Malicious code sandbox analysis engine system and method adopting distributed deployment model

Abstract

The invention discloses a malicious code sandbox analysis engine system and method adopting a distributed deployment model. The system comprises a management module, a host machine module, a virtual network module and an analysis client module. The management module realizes centralized and unified management control and is used for monitoring, configuring and managing all bearing resources and analysis point locations; the host machine module is used for scheduling analysis clients and collecting and returning analysis results; the virtual network module is used for establishing single communication connection between the host machine and the analysis client and realizing stable transmission of samples and analysis results; and the analysis client module is used for analyzing malicious codes in multiple dimensions. According to the method, the analysis engine is packaged into the containers through the container technology, then the containers are deployed on the distributed container management platform, distributed deployment is achieved, a large number of samples can be input into the sandbox containers deployed in a distributed mode in a centralized mode, and the problem that a large number of samples cannot be analyzed in time, and consequently a large amount of time cost is generated is effectively solved.

Description

Technical Field

[0001] The present invention belongs to the field of information security, and in particular relates to a malicious code sandbox analysis engine system and method using a distributed deployment model. Background Art

[0002] Currently, sandboxing is a security mechanism used to isolate running programs. Its purpose is to limit the access rights of untrusted processes or untrusted code at runtime. The sandbox provides a virtual environment for the program to be executed. This virtual environment contains some virtual hardware and software resources, such as file systems, networks, operating systems, etc., so that applications or processes can run in this environment. Programs running in the sandbox can only access the resources loaded by the sandbox, without affecting external applications, systems or platforms, and preventing them from causing permanent changes to other programs or data in the computer.

[0003] However, existing sandboxes take too long to analyze large quantities of samples. There are many reasons for this: first, due to the complexity of the samples, the malware may be designed with complex logic, making the analysis process require more time to thoroughly understand its behavior; second, in order to fully understand the sample behavior, the sandbox may perform detailed analysis, which increases the analysis time; third, due to resource constraints, the computing resources required for the sandbox to run (such as CPU and memory) may become a bottleneck; or due to parallel processing limitations, the lack of parallel processing capabilities may make it impossible to analyze multiple samples at the same time; or it may be that the sandbox encounters network delays when communicating with external servers.

[0004] Therefore, a new technical solution is needed to solve the above problems. Summary of the invention

[0005] Purpose of the invention: In order to overcome the shortcoming of traditional sandboxes that it takes too long to analyze large quantities of samples, a malicious code sandbox analysis engine system and method using a distributed deployment model is provided. The system uses container technology to encapsulate the analysis engine into containers, and then deploys these containers on a distributed container management platform. Multiple container instances run on multiple nodes to achieve distributed deployment, and can centrally input large quantities of samples into distributed deployed sandbox containers, effectively solving the problem of a large number of samples not being able to be analyzed in a timely manner and incurring a lot of time costs.

[0006] Technical solution: To achieve the above-mentioned purpose, the present invention provides a malicious code sandbox analysis engine system adopting a distributed deployment model, including a management module, a host module, a virtual network module, and an analysis client module;

[0007] The management module implements centralized and unified management and control, and is used to monitor, configure and manage all bearer resources and analysis points; by managing each single sandbox system in a unified manner, it enables the analysis of samples in large quantities;

[0008] The host module is used to schedule the analysis client, collect and return the analysis results; and to add polymorphism to the test malicious code sandbox, making it have a variety of forms;

[0009] The virtual network module is used to establish a single communication connection between the host machine and the analysis client machine, so as to achieve stable transmission of samples and analysis results;

[0010] The analysis client module is used to analyze malicious code in multiple dimensions, including specific analysis of malicious sample content, outputting specific analysis results and resetting the analysis client.

[0011] Furthermore, the management module includes a rack-mounted server, and the system supports clustered deployment, which is used to form multiple analysis engine nodes into a cluster to jointly handle large-scale analysis tasks. The management module simplifies the setup and management of distributed deployment, and users can easily add, delete or expand analysis points. The management module can automatically adjust resource allocation according to the actual workload, and can reduce resource usage when the load is low, and automatically increase resources when the load is high. Use automation tools and container orchestration platforms to support elastic scaling of resources.

[0012] Furthermore, the host module includes an automatic task allocation system that can dynamically allocate tasks to appropriate analysis client nodes based on factors such as the nature, priority, and available resources of the task. The host module provides a display page for the overall analysis, including but not limited to sample information (such as file name, MD5 checksum, file size, etc.), threat information (such as detected threats or abnormal behaviors), and judgment basis.

[0013] Furthermore, the analysis client module includes a software containerized or virtualized analysis engine, which has the functions of state restoration and real operating environment simulation. The analysis client module supports the detection of file types including but not limited to PE format, ELF format, script files, document class, compression class, image class, etc. The analysis details include but are not limited to structural information, shell information, shell information, import / export table, process tree, network request, registry operation, file operation, process operation, operation logic, operation screenshot, etc.

[0014] The analysis client module is used to analyze malicious code in multiple dimensions, including static and dynamic analysis, to capture all aspects of malicious behavior. It combines multiple technologies such as file analysis, process monitoring, network monitoring and behavioral analysis to comprehensively detect and report threats.

[0015] The present invention also provides a method for operating a malicious code sandbox analysis engine system using a distributed deployment model, comprising the following steps:

[0016] S1: Use containerization technology to encapsulate the analysis engine into a container and use container orchestration tools for distributed deployment;

[0017] S2: Using the task parallelization method, the malicious code detection task is divided into multiple subtasks and processed simultaneously;

[0018] S3: Develop a specific sample analysis strategy, and then send the malicious sample to the client for analysis through the virtual network module;

[0019] S4: Select a suitable analysis client to perform multi-dimensional malicious code analysis;

[0020] S5: The analysis result is transmitted back to the host module, and an analysis result report is generated.

[0021] Furthermore, the step S1 specifically includes:

[0022] A1: Use cluster deployment to combine multiple analysis engine nodes into a cluster to jointly process large-scale analysis tasks.

[0023] A2: Use container technology to encapsulate the analysis engine into containers, then deploy these containers on a distributed container management platform, and run multiple container instances on multiple nodes to achieve distributed deployment.

[0024] A3: Use a distributed storage system to store analysis tasks and results to ensure that data can be shared between different nodes. Use cluster management tools to create and manage clusters of multiple engine nodes to ensure collaborative work.

[0025] Furthermore, the step S2 specifically includes:

[0026] B1: Develop a clear API interface to allow third-party sandbox engines to communicate with the system;

[0027] B2: Write plug-ins or adapters to integrate different third-party engines;

[0028] B3: Write detailed integration documentation to help users and developers understand how to integrate third-party sandbox engines;

[0029] B4: Implement security control measures to ensure that the integrated third-party sandbox engine does not pose a potential security threat to the system.

[0030] Furthermore, the sample analysis strategy formulation method in step S3 includes static analysis, dynamic analysis, and behavioral analysis.

[0031] Furthermore, the step S4 specifically includes:

[0032] C1: Uses a multi-dimensional analysis engine, including static and dynamic analysis, to detect various evasion methods of malicious samples;

[0033] C2: Identify file types. Based on the identification of file types, run the corresponding documents through different software to track and monitor the program execution process. All required programs can be installed in the virtual machine;

[0034] C3: Implement a file monitoring mechanism to track the derivative files released or generated during the dynamic operation of the sample;

[0035] C4: Capture the sample's behavior, analyze it, and identify potential threat behavior patterns; match the detected threat behavior with the corresponding techniques and tactics in the ATT&CK model.

[0036] Furthermore, the step S5 specifically includes:

[0037] D1: Provides multiple output methods, including WEB interface display, manual batch export and API interface output;

[0038] D2: Create a detailed analysis report page, including sample structure information, packing information, import / export table, process tree, network request, registry operation, file operation, process operation, operation logic, operation screenshots and other detailed information. Create a detailed analysis report page to present the detailed behavior of the sample in the form of tables, charts, images, etc.

[0039] D3: Create a file index and associated database to record derivative files and information related to the sample; this will include information such as file path, hash value, file type, etc.

[0040] D4: Implement advanced search functions, including but not limited to sample name, Hash, upload time, analysis completion time, threat type, domain name request, IP request, etc.; establish a report storage system to ensure that the generated reports can be accessed at any time; establish a report storage system to ensure that the generated reports can be accessed at any time.

[0041] Beneficial effects: Compared with the prior art, the present invention uses container technology to encapsulate the analysis engine into a container, and then deploys these containers on a distributed container management platform, runs multiple container instances on multiple nodes, and realizes distributed deployment. It can centrally input large batches of samples into the distributed deployed sandbox containers, effectively solving the problem that a large number of samples cannot be analyzed in time and a lot of time costs are incurred, thereby improving the overall analysis efficiency of samples and reducing time costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 This is a design diagram of the functional module system in the present invention;

[0043] Figure 2 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0044] The present invention is further explained below in conjunction with the accompanying drawings and specific embodiments. It should be understood that these embodiments are only used to illustrate the present invention and are not used to limit the scope of the present invention. After reading the present invention, various equivalent forms of modifications to the present invention by those skilled in the art all fall within the scope defined by the claims attached to this application.

[0045] like Figure 1 As shown, the present invention provides a malicious code sandbox analysis engine system using a distributed deployment model, including a management module, a host module, a virtual network module, and an analysis client module;

[0046] The management module implements centralized and unified management and control, and is used to monitor, configure and manage all hosting resources and analysis points. By managing each single sandbox system in a unified manner, it can analyze samples in large quantities.

[0047] The host module is used to schedule the analysis client, collect and return the analysis results; it is used to add polymorphism to the test malicious code sandbox, making it have a variety of forms;

[0048] The virtual network module is used to establish a single communication connection between the host and the analysis client to achieve stable transmission of samples and analysis results;

[0049] The analysis client module is used to analyze malicious code in multiple dimensions, including specific analysis of malicious sample content, output of specific analysis results and resetting of the analysis client.

[0050] The management module includes rack-mounted servers, and the system supports clustered deployment, which is used to form multiple analysis engine nodes into a cluster to jointly handle large-scale analysis tasks. The management module simplifies the setup and management of distributed deployments, and users can easily add, delete, or expand analysis points. The management module can automatically adjust resource allocation according to actual workloads, reducing resource usage when the load is low and automatically increasing resources when the load is high. Use automation tools and container orchestration platforms to support elastic scaling of resources.

[0051] The host module includes an automatic task allocation system that can dynamically allocate tasks to appropriate analysis client nodes based on the nature, priority, and available resources of the task. The host module provides a display page for the overall analysis, including but not limited to sample information (such as file name, MD5 checksum, file size, etc.), threat information (such as detected threats or abnormal behaviors), and judgment basis.

[0052] The specific way to dynamically assign tasks to appropriate analysis client nodes is as follows: first, determine the specific requirements of the analysis task, including processing power, memory requirements, storage requirements, and network bandwidth. Secondly, according to factors such as the nature, priority, and available resources of the task, match the corresponding idle analysis client nodes that meet the task requirements, and pass the samples to the analysis client for analysis.

[0053] The analysis client module includes a software containerized or virtualized analysis engine with the functions of state restoration and real operating environment simulation. The analysis client module supports the detection of file types including but not limited to PE format, ELF format, script files, document class, compression class, image class, etc. The analysis details include but are not limited to structural information, shell information, shell information, import / export table, process tree, network request, registry operation, file operation, process operation, operation logic, operation screenshot, etc.

[0054] The analysis client module is used to analyze malicious code in multiple dimensions, including static and dynamic analysis, to capture all aspects of malicious behavior. It combines multiple technologies such as file analysis, process monitoring, network monitoring and behavioral analysis to comprehensively detect and report threats.

[0055] Static analysis uses static evasion techniques such as detection of packers and code obfuscation. The collected samples need to be preprocessed, such as decompression, decryption, format conversion, etc., so that subsequent modules can analyze them. Get as much information as possible without executing the malicious code. Build rules and feature libraries to identify signs and characteristics of various evasion techniques. These libraries will be continuously updated to adapt to new evasion techniques and malicious code variants.

[0056] Dynamic analysis uses dynamic evasion techniques such as sandbox escape detection and anti-debugging. It communicates with the sandbox environment to control the execution of malicious code, monitor system calls, and record network activities. It has advanced detection capabilities such as control flow transfer anomaly detection, CPU mode abnormal switching detection, UAF attack detection, and shellcode execution detection. It has pioneered multiple analysis functions such as bootsector dynamic loading detection, intelligent restart of the analysis process, dynamic acceleration of the virtual system clock, and operating system crash detection.

[0057] like Figure 2As shown, the present invention also provides a method for operating a malicious code sandbox analysis engine system using a distributed deployment model, comprising the following steps:

[0058] S1: Use containerization technology to encapsulate the analysis engine into a container and use container orchestration tools for distributed deployment;

[0059] S2: Using task parallelization, the malicious code detection task is divided into multiple subtasks and processed simultaneously;

[0060] S3: Develop a specific sample analysis strategy, and then send the malicious sample to the client for analysis through the virtual network module;

[0061] S4: Select a suitable analysis client to perform multi-dimensional malicious code analysis;

[0062] S5: The analysis result is transmitted back to the host module, and an analysis result report is generated.

[0063] Step S1 specifically includes:

[0064] A1: Use cluster deployment to combine multiple analysis engine nodes into a cluster to jointly process large-scale analysis tasks.

[0065] Prerequisites for deploying a cluster: A compatible version of the Kubernetes command-line tool kubectl is installed on the server. At least one machine is required as the master node (Master Node) and at least one as a worker node (WorkerNode). All nodes should have compatible versions of the Kubernetes control plane components installed. The network configuration allows communication between nodes.

[0066] Ensure that all nodes meet the minimum system requirements for Kubernetes. Install Kubernetes components on all nodes. You can use various methods, such as using kubeadm, Minikube, or manual installation. Initialize the master node using the kubeadminit command. This will set up the cluster infrastructure and generate a kubeadmjoin command with the information required to join the cluster. Set up kubectl using the configuration file provided by kubeadminit. Select and install a network plugin such as Calico, Flannel, or Weave to enable network communication between Pods. Run the kubeadmjoin command on each worker node, using the token generated by the master node earlier. Use the kubectl get nodes command to verify the status of all nodes. Create and deploy the cluster's Pods and Services. Use the kubectl command-line tool to manage cluster resources and perform operations such as scaling, updating, rolling back, and deleting. Deploy a monitoring and log collection system with Elasticsearch-Logstash. Integrate CI / CD processes and automate deployments using tools such as Jenkins and GitLab CI. Regularly maintain the cluster, including upgrading Kubernetes versions and patching.

[0067] A2: Use container technology to encapsulate the analysis engine into containers, then deploy these containers on a distributed container management platform, and run multiple container instances on multiple nodes to achieve distributed deployment.

[0068] Containers provide a consistent operating environment, ensuring that applications behave the same in development, test, and production environments. Containers are not dependent on a specific infrastructure and can run on any platform that supports container technology. Containers can be started and stopped in seconds, accelerating the deployment and expansion process of applications. Containers share the host's kernel and do not need to simulate the entire operating system like virtual machines, so resource utilization is higher. Due to high resource utilization and easy management, containerization can reduce the overall cost of infrastructure.

[0069] The present invention uses Docker for packaging, specifies a base image, installs the sandbox environment into the container, and adds instructions in the Dockerfile to install the required dependencies. Set the environment variables required by the application. Set the working directory for the container, which is the current directory inside the container. Specify the command or script to be executed when the container starts. Use Dockerfile to build the container image, which can be done by executing the docker build command. Test the built container image locally or in a test environment to ensure that it works as expected. Push the built container image to Docker Hub, Harbor, or other private image repositories. Use container orchestration tools (such as Kubernetes, Docker Swarm, or Mesos) to deploy containers to a production environment.

[0070] A3: Use a distributed storage system to store analysis tasks and results to ensure that data can be shared between different nodes. Use cluster management tools to create and manage clusters of multiple engine nodes to ensure collaborative work.

[0071] The collaborative work here is achieved as follows: Cluster management tools usually provide a node discovery mechanism that allows newly added nodes to be automatically identified and added to the cluster. All cluster nodes are uniformly configured to ensure that they run the same application version and configuration. Cluster management tools distribute requests to different nodes through built-in or integrated load balancers to prevent any one node from being overloaded. Node failures are automatically detected and recovered according to the configured strategy, such as rescheduling tasks to other nodes. Shared storage or distributed storage systems are used to ensure that all nodes have access to the same data set.

[0072] Step S2 specifically includes:

[0073] B1: Develop a clear API interface to allow third-party sandbox engines to communicate with the system;

[0074] B2: Write plug-ins or adapters to integrate different third-party engines;

[0075] B3: Write detailed integration documentation to help users and developers understand how to integrate third-party sandbox engines;

[0076] B4: Implement security control measures to ensure that the integrated third-party sandbox engine does not pose a potential security threat to the system.

[0077] The method for formulating the sample analysis strategy in step S3 includes static analysis, dynamic analysis, and behavioral analysis, as follows:

[0078] Static analysis will be used to detect static evasion techniques such as packing and code obfuscation. The collected samples need to be pre-processed, such as decompression, decryption, format conversion, etc., so that subsequent modules can analyze them. Get as much information as possible without executing the malicious code. Build rules and feature libraries to identify signs and characteristics of various evasion techniques. These libraries will be continuously updated to adapt to new evasion techniques and malicious code variants.

[0079] Dynamic analysis will be used to detect dynamic evasion techniques such as sandbox escape and anti-debugging. It communicates with the sandbox environment to control the execution of malicious code, monitor system calls, record network activities, etc. It has advanced detection capabilities such as control flow transfer anomaly detection, CPU mode abnormal switching detection, UAF attack detection, shellcode execution detection, and pioneered multiple analysis functions such as bootsector dynamic loading detection, intelligent restart of analysis process, dynamic acceleration of virtual system clock, and operating system crash detection.

[0080] Behavioral analysis implements process monitoring and network monitoring to record dynamic behaviors such as API calls, mutex variables, network requests, registry operations, file operations, process operations, etc. Generate process trees and run screenshots to help users understand the running environment and logic of malicious code. A mapping algorithm will be implemented to match the detected threat behaviors with the corresponding techniques and tactics in the ATT&CK model. We will generate detailed reports to show the association of each sample's threat behavior with the ATT&CK model.

[0081] Step S4 specifically includes:

[0082] C1: Uses a multi-dimensional analysis engine, including static and dynamic analysis, to detect various evasion methods of malicious samples;

[0083] C2: Identify file types. Based on the identification of file types, run the corresponding documents through different software to track and monitor the program execution process. All required programs can be installed in the virtual machine;

[0084] C3: Implement a file monitoring mechanism to track the derivative files released or generated during the dynamic operation of the sample;

[0085] This system records the metadata, operation history and attributes of files to provide a data basis for subsequent analysis. A detailed analysis result report will be generated, including information such as the characteristics, behavior, and potential risks of the derived files.

[0086] C4: Capture the sample's behavior, analyze it, and identify potential threat behavior patterns; match the detected threat behavior with the corresponding techniques and tactics in the ATT&CK model.

[0087] Step S5 specifically includes:

[0088] D1: Provides multiple output methods, including WEB interface display, manual batch export and API interface output;

[0089] D2: Create a detailed analysis report page, including sample structure information, packing information, import / export table, process tree, network request, registry operation, file operation, process operation, operation logic, operation screenshots and other detailed information. Create a detailed analysis report page to present the detailed behavior of the sample in the form of tables, charts, images, etc.

[0090] D3: Create a file index and associated database to record derivative files and information related to the sample; this will include information such as file path, hash value, file type, etc.

[0091] D4: Implement advanced search functions, including but not limited to sample name, Hash, upload time, analysis completion time, threat type, domain name request, IP request, etc.; establish a report storage system to ensure that the generated reports can be accessed at any time; establish a report storage system to ensure that the generated reports can be accessed at any time.

[0092] In this embodiment, the generated sample analysis report data is finally extracted, and the severity of the sample exploit vulnerability is evaluated using the Common Vulnerability Score System (CVSS). The CVSS scoring calculation method is divided into: basic evaluation, life cycle evaluation, and environmental evaluation.

[0093] The elements of basic evaluation include: attack vector (Access Vector), attack complexity (Access Complexity), authentication (Authentication), confidentiality (Conf Impact), integrity (Integ Impact), and availability (Avail Impact).

[0094] Weight tendency: average (0.333 each) / confidentiality w1 / integrity w2 / availability w3 (weight tendency factor 0.5 and the other two 0.25)

[0095] Basic evaluation = rounded (10*AccessVector*AccessComplexity*Authentication*((ConfImpact*w1)+(IntegImpact*w2)+(AvailImpact*w3)))

[0096] LCA metrics measure the current state of exploit technology or code availability, the existence of any patches or workarounds, or the confidence level of vulnerability reports. LCA metrics will almost certainly change over time.

[0097] The calculation formula for life cycle assessment is: Life cycle = Roundup (basic score × utilization × patch level × report credibility)

[0098] Exploitability metrics measure the likelihood of a vulnerability being exploited, typically based on the current state of exploit technology, exploit code availability, or active exploitation "in the wild." The easier a vulnerability is to exploit, the higher the vulnerability score.

[0099] Patch Level: The level at which a vulnerability is fixed is an important factor in determining prioritization. Typical vulnerabilities are unpatched when initially released. Workarounds or hotfixes may provide temporary remediation until an official patch or upgrade is released. Each of these stages adjusts the time score downward, reflecting the decreasing urgency as remediation becomes final.

[0100] Report Confidence: This metric measures the confidence in the existence of a vulnerability and the known technical details. Sometimes only the existence of a vulnerability is disclosed, but no specific details are given. The vulnerability may later be confirmed by research that shows where the vulnerability may exist, although the research may not be certain.

[0101] Environmental assessment metrics enable analysts to customize CVSS scores based on the importance of the affected IT assets to the user organization, in terms of existing supplemental / alternative security controls, confidentiality, integrity, and availability. These metrics are modified equivalents of the base metrics and are assigned scores based on the condition of the components in the organization's infrastructure.

[0102] 1. The calculation formula for environmental assessment is:

[0103] When the impact <= 0: environmental assessment score = 0

[0104] When the impact > 0 and no correction: Environmental assessment score = Roundup (Roundup (Min [(M. Impact score + M. Availability score), 10]) × Availability × Patch level × Report credibility)

[0105] When the impact > 0 and there is a correction: Environmental assessment score = Roundup (Roundup (Min [1.08 × (M. Impact score + M. Availability score), 10]) × Availability × Patch level × Report credibility)

[0106] Min compares the previous and next values ​​and takes the smaller one

[0107] M. represents the corrected score. If the weak corresponding item is not modified, it is the original value.

[0108] 2. The influence correction score formula is:

[0109] Scope = Fixed: Impact Modifier = 6.42 × ISCModified

[0110] Scope = Change: Impact Modification = 7.52×(ISCModified-0.029)-3.25×(ISCModified-0.02)^15

[0111] Where: ISCModified = Min(1-[(1-M.Confidentiality impact × M.Confidentiality requirement) × (1-M.Integrity impact × M.Integrity requirement) × (1-M.Availability impact × M.Availability requirement)], 0.915)

[0112] ISCModified is a temporary variable.

[0113] 3. The formula for the exploitability correction score is:

[0114] M. Exploitability score = 8.22 × M. Attack path × M. Attack complexity × M. Permission requirement × M. User interaction.

Claims

1. A malicious code sandbox analysis engine system using a distributed deployment model, characterized in that: It includes management module, host module, virtual network module and analysis client module; The management module implements centralized and unified management control and is used to monitor, configure and manage all bearer resources and analysis points; The host module is used to schedule the analysis client, and collect and return the analysis results; The virtual network module is used to establish a single communication connection between the host machine and the analysis client machine, so as to achieve stable transmission of samples and analysis results; The analysis client module is used to analyze malicious code in multiple dimensions.

2. According to the malicious code sandbox analysis engine system using a distributed deployment model as described in claim 1, it is characterized in that: The management module includes a rack-mounted server, and the system supports cluster deployment, which is used to form a cluster of multiple analysis engine nodes to jointly process large-scale analysis tasks.

3. According to the malicious code sandbox analysis engine system using a distributed deployment model as described in claim 1, it is characterized in that: The host module includes an automatic task allocation system that can dynamically allocate tasks to appropriate analysis client nodes based on the nature, priority and available resources of the tasks.

4. According to the malicious code sandbox analysis engine system using a distributed deployment model as described in claim 1, it is characterized in that: The analysis client module includes a software containerized or virtualized analysis engine, and has the functions of state restoration and real operating environment simulation.

5. A method for operating a malicious code sandbox analysis engine system using a distributed deployment model, characterized in that: The steps include: S1: Use containerization technology to encapsulate the analysis engine into a container and use container orchestration tools for distributed deployment; S2: Using task parallelization, the malicious code detection task is divided into multiple subtasks and processed simultaneously; S3: Develop a specific sample analysis strategy, and then send the malicious sample to the client for analysis through the virtual network module; S4: Select a suitable analysis client to perform multi-dimensional malicious code analysis; S5: The analysis result is transmitted back to the host module, and an analysis result report is generated.

6. The method for operating a malicious code sandbox analysis engine system using a distributed deployment model according to claim 5, characterized in that: The step S1 specifically includes: A1: Use cluster deployment to combine multiple analysis engine nodes into a cluster to jointly process large-scale analysis tasks. A2: Use container technology to encapsulate the analysis engine into containers, then deploy these containers on a distributed container management platform, and run multiple container instances on multiple nodes to achieve distributed deployment. The specific way to use container technology to encapsulate the analysis engine into a container is as follows: use Docker for encapsulation, specify a base image, install the sandbox environment into the container, add instructions in the Dockerfile to install the required dependencies; set the environment variables required by the application; set the working directory for the container, which is the current directory inside the container; specify the command or script to be executed when the container starts; use Dockerfile to build the container image, which is completed by executing the docker build command; test the built container image locally or in a test environment to ensure that it works as expected; push the built container image to Docker Hub, Harbor or other private image repositories; use container orchestration tools to deploy the container to the production environment; A3: Use a distributed storage system to store analysis tasks and results to ensure that data can be shared between different nodes. Use cluster management tools to create and manage clusters of multiple engine nodes to ensure collaborative work.

7. The method for operating a malicious code sandbox analysis engine system using a distributed deployment model according to claim 5, characterized in that: The step S2 specifically includes: B1: Develop a clear API interface to allow third-party sandbox engines to communicate with the system; B2: Write plug-ins or adapters to integrate different third-party engines; B3: Write detailed integration documentation to help users and developers understand how to integrate third-party sandbox engines; B4: Implement security control measures to ensure that the integrated third-party sandbox engine does not pose a potential security threat to the system.

8. The method for operating a malicious code sandbox analysis engine system using a distributed deployment model according to claim 5, characterized in that: The method for formulating the sample analysis strategy in step S3 includes static analysis, dynamic analysis, and behavioral analysis.

9. The method for operating a malicious code sandbox analysis engine system using a distributed deployment model according to claim 5, characterized in that: The step S4 specifically includes: C1: Uses a multi-dimensional analysis engine, including static and dynamic analysis, to detect various evasion methods of malicious samples; C2: Identify the file type, and based on the identified file type, run the corresponding document through different software to track and monitor the program execution process. All required programs can be installed in the virtual machine; C3: Implement a file monitoring mechanism to track the derivative files released or generated during the dynamic operation of the sample; C4: Capture the sample's behavior, analyze it, and identify potential threat behavior patterns; match the detected threat behavior with the corresponding techniques and tactics in the ATT&CK model.

10. The method for operating a malicious code sandbox analysis engine system using a distributed deployment model according to claim 5, characterized in that: The step S5 specifically includes: D1: Provides multiple output methods, including WEB interface display, manual batch export and API interface output; D2: Create a detailed analysis report page; D3: Create a file index and associated database to record derivative files and information related to the sample; this will include information such as file path, hash value, file type, etc. D4: Implement advanced search functions, including sample name, hash, upload time, analysis completion time, threat type, domain name request, IP request; establish a report storage system to ensure that the generated reports can be accessed at any time; establish a report storage system to ensure that the generated reports can be accessed at any time.

Images