Malicious program detection method and device, equipment and storage medium

Abstract

The invention relates to a malicious program detection method and device, equipment and a storage medium. The method comprises the following steps: firstly, determining a target sandbox and a target monitoring strategy from a hierarchical sandbox detection system during malicious program detection; the graded sandbox detection system comprises at least two sandboxes with different grades; running the target program through the target sandbox, and monitoring an operation behavior of the target program through the target monitoring strategy; if the sandbox of the next level and the monitoring strategy need to continue to detect, the sandbox of the next level and the monitoring strategy serve as a target sandbox and a target monitoring strategy, and the step of running the target program through the target sandbox continues to be executed; otherwise, determining a malicious program detection result according to the behavior monitoring result. Visibly, the malicious program is detected through the hierarchical sandbox detection system, and detection is continued through the sandbox of the next level only after threats of the malicious program are detected, so that excessive analysis of non-threat programs is avoided, resource consumption is reduced, and detection efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of malicious program detection, and in particular to a malicious program detection method, device, equipment and storage medium. Background Art

[0002] With the development of the Internet, network security issues have become increasingly prominent, and malware and hacker attacks have emerged in an endless stream. Among them, malicious binary programs, as one of the main means of attack and propagation, pose a serious threat to host security. When detecting malicious binary programs, traditional solutions can run the program to be detected through a sandbox and determine whether the program is a malicious program based on all its operating behaviors during the running process. However, when detecting through this solution, regardless of whether the program is threatening or not, it is necessary to run the entire detection process through the sandbox, which results in high resource consumption, long detection time, and low detection efficiency.

[0003] Therefore, how to efficiently and accurately detect malicious binary programs is a problem that technical personnel in this field need to solve. Summary of the invention

[0004] The present application provides a malicious program detection method, apparatus, device and storage medium to achieve efficient and accurate detection of malicious binary programs.

[0005] In a first aspect, the present application provides a method for detecting malicious programs, comprising:

[0006] Determine the target program to be tested;

[0007] Determine a target sandbox and a target monitoring strategy from a hierarchical sandbox detection system; the hierarchical sandbox detection system includes at least two sandboxes of different levels;

[0008] Running the target program through a target sandbox, and monitoring the operation behavior of the target program through a target monitoring strategy to generate a behavior monitoring result;

[0009] Based on the behavior monitoring results, determine whether the next level of sandbox and monitoring strategy is needed to continue detection; if so, use the next level of sandbox and monitoring strategy as the target sandbox and target monitoring strategy, and continue to execute the step of running the target program through the target sandbox; if not, determine the malicious program detection result based on the behavior monitoring results.

[0010] Optionally, the hierarchical sandbox detection system includes:

[0011] A basic sandbox, an intermediate sandbox and an advanced sandbox; wherein the basic sandbox runs the target program through a lightweight isolation environment and monitors a first operation behavior of the target program; the intermediate sandbox runs the target program by simulating a partial operating system environment and monitors a second operation behavior of the target program; the advanced sandbox runs the target program multiple times by simulating a complete operating system environment and monitors a third operation behavior of the target program.

[0012] Optionally, monitoring the operation behavior of the target program through a target monitoring strategy includes:

[0013] If the target program is monitored to perform anti-sandbox behavior through the target monitoring policy, the virtual machine parameters and user simulation behavior of the target sandbox are dynamically adjusted.

[0014] Optionally, monitoring the operation behavior of the target program through a target monitoring strategy to generate a behavior monitoring result includes:

[0015] Monitoring the operation behavior of the target program through a target monitoring strategy;

[0016] Determine the threat score and weighting factor for each operation behavior;

[0017] The total score is calculated based on the threat score and weighting coefficient of each operation behavior.

[0018] Optionally, judging whether a next level of sandbox and monitoring strategy is needed to continue detection according to the behavior monitoring result includes:

[0019] Determining whether the total score exceeds a detection threshold corresponding to a target sandbox;

[0020] If not, determine the malicious program detection result based on the behavior monitoring result; if so, determine whether there is a next-level target sandbox and target monitoring strategy;

[0021] If not, the malicious program detection result is determined based on the behavior monitoring result; if so, it is determined that the next level of sandbox and monitoring strategy is needed to continue detection.

[0022] Optionally, determining the malicious program detection result according to the behavior monitoring result includes:

[0023] Obtain the operation behavior of the target program according to the behavior monitoring results;

[0024] Use graphical models and operational behaviors to build target behavior chains;

[0025] The malicious behavior characteristics in the target behavior chain are detected through a malicious behavior chain database to generate a malicious program detection result.

[0026] Optionally, detecting malicious behavior features in the target behavior chain through a malicious behavior chain database includes:

[0027] Determine a target malicious behavior chain from a malicious behavior chain database;

[0028] Calculate the behavior similarity between the target behavior chain and the target malicious behavior chain through graph edit distance algorithm, fuzzy logic matching rule and multi-dimensional matching analysis rule;

[0029] Determining whether the behavior similarity is greater than a similarity threshold;

[0030] If so, it is determined that there is a malicious behavior feature corresponding to the target malicious behavior chain in the target behavior chain.

[0031] In a second aspect, the present application provides a malicious program detection device, comprising:

[0032] A first determination module, used to determine a target program to be detected;

[0033] A second determination module is used to determine a target sandbox and a target monitoring strategy from a hierarchical sandbox detection system; the hierarchical sandbox detection system includes at least two sandboxes of different levels;

[0034] A running module, used for running the target program through a target sandbox;

[0035] A monitoring module, used to monitor the operation behavior of the target program through a target monitoring strategy to generate a behavior monitoring result;

[0036] A judgment module, used to judge whether the next level of sandbox and monitoring strategy is needed to continue detection according to the behavior monitoring result; if so, trigger the third determination module; if so, trigger the fourth determination module;

[0037] A third determination module is used to determine the sandbox and monitoring strategy of the next level, and use the sandbox and monitoring strategy of the next level as the target sandbox and target monitoring strategy to trigger the operation module;

[0038] The fourth determination module is used to determine the malicious program detection result according to the behavior monitoring result.

[0039] In a third aspect, the present application provides an electronic device, including:

[0040] A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the above-mentioned malicious program detection method of the present application through the computer program.

[0041] In a fourth aspect, the present application also provides a computer storage medium, which stores computer executable instructions, and the computer executable instructions are used to execute the steps of the above-mentioned malicious program detection method of the present application.

[0042] The above technical solution provided by the embodiment of the present application has the following advantages compared with the prior art: when detecting malicious programs, the present application first determines the target sandbox and the target monitoring strategy from the hierarchical sandbox detection system; the hierarchical sandbox detection system includes at least two sandboxes of different levels; the target program to be detected is run through the target sandbox, and the operation behavior of the target program is monitored through the target monitoring strategy to generate a behavior monitoring result; according to the behavior monitoring result, it is determined whether the sandbox and monitoring strategy of the next level are needed to continue the detection; if so, the sandbox and monitoring strategy of the next level are used as the target sandbox and target monitoring strategy, and the step of running the target program through the target sandbox is continued; if not, the malicious program detection result is determined according to the behavior monitoring result. It can be seen that when the present application detects malicious programs through the hierarchical sandbox detection system, only after detecting that the malicious program is threatening will it continue the detection through the sandbox of the next level, avoiding excessive analysis of non-threatening programs, reducing resource consumption, and improving detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0045] One or more embodiments are exemplarily described by pictures in the corresponding drawings, and these exemplified descriptions do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the figures in the drawings do not constitute proportional limitations.

[0046] Figure 1 A flowchart of a malicious program detection method provided in an embodiment of the present application;

[0047] Figure 2 A flowchart of another malicious program detection method provided in an embodiment of the present application;

[0048] Figure 3 A flowchart of another malicious program detection method provided in an embodiment of the present application;

[0049] Figure 4 A schematic diagram of the structure of a malicious program detection device provided in an embodiment of the present application;

[0050] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0052] The disclosure below provides many different embodiments or examples to implement different structures of the present invention. In order to simplify the disclosure of the present invention, the parts and settings of specific examples are described below. Of course, they are only examples, and the purpose is not to limit the present invention. In addition, the present invention can repeat reference numbers and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0053] The embodiment of the present invention discloses a malicious program detection method, device, equipment and storage medium to achieve efficient and accurate detection of malicious binary programs.

[0054] join Figure 1 , Figure 1 A flowchart of a malicious program detection method provided in an embodiment of the present application, the method specifically comprises the following steps:

[0055] S101, determining a target program to be detected;

[0056] S102, determining a target sandbox and a target monitoring strategy from a hierarchical sandbox detection system; the hierarchical sandbox detection system includes at least two sandboxes of different levels;

[0057] In this embodiment, the target program can be a binary program, and the application refers to the program to be detected as the target program. The hierarchical sandbox detection system includes sandboxes of different levels, and the level of the sandbox can be determined according to the ability of the sandbox to analyze malicious behavior, the isolation strength of the sandbox, etc. For a sandbox of a lower level, its isolation level is lower, and only basic malicious behavior can be analyzed; for a sandbox of a higher level, its isolation level is higher, and deeper malicious behavior can be analyzed. The number of sandboxes in the hierarchical sandbox detection system in this embodiment can be set according to actual conditions, such as: two sandboxes of different levels can be set, three sandboxes of different levels can be set, or four sandboxes of different levels can be set, etc. In addition, the level of the sandbox is different, and the corresponding monitoring strategy is also different. Different levels of monitoring strategies can monitor different levels of operation behaviors. The monitoring strategy records the types of operation behaviors that need to be monitored by different sandboxes, such as: in the low-level monitoring strategy, only basic system call behaviors, network request behaviors, file read and write behaviors, etc. are monitored; while in the high-level monitoring strategy, advanced system call behaviors, anti-sandbox behaviors, etc. need to be monitored.

[0058] It should be noted that when performing a preliminary analysis of the target program, the lowest-level sandbox and the corresponding monitoring strategy can be determined from the hierarchical sandbox detection system for detection. If a threat is detected, the detection will continue through the sandbox and monitoring strategy of the next level. In addition, for the sake of distinction, this solution only refers to the sandbox that is currently detecting the target program as the target sandbox, and the monitoring strategy of the target sandbox as the target monitoring strategy. If the sandbox and monitoring strategy of the next level are still needed to continue detection, the sandbox and monitoring strategy of the next level will be used as the target sandbox and target monitoring strategy and then the subsequent steps will be continued.

[0059] S103, running the target program through the target sandbox, and monitoring the operation behavior of the target program through the target monitoring strategy to generate a behavior monitoring result;

[0060] In this solution, after determining the target sandbox and target monitoring strategy for the current detection target program, the target program can be run through the target sandbox, and the target program's operation behavior can be monitored through the target monitoring strategy to generate behavior monitoring results. For example: when the target sandbox runs the target program, the target program's basic system call behavior, network request behavior, and file read and write behavior during operation are monitored through the target monitoring strategy, and the monitoring results obtained are: the target program performs abnormal file operation behavior, abnormal network traffic behavior, and suspicious system call behavior during operation.

[0061] S104. According to the behavior monitoring results, determine whether the next level of sandbox and monitoring strategy is needed to continue detection; if so, execute S105; if not, execute S106.

[0062] It is understandable that after the application obtains the monitoring results, if the target program is found to be free of threats by analyzing the monitoring results, the detection process can be terminated at this time; if the target program is a threat, the next level of sandbox and monitoring strategy can be used to detect it until all levels of sandboxes are detected, or it is determined that no further detection is needed based on the monitoring results of the sandbox. For example: the monitoring result is: the target program performs abnormal file operation behavior, abnormal network traffic behavior, and suspicious system call behavior during operation, that is: the target program has suspicious behavior during operation, so it is determined that the target program is a threat, and it is necessary to continue detection through the next level of sandbox and monitoring strategy.

[0063] S105, taking the sandbox and monitoring strategy of the next level as the target sandbox and target monitoring strategy, and continuing to execute S103;

[0064] S106. Determine malicious program detection results based on the behavior monitoring results.

[0065] In this embodiment, the next level of sandbox and monitoring strategy is a higher level sandbox and monitoring strategy, such as: the hierarchical sandbox detection system includes three sandboxes, namely: the first level sandbox, the second level sandbox and the third level sandbox. During the initial detection, the first level sandbox and the corresponding monitoring strategy are used to detect the target program; if it is determined through the monitoring results that there is no threat, the detection process is terminated and the target program is determined not to be a malicious program; if it is determined through the monitoring results that there is a threat, the target program is continuously detected through the second level sandbox and the corresponding monitoring strategy; if it is determined through the monitoring results that it is not necessary to continue the detection, the detection process is terminated and the probability of the target program being a malicious program is low; if it is determined through the monitoring results that it is necessary to continue the detection, the target program is continuously detected through the third level sandbox and the corresponding monitoring strategy to obtain the monitoring result. Since the third level sandbox is the highest level sandbox, it is not necessary to detect through other sandboxes. At this time, it is determined whether the target program is a malicious program based on the monitoring results of the third sandbox.

[0066] In summary, when this application detects malicious programs through a graded sandbox detection system, it will only continue to detect through the next level of sandbox after detecting that the malicious program is threatening, avoiding excessive analysis of non-threatening programs, reducing resource consumption, and improving detection efficiency; and this application can effectively detect complex malware and improve detection accuracy

[0067] Based on the above embodiments, in this embodiment, the hierarchical sandbox detection system includes:

[0068] Basic sandbox, intermediate sandbox and advanced sandbox; the basic sandbox runs the target program in a lightweight isolation environment and monitors the first operation behavior of the target program; the intermediate sandbox runs the target program by simulating a partial operating system environment and monitors the second operation behavior of the target program; the advanced sandbox runs the target program multiple times by simulating a complete operating system environment and monitors the third operation behavior of the target program. If the target program is detected to perform anti-sandbox behavior through the target monitoring strategy, the virtual machine parameters and user simulation behavior of the target sandbox are dynamically adjusted.

[0069] Specifically, the present application can dynamically adjust the isolation strength of the analysis environment by deeply analyzing the behavior of malware layer by layer through a hierarchical sandbox detection system to balance resource consumption and detection effect. In this embodiment, the detection process is described by taking a hierarchical sandbox detection system including a basic sandbox, an intermediate sandbox and an advanced sandbox as an example. Among them, the basic sandbox is used for rapid preliminary analysis, and the basic behavior of malware, such as file operations, network requests, etc., is monitored through a lightweight isolation environment. The basic sandbox can quickly screen out benign files without complex behaviors. The intermediate sandbox is used to provide a more in-depth environment for suspicious samples found in the basic sandbox, including virtual networks, simulated user behaviors, etc., to further explore the hidden behaviors of malware. The advanced sandbox is used to analyze advanced threats and malware targeting anti-sandbox technology, provide a fully simulated operating system environment, and have multiple execution capabilities, aiming to prevent malware from passing sandbox detection.

[0070] When detecting a target program, first run the target program in a basic sandbox, and monitor its initial behavior, such as file reading and writing, network connection, system call, etc., through monitoring strategies. At this time, the environment is simple and resource consumption is low. If the monitoring results show that the basic sandbox has suspicious or malicious behavior, such as abnormal system call frequency, suspicious network request, etc., the system will automatically upgrade the target program to the middle-layer sandbox to further simulate the real user operating environment, and analyze its behavior in the virtual network and file system through monitoring strategies; if the monitoring results show that the target program has a high risk, the target program can be executed multiple times in the advanced sandbox. The advanced sandbox can simulate a complete operating system environment to prevent malware from evading detection using anti-sandbox technology. The system can dynamically adjust the virtual environment parameters to evade the sandbox detection mechanism of malware and obtain the final detection results.

[0071] For example, if the target program is a binary file, the binary file is loaded into the basic sandbox, the binary file is isolated and its access to system resources is restricted, and only the most basic system interactions are allowed, such as system calls, network requests, file read and write operations, etc. The behavior of the binary file is monitored in real time using the behavior analysis engine and monitoring strategy, and the following are recorded and analyzed: system call behavior, file operation behavior, network request behavior, etc. The key information recorded includes: file creation, modification, and deletion; target address and port of network connection; memory usage; CPU utilization and number of threads; if a suspicious behavior feature is detected in the monitoring results of the basic sandbox, it is determined that the next level of sandbox is required for detection, and the binary file is transferred to the middle layer sandbox at this time; the suspicious behavior feature is: abnormal file operation (such as write operation to key system files), abnormal network traffic (such as connecting to unknown IP (Internet Protocol) addresses), suspicious system calls (such as debugging API (Application Programming Interface), code injection).

[0072] In this embodiment, the middle-layer sandbox provides a more complex environment, including virtual network simulation, virtual file system, simulated user behavior, etc. Among them, virtual network simulation refers to: creating a simulated network environment, including common server ports, DNS (Domain Name System) resolution, network bandwidth, etc.; virtual file system refers to creating a disguised real file system, simulating key system files and user files to observe whether malware attempts to modify or steal data; simulating user behavior refers to simulating common user operations such as keyboard input, mouse movement, etc. through scripts to observe whether malware triggers more malicious activities based on user behavior. In the middle-layer sandbox, the following advanced behaviors can be detected according to the corresponding monitoring strategy: whether the malware attempts to evade sandbox detection, such as detecting the virtual machine environment and attempting to delay execution; advanced system calls, such as kernel mode operations, virtual memory manipulation, etc.; whether the network behavior communicates with known malicious IPs or C2 (Command and Control Server) servers. If anti-sandbox behavior or highly suspicious behavior (such as malicious IP communication, complex code injection) is detected according to the monitoring results, the sample is transferred to the advanced sandbox.

[0073] In this embodiment, the advanced sandbox provides a fully virtualized operating system environment and allows samples to be executed multiple times to prevent malware from judging whether it is in the sandbox through short-term observation. Specifically, the advanced sandbox can dynamically modify the hardware parameters of the virtual machine, such as CPU (Central Processing Unit), memory, and hard disk serial number, to disguise as a real physical machine, and execute the same file multiple times to prevent malware from evading detection by detecting the short-term behavior of the sandbox. In the middle-layer sandbox, the malicious code behavior in the memory can be analyzed according to the corresponding monitoring strategy, and the anti-sandbox technology of the malware can be detected using memory analysis tools, such as dynamic code modification and anti-debugging technology. Combined with the deep log of the virtual environment, the following behaviors are recorded: self-modification behavior of the code (such as using anti-debugging technology, encryption and decryption execution logic), advanced kernel state operations (such as kernel code injection, driver loading). After the above analysis, a detailed behavior analysis report can be generated based on the monitoring results. The analysis report includes: memory dump and code execution path; detailed logs of file and network operations; and the use of anti-sandbox technology.

[0074] It should be noted that the anti-sandbox behavior in this application refers to the behavior generated when the target program uses anti-sandbox technology, such as checking the hardware parameters of the virtual machine and simulating user behavior; if anti-sandbox behavior is detected, the target sandbox can dynamically adjust the parameters of the virtual machine and the environment through an adaptive mechanism. In this embodiment, the intermediate layer sandbox and the advanced sandbox have the function of dynamically adjusting the virtual machine parameters and environmental parameters. Among them, the dynamic adjustment content may include: hardware parameters: adjusting the hardware configuration of the virtual machine, such as modifying BIOS (Basic Input Output System) information, CPU serial number, etc., to make it more like a physical machine; time acceleration / delay mechanism: adjusting the system time or clock frequency to prevent malware from evading detection through delayed execution; simulating user behavior: dynamically generating user behavior scripts to simulate real user operations, such as file access, web browsing, etc.

[0075] For example: If a mining malicious program uses anti-sandbox technology to evade detection, it can be determined whether it is in a sandbox by detecting the system's CPU load, memory usage, and system time. When detecting through this application, the mining malicious program is first executed through the basic sandbox, and the basic sandbox will monitor its attempt to access system resources and detect the CPU load. Due to suspicious behavior, it enters the middle-layer sandbox. In the middle-layer sandbox, the mining malicious program exhibits more anti-sandbox behaviors, such as reading system BIOS information and delaying execution. After the adaptive mechanism detects this behavior, it automatically adjusts the hardware parameters and system time of the virtual machine, and further induces malicious behavior by simulating user behavior. In the advanced sandbox, the mining script attempts to modify the system kernel module to obtain higher computing resources. After multiple executions of the advanced sandbox, the kernel operation and mining pool connection behavior of the script are recorded in detail, and a complete behavior analysis report is generated. Through this detection, the anti-sandbox behavior of the mining malicious program is successfully captured, and the anti-sandbox technology it uses is revealed. The advanced sandbox records the behavior of the mining script in detail and generates a behavior log, including the IP address of the malicious network connection and the specific kernel operation.

[0076] In summary, the present application can automatically adjust the sandbox level after analyzing the operation behavior, reduce unnecessary waste of resources, and gradually deepen the analysis of complex threats, thereby solving the problem of insufficient detection of advanced threats by traditional sandboxes; and, if the malware has anti-sandbox capabilities, such as detecting virtual machines, simulating user behaviors, and delaying execution, the present application can make the sandbox environment difficult to detect by changing the hardware parameters of the virtual machine, dynamically adjusting simulated user operations, and other means through the virtual environment adaptive mechanism, thereby enhancing the concealment of the sandbox.

[0077] join Figure 2 , Figure 2 Another malicious program detection method provided in the present application is a flowchart, and the method specifically includes the following steps:

[0078] S201, determining a target program to be detected;

[0079] S202, determining a target sandbox and a target monitoring strategy from a hierarchical sandbox detection system; the hierarchical sandbox detection system includes at least two sandboxes of different levels;

[0080] S203, running the target program through a target sandbox, and monitoring the operation behavior of the target program through a target monitoring strategy;

[0081] S204, determining the threat score and weighting coefficient of each operation behavior;

[0082] S205, calculating a total score according to the threat score and weighting coefficient of each operation behavior;

[0083] S206, determining whether the total score exceeds the detection threshold corresponding to the target sandbox;

[0084] If yes, execute S207; if no, execute S209.

[0085] S207, determining whether there is a target sandbox and target monitoring strategy at the next level;

[0086] If yes, execute S208; if no, execute S209;

[0087] S208, using the sandbox and monitoring policy of the next level as the target sandbox and target monitoring policy, and continuing to execute S203;

[0088] S209: Determine malicious program detection results based on the behavior monitoring results.

[0089] In this embodiment, the total score can be calculated based on the threat scores of different operating behaviors, and the sandbox environment can be automatically adjusted based on the total score. Sandbox environments of different levels gradually deepen the analysis depth, effectively detect complex malware, and improve detection accuracy. False alarms can be reduced through the setting of a reasonable scoring system and detection thresholds. In addition, the present application targets malicious programs that use anti-sandbox technology, such as mining malicious programs, and can capture them through gradually accumulated scores, and thoroughly analyze their behaviors in advanced sandboxes.

[0090] Specifically, the present application implements an intelligent sandbox switching mechanism through a dynamic decision tree algorithm. Here, the intelligent switching process of the sandbox is described by taking the hierarchical sandbox detection system including the basic sandbox, the middle-layer sandbox and the advanced sandbox as an example. First, when the basic sandbox is running, a decision tree needs to be established, and the initial behavior analysis is based on common system calls and file operations. Then a threat score will be added to each suspicious behavior. If the score exceeds the corresponding detection threshold, it will be automatically promoted to the middle-layer sandbox. In the middle-layer or advanced sandbox, malicious samples may show more anti-sandbox behaviors. At this time, the sandbox parameters are adjusted according to the weighted scores of specific behaviors. Among them, the calculation of the total score is the core of the dynamic decision tree. By assigning scores to different malicious behaviors, the depth of the sandbox analysis can be dynamically adjusted. Here, the above process is described in detail through mining malicious programs.

[0091] 1. Basic sandbox stage

[0092] In the basic sandbox, the system performs lightweight analysis on the initial operation behavior of the target program based on the monitoring strategy. Assume that the behavior log records the following behaviors performed by the target program:

[0093] System calls: VirtualAlloc (memory allocation) is called twice; CreateProcess (create a new process) is called once;

[0094] File operations: read and write C:\Users\Public\Temp\file.tmp;

[0095] Network behavior: Tried to connect to IP address 192.168.1.100, port 8080;

[0096] CPU usage: After running, the CPU usage is 85%.

[0097] See Table 1, which is a behavior score calculation table provided in the embodiment of the present application; Table 1 shows that the final score of each behavior can be calculated based on the threat score of each behavior and the additional weighting coefficient, and the final scores of all behaviors can be added together to obtain the total score, which is compared with the detection threshold of the basic sandbox to determine whether the intermediate layer sandbox needs to continue the analysis. Among them, the weighting coefficient can be determined according to the frequency meter / sensitivity of the behavior.

[0098] Table 1

[0099]

[0100]

[0101] Through the values ​​in Table 1, the total score can be calculated as follows:

[0102] Total score = 7.5 + 8 + 2 + 8.4 + 9 = 34.9

[0103] In this embodiment, the detection threshold of the basic sandbox is set to 30. Since the total score exceeds the detection threshold, the target program is promoted to the intermediate layer sandbox for more in-depth analysis.

[0104] 2. Middle-layer sandbox stage

[0105] In the middle-layer sandbox, the system conducts a deeper analysis of the target program's behavior based on the monitoring strategy and provides a virtual network and user interaction environment. Assume that the behavior log records the following behaviors performed by the target program:

[0106] System call: NtQueryInformationProcess (query process information, detect virtual machine) is called once;

[0107] File operations: read and write

[0108] C:\Windows\System32\drivers\etc\hosts;

[0109] Network behavior: connect to the mining pool server IP 203.0.113.1, port 3333;

[0110] Anti-sandbox behavior: Use GetTickCount to detect the system running time and determine whether the sandbox execution time is shorter than expected.

[0111] See Table 2, which is a behavior score calculation table provided in the embodiment of the present application; Table 2 shows that the final score of each behavior can be calculated based on the threat score of each behavior and the additional weighting coefficient, and the final scores of all behaviors can be added together to obtain the total score, which is compared with the detection threshold of the intermediate layer sandbox to determine whether the advanced sandbox needs to continue the analysis. Among them, the weighting coefficient can be determined according to the frequency meter / sensitivity of the behavior.

[0112] Table 2

[0113]

[0114]

[0115] Through the values ​​in Table 2, the total score can be calculated as:

[0116] Total score = 12 + 11.7 + 15 + 8.4 = 47.1

[0117] In this embodiment, the detection threshold of the intermediate sandbox is set to 40. Since the total score exceeds the detection threshold, the target program is promoted to the advanced sandbox for more in-depth analysis.

[0118] 3. Advanced Sandbox Stage

[0119] In the advanced sandbox, the system performs in-depth analysis of the target program's memory operations and kernel state operations based on monitoring strategies, and executes multiple runs to capture hidden malicious behaviors. Assume that the behavior log records the following behaviors of the target program in the advanced sandbox:

[0120] Memory operations: loading and modifying own code, using anti-debugging techniques

[0121] Kernel mode operation: A suspicious driver evil.sys is loaded

[0122] File operation: Modify registry key value

[0123] HKLM\SYSTEM\CurrentControlSet\Services\evil, add a startup item

[0124] Network behavior: Encrypted communication data is transmitted to the mining pool server

[0125] See Table 3, which is a behavior score calculation table provided in the embodiment of the present application; Table 3 shows that the final score of each behavior can be calculated based on the threat score of each behavior and the additional weighting coefficient, and the final score of all behaviors can be added together to obtain the total score, and the final detection result can be determined based on the total score. Among them, the weighting coefficient can be determined based on the frequency meter / sensitivity of the behavior.

[0126] Table 3

[0127]

[0128] Through the values ​​in Table 3, the total score can be calculated as follows:

[0129] Total score = 18 + 21 + 11.7 + 15 = 65.7

[0130] In this embodiment, the detection threshold of the advanced sandbox is set to 60. Since the total score exceeds the detection threshold, the target program is confirmed to be a malicious program (mining malware).

[0131] From the above steps, we can see that the behavior score of the target program gradually accumulates and is promoted to a higher-level sandbox as the score increases. Finally, in the advanced sandbox, the behavior score of the sample exceeds the set threshold and is determined to be a malicious program. The behavior of the malicious program indicates that it is a mining malware that uses anti-sandbox technology to try to evade detection and communicate with the mining pool server.

[0132] From the above, it can be seen that when calculating the total score, different behaviors have different weight coefficients. Behaviors with lower weights in the basic sandbox (such as ordinary file operations) will not significantly affect the total score, but behaviors with high risk and high frequency (such as memory modification and network communication) will significantly increase the total score. And as the sandbox level increases, the detection threshold gradually increases to ensure that no false positives are generated for harmless programs in the basic sandbox, but advanced sandboxes can capture complex malicious behaviors. Furthermore, higher scores are given for anti-sandbox behaviors (such as detecting system time and detecting virtual machines) to prevent malicious programs from evading detection through anti-sandbox technology.

[0133] join Figure 3 , Figure 3 Another malicious program detection method provided in the present application is a flowchart, and the method specifically includes the following steps:

[0134] S301, determining a target program to be detected;

[0135] S302, determining a target sandbox and a target monitoring strategy from a hierarchical sandbox detection system; the hierarchical sandbox detection system includes at least two sandboxes of different levels;

[0136] S303, running the target program through the target sandbox, and monitoring the operation behavior of the target program through the target monitoring strategy to generate a behavior monitoring result;

[0137] S304. According to the behavior monitoring results, determine whether the next level of sandbox and monitoring strategy is needed to continue detection; if so, execute S305; if not, execute S306.

[0138] S305, taking the sandbox and monitoring policy of the next level as the target sandbox and target monitoring policy, and continuing to execute S303;

[0139] S306, obtaining the operation behavior of the target program according to the behavior monitoring result;

[0140] S307, constructing a target behavior chain using a graph model and operation behaviors;

[0141] S308: Detect malicious behavior features in the target behavior chain through the malicious behavior chain database to generate malicious program detection results.

[0142] In this embodiment, after the target program is detected by the sandbox, in order to improve the detection rate of the target program, the operation behavior of the target program can be further analyzed by the behavior chain analysis technology. The behavior chain analysis technology can use the graph model to build a behavior chain and identify variants or obfuscated malicious programs through the malicious behavior chain database. For example: a malware sample is running in a sandbox, and the system records a series of file modifications, registry key creation, and network connection behaviors. These behaviors are structured into a behavior chain, and through behavior chain feature extraction, the system identifies that the sample executes a behavior pattern similar to that of common ransomware. Through the behavior chain visualization tool, the causal relationship and key behavior path of its operation steps can be clearly seen. In addition, in order to avoid resource consumption, the present application can be set to perform behavior chain analysis through this embodiment only after the last advanced sandbox is run and the total score of the advanced sandbox is greater than the detection threshold of the advanced sandbox.

[0143] Specifically, the operational behavior obtained by the present application based on the behavior monitoring results is obtained through the monitoring strategy when the target program to be detected is placed in the sandbox environment in the above embodiment and runs, and the monitoring dimensions can be specifically: system call monitoring: such as NtCreateFile, NtWriteFile, connect, etc.; network activity monitoring: capturing target IP addresses, ports and traffic characteristics; CPU / GPU (graphics processing unit) resource monitoring: detecting abnormal resource usage behavior.

[0144] For example, the monitored behaviors can be:

[0145] Timestamp 1: 10:03:15.231, Action: NtCreateFile("C:\config.txt"), Result: Success;

[0146] Timestamp 2: 10:03:15.532, Action: NtWriteFile("C:\config.txt", Data), Result: Success;

[0147] Timestamp 3: 10:03:17.456, Behavior: connect(1.2.3.4:3333), Result: Success.

[0148] In this embodiment, it is necessary to decompose each behavior into independent events, and use a graph structure to represent the behavior chain to enhance the analysis of the logical relationship between events. When decomposing events, the system call can be disassembled into basic events, such as decomposing the network connection behavior connect into independent events such as opening a socket, setting a target address, and connection operations, and constructing a behavior chain in the form of a directed graph. The nodes in the behavior chain represent behavior events, and the edges represent time sequences or causal relationships, forming a complete graph structure.

[0149] For example, the basic events are:

[0150] Timestamp 4: 10:03:18.132, Action: socket(AF_INET,SOCK_STREAM), Result: Success;

[0151] Timestamp 5: 10:03:18.234, Behavior: connect(1.2.3.4:3333), Result: Success.

[0152] The generated behavior chain structure diagram contains the nodes:

[0153] NtCreateFile("C:\config.txt")

[0154] NtWriteFile("C:\config.txt")

[0155] socket(AF_INET)

[0156] connect(1.2.3.4:3333)

[0157] Furthermore, after the present application constructs the target behavior chain using the graph model and operational behavior, the malicious behavior features in the target behavior chain can be detected through the malicious behavior chain database to generate malicious program detection results; the malicious behavior chain database includes malicious behavior features of different modes, and the malicious behavior features are identified by matching the target behavior chain with the malicious behavior chain database. During matching, a frequent subgraph mining algorithm (such as GSPAN) can be used to identify characteristic patterns that appear multiple times in the behavior chain, such as network behavior that connects to the mining pool server multiple times. For example: Connect (1.2.3.4:3333) is found to appear multiple times in the behavior chain, indicating that this is a typical behavior of the mining program. During matching, unusual behavior paths can also be identified through anomaly detection algorithms such as Isolation Forest, such as the behavior of modifying system files or disabling protection software. For example: There are modifications in the behavior chain.

[0158] The manipulation of the C:\Windows\System32\drivers\etc\hosts file serves as evidence of malicious behavior.

[0159] It should be noted that the present application can automatically construct a malicious behavior chain database and update it based on new samples. Specifically, the present application can use unsupervised learning algorithms (such as K-Means (k-means clustering algorithm) or DBSCAN (Density-Based Spatial Clustering of Applications with Noise, density-based clustering algorithm)) to cluster and extract typical behavior patterns of malicious programs based on large-scale samples to establish a malicious behavior chain database. For example: the system automatically identifies frequent network connection behaviors and high-frequency resource occupancy patterns by observing the behavior chain of mining programs multiple times, and stores them as features of the mining behavior chain in the malicious behavior chain database.

[0160] The present application can specifically match malicious behavior features by calculating the similarity between the malicious behavior chain and the target behavior chain in the malicious behavior chain database. The specific process is: determine the target malicious behavior chain from the malicious behavior chain database; calculate the behavioral similarity between the target behavior chain and the target malicious behavior chain through the graph edit distance algorithm, fuzzy logic matching rules, and multi-dimensional matching analysis rules; determine whether the behavioral similarity is greater than the similarity threshold; if so, determine that there are malicious behavior features corresponding to the target malicious behavior chain in the target behavior chain. Through similarity analysis, the present application can partially match different versions or obfuscated malicious programs to improve the accuracy of detection.

[0161] In this embodiment, the Graph Edit Distance (GED) algorithm is specifically used to calculate the similarity between behavior chains, allowing partial changes in nodes (behavior events) and edges (time series or causal relationships). The calculation formula is:

[0162]

[0163] Among them, SizeA represents the size of behavior chain A in the graph model, usually indicating the number of nodes or edges in behavior chain A. SizeB represents the size of behavior chain B in the graph model, usually indicating the number of nodes or edges in behavior chain B. GraphEdit Distance(A,B) represents the graph edit distance, which indicates the minimum number of editing operations (such as inserting, deleting, and replacing nodes or edges) required to convert from behavior chain A to behavior chain B. For example: the similarity between behavior chain A and behavior chain B is 0.85, which means that although the behavior chains of the two programs are partially different, the overall patterns are similar, and they may be variant malicious programs.

[0164] In addition, when the graph edit distance algorithm calculates similarity, it can be calculated through fuzzy logic matching rules and multi-dimensional matching analysis rules. Among them, fuzzy logic matching rules allow changes in behavior order, content, object details, etc., and the fuzzy matching mechanism can still accurately identify malicious behavior when there are slight changes in behavior. For example, the behavior chain of a new malicious sample does not completely match multiple known malicious samples in the database, but through the fuzzy matching algorithm, the system finds that the behavior chain of the sample has a high degree of similarity with a cross-platform malware. Although the behavior details are somewhat different, the overall attack path and execution logic are basically the same. The system infers that this is a variant of the same type of malware and marks it. Multi-dimensional matching analysis rules can match and compare in multiple dimensions, such as the time dimension of behavior, the spatial dimension (file operation, network activity, resource usage, etc.), and the behavior type dimension, which enhances the accuracy and comprehensiveness of malicious behavior chain matching.

[0165] Specifically, in the fuzzy logic matching rules, tolerance can be set to allow some behavior sequences and object details to change, but when the core behavior pattern remains the same, it is still judged as similar. For example, the tolerance for behavior sequence changes is set to 15%, and the tolerance for behavior objects (such as IP addresses, file paths) changes is set to 30%. In this way, although the target IP address changes from 1.2.3.4:3333 to 5.6.7.8:3333, the core of the behavior chain is still a continuous connection to the mining pool, so it is judged as a similar malicious program. Through multi-dimensional matching analysis rules, different dimensions of the behavior chain (such as file operations, network connections, and resource usage) can be analyzed to ensure that malicious programs can still be identified even when individual dimensions change. In the multi-dimensional matching analysis rules, the weights of different dimensions can be set, such as: the weight of the file operation dimension is 40%, the weight of the network connection dimension is 30%, and the weight of the resource usage dimension is 30%. Therefore, the final matching result can be obtained by combining the detection results of each dimension. For example, although the target IP of the network connection mining pool has changed, the CPU / GPU resource usage pattern and file reading and writing behavior remain the same, and it can still be determined as the same type of mining behavior.

[0166] In summary, the detection system based on behavior chain analysis in this application achieves efficient detection of complex, obfuscated, and variant malicious programs through means such as behavior chain graph structuring, fuzzy logic matching, multi-dimensional analysis, and behavior chain similarity calculation. Unlike traditional signature-based detection methods, it can capture the core behavior patterns of malware and accurately identify programs even if they are encrypted or obfuscated. It is particularly suitable for detecting malware that frequently abuses system resources, such as mining programs.

[0167] See also Figure 4 , Figure 4 A schematic diagram of the structure of a malicious program detection device provided in an embodiment of the present application, the device specifically comprises:

[0168] A first determination module 11 is used to determine a target program to be detected;

[0169] A second determination module 12 is used to determine a target sandbox and a target monitoring strategy from a hierarchical sandbox detection system; the hierarchical sandbox detection system includes at least two sandboxes of different levels;

[0170] An operating module 13, used for operating the target program through a target sandbox;

[0171] A monitoring module 14, configured to monitor the operation behavior of the target program through a target monitoring strategy to generate a behavior monitoring result;

[0172] A judgment module 15 is used to judge whether the next level of sandbox and monitoring strategy is needed to continue detection according to the behavior monitoring result; if so, trigger the third determination module 16; if so, trigger the fourth determination module 17;

[0173] The third determination module 16 is used to determine the sandbox and monitoring strategy of the next level, and use the sandbox and monitoring strategy of the next level as the target sandbox and target monitoring strategy to trigger the operation module 13;

[0174] The fourth determination module 17 is used to determine the malicious program detection result according to the behavior monitoring result.

[0175] As an optional embodiment, the hierarchical sandbox detection system includes:

[0176] A basic sandbox, an intermediate sandbox and an advanced sandbox; wherein the basic sandbox runs the target program through a lightweight isolation environment and monitors a first operation behavior of the target program; the intermediate sandbox runs the target program by simulating a partial operating system environment and monitors a second operation behavior of the target program; the advanced sandbox runs the target program multiple times by simulating a complete operating system environment and monitors a third operation behavior of the target program.

[0177] As an optional embodiment, the monitoring module includes:

[0178] The adjustment unit is used to dynamically adjust the virtual machine parameters and user simulation behavior of the target sandbox when the target program is monitored to execute anti-sandbox behavior through the target monitoring strategy.

[0179] As an optional embodiment, the monitoring module includes:

[0180] A monitoring unit, used to monitor the operation behavior of the target program through a target monitoring strategy;

[0181] A first determination unit, used to determine a threat score and a weighting coefficient of each operation behavior;

[0182] The calculation unit is used to calculate the total score according to the threat score and weighting coefficient of each operation behavior.

[0183] As an optional embodiment, the judging module includes:

[0184] a first determination unit, configured to determine whether the total score exceeds a detection threshold corresponding to a target sandbox; if not, triggering a second determination unit; if yes, triggering a second determination unit;

[0185] A second determination unit, configured to determine a malicious program detection result according to the behavior monitoring result;

[0186] A second judgment unit is used to judge whether there is a target sandbox and a target monitoring strategy of the next level; if not, the second determination unit is triggered; if yes, the determination unit is triggered;

[0187] The determination unit is used to determine whether the next level of sandbox and monitoring strategy is needed to continue detection.

[0188] As an optional embodiment, the fourth determining module includes:

[0189] An acquisition unit, used for acquiring the operation behavior of the target program according to the behavior monitoring result;

[0190] A construction unit is used to construct a target behavior chain using a graph model and operation behaviors;

[0191] The detection unit is used to detect malicious behavior features in the target behavior chain through a malicious behavior chain database and generate a malicious program detection result.

[0192] As an optional embodiment, the detection unit includes:

[0193] A determination subunit, used to determine a target malicious behavior chain from a malicious behavior chain database;

[0194] A calculation subunit, used to calculate the behavior similarity between the target behavior chain and the target malicious behavior chain through a graph edit distance algorithm, a fuzzy logic matching rule, and a multi-dimensional matching analysis rule;

[0195] A judging subunit, used to judge whether the behavior similarity is greater than a similarity threshold; if so, triggering a judging subunit;

[0196] The determination subunit is used to determine whether there is a malicious behavior feature corresponding to the target malicious behavior chain in the target behavior chain.

[0197] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0198] See also Figure 5 , Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, the electronic device specifically includes:

[0199] The processor 21, the memory 22 and a computer program stored in the memory 22 and executable on the processor 21. The processor 21 executes the steps of the malicious program detection method described in any of the above method embodiments through the computer program.

[0200] Among them, the processor 21 may include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 21 may be implemented in at least one hardware form of DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor is a processor for processing data in the awake state, also known as a CPU (Central Processing Unit); the coprocessor is a low-power processor for processing data in the standby state. In some embodiments, the processor 21 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the display screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to process computing operations related to machine learning.

[0201] The memory 22 may include one or more computer-readable storage media, which may be non-transitory. The memory 22 may also include a high-speed random access memory, and a non-volatile memory, such as one or more disk storage devices, flash memory storage devices. In this embodiment, the memory 22 is at least used to store the following computer program 221, wherein, after the computer program is loaded and executed by the processor 21, it can implement the relevant steps in the malicious program detection method disclosed in any of the aforementioned embodiments. In addition, the resources stored in the memory 22 may also include an operating system 222 and data 223, etc., and the storage method may be temporary storage or permanent storage. Among them, the operating system 222 may include Windows, Unix, Linux, etc.

[0202] In some embodiments, the electronic device may further include a display screen 23 , an input / output interface 24 , a communication interface 25 , a sensor 26 , a power source 27 , and a communication bus 28 .

[0203] certainly, Figure 5 The structure of the electronic device shown does not constitute a limitation on the electronic device in the embodiments of the present application. In actual applications, the electronic device may include Figure 5 More or fewer components than shown, or combinations of certain components.

[0204] In another exemplary embodiment, a computer storage medium is also provided, and when the program instructions are executed by the processor, the steps of the malicious program detection method described in any of the above method embodiments are implemented. The storage medium may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes.

[0205] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments, and this embodiment will not be described in detail here.

[0206] It should be understood that the terms used herein are only for the purpose of describing specific example embodiments and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "include", "comprise", "contain", and "have" are inclusive, and therefore specify the existence of stated features, steps, operations, elements and / or parts, but do not exclude the existence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not interpreted as necessarily requiring them to be performed in the specific order described or illustrated, unless the execution order is clearly indicated. It should also be understood that additional or alternative steps may be used.

[0207] The foregoing is merely a specific embodiment of the present invention, which enables those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for detecting malicious programs, characterized in that: include: Determine the target program to be tested; Determine the target sandbox and target monitoring strategy from the hierarchical sandbox detection system; The hierarchical sandbox detection system includes at least two sandboxes of different levels; Running the target program through a target sandbox, and monitoring the operation behavior of the target program through a target monitoring strategy to generate a behavior monitoring result; Based on the behavior monitoring results, determine whether the next level of sandbox and monitoring strategy is needed to continue detection; If yes, the next level of sandbox and monitoring policy are used as the target sandbox and target monitoring policy, and the step of running the target program through the target sandbox is continued; If not, the malicious program detection result is determined based on the behavior monitoring result.

2. The malicious program detection method according to claim 1, characterized in that: The hierarchical sandbox detection system comprises: A basic sandbox, an intermediate sandbox and an advanced sandbox; wherein the basic sandbox runs the target program through a lightweight isolation environment and monitors a first operation behavior of the target program; the intermediate sandbox runs the target program by simulating a partial operating system environment and monitors a second operation behavior of the target program; the advanced sandbox runs the target program multiple times by simulating a complete operating system environment and monitors a third operation behavior of the target program.

3. The malicious program detection method according to claim 1, characterized in that: The operation behavior of the target program is monitored through a target monitoring strategy, including: If the target program is monitored to perform anti-sandbox behavior through the target monitoring policy, the virtual machine parameters and user simulation behavior of the target sandbox are dynamically adjusted.

4. The malicious program detection method according to claim 1, characterized in that: The target program's operation behavior is monitored by the target monitoring strategy to generate a behavior monitoring result, including: Monitoring the operation behavior of the target program through a target monitoring strategy; Determine the threat score and weighting factor for each operation behavior; The total score is calculated based on the threat score and weighting coefficient of each operation behavior.

5. The malicious program detection method according to claim 4, characterized in that: The step of determining whether the next level of sandbox and monitoring strategy is needed to continue the detection according to the behavior monitoring result includes: Determining whether the total score exceeds a detection threshold corresponding to a target sandbox; If not, determine the malicious program detection result based on the behavior monitoring result; if so, determine whether there is a next-level target sandbox and target monitoring strategy; If not, the malicious program detection result is determined based on the behavior monitoring result; if so, it is determined that the next level of sandbox and monitoring strategy is needed to continue detection.

6. The method for detecting malicious programs according to any one of claims 1 to 5, characterized in that: Determining the malicious program detection result according to the behavior monitoring result includes: Obtain the operation behavior of the target program according to the behavior monitoring results; Use graphical models and operational behaviors to build target behavior chains; The malicious behavior characteristics in the target behavior chain are detected through a malicious behavior chain database to generate a malicious program detection result.

7. The malicious program detection method according to claim 6, characterized in that: Detecting malicious behavior features in the target behavior chain through a malicious behavior chain database includes: Determine a target malicious behavior chain from a malicious behavior chain database; Calculate the behavior similarity between the target behavior chain and the target malicious behavior chain through graph edit distance algorithm, fuzzy logic matching rule and multi-dimensional matching analysis rule; Determining whether the behavior similarity is greater than a similarity threshold; If so, it is determined that there is a malicious behavior feature corresponding to the target malicious behavior chain in the target behavior chain.

8. A malicious program detection device, characterized in that: include: A first determination module, used to determine a target program to be detected; A second determination module is used to determine a target sandbox and a target monitoring strategy from a hierarchical sandbox detection system; The hierarchical sandbox detection system includes at least two sandboxes of different levels; A running module, used for running the target program through a target sandbox; A monitoring module, used to monitor the operation behavior of the target program through a target monitoring strategy to generate a behavior monitoring result; A judgment module, used to judge whether the next level of sandbox and monitoring strategy is needed to continue detection according to the behavior monitoring result; if so, triggering a third determination module; If yes, trigger the fourth determination module; A third determination module is used to determine the sandbox and monitoring strategy of the next level, and use the sandbox and monitoring strategy of the next level as the target sandbox and target monitoring strategy to trigger the operation module; The fourth determination module is used to determine the malicious program detection result according to the behavior monitoring result.

9. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the steps of the malicious program detection method described in any one of claims 1 to 7 of the present application through the computer program.

10. A computer storage medium, characterized in that: The computer storage medium stores computer executable instructions, and the computer executable instructions are used to execute the steps of the malicious program detection method described in any one of claims 1 to 7 of the present application.

Images