Distributed malicious sample simulation analysis method, device, electronic device and storage medium

Abstract

The distributed malicious sample simulation analysis method, device, electronic device and storage medium disclosed in the embodiment of the present invention relate to the field of network security technology. It includes: according to the file header information of the received malicious sample, the matching score of each malicious sample and the virtual machine environment composed of different virtual machine operating systems and hardware architectures is calculated based on a weighted scoring algorithm; according to the matching score, the virtual machine environment with the best matching degree with the malicious sample is judged; according to the judgment result, the malicious sample is placed in the virtual machine environment with the best matching degree; the operation behavior of the malicious sample on the system during operation is recorded in real time by the behavior monitoring component, and the network traffic of the malicious sample during operation is recorded in real time by the traffic monitoring component; the malicious sample is analyzed according to the operation behavior and network traffic of the malicious sample recorded in real time, so as to fully understand and collect the information of the malicious sample to improve the efficiency of sample analysis. It is suitable for threat intelligence collection scenarios.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a distributed malicious sample simulation analysis method, device, electronic device and storage medium. Background Art

[0002] As a relatively safe dynamic analysis environment, sandbox technology can automatically analyze unknown samples and record the various behaviors of samples in the sandbox environment, so as to determine the true intention of the samples. At the same time, the operation of malicious samples in the sandbox will not cause any modification to the real environment, which is an ideal analysis environment. However, the single operation logic of the sandbox can no longer meet the demand for the production of threat intelligence data for a large number of samples. Summary of the invention

[0003] In view of this, an embodiment of the present invention provides a distributed malicious sample simulation analysis method, device, electronic device and storage medium, which are convenient for comprehensively understanding and collecting information of malicious samples to improve sample analysis efficiency.

[0004] In order to achieve the above-mentioned invention object, the following technical scheme is adopted:

[0005] In a first aspect, the embodiment of the present invention provides a distributed malicious sample simulation analysis method.

[0006] Applied to at least one server, multiple virtual machine environments are created on the server, wherein at least one virtual machine runs in each virtual machine environment, at least one operating system runs on each virtual machine, and is configured to simulate a corresponding malicious sample running environment, each virtual machine environment is equipped with a behavior monitoring component and a traffic monitoring component, the behavior monitoring component is configured to record in real time the operation behavior of the malicious sample on the system during operation, and the traffic monitoring component is configured to record in real time the network traffic of the malicious sample during operation;

[0007] The method comprises: calculating the matching score of each malicious sample with a virtual machine environment composed of different virtual machine operating systems and hardware architectures based on a weighted scoring algorithm according to the file header information of the received malicious sample;

[0008] According to the matching score, determining the virtual machine environment that best matches the malicious sample;

[0009] According to the judgment result, the malicious sample is placed in the virtual machine environment with the best matching degree;

[0010] Using the behavior monitoring component to record in real time the operation behavior of the malicious sample on the system during operation, and using the traffic monitoring component to record in real time the network traffic of the malicious sample during operation;

[0011] The malicious samples are analyzed based on the operational behaviors and network traffic of the malicious samples recorded in real time.

[0012] Optionally, the step of calculating the matching score of each malicious sample with a virtual machine environment composed of different virtual machine operating systems and hardware architectures based on a weighted scoring algorithm according to the file header information of the received malicious sample includes:

[0013] Extracting file header information of the malicious sample, wherein the file header information includes: an operating system dependent field and a hardware architecture dependent field;

[0014] Preliminarily determine the virtual machine environment that supports the operation of the malicious sample based on the operating system dependency field and the hardware architecture dependency field;

[0015] Determining whether there are multiple virtual machine environments;

[0016] If yes, then the matching scores of the malicious samples in the multiple virtual machine environments are calculated based on a weighted scoring algorithm according to the multiple dimensional features; wherein the matching degree of each dimensional feature with each operating system and hardware architecture, as well as the matching weight value of each dimension are predefined; the weighted scoring algorithm is:

[0017] , W is the final matching score, w i is the weight of the i-th dimension involved in the rating calculation, x i is the matching degree of the i-th dimension involved in the scoring calculation, where i is a positive integer, and n is the number of dimensions involved in the scoring calculation. The matching score is used to quantitatively characterize the virtual machine environment consisting of the operating system and hardware architecture that the malicious sample is suitable for running.

[0018] Optionally, after determining whether there are multiple virtual machine environments, the method further includes: placing the malicious sample into the multiple virtual machine environments; wherein the operating system versions or hardware architecture versions of the multiple virtual machine environments are different;

[0019] Using the behavior monitoring component to record in real time the operation behavior of the malicious sample on the system when it is running in the multiple virtual machine environments, and using the traffic monitoring component to record in real time the network traffic of the malicious sample when it is running in the multiple virtual machine environments;

[0020] Based on the real-time recorded operation behaviors and network traffic of malicious samples, the running behavior performance of the malicious samples in the virtual machine environment composed of different operating system versions or hardware architecture versions is analyzed.

[0021] Optionally, the operation behavior includes: behavior of an operating system registry, a file system, a process table, and a memory data structure;

[0022] The use of the behavior monitoring component to record in real time the operation behavior of the malicious sample on the system during operation includes: the monitoring component is specifically configured to install a system call hook at the operating system kernel level to intercept system call requests;

[0023] Injecting interception code into system call entry points to monitor and record the execution of system calls related to the operating system registry, file system, process table, and memory data structures;

[0024] When the malicious sample runs and initiates a system call request, the system call request is intercepted by the hook function;

[0025] Record relevant information of the system call request initiated by the malicious sample, including the called function name, parameters and calling time; wherein the parameters carry the operation behavior to be performed by the malicious sample.

[0026] Optionally, the behavior monitoring component is further configured to generate a behavior sequence according to the operation behavior of the malicious sample at runtime after recording the operation behavior of the malicious sample in real time; wherein the behavior sequence represents a sequential record of a series of operations or events performed by each malicious sample in the system;

[0027] Classify according to the behavior sequence and generate a multi-dimensional analysis report of each malicious sample behavior pattern.

[0028] Optionally, the behavior monitoring component is further configured to record the operation frequency of each operation behavior of the malicious sample after recording the operation behavior of the malicious sample on the system in real time during operation;

[0029] The abnormal behavior degree of the malicious sample within a predetermined time window is monitored according to the abnormal behavior detection algorithm; wherein the abnormal behavior detection algorithm is:

[0030] ; Where A represents the abnormality score of the malicious sample within the predetermined time window, N represents the total number of operation behavior categories monitored within the predetermined time window, is the operation frequency of the ith operation behavior, is the mean value of the operation frequency of the ith operation behavior under normal circumstances, is the standard deviation of the operation frequency of the ith operation behavior;

[0031] When the abnormality of the behavior exceeds a preset threshold, an alarm message is generated and the malicious sample is further analyzed.

[0032] Optionally, the traffic monitoring component is specifically configured to analyze the network traffic of the malicious sample in real time based on the embedded deep packet inspection technology when the malicious sample is running, extract and save the network connection information of the malicious sample, and the network connection information includes: source IP, destination IP, port number, protocol type, total traffic and burst traffic;

[0033] Calculate whether the total traffic and burst traffic of the malicious sample exceed the preset threshold. If so, associate the network traffic with the corresponding behavior sequence to analyze the potential threat behavior of the malicious sample.

[0034] In a second aspect, the present invention also provides a distributed malicious sample simulation analysis device, including a matching calculation module, which is used to calculate the matching score of each malicious sample with a virtual machine environment composed of different virtual machine operating systems and hardware architectures based on a weighted scoring algorithm according to the file header information of the received malicious sample; a first judgment module, which is used to judge the virtual machine environment with the best matching degree with the malicious sample according to the matching score; a sample delivery module, which is used to deliver the malicious sample to the virtual machine environment with the best matching degree according to the judgment result; a data monitoring and recording module, which is used to use a behavior monitoring component to record in real time the operation behavior of the malicious sample on the system during operation, and to use a traffic monitoring component to record in real time the network traffic of the malicious sample during operation; a sample analysis module, which is used to analyze the malicious sample according to the operation behavior and network traffic of the malicious sample recorded in real time.

[0035] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: one or more processors; a memory; one or more executable programs are stored in the memory, and the one or more processors read the executable program code stored in the memory and run the program corresponding to the executable program code to execute the steps of the distributed malicious sample simulation analysis method described in any one of the first aspects.

[0036] In a fourth aspect, an embodiment of the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to execute the steps of the distributed malicious sample simulation analysis method described in any one of the first aspects.

[0037] The distributed malicious sample simulation analysis method, device, electronic device and storage medium provided by the embodiment of the present invention create a virtual machine environment on the server to simulate the malicious sample running environment, and are equipped with a behavior monitoring component and a traffic monitoring component in the virtual machine environment to record the behavior log and traffic data generated by the malicious sample when it is running in real time, and then put the malicious sample into the virtual machine environment. The malicious sample is put into the created virtual machine environment for breeding, and the behavior monitoring component and traffic monitoring component equipped in the virtual machine environment are used to monitor and collect the behavior log and traffic data generated by the malicious sample when it is running in the virtual machine environment in real time, so as to facilitate the subsequent analysis of the malicious sample. Among them, when the malicious sample is put into the virtual machine environment, a distributed architecture is adopted, and the matching score of each malicious sample and the virtual machine environment composed of different virtual machine operating systems and hardware architectures is calculated based on the weighted scoring algorithm according to the file header information of the malicious sample, and the virtual machine environment with the best matching degree with the malicious sample is obtained, and the malicious sample is put into it. In this way, each sample runs in the virtual machine environment with the best matching degree, so as to facilitate the comprehensive understanding and collection of information of the malicious sample to improve the efficiency of sample analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 This is a schematic block diagram of the architecture of a distributed malicious sample simulation analysis system according to an embodiment of the present invention;

[0040] Figure 2 This is a flow chart of a distributed malicious sample simulation analysis method according to an embodiment of the present invention;

[0041] Figure 3 This is a flow chart of step S110 of a distributed malicious sample simulation analysis method according to an embodiment of the present invention;

[0042] Figure 4 This is a flow chart of step S140 of the distributed malicious sample simulation analysis method according to an embodiment of the present invention;

[0043] Figure 5 A schematic diagram of a virtual machine environment creation process in a distributed malicious sample simulation analysis according to an embodiment of the present invention;

[0044] Figure 6 This is a schematic diagram of the structure of a distributed malicious sample simulation analysis device according to an embodiment of the present invention;

[0045] Figure 7 The present invention is a schematic block diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0047] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] In related technologies, Qemu is a virtualization technology that can virtualize multiple virtual machines (simulation environments) on a hardware server. This is the basic condition for the operation of malicious samples, and malicious samples run on these virtual machines (simulation environments).

[0049] This embodiment uses distributed concurrent multi-system operation analysis. After the malicious samples are put into use, they are automatically allocated according to the algorithm and allocated to the best virtual machine environment for breeding. The traffic data and behavior logs generated by each malicious sample during operation are monitored and collected in real time. The distributed simulation environment supports running as many samples as possible at the same time, thereby improving efficiency.

[0050] See also Figure 1 As shown, an embodiment of the present invention provides a distributed malicious sample simulation analysis system, including:

[0051] At least one server, wherein a plurality of virtual machine environments are created on the server, wherein at least one virtual machine is run in each virtual machine environment, and at least one operating system is run on each virtual machine, and the environment is configured to simulate a corresponding malicious sample running environment, and each virtual machine environment is equipped with a behavior monitoring component and a traffic monitoring component, wherein the behavior monitoring component is configured to record in real time the operation behavior of the malicious sample on the system during operation, and the traffic monitoring component is configured to record in real time the network traffic of the malicious sample during operation.

[0052] In this embodiment, see Figure 5As shown, when creating a virtual machine, firstly, with the help of Qemu virtualization technology, a simulated virtual machine environment consisting of multiple virtual machine operating systems and hardware architectures is created on the server. At least one virtual machine runs in each virtual machine environment, and at least one operating system runs on each virtual machine, such as a windows operating system or a linux operating system. The creation of the virtual machine environment has a distribution mechanism. First, the API platform receives a user's request to create a virtual machine. According to the system resource usage reported by the node, the operating system selects an idle node in a healthy server according to the idleness of resources to create a virtual machine. In addition, a behavior monitoring component and a traffic monitoring component are configured in each virtual machine environment to monitor the operation behavior of the sample in each virtual machine environment and to record the network traffic information of the malicious sample in real time during operation.

[0053] This embodiment uses the above-mentioned distributed malicious sample simulation and analysis system and a distributed architecture to place malicious samples into at least one created virtual machine environment for breeding. The behavior monitoring components and traffic monitoring components provided in the virtual machine environment are used to monitor and collect in real time the behavior logs and traffic data generated by the malicious samples when they are running in the virtual machine environment, so as to facilitate subsequent analysis of the malicious samples.

[0054] For details, see Figure 2 As shown, when conducting a simulation analysis of malicious sample distribution, the following steps are included:

[0055] S110. Calculate, based on the received file header information of the malicious sample and a weighted scoring algorithm, a matching score between each malicious sample and a virtual machine environment composed of different virtual machine operating systems and hardware architectures.

[0056] In this step, when using the distributed malicious sample simulation analysis system provided by the present embodiment to perform malicious sample simulation analysis, each malicious sample must first be placed in a different virtual machine environment, and each virtual machine environment is isolated from each other. When selecting a virtual machine environment for each malicious sample to be placed, the present embodiment can calculate the matching score between each malicious sample and each virtual machine environment based on the file header information of the received malicious sample and the user scenario or requirement based on a weighted scoring algorithm, and place each malicious sample in a suitable virtual machine environment.

[0057] Optionally, in some embodiments, see Figure 3 As shown, step S110, the matching score between each malicious sample and a virtual machine environment composed of different virtual machine operating systems and hardware architectures is calculated based on a weighted scoring algorithm according to the file header information of the received malicious sample, including:

[0058] S111, extracting file header information of the malicious sample, wherein the file header information includes: an operating system dependent field and a hardware architecture dependent field;

[0059] S113, preliminarily determining a virtual machine environment that supports the running of the malicious sample based on the operating system dependency field and the hardware architecture dependency field;

[0060] S115, determining whether there are multiple virtual machine environments;

[0061] S117: If yes, then calculate the matching scores of the malicious samples in the multiple virtual machine environments based on a weighted scoring algorithm according to the multiple dimensional features.

[0062] In this embodiment, when delivering malicious samples, the malicious samples can be delivered to a specified virtual machine environment, such as Windows or Linux, according to user scenarios or requirements. If there is no specified virtual machine environment, this embodiment can also calculate the matching score of each malicious sample with a virtual machine environment composed of different virtual machine operating systems and hardware architectures according to a weighted scoring algorithm, and select a virtual machine environment according to the matching score.

[0063] Specifically, after the malicious samples are released, the file header information of each malicious sample is extracted, wherein the file header information includes an operating system dependency field and a hardware architecture dependency field. The operating system dependency field and the hardware architecture dependency field are used to preliminarily determine the virtual machine environment that supports the operation of the malicious samples.

[0064] Specifically, the file header information of the malicious sample includes the file type of the malicious sample, such as text files, source files, executable files, pictures, videos, installation files, source files, scripts, project files, auxiliary files, etc. and the information of the hardware architecture. Combined with the suffix of the file name (such as .sh, .bash, .exe, .dll, etc.), by reading the binary data of the malicious sample file, the identifier and flag bit of the file header can be checked to determine the hardware architecture targeted by the malicious sample file, so as to preliminarily determine the virtual machine environment that supports the operation of the malicious sample. Further determine whether there are multiple corresponding virtual machine environments that support the operation of the same malicious sample. If so, calculate the matching scores of the malicious sample in multiple virtual machine environments based on the weighted scoring algorithm according to the multiple dimensional features of the malicious sample.

[0065] The matching degree of each dimension feature with each operating system and hardware architecture, as well as the matching weight value of each dimension, are predefined; a weighted scoring algorithm is used to calculate the matching scores with malicious samples in multiple virtual machine environments.

[0066] Specifically, the weighted scoring algorithm is: ;

[0067] W is the final matching score, w i is the weight of the i-th dimension involved in the rating calculation, x i is the matching degree of the i-th dimension involved in the scoring calculation, where i is a positive integer, and n is the number of dimensions involved in the scoring calculation. The matching score is used to quantitatively characterize the virtual machine environment consisting of the operating system and hardware architecture that the malicious sample is suitable for running.

[0068] S120: Determine, according to the matching score, a virtual machine environment that best matches the malicious sample.

[0069] S130. According to the judgment result, the malicious sample is placed in the virtual machine environment with the best matching degree.

[0070] Specifically, according to the obtained judgment results, the malicious samples are placed in the virtual machine environment with the best match. Among them, the same sample can be placed in different versions of the same system or in different systems. In this way, the differences between malicious samples on different versions of the system can be fully understood, and the malicious samples can be analyzed more comprehensively.

[0071] S140, using the behavior monitoring component to record in real time the operation behavior of the malicious sample on the system during operation, and using the traffic monitoring component to record in real time the network traffic of the malicious sample during operation.

[0072] In this step, when each malicious sample is running in the virtual machine, the behavior monitoring component is used to record in real time the operation behavior of each malicious sample on the system during runtime, and the traffic monitoring component is used to record in real time the network traffic of each malicious sample during runtime, and collect and output the behavior log and traffic data of the malicious samples.

[0073] Specifically, taking Windows and Linux as examples, for behavior monitoring components, Sysmon and Falco are used. Sysmon and Falco are behavior monitoring components on Windows and Linux platforms respectively, which can collect system calls from the system kernel when running. Any traces left by programs running on the system (including malicious samples) will be recorded by the component in the form of log files. These logs will be sent to the syslog server of the server, so as to achieve log induction and statistics on the server.

[0074] For the traffic monitoring component, Arkime is used. Arkime can collect the traffic of the specified network card. It stores and indexes the network traffic in the standard PCAP format, provides fast index access, and provides an intuitive and simple web interface for PCAP browsing, searching and exporting. This component runs in a virtual machine environment, monitors the network card traffic corresponding to the virtual machine and saves it as a pcap file.

[0075] S150: Analyze the malicious sample according to the operation behavior and network traffic of the malicious sample recorded in real time.

[0076] In this embodiment, when the malicious sample is running, the behavior monitoring component and the traffic monitoring component collect the malicious sample running data in real time, and the data collected on each node will be synchronized to a dedicated file server, and then the analysis results will be split. The complete analysis results of the sample file in each breeding environment (virtual machine environment) such as behavior logs, traffic logs, and data packet pcap are output to facilitate subsequent security personnel to analyze the malicious sample.

[0077] Specifically, after the malicious sample is executed, the behavior log and network traffic of the malicious sample's operations recorded in real time during its operation are exported, analyzed, and then a threat report of the malicious sample is generated.

[0078] Specifically, the behavior logs output by the behavior monitoring components Sysmon and falco contain the file names of the executable programs (including malicious samples). For example, if the file name of the malicious sample is hacker.exe, then each behavior log generated by the malicious sample will contain {"filename":"hacker.exe"}. When the operation behavior of the malicious sample belongs to the category of network behavior, the log record will also contain the two fields "src_ip" and "dst_ip", which represent the source IP and destination IP addresses of the network behavior, respectively. That is, a network behavior log will contain the three key fields "filename", "src_ip" and "dst_ip". The traffic monitoring component Arkime is used to monitor network traffic data, and its output monitoring information also contains the two fields "src_ip" and "dst_ip". Therefore, for the traffic monitoring component, these two fields can be used for correlation analysis to summarize and output a pcap file, in which all the traffic contained in the pcap file is generated by the corresponding filename when it is running. Therefore, when multiple malicious samples are running at the same time, the traffic data of each malicious sample can be split and summarized for analysis by security analysts.

[0079] The distributed malicious sample simulation analysis method provided in this embodiment creates different virtual machine environments, calculates the matching scores of each received malicious sample and the created different virtual machine environments based on the weighted scoring algorithm, obtains the virtual machine environment with the best matching degree with the malicious sample according to each matching degree score, and puts the malicious sample into the best virtual machine environment, uses the behavior monitoring component and traffic monitoring component configured in the virtual machine environment to record the operation behavior of the malicious sample at runtime and the network traffic of the malicious sample at runtime in real time, and analyzes the malicious sample according to the recorded operation behavior and network traffic, thereby improving the efficiency of sample analysis. In this way, each sample runs in its own best matching virtual machine environment, so that the malicious sample can be fully understood and analyzed.

[0080] Furthermore, this embodiment can flexibly expand the number of simulation environments according to user scenarios and needs, thereby increasing the number of malicious samples running at the same time while fully utilizing existing hardware resources, taking into account concurrency and stability. After the malicious samples are input, they are quickly allocated according to the algorithm to collect and analyze the operation data; and when monitoring the operation of malicious samples, it is accurate to the sample dimension, which improves efficiency while avoiding confusion of data between different samples, and filters and exports the behavior logs and traffic data corresponding to the samples for analysis.

[0081] Optionally, in some embodiments, after determining whether there are multiple virtual machine environments, step S115 further includes: placing the malicious sample into multiple virtual machine environments; wherein the operating system versions or hardware architecture versions of the multiple virtual machine environments are different;

[0082] Using the behavior monitoring component to record in real time the operation behavior of the malicious sample on the system when it is running in the multiple virtual machine environments, and using the traffic monitoring component to record in real time the network traffic of the malicious sample when it is running in the multiple virtual machine environments;

[0083] Based on the real-time recorded operation behaviors and network traffic of malicious samples, the running behavior performance of the malicious samples in the virtual machine environment composed of different operating system versions or hardware architecture versions is analyzed.

[0084] In this embodiment, for the same sample, after preliminarily determining the virtual machine environment that supports its operation based on the file header information, it can be launched into different versions of the same operating system or different versions of the same hardware architecture. For example, a malicious sample running on a Windows system can be launched into Windows 7, Windows XP, Windows 10 and other system versions for operation. The operation behavior and network traffic of the malicious sample are recorded in real time by the behavior monitoring component and traffic monitoring component deployed in each virtual machine environment. The operation behavior and network traffic of the recorded malicious sample are analyzed in the virtual machine environment composed of different operating system versions or hardware architecture versions, so as to fully understand and analyze the differences between malicious samples on different versions of the system.

[0085] Optionally, in some embodiments, see Figure 4 As shown, in step S140;

[0086] Step S140, using the behavior monitoring component to record in real time the operation behavior of the malicious sample on the system during operation includes:

[0087] S141, the monitoring component is specifically configured to install a system call hook at the operating system kernel level to intercept system call requests;

[0088] S143, injecting the interception code into the system call entry point to monitor and record the execution of the system calls related to the operating system registry, file system, process table and memory data structure;

[0089] S145. When the malicious sample runs and initiates a system call request, the system call request is intercepted by the hook function;

[0090] S147. Record relevant information of the system call request initiated by the malicious sample, including the called function name, parameters, and calling time; wherein the parameters carry the operation behavior to be performed by the malicious sample.

[0091] In this embodiment, the operational behavior of the malicious sample includes: the behavior of the operating system registry, file system, process table and memory data structure. When the operational behavior of the malicious sample is monitored by using the behavior monitoring component, the system call hook installed at the operating system kernel level is used to intercept the system call request, and the interception code is injected into the system call entry point to monitor and record the execution of the system calls related to the operating system registry, file system, process table and memory data structure. When the malicious sample runs and initiates a system call request, the system call request is intercepted by the hook function, and the relevant information of the system call request initiated by the malicious sample is recorded, including the called function name, parameters and call time.

[0092] Optionally, in some embodiments, the behavior monitoring component is further configured to generate a behavior sequence according to the operation behavior of the malicious sample on the system during runtime after recording in real time the operation behavior of the malicious sample;

[0093] Classify according to the behavior sequence and generate a multi-dimensional analysis report of each malicious sample behavior pattern.

[0094] Specifically, after the behavior monitoring component records the malicious sample's operational behavior on the system in real time during runtime, it generates a behavior sequence based on the malicious sample's operational behavior, where the behavior sequence represents a sequential record of a series of operations or events performed by each malicious sample in the system; the generated behavior series are classified to generate a multi-dimensional analysis report on the behavior pattern of each malicious sample.

[0095] Optionally, in some embodiments, the behavior monitoring component is further configured to record the operation frequency of each operation behavior of the malicious sample after recording the operation behavior of the malicious sample on the system during runtime in real time;

[0096] Monitoring the degree of behavioral abnormality of the malicious sample within a predetermined time window according to a behavioral abnormality detection algorithm;

[0097] Wherein, the behavior anomaly detection algorithm is: ; Where A represents the abnormality score of the malicious sample within the predetermined time window, N represents the total number of operation behavior categories monitored within the predetermined time window, is the operation frequency of the ith operation behavior, is the mean value of the operation frequency of the ith operation behavior under normal circumstances, is the standard deviation of the operation frequency of the ith operation behavior;

[0098] When the abnormality of the behavior exceeds a preset threshold, an alarm message is generated and the malicious sample is further analyzed.

[0099] In this embodiment, the operation behavior of the malicious sample is monitored in real time according to the behavior monitoring component, and a series of key features are extracted therefrom, such as system call frequency, number of file read and write operations, number of network connections, etc.

[0100] Specifically, when using the behavior monitoring component to record the operation behavior of malicious samples, it is necessary not only to record the operation behavior of the malicious samples, but also to record the operation frequency of each operation behavior of the malicious samples. The behavior anomaly detection algorithm is used to monitor the behavior anomaly of the malicious samples within a predetermined time window. When it is detected that the behavior anomaly of the malicious samples exceeds a preset threshold, an alarm message is automatically generated, and the motivation of the malicious samples to perform malicious behaviors is further analyzed based on the operation frequency of the malicious samples.

[0101] This embodiment uses virtual machine technology to isolate the execution environment of malware / samples to avoid damage to the real system. Through the behavior monitoring component, system calls, file operations, network communications and other behaviors in the virtual machine are monitored in real time, and the behavior characteristics of the malware can be obtained in time to generate the behavior log of the malicious sample in the breeding environment (virtual machine environment). In terms of feature extraction, a series of key features are extracted from the dynamic behavior of the malicious sample, such as system call frequency, number of file read and write operations, number of network connections, etc. These features can characterize the behavior pattern of the malware, so as to perform subsequent classification and detection.

[0102] Optionally, in some embodiments, the traffic monitoring component is specifically configured to analyze the network traffic of the malicious sample in real time based on the embedded deep packet inspection technology when the malicious sample is running, extract and save the network connection information of the malicious sample, and the network connection information includes: source IP, destination IP, port number, protocol type, total traffic and burst traffic;

[0103] Calculate whether the total traffic and burst traffic of the malicious sample exceed the preset threshold. If so, associate the network traffic with the corresponding behavior sequence to analyze the potential threat behavior of the malicious sample.

[0104] In this embodiment, the network traffic data generated by the malicious sample during its operation is collected and features are extracted through the traffic monitoring component, the network traffic is captured and feature information such as source IP, target IP, protocol, etc. is extracted to provide a data basis for subsequent malware behavior analysis. Furthermore, by calculating whether the total traffic and burst traffic of the malicious sample exceed the preset threshold, the network traffic is associated with the corresponding behavior sequence to analyze the potential threat behavior of the malicious sample.

[0105] Specifically, when using the traffic monitoring component to record and analyze the network traffic of malicious samples in real time during runtime, you can call functions to collect data and extract features: capture network traffic data packets and save the captured data packets as pcap files; read the saved pcap files, extract source IP, target IP, protocol and other features, and provide a data basis for subsequent malware behavior analysis.

[0106] The distributed malicious sample simulation analysis method provided in this embodiment creates a virtual machine environment on the server to simulate the malicious sample running environment, and is equipped with a behavior monitoring component and a traffic monitoring component in the virtual machine environment to record the behavior logs and traffic data generated by the malicious sample when it is running in real time, and then put the malicious sample into the virtual machine environment. The malicious sample is put into the created virtual machine environment for breeding, and the behavior monitoring component and the traffic monitoring component equipped in the virtual machine environment are used to monitor and collect the behavior logs and traffic data generated by the malicious sample when it is running in the virtual machine environment in real time, so as to facilitate the subsequent analysis of the malicious sample. Among them, when the malicious sample is put into the virtual machine environment, a distributed architecture is adopted, and the matching score of each malicious sample and the virtual machine environment composed of different virtual machine operating systems and hardware architectures is calculated based on the weighted scoring algorithm according to the file header information of the malicious sample, and the virtual machine environment with the best matching degree with the malicious sample is obtained, and the malicious sample is put into it. In this way, each sample runs in the virtual machine environment with the best matching degree, so that the malicious sample can be fully understood and analyzed, and the sample analysis efficiency is improved.

[0107] Embodiment 2

[0108] Figure 6 This is a schematic diagram of the structure of a distributed malicious sample simulation analysis device according to an embodiment of the present invention; please refer to Figure 6 As shown, based on the same technical concept as the above embodiments, the present invention also provides a distributed malicious sample simulation analysis device, including:

[0109] A matching degree calculation module 610 is used to calculate the matching degree score of each malicious sample with a virtual machine environment composed of different virtual machine operating systems and hardware architectures based on the file header information of the received malicious sample and based on a weighted scoring algorithm;

[0110] A first judgment module 620, configured to judge the virtual machine environment that best matches the malicious sample according to the matching score;

[0111] The sample delivery module 630 is used to deliver the malicious sample to the virtual machine environment with the best matching degree according to the judgment result;

[0112] The data monitoring and recording module 640 is used to use the behavior monitoring component to record the operation behavior of the malicious sample on the system in real time during operation, and to use the traffic monitoring component to record the network traffic of the malicious sample in real time during operation;

[0113] The sample analysis module 650 is used to analyze the malicious sample according to the operation behavior and network traffic of the malicious sample recorded in real time.

[0114] In addition, it is understandable that Figure 6The device shown is also suitable for executing the step processes in other embodiments of Example 1. For the sake of brevity, please refer to the relevant description in Example 1, and the remaining embodiments will not be repeated here.

[0115] Embodiment 3

[0116] The present invention also provides an electronic device according to an embodiment, comprising: one or more processors; a memory; one or more executable programs are stored in the memory, and the one or more processors read the executable program code stored in the memory and run the program corresponding to the executable program code to execute the steps of the distributed malicious sample simulation analysis method described in any one of the first embodiments.

[0117] Figure 7 FIG. 1 is a schematic diagram of the structure of an embodiment of an electronic device of the present invention, which can implement any method described in Embodiment 1 of the present invention, such as Figure 7 As shown, as an optional embodiment, the above-mentioned electronic device may include: a shell 41, a processor 42, a memory 43, a circuit board 44 and a power supply circuit 45, wherein the circuit board 44 is arranged inside the space enclosed by the shell 41, and the processor 42 and the memory 43 are arranged on the circuit board 44; the power supply circuit 45 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 43 is used to store executable program codes; the processor 42 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 43, and is used to execute the steps of the distributed malicious sample simulation analysis method described in any of the embodiments one.

[0118] The specific execution process of the processor 42 for the above steps and the steps further executed by the processor 42 by running the executable program code can be found in the description of the first embodiment of the distributed malicious sample simulation analysis method of the present invention, which will not be repeated here.

[0119] The electronic device exists in various forms, including but not limited to: (1) Mobile communication devices: These devices are characterized by having mobile communication functions and are mainly aimed at providing voice and data communications. Such terminals include: smart phones, multimedia phones, functional phones, and low-end phones. (2) Ultra-mobile personal computer devices: These devices belong to the category of personal computers, have computing and processing functions, and generally also have mobile Internet access features. Such terminals include: PDA, MID and UMPC devices, such as iPad. (3) Portable entertainment devices: These devices can display and play multimedia content. Such devices include: audio and video playback modules (such as iPod), handheld game consoles, e-books, as well as smart toys and portable car navigation devices. (4) Servers: Devices that provide computing services. The server's composition includes processors, hard disks, memory, system buses, etc. The server is similar to the general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, manageability, etc. (5) Other electronic devices with data interaction functions.

[0120] An embodiment of the present invention also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the steps of the distributed malicious sample simulation analysis method described in any one of the above-mentioned embodiments.

[0121] In summary, according to the description of the above embodiments, the distributed malicious sample simulation analysis method provided by this embodiment creates a virtual machine environment on the server to simulate the malicious sample running environment, and is equipped with a behavior monitoring component and a traffic monitoring component in the virtual machine environment to record the behavior logs and traffic data generated by the malicious sample when it is running in real time, and then put the malicious sample into the virtual machine environment. The malicious sample is put into the created virtual machine environment for breeding, and the behavior monitoring component and the traffic monitoring component equipped in the virtual machine environment are used to monitor and collect the behavior logs and traffic data generated by the malicious sample when it is running in the virtual machine environment in real time, so as to facilitate the subsequent analysis of the malicious sample. Among them, when the malicious sample is put into the virtual machine environment, a distributed architecture is adopted, and the matching score of each malicious sample and the virtual machine environment composed of different virtual machine operating systems and hardware architectures is calculated based on the weighted scoring algorithm according to the file header information of the malicious sample, and the virtual machine environment with the best matching degree with the malicious sample is obtained, and the malicious sample is put into it. In this way, each sample runs in the virtual machine environment with the best matching degree, so that the malicious sample can be fully understood and analyzed, and the sample analysis efficiency is improved.

[0122] In addition, this embodiment uses virtual machine technology to isolate the execution environment of malware / samples to avoid damage to the real system. By monitoring the system calls, file operations, network communications and other behaviors in the virtual machine in real time through the monitoring component, the behavior characteristics of the malware can be obtained in time, so as to generate the behavior log of the malicious sample in the breeding environment (virtual machine environment). In terms of feature extraction, a series of key features are extracted from the dynamic behavior of the malicious sample, such as system call frequency, number of file read and write operations, number of network connections, etc. These features can characterize the behavior pattern of the malware, so as to perform subsequent classification and detection.

[0123] It should be noted that, in this article, if the description involves the relational terms such as first and second, it is only used to distinguish one entity or operation from another entity or operation, and does not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0124] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0125] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can also be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc.

[0126] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A distributed malicious sample simulation analysis method, characterized in that: Applied to at least one server, multiple virtual machine environments are created on the server, wherein at least one virtual machine runs in each virtual machine environment, at least one operating system runs on each virtual machine, and is configured to simulate a corresponding malicious sample running environment, each virtual machine environment is equipped with a behavior monitoring component and a traffic monitoring component, the behavior monitoring component is configured to record in real time the operation behavior of the malicious sample on the system during operation, and the traffic monitoring component is configured to record in real time the network traffic of the malicious sample during operation; The method comprises: calculating the matching score of each malicious sample with a virtual machine environment composed of different virtual machine operating systems and hardware architectures based on a weighted scoring algorithm according to the file header information of the received malicious sample; According to the matching score, determining the virtual machine environment that best matches the malicious sample; According to the judgment result, the malicious sample is placed in the virtual machine environment with the best matching degree; Using the behavior monitoring component to record in real time the operation behavior of the malicious sample on the system during operation, and using the traffic monitoring component to record in real time the network traffic of the malicious sample during operation; Analyze the malicious samples according to the operation behaviors and network traffic of the malicious samples recorded in real time; The method of calculating the matching score of each malicious sample with a virtual machine environment composed of different virtual machine operating systems and hardware architectures based on the file header information of the received malicious sample and a weighted scoring algorithm includes: Extracting file header information of the malicious sample, wherein the file header information includes: an operating system dependent field and a hardware architecture dependent field; Preliminarily determine the virtual machine environment that supports the operation of the malicious sample based on the operating system dependency field and the hardware architecture dependency field; Determining whether there are multiple virtual machine environments; If yes, then the matching scores of the malicious samples in the multiple virtual machine environments are calculated based on a weighted scoring algorithm according to the multiple dimensional features; wherein the matching degree of each dimensional feature with each operating system and hardware architecture, as well as the matching weight value of each dimension are predefined; the weighted scoring algorithm is: , W is the final matching score, w i is the weight of the i-th dimension involved in the rating calculation, x i is the matching degree of the i-th dimension involved in the scoring calculation, where i is a positive integer and n is the number of dimensions involved in the scoring calculation. The matching degree score is used to quantitatively characterize the virtual machine environment consisting of the operating system and hardware architecture that the malicious sample is suitable for running; After determining whether there are multiple virtual machine environments, the method further includes: placing the malicious sample into the multiple virtual machine environments; wherein the operating system versions or hardware architecture versions of the multiple virtual machine environments are different; Using the behavior monitoring component to record in real time the operation behavior of the malicious sample on the system when it is running in the multiple virtual machine environments, and using the traffic monitoring component to record in real time the network traffic of the malicious sample when it is running in the multiple virtual machine environments; Analyze the operation behavior of the malicious samples in virtual machine environments composed of different operating system versions or hardware architecture versions based on the real-time recorded operation behavior and network traffic of the malicious samples; The operation behaviors include: behaviors of the operating system registry, file system, process table and memory data structure; The use of the behavior monitoring component to record in real time the operation behavior of the malicious sample on the system during operation includes: the monitoring component is specifically configured to install a system call hook at the operating system kernel level to intercept system call requests; Injecting interception code into system call entry points to monitor and record the execution of system calls related to the operating system registry, file system, process table, and memory data structures; When the malicious sample runs and initiates a system call request, the system call request is intercepted by a hook function; Record relevant information of the system call request initiated by the malicious sample, including the called function name, parameters and calling time; wherein the parameters carry the operation behavior to be performed by the malicious sample.

2. The distributed malicious sample simulation analysis method according to claim 1 is characterized in that: The behavior monitoring component is further configured to generate a behavior sequence according to the operation behavior of the malicious sample on the system after recording the operation behavior of the malicious sample on the system in real time; wherein the behavior sequence represents a sequential record of a series of operations or events performed by each malicious sample in the system; Classify according to the behavior sequence and generate a multi-dimensional analysis report of each malicious sample behavior pattern.

3. The distributed malicious sample simulation analysis method according to claim 1 is characterized in that: The behavior monitoring component is further configured to record the operation frequency of each operation behavior of the malicious sample after recording the operation behavior of the malicious sample on the system in real time during operation; The abnormal behavior degree of the malicious sample within a predetermined time window is monitored according to the abnormal behavior detection algorithm; wherein the abnormal behavior detection algorithm is: ; Where A represents the abnormality score of the malicious sample within the predetermined time window, N represents the total number of operation behavior categories monitored within the predetermined time window, is the operation frequency of the ith operation behavior, is the mean value of the operation frequency of the ith operation behavior under normal circumstances, is the standard deviation of the operation frequency of the ith operation behavior; When the abnormality of the behavior exceeds a preset threshold, an alarm message is generated and the malicious sample is further analyzed.

4. The distributed malicious sample simulation analysis method according to claim 2 or 3, characterized in that: The traffic monitoring component is specifically configured to analyze the network traffic of the malicious sample in real time based on the embedded deep packet inspection technology when the malicious sample is running, extract and save the network connection information of the malicious sample, and the network connection information includes: source IP, destination IP, port number, protocol type, total traffic and burst traffic; Calculate whether the total traffic and burst traffic of the malicious sample exceed the preset threshold. If so, associate the network traffic with the corresponding behavior sequence to analyze the potential threat behavior of the malicious sample.

5. A distributed malicious sample simulation analysis device, characterized in that: The distributed malicious sample simulation analysis method according to any one of claims 1 to 4 comprises: A matching degree calculation module is used to calculate the matching degree score of each malicious sample with a virtual machine environment composed of different virtual machine operating systems and hardware architectures based on the file header information of the received malicious sample and a weighted scoring algorithm; A first judgment module, used to judge the virtual machine environment with the best matching degree with the malicious sample according to the matching degree score; A sample delivery module is used to deliver the malicious sample to the virtual machine environment with the best matching degree according to the judgment result; A data monitoring and recording module is used to use a behavior monitoring component to record in real time the operation behavior of malicious samples on the system during operation, and to use a traffic monitoring component to record in real time the network traffic of malicious samples during operation; The sample analysis module is used to analyze the malicious samples according to the operation behaviors and network traffic of the malicious samples recorded in real time.

6. An electronic device, characterized in that: include: One or more processors; Memory; One or more executable programs are stored in the memory, and the one or more processors read the executable program code stored in the memory and run the program corresponding to the executable program code to execute the steps of the distributed malicious sample simulation analysis method described in any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to execute the steps of the distributed malicious sample simulation analysis method described in any one of claims 1 to 4.

Images