process calls an encryption API, the encryption API call information of the process will be recorded, and the call will not be blocked, so it will not be detected by malicious code. Among them, the encryption API call information includes the call order of the encryption API, the name of each encryption API, parameters (such as encryption key, initial vector) and return value, as well as the call timestamp and call stack information, etc. This information will be serialized and stored in the monitoring log for subsequent reverse decryption and analysis.

[0058] Since not all data packets are encrypted using the encryption API, they may be encrypted using a custom encryption algorithm. If all are reverse decrypted, it will increase time costs and waste resources. Therefore, before reverse decryption, the data packets can be screened first.

[0059] Specifically, before reverse decrypting the data packets sent by the malicious code based on the encrypted API call information, it also includes:

[0060] Match the contents of the data packet with the return value in the encrypted API call information of the malicious code;

[0061] If there is a match, the encrypted data packet is saved for reverse decryption;

[0062] If they do not match, then check whether the data packet is a custom encrypted data packet; if it is a custom encrypted data packet, first decrypt the data packet and then analyze the data packet; if the detected data packet is not encrypted, directly analyze the data packet.

[0063] In this embodiment, the system will match the content in the data packet with the return value in the previously recorded encrypted API call information to determine whether it contains encrypted data. If it matches, the destination address, port number, communication protocol and other information of the data packet will be recorded, and the data packet will be saved for subsequent reverse decryption and analysis. If it does not match, it will detect whether the data packet is encrypted. It can be understood that the behavior data can be directly analyzed without encryption. If it is encrypted, it means that the data packet is a custom encrypted data packet, and the decryption algorithm library can be used to decrypt the data packet and then analyze the behavior data.

[0064] In some implementations, after detecting a custom encrypted data packet, the method further includes:

[0065] Add the calling file of the data packet to the configuration file and record the decryption algorithm of the data packet to optimize the protection rules.

[0066] With the continuous advancement of network technology, secret-stealing Trojans have become one of the main threats in network attacks. This type of Trojan specifically targets users' sensitive information, such as browser cookies, digital wallets, and other files that store key data, and transmits them back to the attacker's control server. When performing behavioral analysis on secret-stealing Trojans, a comprehensive scan of the system is required to determine which sensitive files are included in the intercepted data, which requires CPU and memory. Therefore, the sensitive files to be monitored can be written into the configuration file in advance, and the reading of sensitive files by the secret-stealing Trojan can be directly monitored. The sensitive information stolen by the secret-stealing Trojan can be quickly identified and its behavioral data can be determined.

[0067] In some embodiments, the configuration file also contains sensitive files to be monitored;

[0068] When the malicious code is a secret-stealing Trojan, the malicious code runs normally and the behavior data of the malicious code is monitored and recorded in real time, including:

[0069] Based on the configuration file, the reading of sensitive files by the secret stealing Trojan is monitored in real time, and the encryption API call information of the secret stealing Trojan is recorded; wherein the encryption API call information at least includes the calling sequence of the encryption API, the name, parameter and return value of each encryption API;

[0070] Based on the encrypted API call information, the data packets sent by the secret-stealing Trojan horse are reversely decrypted to identify the sensitive information stolen by the secret-stealing Trojan horse based on the reading records of sensitive files by the secret-stealing Trojan horse.

[0071] In this embodiment, based on the recorded encryption API call sequence, the encryption process of the program is reproduced in sequence, and the encrypted data is restored in reverse order using the recorded key and API encryption algorithm. The recorded encryption API call information is used for reverse decryption, so that even when faced with a complex encryption algorithm, it can be quickly decrypted. After the decryption is successful, the original data is checked and the sensitive information it contains is analyzed, such as user credentials, browser cookies, etc.

[0072] In some implementations, after identifying sensitive information stolen by a stealing Trojan horse, the method further includes:

[0073] Generate an analysis report based on the malicious behavior of the stealing Trojan, the processes and sensitive files involved, and the decryption process information;

[0074] Assign a risk score to the secret-stealing Trojan based on the amount of sensitive information stolen by the secret-stealing Trojan, the category of sensitive files, and the sensitivity of sensitive files;

[0075] Based on the level of risk score, a response recommendation is provided.

[0076] In this embodiment, the analysis report will include a description of the malicious behavior, the processes and files involved, detailed information about the decryption process, etc. At the same time, the system will also generate a risk score and provide reasonable response suggestions based on the risk score.

[0077] Specifically, when the risk score level is high, it can be recommended to cut off all network connections and all communications; when the risk score level is medium, it can be recommended to prohibit the program from accessing the network, prevent it from further accessing sensitive files, or freeze its process for further analysis; when the risk score level is low, it can be recommended to enhance access control of specific files to avoid core data leakage.

[0078] In some embodiments, the risk score is calculated by the following formula:

[0079]

[0080] In the formula, is the risk factor of the amount of sensitive information, The number of sensitive file categories stolen. For the stolen The sensitivity of sensitive files. For the stolen The amount of sensitive information in each sensitive file.

[0081] In this embodiment, sensitive files in the system include system data (such as keyboard logs, screenshots, etc.), browser clients, email clients, etc. Each sensitive file has a preset sensitivity. The higher the sensitivity, the higher the risk score and the greater the threat. Multiple thresholds are set for the number of sensitive information, and different levels of risk are assigned to different risk factors. It can be understood that the more sensitive file categories are stolen, the lower the probability that the program is a normal system program, and the greater the risk. Therefore, through the above calculation formula, the risk score of the stealing Trojan can be obtained more accurately, so as to give more reasonable response suggestions and obtain more comprehensive and accurate behavior analysis results.

[0082] Please refer to Figure 2 The embodiment of the present invention provides a malicious code behavior analysis and detection device, which is used to implement the steps of any method embodiment in the specification, and is set in a sandbox or a virtual machine. The device includes:

[0083] The hook unit 201 is used to hook the call of the malicious code to the target API in real time based on a preset configuration file; wherein the configuration file contains at least the target API to be hooked for anti-analysis, and the target API includes at least an anti-virtual machine API, a file operation API for anti-analysis, and a network communication API for communicating with a malicious server;

[0084] The interruption unit 202 is used to interrupt the execution of the malicious code when the malicious code calls the target API;

[0085] The running unit 203 is used to obtain a return value or parameter for simulating a normal running environment so as to enable the malicious code to run normally, and to monitor and record the behavior data of the malicious code in real time.

[0086] In one embodiment of the present invention, the return value or parameter in the operation unit 203 is obtained by manual input and pre-configuration.

[0087] In one embodiment of the present invention, the return value or parameter in the operation unit 203 is manually input in the following manner:

[0088] Parse various data structures passed by malicious code to the target API;

[0089] An interactive window pops up for the analyst and displays the target API call information;

[0090] In response to the analyst inputting a return value or parameter in the interactive window to simulate a normal operating environment, the return value or parameter is sent to the malicious code.

[0091] In one embodiment of the present invention, when executing to obtain the return value and parameters for simulating the normal operating environment, the operation unit 203 is used to:

[0092] When the malicious code calls the anti-virtual machine API, a return value indicating that the virtual machine does not exist is returned;

[0093] When the malicious code calls the file operation API, it modifies the file path and file attributes to simulate the existence of the file;

[0094] When the malicious code calls the network communication API, it simulates the malicious server to communicate.

[0095] In one embodiment of the present invention, the configuration file in the Hook unit 201 also contains the encryption API to be Hooked;

[0096] When the running unit 203 executes the normal operation of the malicious code and monitors and records the behavior data of the malicious code in real time, it is used to:

[0097] Based on the configuration file, the malicious code's call to the encryption API is hooked in real time, and the encryption API call information of the malicious code is recorded; wherein the encryption API call information at least includes the calling sequence of the encryption API, the name, parameters and return value of each encryption API;

[0098] Based on the encrypted API call information, the data packets sent by the malicious code are reversely decrypted to determine the behavior data of the malicious code.

[0099] In one embodiment of the present invention, the configuration file in the Hook unit 201 also contains sensitive files to be monitored;

[0100] When the malicious code is a secret stealing Trojan horse, the operation unit 203 is used to execute the malicious code normally and monitor and record the behavior data of the malicious code in real time, and also to:

[0101] Based on the configuration file, the reading of sensitive files by the secret stealing Trojan is monitored in real time, and the encryption API call information of the secret stealing Trojan is recorded; wherein the encryption API call information at least includes the calling sequence of the encryption API, the name, parameter and return value of each encryption API;

[0102] Based on the encrypted API call information, the data packets sent by the secret-stealing Trojan horse are reversely decrypted to identify the sensitive information stolen by the secret-stealing Trojan horse based on the reading records of sensitive files by the secret-stealing Trojan horse.

[0103] It should be noted that the analysis and detection device for malicious code behavior provided in the above embodiment is only illustrated by the division of the above functional units. In actual applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device is divided into different functional units to complete all or part of the functions described above. In addition, the above device embodiment and the method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0104] The embodiment of the present application also provides a computer device, please refer to Figure 3 The computer device includes a processor and a memory, in which at least one instruction, at least one program, code set or instruction set is stored, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the malicious code behavior analysis and detection method provided by the above-mentioned method embodiments.

[0105] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the malicious code behavior analysis and detection method provided by the above-mentioned method embodiments.

[0106] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes any of the malicious code behavior analysis and detection methods in the above embodiments.

[0107] For the convenience of description, the above system or device is described by dividing it into various modules or units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0108] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment of the present application or some parts of the embodiments.

[0109] Finally, it should be noted that, in this article, relational terms such as first, second, third and fourth are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0110] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for analyzing and detecting malicious code behavior, characterized in that: Applied to a sandbox or a virtual machine, the method comprises: Based on a preset configuration file, the malicious code's call to the target API is hooked in real time; wherein the configuration file contains at least the target API to be hooked for anti-analysis, and the target API includes at least an anti-virtual machine API, a file operation API for anti-analysis, and a network communication API for communicating with a malicious server; When the malicious code calls the target API, interrupting the execution of the malicious code; Obtaining a return value or parameter for simulating a normal operating environment so that the malicious code can run normally, and monitoring and recording the behavior data of the malicious code in real time; The obtaining of the return value and parameters for simulating the normal operating environment includes: When the malicious code calls the anti-virtual machine API, a return value indicating that the virtual machine does not exist is returned; When the malicious code calls the file operation API, the file path and file attributes are modified to simulate the existence of the file; When the malicious code calls the network communication API, it simulates a malicious server to communicate; The configuration file also contains the encryption API to be hooked; The malicious code runs normally, and the behavior data of the malicious code is monitored and recorded in real time, including: Based on the configuration file, hook the malicious code's call to the encryption API in real time, and record the encryption API call information of the malicious code; wherein the encryption API call information at least includes the calling sequence of the encryption API, the name, parameter and return value of each encryption API; Based on the encrypted API call information, the data packets sent externally by the malicious code are reversely decrypted to determine the behavior data of the malicious code.

2. The method according to claim 1, characterized in that The return value or parameter is obtained by manual input and pre-configuration.

3. The method according to claim 1, characterized in that The return value or parameter is manually input in the following way: Parsing various data structures passed by the malicious code to the target API; An interactive window pops up for the analyst and displays the call information of the target API; In response to the analyst inputting a return value or parameter in the interactive window to simulate a normal operating environment, the return value or the parameter is sent to the malicious code.

4. The method according to claim 1, characterized in that The configuration file also contains sensitive files to be monitored; When the malicious code is a secret-stealing Trojan horse, the malicious code runs normally, and the behavior data of the malicious code is monitored and recorded in real time, further comprising: Based on the configuration file, the reading of sensitive files by the secret-stealing Trojan is monitored in real time, and the encryption API call information of the secret-stealing Trojan is recorded; wherein the encryption API call information at least includes the calling sequence of the encryption API, the name, parameter and return value of each encryption API; Based on the encrypted API call information, the data packets sent out by the secret-stealing Trojan horse are reversely decrypted, so as to identify the sensitive information stolen by the secret-stealing Trojan horse based on the reading records of the sensitive files by the secret-stealing Trojan horse.

5. A malicious code behavior analysis and detection device, used to implement the steps of any of the methods described in claims 1-4 above, characterized in that: Set in a sandbox or a virtual machine, the device includes: A hook unit, used for hooking the call of the malicious code to the target API in real time based on a preset configuration file; wherein the configuration file contains at least the target API to be hooked for anti-analysis, and the target API includes at least an anti-virtual machine API, a file operation API for anti-analysis, and a network communication API for communicating with a malicious server; An interruption unit, used for interrupting the execution of the malicious code when the malicious code calls the target API; The running unit is used to obtain a return value or parameter for simulating a normal operating environment so that the malicious code can run normally, and to monitor and record the behavior data of the malicious code in real time.

6. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of any one of the methods described in claims 1-4.

7. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 4 are implemented.

8. A computer program product, characterized in that The method comprises a computer program, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images