Method, system and equipment for inducing malicious sample triggering behavior in sandbox and medium

Abstract

The invention provides a method, a system, equipment and a medium for inducing a malicious sample to trigger a behavior in a sandbox, and the method comprises the steps: operating a management module outside a virtual machine, and carrying out script compiling and script issuing through the management module; an environment function name to be constructed and related parameters are described in the script; and running an agent module in the virtual machine, realizing an environment construction function item through the agent module, and constructing a malicious sample running environment according to a script by utilizing the environment construction function item. Through script design and environment function construction, malicious sample behaviors can be induced and triggered to a certain extent, and the malicious sample behavior discovery capability of the sandbox is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, system, device and medium for inducing malicious sample triggering behavior in a sandbox. Background Art

[0002] Currently, most of the malicious sample behavior analysis systems based on sandboxes on the market use virtual machines. The core workflow is as follows: the host machine to which the sandbox belongs starts a virtual machine, transfers the sample file into the virtual machine and starts the sample file, captures the sample behavior during the sample operation, and finally automatically analyzes the captured behavior data to determine the threat level of the sample.

[0003] When the sandbox has strong behavior capture capabilities, wide coverage of automated behavior analysis, and sufficient anti-virtual machine detection capabilities to deceive samples, it can indeed produce better results. However, the virtual machine environment built into the sandbox itself is designed for sample analysis, and both static features such as the file system and dynamic features such as process lists and network traffic are too simple and inactive. Some advanced samples do not execute all their codes in sequence from the beginning, but scan and judge their operating environment, and only execute the corresponding code snippets when they find features of interest. If these samples are simply put into a virtual machine for execution, the core code of the sample will not be executed because it does not meet the execution conditions, and ultimately its behavior cannot be captured. In response to the above problems, the present invention proposes a solution to actively trigger sample behavior by constructing a rich operating environment, which can be used to enhance the sandbox's sample behavior discovery capability. Summary of the invention

[0004] The present invention aims to provide a method, system, device and medium for inducing malicious samples to trigger behavior in a sandbox, so as to solve the problem that the sandbox virtual machine environment is too complex and inactive, resulting in the core behavior of the malicious samples cannot be triggered and thus cannot be detected.

[0005] The present invention provides a method for inducing malicious samples to trigger behavior in a sandbox, comprising:

[0006] A management module is run outside the virtual machine, and scripts are compiled and issued through the management module; the scripts describe the names of environment functions to be built and related parameters;

[0007] An agent module is run inside the virtual machine, an environment construction function item is implemented through the agent module, and the environment construction function item is used to build a malicious sample operating environment according to the script.

[0008] Furthermore, the management module has script management function and script downloading function;

[0009] Compile scripts through the script management function.

[0010] The script download function provides a script download interface for issuing scripts.

[0011] Furthermore, the management module provides the proxy module with resources corresponding to the script through the local HTTP service site.

[0012] Furthermore, the proxy module parses the received script through the script parsing function; the script parsing function is implemented using a mapping table, that is, mapping the environment function name in the script and the address of the environment construction function item implementation function, and parsing the corresponding parameters when interpreting and executing a single action in the script, and then using the assembly instruction push to push the functions out of the stack one by one, and finally using the call instruction to call the corresponding environment construction function item implementation function.

[0013] Furthermore, the environment construction function items include: file generation function, system account creation function, registry entry creation function, file download function, file opening function, process simulation function, network service simulation, keyboard key simulation, mouse movement and key simulation, and one or more environment construction function items in network traffic simulation.

[0014] Furthermore, the proxy module can execute the environment construction function item in a multi-threaded or multi-process manner.

[0015] Further, the process of sandbox analysis sample is as follows:

[0016] The proxy module starts before the malicious sample and immediately requests the script from the management module;

[0017] The management module sends the script in the activated state to the agent module;

[0018] The proxy module receives and parses the script, calls the environment building function item, and builds the environment functions in the virtual machine in sequence according to the script;

[0019] When the script is executed, the proxy module instructs the sandbox to continue executing the malicious sample process.

[0020] Furthermore, in the proxy module, anti-virtual machine detection is used to prevent malicious samples from detecting whether they are running in a virtual machine.

[0021] Furthermore, the anti-virtual machine detection includes registry query interception, file access interception and virtual machine process information modification.

[0022] Furthermore, the registry query interception is implemented as follows:

[0023] Write a kernel module to call CmRegisterCallbackEx kernel function to implement a registry call filtering function; when the callback function parameter Argument1 value is RegNtPostQueryValueKey, modify the corresponding field in Argument(REG_POST_OPERATION_INFORMATION) to return the custom registry key value; the kernel module provides a rule setting interface to the application, which accepts the registry item path and the custom registry key value and adds them to a mapping table; when an application queries the registry, if the registry item path hits any item in the mapping table, the corresponding custom registry key value is returned.

[0024] Furthermore, the modification of the virtual machine process information is implemented by writing a dynamic link library to hide the virtual machine file information and process information function from the malicious sample process, and injecting it into the malicious sample process at the initial stage of the malicious sample startup.

[0025] Furthermore, the implementation method of the file access interception module is as follows: write a MiniFilter driver module, determine whether the current process is a malicious sample process in the callback function corresponding to the configured IRP_MJ_CREATE, and if so, determine whether the file name to be opened contains the set string. If it does, assign Data->IoStatus.Status to STATUS_ACCESS_DENIED and terminate the filtering and return directly to the application layer; otherwise, send the request directly to the next filter.

[0026] The present invention also provides a system for inducing malicious samples to trigger behavior in a sandbox, comprising:

[0027] A management module running outside the virtual machine, used for script compilation and script distribution; the script describes the name of the environment function to be built and related parameters;

[0028] The proxy module running inside the virtual machine is used to implement the environment construction function items, and use the environment construction function items to build the malicious sample running environment according to the script.

[0029] Furthermore, the system for inducing malicious samples to trigger behaviors in the sandbox also includes an anti-virtual machine detection module, which is used to prevent malicious samples from detecting whether they are running in a virtual machine through anti-virtual machine detection.

[0030] The present invention also provides an electronic device, comprising:

[0031] at least one processor; and a memory communicatively coupled to the at least one processor;

[0032] The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the instructions stored in the memory, so that the at least one processor executes the method of inducing malicious samples to trigger behavior in the sandbox.

[0033] The present invention also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the method of inducing malicious samples to trigger behavior in the sandbox is implemented.

[0034] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0035] Malicious samples usually do not execute all the behaviors they are designed to perform from beginning to end. If the behavior of the malicious sample is not triggered, the sandbox cannot detect it. Through the present invention, the malicious sample behavior can be induced and triggered to a certain extent according to the script design and environment function construction, thereby enhancing the malicious sample behavior detection capability of the sandbox. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 Schematic diagram of a system for inducing malicious samples to trigger behavior in a sandbox in an embodiment of the present invention.

[0037] Figure 2 This is a flow chart of sandbox analyzing malicious samples when applying the method of inducing malicious samples to trigger behavior in the sandbox in an embodiment of the present invention.

[0038] Figure 3 Schematic diagram of the script library in an embodiment of the present invention.

[0039] Figure 4 Schematic diagram of the structure of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0041] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] In order to address the problem that the sandbox virtual machine environment is too complex and inactive, resulting in the core behavior of malicious samples failing to be triggered and thus failing to be detected, this embodiment proposes a method for inducing malicious samples to trigger behavior in a sandbox. By conducting a series of static and dynamic activities from multiple aspects inside the virtual machine and building an active computer scenario, a simulation of a real production computer environment is achieved, thereby providing malicious samples with sufficient information and conditions to trigger their behavior.

[0043] like Figure 1 As shown, the method of inducing malicious samples to trigger behavior in the sandbox includes:

[0044] A management module is run outside the virtual machine, and scripts are compiled and issued through the management module; the scripts describe the names of environment functions to be built and related parameters;

[0045] An agent module is run inside the virtual machine, an environment construction function item is implemented through the agent module, and the environment construction function item is used to build a malicious sample operating environment according to the script.

[0046] In this embodiment, the script consists of multiple lines of text, each line of the text corresponds to a function call of the proxy module, which consists of the environment function name and related parameters. If the first character of a line is '#', it means that this is a comment line. Multiple different scripts constitute a script library, and there is only one script in the script library that is activated.

[0047] The management module has a script management function. By compiling scripts through the script management function and combining it with the environment construction function implemented by the proxy module, a malicious sample operating environment with diverse types and rich content can be constructed, so that the malicious samples believe that they are indeed in a real, active, and interesting environment, triggering the malicious samples to execute their related code fragments, showing their designed behaviors, and then capturing them through the sandbox behavior detection logic, thereby further discovering the behavioral characteristics of the malicious samples.

[0048] Furthermore, for actions designed for specific scripts, the original sandbox behavior detection logic is modified to detect malicious sample behaviors at a finer granularity. For example, if the script indicates that the proxy module generates a sensitive file, the sandbox behavior detection logic can be used to determine whether the malicious sample has accessed the content of the sensitive file. In the specific implementation process, implementers can write scripts with a wide range of coverage and rich processes based on the script mechanism proposed by the present invention and in combination with actual conditions and apply them to practice, so as to achieve the purpose of triggering and detecting malicious sample behavior characteristics. Figure 2 An example of a script library is given.

[0049] The management module also has a script downloading function, which provides a script downloading interface for script distribution. Correspondingly, the agent module needs to implement the script downloading and script parsing functions, and call the corresponding environment construction function items to build the environment according to the environment function name and related parameters described in the script.

[0050] For the script download function, the management module provides the proxy module with the corresponding resources of the script through the local HTTP service site. The directory of the local HTTP service site stores a large number of simulated office files, pcap traffic files, audio files, video files, software installation packages and other resource files in a classified manner to support the script download function. Specific document files can be named as sensitive files, and the document content can also be forged as sensitive content. The pcap traffic package can contain rich traffic information such as ftp file download traffic, email sending and receiving traffic, various website access traffic, http download traffic, etc. According to actual needs, the corresponding resources can be downloaded from the above-mentioned HTTP service site through the script download function.

[0051] Furthermore, the script parsing function of the proxy module is implemented using a mapping table, that is, the environment function name in the script and the address of the environment construction function item implementation function are mapped, and the corresponding parameters are parsed when interpreting and executing a single action in the script, and then the assembly instruction push is used to push the function out of the stack in sequence, and finally the call instruction is used to call the corresponding environment construction function item implementation function. The proxy module implements a series of fine-grained environment construction function items that can accept parameters at the application layer. The environment construction function items can construct the virtual machine environment in multiple dimensions. In actual applications, the environment construction function items of the proxy module should be expanded according to actual needs and the script management function of the management module should be modified synchronously. When the malicious sample runs and finds the environment of interest, it will run the relevant code snippets and be captured by the sandbox behavior detection logic.

[0052] The following describes some of the environment building functions that the agent module needs to implement:

[0053] a. File generation function, calling CreateFile and WriteFile functions to generate a file in the specified path and fill it with specified content or random content.

[0054] b. System account creation function, calling NetUserAdd function to generate a system account according to the specified user name and password.

[0055] c. Registry key creation function, calls the RegCreateKeyEx function to create a registry key with a specified path, and calls the RegSetValueEx function to write the specified value.

[0056] d. File download function, calls libcurl related functions to implement file download, and downloads the specified URL path file to the specified location of the local file system.

[0057] e. File opening function, calling ShellExecute function to use the default software to open the specified file, such as when ShellExecute passes a docx document path, it will use Microsoft Word office software to open and display the document, and when it passes a pdf document path, it will use Adobe Reader software to open and display it.

[0058] f. Process simulation function: the proxy module implements an empty shell program and copies the empty shell program with the specified target name, and then starts the process to simulate the process with the specified name, such as acad.exe, foxmail.exe, wechat.exe, mplayer.exe, qq.exe, wps.exe, firefox.exe, chrome.exe, etc.

[0059] g. Network service simulation, the proxy module implements a function of listening on a specified port number, which can listen according to the specified port number and respond to preset content when a client accesses it. The specific implementation method is to call the socket, bind, listen, accept, recv, and send functions in sequence, where the port number is specified by a parameter. This function runs in an independent thread to avoid blocking other functions.

[0060] h. Keyboard key simulation, call the SendInput function to simulate keyboard key presses according to the key sequence specified by the parameters. This function runs in an independent thread to avoid blocking other functions.

[0061] i. Mouse movement and button simulation, call SetCursorPos function and mouse_event function to realize mouse position movement and mouse button operation. This function runs in an independent thread to avoid blocking other functions.

[0062] j. Network traffic simulation: call the tcpreplay tool to implement network traffic simulation, where the file path of the traffic packet and the network card interface are specified by parameters.

[0063] like Figure 3 As shown in the figure, applying the method of inducing malicious samples to trigger behavior in the sandbox, the process of sandbox analysis samples is as follows:

[0064] The proxy module starts before the malicious sample and immediately requests the script from the management module;

[0065] The management module sends the script in the activated state to the agent module;

[0066] The proxy module receives and parses the script, calls the environment building function item, and builds the environment functions in the virtual machine in sequence according to the script;

[0067] When the script is executed, the proxy module instructs the sandbox to continue executing the malicious sample process. Among them, the function entries in the script support background execution, that is, the function entries in the script will not block the execution of subsequent entries, requiring the proxy module to be able to execute those time-consuming environment construction function items in a multi-threaded or multi-process manner.

[0068] In addition, an anti-virtual machine detection module is run inside the virtual machine to prevent malicious samples from detecting whether they are running in the virtual machine to a certain extent through a series of anti-virtual machine detection measures. In this embodiment, three methods are used to implement anti-virtual machine detection, namely, registry query interception, file access interception, and virtual machine process information modification. Among them:

[0069] (1) The implementation method of registry query interception is:

[0070] Write a kernel module to call CmRegisterCallbackEx kernel function to implement a registry call filtering function; when the callback function parameter Argument1 value is RegNtPostQueryValueKey, modify the corresponding field in Argument(REG_POST_OPERATION_INFORMATION) to return the custom registry key value; the kernel module provides a rule setting interface to the application, which accepts the registry item path and the custom registry key value and adds them to a mapping table; when an application queries the registry, if the registry item path hits any item in the mapping table, the corresponding custom registry key value is returned.

[0071] The proxy module uses the above registry query interception and adds the following rules:

[0072] (HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIO S\BIOSVendor,LENOVO)

[0073] (HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIO S\BIOSVersion,M1UKT62A)

[0074] (HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIO S\SystemFamily,ThinkCentre)

[0075] (HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIO S\SystemManufacturer,ThinkCentre)

[0076] (HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIO S\SystemProductName,ThinkCentre)

[0077] (HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\Syst emBiosVersion,LENOVO)

[0078] To achieve hidden virtual machine feature strings, the above registry key paths are not exhaustive and can be expanded on this basis to achieve virtual machine detection methods against malicious samples.

[0079] (2) The implementation method of modifying the virtual machine process information is as follows:

[0080] Write a dynamic link library to hide the virtual machine file information and process information of the malicious sample process, and inject it into the malicious sample process at the beginning of the malicious sample startup. The HOOK Process32Next function in the dynamic link library determines whether the szExeFile member of its second parameter lppe contains the set string (such as "vm" and other strings). If it does, the string value of the szExeFile member is randomly changed, otherwise no modification is made; the above "vm" and other strings can be expanded to intercept more process information query operations.

[0081] (3) The implementation method of the file access interception module is:

[0082] Write a MiniFilter driver module, and in the callback function corresponding to the configured IRP_MJ_CREATE, determine whether the current process is a malicious sample process. If so, determine whether the file name to be opened contains the set string (such as "vm" and other strings). If it does, assign Data->IoStatus.Status to STATUS_ACCESS_DENIED and terminate the filtering and return directly to the application layer; otherwise, send the request directly to the next filter. The above "vm" and other strings can be appropriately expanded according to the actual situation to intercept more file opening operations.

[0083] Correspondingly, this embodiment provides a system for inducing malicious samples to trigger behavior in a sandbox, including:

[0084] A management module running outside the virtual machine, used for script compilation and script distribution; the script describes the name of the environment function to be built and related parameters;

[0085] The proxy module running inside the virtual machine is used to implement the environment construction function items, and use the environment construction function items to build the malicious sample running environment according to the script.

[0086] The specific implementation of the management module and the agent module refers to the aforementioned method description and will not be repeated here.

[0087] In addition, the corresponding anti-virtual machine detection module is also included, which is used to prevent malicious samples from detecting whether they are running in a virtual machine to a certain extent through measures such as registry query interception, file access interception, and virtual machine process information modification. The specific implementation method is also referred to above and will not be repeated here.

[0088] The above describes a method and system for inducing malicious sample triggering behavior in a sandbox provided by an embodiment of the present application, as a possible product form of the above system, such as Figure 4 As shown, an embodiment of the present application further provides an electronic device, including:

[0089] At least one processor; and a communication interface that is communicatively connected to the at least one processor; the at least one processor executes instructions stored in the memory, so that the electronic device executes the method steps executed by any device in the above method embodiments through the communication interface.

[0090] Optionally, the memory is located outside the electronic device.

[0091] Optionally, the electronic device includes the memory, the memory is connected to the at least one processor, and the memory stores instructions that can be executed by the at least one processor. Figure 4The dashed lines indicate that the memory is optional for the electronic device.

[0092] The processor and the memory may be coupled via an interface circuit or may be integrated together, which is not limited here.

[0093] The specific connection medium between the processor, memory and communication interface is not limited in the embodiments of the present application. Figure 4 The processor, memory and communication interface are connected by a bus. Figure 4 The connections between the other components are shown in bold lines, which are only for illustration and are not intended to be limiting. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 In the example, only one thick line is used to represent the bus, but it does not mean that there is only one bus or one type of bus. It should be understood that the processor mentioned in the embodiment of the present application can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc. When implemented by software, the processor can be a general-purpose processor, which is implemented by reading the software code stored in the memory.

[0094] Exemplarily, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0095] It should be understood that the memory mentioned in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DirectRambus RAM, DR RAM).

[0096] It should be noted that when the processor is a general-purpose processor, DSP, ASIC, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, the memory (storage module) can be integrated into the processor.

[0097] It should be noted that the memory described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0098] As another possible product form, an embodiment of the present application also provides a computer-readable storage medium, which is used to store instructions. When the instructions are executed, the computer executes the method steps executed by any device in the above method example.

[0099] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0100] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0101] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0102] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0103] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for inducing malicious samples to trigger behavior in a sandbox, characterized in that: include: A management module is run outside the virtual machine, and scripts are compiled and issued through the management module; the scripts describe the names of environment functions to be built and related parameters; An agent module is run inside the virtual machine, an environment construction function item is implemented through the agent module, and the environment construction function item is used to build a malicious sample operating environment according to the script.

2. The method for inducing malicious sample triggering behavior in a sandbox according to claim 1, characterized in that: The management module has script management function and script download function; Compile scripts through the script management function. The script download function provides a script download interface for issuing scripts.

3. The method for inducing malicious sample triggering behavior in a sandbox according to claim 2, characterized in that: The management module provides the proxy module with script-related resources through the local HTTP service site.

4. The method for inducing malicious samples to trigger behavior in a sandbox according to claim 3, characterized in that: The proxy module parses the received script through the script parsing function; the script parsing function is implemented using a mapping table, that is, mapping the environment function name in the script and the address of the environment construction function item implementation function, and parsing the corresponding parameters when interpreting and executing a single action in the script, and then using the assembly instruction push to push the functions out of the stack in turn, and finally using the call instruction to call the corresponding environment construction function item implementation function.

5. The method for inducing malicious sample triggering behavior in a sandbox according to claim 4, characterized in that: The environment construction function items include: file generation function, system account creation function, registry entry creation function, file download function, file opening function, process simulation function, network service simulation, keyboard key simulation, mouse movement and key simulation, and one or more environment construction function items in network traffic simulation.

6. The method for inducing malicious sample triggering behavior in a sandbox according to claim 4, characterized in that: The proxy module can execute the environment construction function item in a multi-threaded or multi-process manner.

7. The method for inducing malicious sample triggering behavior in a sandbox according to any one of claims 1 to 6, characterized in that: The process of sandbox analysis sample is as follows: The proxy module starts before the malicious sample and immediately requests the script from the management module; The management module sends the script in the activated state to the agent module; The proxy module receives and parses the script, calls the environment building function item, and builds the environment functions in the virtual machine in sequence according to the script; When the script is executed, the proxy module instructs the sandbox to continue executing the malicious sample process.

8. The method for inducing malicious samples to trigger behavior in a sandbox according to claim 1, characterized in that: In the proxy module, anti-virtual machine detection is used to prevent malicious samples from detecting whether they are running in a virtual machine.

9. The method for inducing malicious samples to trigger behavior in a sandbox according to claim 8, characterized in that: The anti-virtual machine detection includes registry query interception, file access interception and virtual machine process information modification.

10. The method for inducing malicious samples to trigger behavior in a sandbox according to claim 9, characterized in that: The registry query interception is implemented as follows: Write a kernel module to call CmRegisterCallbackEx kernel function to implement a registry call filtering function; when the callback function parameter Argument1 value is RegNtPostQueryValueKey, modify the corresponding field in Argument(REG_POST_OPERATION_INFORMATION) to return the custom registry key value; the kernel module provides a rule setting interface to the application, which accepts the registry item path and the custom registry key value and adds them to a mapping table; when an application queries the registry, if the registry item path hits any item in the mapping table, the corresponding custom registry key value is returned.

11. The method for inducing malicious samples to trigger behavior in a sandbox according to claim 9, characterized in that: The modification of the virtual machine process information is implemented by writing a dynamic link library to hide the virtual machine file information and process information function for the malicious sample process, and injecting it into the malicious sample process at the initial stage of the malicious sample startup.

12. The method for inducing malicious samples to trigger behavior in a sandbox according to claim 9, characterized in that: The implementation method of the file access interception module is as follows: write a MiniFilter driver module, determine whether the current process is a malicious sample process in the callback function corresponding to the configured IRP_MJ_CREATE, and if so, determine whether the file name to be opened contains the set string. If it does, assign Data->IoStatus.Status to STATUS_ACCESS_DENIED and terminate the filtering and return directly to the application layer; otherwise, send the request directly to the next filter.

13. A system for inducing malicious samples to trigger behavior in a sandbox, characterized in that: include: A management module running outside the virtual machine, used for script compilation and script distribution; the script describes the name of the environment function to be built and related parameters; The proxy module running inside the virtual machine is used to implement the environment construction function items, and use the environment construction function items to build the malicious sample running environment according to the script.

14. An electronic device, characterized in that: include: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the method according to any one of claims 1 to 12 by executing the instructions stored in the memory.

15. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store instructions, and when the instructions are executed, the method according to any one of claims 1 to 12 is implemented.

Images