Behavior detection method for malicious code and related equipment

Abstract

The embodiment of the invention provides a malicious code behavior detection method and related equipment. The malicious code behavior detection method comprises the following steps: running a sample code in a sandbox; calling a callback routine in response to a predetermined operation of the sample code; in response to the callback routine, determining whether the sample code is a malicious code; if the sample code is the malicious code, the follow-up behavior of the sample code is actively triggered, and the follow-up behavior is the follow-up behavior of the predetermined operation of the sample code. According to the technical scheme, the follow-up behavior of the malicious code is actively triggered to ensure that the malicious code executes all malicious functions, so that the functions and behaviors of the malicious code are analyzed more comprehensively, the defense ability to the malicious code is improved, and meanwhile, the recording of the follow-up behavior of the malicious code is facilitated. And researchers can be helped to analyze sources, propagation paths, behavior modes and targets of malicious codes.

Description

Technical Field

[0001] The present application relates to the field of computer and communication technology, and in particular to a malicious code behavior detection method and related equipment. Background Art

[0002] In current computer offense and defense confrontations and network attacks, malicious codes use a variety of means to increase their concealment and persistence in order to achieve persistent infection, including various persistent subsequent behaviors. That is, these malicious programs may not perform all functions when they are first executed, but add self-startup, services, scheduled tasks, etc. to trigger at subsequent times to evade detection. Conventional security software cannot detect related behaviors, resulting in some malicious codes escaping detection. Summary of the invention

[0003] The embodiments of the present application provide a malicious code behavior detection method and related equipment, thereby overcoming, at least to a certain extent, the problem that the security software in the prior art cannot detect the persistent subsequent behavior of malicious code, causing some malicious code to escape detection.

[0004] Other features and advantages of the present application will become apparent from the following detailed description, or may be learned in part by the practice of the present application.

[0005] According to one aspect of an embodiment of the present application, a behavior detection method for malicious code is provided, comprising: running sample code in a sandbox; calling a callback routine in response to a predetermined operation of the sample code; and determining whether the sample code is malicious code in response to the callback routine.

[0006] In some embodiments of the present application, the predetermined operation is an operation on the registry, and the responding to the callback routine to determine whether the sample code is malicious code specifically includes: responding to the callback routine to determine target key value information, wherein the target key value information is the registry key value information after the sample code performs the predetermined operation; and determining whether the sample code is malicious code based on the target key value information.

[0007] In some embodiments of the present application, the target key value information includes a registry key value and a registry key value type, and determining whether the sample code is malicious code based on the target key value information specifically includes: determining whether the sample code is suspicious code based on the registry key value; if the sample code is suspicious code, determining whether the sample code is malicious code based on the registry key value type.

[0008] In some embodiments of the present application, the predetermined operation is an operation on the file system, and the responding to the callback routine to determine whether the sample code is malicious code specifically includes: responding to the callback routine to record a target file, wherein the target file is a file in the file system that has been operated; and determining whether the sample code is malicious code based on the target file.

[0009] In some embodiments of the present application, determining whether the sample code is malicious code based on the target file specifically includes: judging whether the target file belongs to a self-starting file directory; if the target file belongs to a self-starting file directory, determining that the sample code is malicious code.

[0010] In some embodiments of the present application, the predetermined operation is an operation on a scheduled task process, and the responding to the callback routine to determine whether the sample code is malicious code specifically includes: responding to the callback routine to record scheduled task information; and determining whether the sample code is malicious code based on the scheduled task information.

[0011] In some embodiments of the present application, the planned task information includes a process path and a command line, and determining whether the sample code is malicious code based on the process information specifically includes: comparing the process path and the command line to determine whether they match a preset process path and a preset command line; if the process path matches the preset process path and the command line matches the preset command line, determining that the sample code is malicious code.

[0012] In some embodiments of the present application, calling the callback routine in response to a predetermined operation of the sample code specifically includes: calling the callback routine in response to a target operation of the sample code on the registry; calling the callback routine in response to a target operation of the sample code on a system file; calling the callback routine in response to a target operation of the sample code on a scheduled task process.

[0013] In some embodiments of the present application, if the sample code is malicious code, actively triggering the subsequent behavior of the sample code specifically includes: obtaining target data, the target data is the data generated by the predetermined operation; according to the target data, starting the target file process through the CreateProcessW function to complete the active triggering of the subsequent behavior of the sample code.

[0014] According to one aspect of an embodiment of the present application, a malicious code behavior detection device is provided, and the malicious code behavior detection device includes: a code running module, which is used to run sample code in a sandbox; a routine calling module, which is used to call a callback routine in response to a predetermined operation of the sample code; a code judgment module, which is used to respond to the callback routine to determine whether the sample code is malicious code; and an active triggering module, which is used to actively trigger a subsequent behavior of the sample code if the sample code is malicious code, and the subsequent behavior is a subsequent behavior of the predetermined operation of the sample code.

[0015] In some embodiments of the present application, the predetermined operation is an operation on the registry, and the code judgment module specifically includes: a key value acquisition submodule, which is used to respond to the callback routine and determine the target key value information, and the target key value information is the registry key value information after the sample code executes the predetermined operation; a key value analysis submodule, which is used to determine whether the sample code is malicious code based on the target key value information.

[0016] In some embodiments of the present application, the target key value information includes a registry key value and a registry key value type, and the key value analysis submodule specifically includes: a preliminary judgment unit, used to determine whether the sample code is suspicious code based on the registry key value; and a final judgment unit, used to determine whether the sample code is malicious code based on the registry key value type if the sample code is suspicious code.

[0017] In some embodiments of the present application, the predetermined operation is an operation on the file system, and the code judgment module specifically includes: a file recording submodule, which is used to respond to the callback routine and record the target file, where the target file is a file that has been operated in the file system; and a file analysis submodule, which is used to determine whether the sample code is malicious code based on the target file.

[0018] In some embodiments of the present application, the file analysis submodule specifically includes: a directory judgment unit, used to judge whether the target file belongs to the self-starting file directory; a first judgment unit, used to determine that the sample code is malicious code if the target file belongs to the self-starting file directory.

[0019] In some embodiments of the present application, the predetermined operation is an operation on a scheduled task process, and the code judgment module specifically includes: an information recording submodule, used to respond to the callback routine and record scheduled task information; an information analysis submodule, used to determine whether the sample code is malicious code based on the scheduled task information.

[0020] In some embodiments of the present application, the planned task information includes a process path and a command line, and the information analysis submodule specifically includes: an information matching unit, used to compare the process path and the command line to determine whether they match a preset process path and a preset command line; a second determination unit, used to determine that the sample code is malicious code if the process path matches the preset process path and the command line matches the preset command line.

[0021] In some embodiments of the present application, the routine calling module specifically includes: a first target operation submodule, which is used to call a callback routine in response to the target operation of the sample code on the registry; a second target operation submodule, which is used to call a callback routine in response to the target operation of the sample code on the system file; and a third target operation submodule, which is used to call a callback routine in response to the target operation of the sample code on the scheduled task process.

[0022] In some embodiments of the present application, the active trigger module specifically includes: a data acquisition submodule, used to acquire target data, where the target data is data generated by the predetermined operation; and a process startup submodule, used to start the target file process through the CreateProcessW function according to the target data, so as to complete the active triggering of subsequent behaviors of the sample code.

[0023] According to one aspect of an embodiment of the present application, a computer-readable medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the malicious code behavior detection method as described in the above embodiment is implemented.

[0024] According to one aspect of an embodiment of the present application, an electronic device is provided, comprising: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the malicious code behavior detection method as described in the above embodiments.

[0025] In the technical solutions provided in some embodiments of the present application, the suspicious predetermined operations of the sample code are monitored through the callback routine. After the sample code executes the predetermined operation, the callback-related event of the callback routine is triggered, and the callback routine is called. In response to the callback routine, it is determined whether the sample code is malicious code based on the traces after the sample code executes the predetermined operation. After determining that the sample code is malicious code, its subsequent behavior is actively triggered to ensure that it executes all malicious functions, and then the functions and behaviors of the malicious code are more comprehensively analyzed, thereby improving the defense capabilities against malicious code. At the same time, the record of its subsequent behavior can help researchers analyze the source, propagation path, behavior pattern and target of the malicious code.

[0026] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0028] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solution of the embodiments of the present application can be applied is shown.

[0029] Figure 2 A flow chart of a malicious code behavior detection method provided in an embodiment of the present application is shown.

[0030] Figure 3 Shown according to Figure 2 A specific implementation flow chart of step S300 in the malicious code behavior detection method shown in the corresponding embodiment.

[0031] Figure 4 Shown according to Figure 2 Another specific implementation flow chart of step S300 in the malicious code behavior detection method shown in the corresponding embodiment.

[0032] Figure 5 Shown according to Figure 2 Another specific implementation flow chart of step S300 in the malicious code behavior detection method shown in the corresponding embodiment.

[0033] Figure 6 Shown according to Figure 2 A specific implementation flow chart of step S400 in the malicious code behavior detection method shown in the corresponding embodiment.

[0034] Figure 7 A schematic diagram of the structure of a malicious code behavior detection device provided in an embodiment of the present application is shown.

[0035] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0036] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concept of the example embodiments to those skilled in the art.

[0037] In addition, described feature, structure or characteristic can be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present application. However, those skilled in the art will appreciate that the technical scheme of the present application can be put into practice without one or more of the specific details, or other methods, components, devices, steps, etc. can be adopted. In other cases, known methods, devices, realizations or operations are not shown or described in detail to avoid blurring the various aspects of the application.

[0038] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0039] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0040] Figure 1 A schematic diagram of an exemplary system architecture to which the technical solution of the embodiments of the present application can be applied is shown.

[0041] like Figure 1 As shown, the system architecture may include terminal devices (such as Figure 1 The embodiment of the present invention is a schematic diagram of a mobile phone 101, a tablet computer 102, a portable computer 103, a desktop computer, etc., a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the terminal device and the server 105. The network 104 may include various connection types, such as a wired communication link, a wireless communication link, etc.

[0042] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. According to the implementation requirements, there may be any number of terminal devices, networks and servers. For example, the server 105 may be a server cluster composed of multiple servers.

[0043] The user can use the terminal device to interact with the server 105 through the network 104 to receive or send messages, etc. The server 105 can be a server that provides various services. For example, the user uploads sample code to the server 105 using the terminal device 103 (or the terminal device 101 or 102), and the server 105 can run the sample code in the sandbox; call the callback routine in response to the predetermined operation of the sample code; and determine whether the sample code is malicious code in response to the callback routine.

[0044] It should be noted that the malicious code behavior detection method provided in the embodiment of the present application is generally executed by the server 105, and accordingly, the malicious code behavior detection device is generally set in the server 105. However, in other embodiments of the present application, the terminal device may also have similar functions as the server, so as to execute the malicious code behavior detection solution provided in the embodiment of the present application.

[0045] The implementation details of the technical solution of the embodiment of the present application are described in detail below:

[0046] Figure 2 A flowchart of a malicious code behavior detection method according to an embodiment of the present application is shown. The malicious code behavior detection method can be executed by a server, which can be Figure 1 Refer to the server shown in Figure 2 As shown, the behavior detection method of the malicious code at least includes:

[0047] Step S100: running the sample code in the sandbox.

[0048] Step S200: In response to a predetermined operation of the sample code, a callback routine is called.

[0049] Step S300, responding to the callback routine, determining whether the sample code is malicious code.

[0050] Step S400: If the sample code is malicious code, actively trigger a subsequent behavior of the sample code, where the subsequent behavior is a subsequent behavior of a predetermined operation of the sample code.

[0051] In this embodiment, the suspicious predetermined operations of the sample code are monitored through the callback routine. After the sample code executes the predetermined operation, the callback associated event of the callback routine is triggered and the callback routine is called. In response to the callback routine, it is determined whether the sample code is malicious code based on the traces after the sample code executes the predetermined operation. After determining that the sample code is malicious code, its subsequent behavior is actively triggered to ensure that it executes all malicious functions, and then the functions and behaviors of the malicious code are more comprehensively analyzed, thereby improving the defense capability against malicious code. At the same time, the record of its subsequent behavior can help researchers analyze the source, propagation path, behavior pattern and target of the malicious code.

[0052] In step S100, the code to be detected is put into a sandbox and run as a sample code.

[0053] In step S200, after the sample code is started, the predetermined operation of the sample code is monitored through the callback routine. When the sample code executes the predetermined operation, the callback routine is called to notify the server that the sample code executes the predetermined operation.

[0054] The predetermined operation is a target operation executed by the sample code at a predetermined position, which is a high-frequency operation executed by malicious code. If the sample code executes the predetermined operation, it is very likely to be malicious code.

[0055] Specifically, in some embodiments, the specific implementation of step S200 can refer to the following embodiments. Figure 2 The detailed description of step S200 in the malicious code behavior detection method shown in the corresponding embodiment, in the malicious code behavior detection method, step S200 may include the following steps:

[0056] In response to the sample code's targeted operation on the registry, a callback routine is called.

[0057] In response to the sample code's targeted operation on the system file, a callback routine is called.

[0058] In response to the sample code's targeted operation on the scheduled task process, a callback routine is called.

[0059] In this embodiment, the predetermined operation includes target operations of the sample code on the registry, system files, and scheduled task processes.

[0060] Among them, the target operations on the registry include creating registry entries, opening registry entries, deleting registry entries, querying registry key values, setting registry key values, deleting registry key values, closing registry entries, etc.

[0061] Target operations on system files may include the following items: file creation or opening (i.e. IRP_MJ_CREATE), file reading (i.e. IRP_MJ_READ), file writing (i.e. IRP_MJ_WRITE), setting file information (i.e. IRP_MJ_SET_INFORMATION), querying file information (i.e. IRP_MJ_QUERY_INFORMATION), file system control (i.e. IRP_MJ_FILE_SYSTEM_CONTROL), file directory control (i.e. IRP_MJ_DIRECTORY_CONTROL), file closing (i.e. IRP_MJ_CLOSE), file cleanup (i.e. IRP_MJ_CLEANUP), etc.

[0062] The target operation of the scheduled task process can include the creation and exit of the process.

[0063] Specifically, for monitoring the registry, first call CmRegisterCallbackEx to set the registry notification callback routine in the operating system kernel, which will be called whenever a thread performs an operation on the registry. In the callback routine, a series of registry operations are monitored, including creating registry entries, opening registry entries, deleting registry entries, querying registry key values, setting registry key values, deleting registry key values, closing registry entries, etc.

[0064] For file system monitoring, first call FltRegisterFilter to register the file micro-filter driver, pass the constructed FLT_REGISTRATION structure as the second parameter, specify the corresponding operation callback function set and driver uninstall function; then create a communication server port through FltCreateCommunicationPort so that the application layer can communicate with it; finally, start filtering through FltStartFiltering.

[0065] That is, the file operations occurring in the system are monitored by the file micro-filter driver, and the pre-operation callback function and the post-operation callback function are defined for the target operations. When the corresponding target operation occurs, the file system will first enter the pre-operation callback function before processing, and then hand it over to the file system for processing. After the processing is completed, it will enter the post-operation callback function. Both the pre-operation and post-operation callback functions can filter and control the processing results of the file operation.

[0066] For monitoring of scheduled task processes, first register the process creation notification callback routine in the operating system kernel through the PsSetCreateProcessNotifyEx or PsSetCreateProcessNotifyXP function to monitor process creation and exit operations in the system. When a process is created in the system, it will enter the callback function, where further processing can be performed. The sample process and its created child processes will be intercepted and recorded when they are created and added to the engine's monitoring list.

[0067] In step S300, when the sample code executes a predetermined operation, a callback-associated event is triggered, and the callback routine is called at this time, and the callback routine is responded to (ie, the callback event is responded to) to determine whether the sample code is malicious code.

[0068] The target operations of malicious code in different locations can be monitored in different ways, and the malicious code can also be identified in different ways.

[0069] Specifically, in some embodiments, the specific implementation of step S300 can be found in Figure 3 . Figure 3 is based on Figure 2 The detailed description of step S300 in the malicious code behavior detection method shown in the corresponding embodiment, in the malicious code behavior detection method, the predetermined operation is an operation on the registry, and step S300 may include the following steps:

[0070] Step S310, responding to the callback routine, determining target key value information, wherein the target key value information is the registry key value information after the sample code executes a predetermined operation.

[0071] Step S350: determining whether the sample code is malicious code according to the target key value information.

[0072] In the embodiment of the present application, when the sample code performs the target operation on the registry, the callback-associated event is triggered, and the callback routine is called at this time, and the callback routine is responded to (i.e., the callback event is responded to), and the target key value information is determined. The target key value information is the registry key value information created, modified, or deleted when the sample code performs the predetermined operation, that is, the registry key value information after the sample code performs the predetermined operation. According to the target key value information, the changes made by the sample code to the registry can be determined, and then it can be determined whether the sample code is malicious code.

[0073] In step S310, when the operation request is RegNtPostSetValueKey, further filtering is performed to monitor only the corresponding behaviors of the sample process and its child processes, and then the key value information is determined, and malicious code is filtered through the registry path and key value information of the predetermined operation.

[0074] In step S350, after the key value information is determined, malicious code is screened through the registry path and key value information of the predetermined operation.

[0075] Specifically, in some embodiments, the specific implementation of step S350 can refer to the following embodiments. Figure 3 The detailed description of step S350 in the malicious code behavior detection method shown in the corresponding embodiment, in the malicious code behavior detection method, the target key value information includes a registry key value and a registry key value type, and step S350 may include the following steps:

[0076] According to the registry key value, it is determined whether the sample code is suspicious code.

[0077] If the sample code is suspicious code, whether the sample code is malicious code is determined according to the registry key type.

[0078] In this embodiment, the target key value information includes a registry key value and a registry key value type. The registry key value is first used for preliminary screening to determine whether the sample code has the possibility of being malicious code, that is, to determine suspicious code, and then further screening is performed based on the registry key value type to determine whether the sample code is malicious code.

[0079] In the embodiment of the present application, the key value is determined by triggering the corresponding event, and after the triggering, the registry path of the operation is screened. If it is related to the auto-startup item and the corresponding key value type is REG_SZ or REG_EXPAND_SZ, it is recorded and determined as malicious code. The above registry path includes:

[0080] "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Current Version\\Run\\*"

[0081] "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentV ersion\\Run\\*"

[0082] "HKEY_LOCAL_MACHINE\\Microsoft\\WindowsNT\\CurrentVersion\\Winlogon\\Shell"

[0083] "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit"

[0084] Specifically, in some embodiments, the specific implementation of step S300 can be found in Figure 4 . Figure 4 is based on Figure 2 The detailed description of step S300 in the malicious code behavior detection method shown in the corresponding embodiment, in the malicious code behavior detection method, the predetermined operation is an operation on the file system, and step S300 may include the following steps:

[0085] Step S320, responding to the callback routine, recording the target file, the target file being the file that has been operated in the file system.

[0086] Step S360: Determine whether the sample code is malicious code according to the target file.

[0087] In this embodiment, when the sample code performs the target operation on the file system, the callback-related event is triggered, and the callback routine is called at this time. The callback routine is responded to (i.e., the callback event is responded to), and the target file is recorded. The target file is the file object on which the sample code performs the predetermined operation, i.e., the file that has been operated in the file system. According to the target file, the changes made by the sample code to the file system can be determined, and then whether the sample code is malicious code can be determined.

[0088] In step S320, when a corresponding file operation occurs, the file system will first enter the pre-operation callback function before processing, and then hand it over to the file system for processing. After the processing is completed, it will enter the post-operation callback function. Both the pre-operation callback function and the post-operation callback function can filter and control the processing results of the file operation.

[0089] In step S360, after the target file is determined, malicious code is screened through the target file.

[0090] Specifically, in some embodiments, the specific implementation of step S360 can refer to the following embodiments. Figure 4 The detailed description of step S360 in the malicious code behavior detection method shown in the corresponding embodiment, in the malicious code behavior detection method, step S360 may include the following steps:

[0091] Determine whether the target file belongs to the self-starting file directory;

[0092] If the target file belongs to the self-starting file directory, the sample code is determined to be malicious code.

[0093] In this embodiment, when the sample code performs a file closing operation / file cleaning operation, the current file is recorded and it is determined whether it belongs to the self-starting file directory. If the match is successful (i.e. the target file belongs to the self-starting file directory), the sample code is determined to be malicious code. The above self-starting file directory may include:

[0094] "C:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*"

[0095] "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*"

[0096] Specifically, in some embodiments, the specific implementation of step S300 can be found in Figure 5 . Figure 5 is based on Figure 2 The detailed description of step S300 in the malicious code behavior detection method shown in the corresponding embodiment, in the malicious code behavior detection method, the predetermined operation is an operation on the process, and step S300 may include the following steps:

[0097] Step S330, responding to the callback routine and recording process information.

[0098] Step S370: Determine whether the sample code is malicious code according to the process information.

[0099] In an embodiment of the present application, when the sample code executes the target operation on the scheduled task process, the callback-associated event is triggered. At this time, the callback routine is called, and the callback routine is responded to (i.e., the callback event is responded to), and the process information is recorded. The process information is the process information created when the sample code executes the predetermined operation. Based on the process information, the changes made by the sample code to the scheduled task process can be determined, and then it can be determined whether the sample code is malicious code.

[0100] In step S330, when a process is created in the system, it will enter the callback function, in which further processing can be performed. The sample process and its created subprocesses will be intercepted and recorded when they are created and added to the monitoring list of the engine.

[0101] In step S370, the scheduled task information is recorded, that is, malicious code is filtered through the scheduled task information.

[0102] Specifically, in some embodiments, the specific implementation of step S370 can refer to the following embodiments. Figure 2 The detailed description of step S370 in the malicious code behavior detection method shown in the corresponding embodiment, in the malicious code behavior detection method, the process information includes the process path and command line, and step S370 may include the following steps:

[0103] The process path and the command line are compared to determine whether they match a preset process path and a preset command line.

[0104] If the process path matches the preset process path and the command line matches the preset command line, it is determined that the sample code is malicious code.

[0105] In this embodiment, when the sample process creates a scheduled task, it will create a schtasks.exe process and specify the detailed information of the scheduled task in the command line. When recording the process, the process path and command line are matched. If the match is successful, it is monitored that the sample process has the behavior of creating a scheduled task. At this time, it is recorded and actively triggered to run. Among them, the above-mentioned process path and command line include:

[0106] Process path: "C:\\WINDOWS\\SYS*\\SCHTASKS.EXE"

[0107] Command line: "* / CREATE* / XML*"

[0108] In step S400, after determining that the sample code is malicious code, its subsequent behavior is actively triggered to ensure that it executes all malicious functions, and then the functions and behaviors of the malicious code are more comprehensively analyzed, thereby improving the defense capabilities against malicious code. At the same time, the record of its subsequent behavior can help researchers analyze the source, propagation path, behavior pattern and target of the malicious code.

[0109] Specifically, in some embodiments, the specific implementation of step S400 can be found in Figure 6 . Figure 6 is based on Figure 2 The detailed description of step S400 in the malicious code behavior detection method shown in the corresponding embodiment, in the malicious code behavior detection method, step S400 may include the following steps:

[0110] Step S410, acquiring target data, where the target data is data generated by the predetermined operation.

[0111] Step S420, starting the target file process through the CreateProcessW function according to the target data to complete the active triggering of subsequent behaviors.

[0112] When the scheduled operation is the target operation of the sample code on the registry, the data written into the registry in this target operation is transmitted to the startup process of the detection engine. The data written into the registry is usually the full path of the executable file. Then the startup process of the detection engine starts the target file through the CreateProcessW function, thereby completing the active triggering of subsequent behaviors. After the startup process successfully starts the target file, it will be added to the monitoring list to monitor its specific behavior.

[0113] When the predetermined operation is the target operation of the sample code on the system file, the file path of the target file corresponding to this target operation is transmitted to the startup process of the detection engine. First, it is determined whether the target file is a shortcut file; if the target file is a shortcut file, the target file is parsed and the real executable file is obtained; finally, the startup process of the detection engine is used to start the executable file process through the CreateProcessW function, thereby completing the active triggering of subsequent behaviors. If the target file is not a shortcut file, it is an executable file itself, and the startup process of the detection engine is directly used to start the target file process through the CreateProcessW function, thereby completing the active triggering of subsequent behaviors. After the startup process successfully starts the target file, it will be added to the monitoring list to monitor its specific behavior.

[0114] Specifically, the present application adopts COM library to parse shortcuts. First, the COM library is initialized through CoInitializeEx; then an IShellLink interface object is created through CoCreateInstance function (the first parameter is specified as CLSID_ShellLink) and the IPersistFile interface object pointer is obtained through QueryInterface function; then the Load function is called to load the shortcut file; finally, the target path, command line parameters, and current working directory are obtained.

[0115] After the target path, command line parameters, and current working directory are successfully obtained, the interface pointer and interface object are released. The target path and command line obtained by parsing will eventually be used as the parameters of the startup target file of CreateProcessW.

[0116] The target path, command line parameters, and current working directory are obtained as follows:

[0117] Call the GetPath function to obtain the target path of the shortcut.

[0118] Call the GetArguments function to obtain the command line parameters of the target path.

[0119] Call the GetWorkingDirectory function to get the current working directory.

[0120] When the scheduled operation is the target operation of the sample code on the scheduled task process, the command line of the schtasks process is passed to the startup process of the detection engine, and then the command line of the schtasks process is parsed to extract the scheduled task from the command line. Among them, the " / CREATE" in the command line indicates to create a new scheduled task; the " / XML xmlfile" in the command line indicates to create a task from the specified task XML in the file. Extract the XML file path after " / XML", then load the corresponding XML file, and extract Task, Actions, Exec, and Command from it in turn to obtain the real command line. Finally, the startup process of the detection engine starts the target process through the CreateProcessW function, thereby completing the active triggering of the subsequent behavior of the sample code. After the startup process is successfully started, it will be added to the monitoring list to monitor its specific behavior.

[0121] Specifically, this application uses the PugiXml library to parse XML files. First, a variable of type pugi::xml_document is defined and the load_file function is called to load the target XML file, and the parsing result of type pugi::xml_parse_result is returned; then multiple functions are called to obtain the command line, and the command line obtained by parsing will be used as a parameter of CreateProcessW.

[0122] Specifically, the command line is obtained by calling the child function to obtain the child node Task, and obtaining its child node Actions through the Task node; obtaining its child node Exec through the Actions node; obtaining its child node Command through the Exec node; and finally obtaining the first child node of the Command node, the value corresponding to which is the target command line.

[0123] The following describes an apparatus embodiment of the present application, which can be used to execute the malicious code behavior detection method in the above embodiment of the present application. For details not disclosed in the apparatus embodiment of the present application, please refer to the above embodiment of the malicious code behavior detection method in the present application.

[0124] Figure 7 A block diagram of a malicious code behavior detection device according to an embodiment of the present application is shown.

[0125] Reference Figure 7As shown, a malicious code behavior detection device 700 according to an embodiment of the present application includes: a code running module 710, which is used to run the sample code in a sandbox; a routine calling module 720, which is used to call a callback routine in response to a predetermined operation of the sample code; a code judgment module 730, which is used to respond to the callback routine to determine whether the sample code is malicious code; and an active triggering module 740, which is used to actively trigger the subsequent behavior of the sample code if the sample code is malicious code, and the subsequent behavior is the subsequent behavior of the predetermined operation of the sample code.

[0126] In some embodiments of the present application, the predetermined operation is an operation on the registry, and the code judgment module specifically includes: a key value acquisition submodule, which is used to respond to the callback routine and determine the target key value information, and the target key value information is the registry key value information after the sample code executes the predetermined operation; a key value analysis submodule, which is used to determine whether the sample code is malicious code based on the target key value information.

[0127] In some embodiments of the present application, the target key value information includes a registry key value and a registry key value type, and the key value analysis submodule specifically includes: a preliminary judgment unit, used to determine whether the sample code is suspicious code based on the registry key value; and a final judgment unit, used to determine whether the sample code is malicious code based on the registry key value type if the sample code is suspicious code.

[0128] In some embodiments of the present application, the predetermined operation is an operation on the file system, and the code judgment module specifically includes: a file recording submodule, which is used to respond to the callback routine and record the target file, where the target file is a file that has been operated in the file system; and a file analysis submodule, which is used to determine whether the sample code is malicious code based on the target file.

[0129] In some embodiments of the present application, the file analysis submodule specifically includes: a directory judgment unit, used to judge whether the target file belongs to the self-starting file directory; a first judgment unit, used to determine that the sample code is malicious code if the target file belongs to the self-starting file directory.

[0130] In some embodiments of the present application, the predetermined operation is an operation on a scheduled task process, and the code judgment module specifically includes: an information recording submodule, used to respond to the callback routine and record scheduled task information; an information analysis submodule, used to determine whether the sample code is malicious code based on the scheduled task information.

[0131] In some embodiments of the present application, the planned task information includes a process path and a command line, and the information analysis submodule specifically includes: an information matching unit, used to compare the process path and the command line to determine whether they match a preset process path and a preset command line; a second determination unit, used to determine that the sample code is malicious code if the process path matches the preset process path and the command line matches the preset command line.

[0132] In some embodiments of the present application, the routine calling module specifically includes: a first target operation submodule, which is used to call a callback routine in response to the target operation of the sample code on the registry; a second target operation submodule, which is used to call a callback routine in response to the target operation of the sample code on the system file; and a third target operation submodule, which is used to call a callback routine in response to the target operation of the sample code on the scheduled task process.

[0133] In some embodiments of the present application, the active trigger module specifically includes: a data acquisition submodule, used to acquire target data, where the target data is data generated by the predetermined operation; and a process startup submodule, used to start the target file process through the CreateProcessW function according to the target data, so as to complete the active triggering of subsequent behaviors of the sample code.

[0134] In this embodiment, the suspicious predetermined operations of the sample code are monitored through the callback routine. After the sample code executes the predetermined operation, the callback associated event of the callback routine is triggered and the callback routine is called. In response to the callback routine, it is determined whether the sample code is malicious code based on the traces after the sample code executes the predetermined operation. After determining that the sample code is malicious code, its subsequent behavior is actively triggered to ensure that it executes all malicious functions, and then the functions and behaviors of the malicious code are more comprehensively analyzed, thereby improving the defense capability against malicious code. At the same time, the record of its subsequent behavior can help researchers analyze the source, propagation path, behavior pattern and target of the malicious code.

[0135] Figure 8 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0136] It should be noted that Figure 8 The computer system of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0137] like Figure 8As shown, the computer system includes a central processing unit (CPU) 1801, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 1802 or the program loaded from the storage part 1808 to the random access memory (RAM) 1803, such as executing the method described in the above embodiment. In RAM 1803, various programs and data required for system operation are also stored. CPU 1801, ROM 1802 and RAM 1803 are connected to each other through bus 1804. Input / output (I / O) interface 1805 is also connected to bus 1804.

[0138] The following components are connected to the I / O interface 1805: an input section 1806 including a keyboard, a mouse, etc.; an output section 1807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1808 including a hard disk, etc.; and a communication section 1809 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1809 performs communication processing via a network such as the Internet. A drive 1810 is also connected to the I / O interface 1805 as needed. A removable medium 1811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1810 as needed so that a computer program read therefrom is installed into the storage section 1808 as needed.

[0139] In particular, according to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a computer program for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication section 1809, and / or installed from a removable medium 1811. When the computer program is executed by a central processing unit (CPU) 1801, various functions defined in the system of the present application are executed.

[0140] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by an instruction execution system, device or device or used in combination with it. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate, or transmit programs for use by or in conjunction with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0141] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0142] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0143] As another aspect, the present application also provides a computer-readable medium, which may be included in the electronic device described in the above embodiment; or may exist independently without being assembled into the electronic device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by an electronic device, the electronic device implements the method described in the above embodiment.

[0144] It should be noted that, although several modules or units of the equipment for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into being embodied by multiple modules or units.

[0145] Through the description of the above implementation methods, it is easy for those skilled in the art to understand that the example implementation methods described here can be implemented by software or by combining software with necessary hardware. Therefore, the technical solution according to the implementation methods of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a touch terminal, or a network device, etc.) to execute the method according to the implementation methods of the present application.

[0146] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the embodiments disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0147] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A malicious code behavior detection method, characterized in that: include: Run the sample code in the sandbox; In response to a predetermined operation of the sample code, calling a callback routine; In response to the callback routine, determining whether the sample code is malicious code; If the sample code is malicious code, a subsequent behavior of the sample code is actively triggered, and the subsequent behavior is a subsequent behavior of a predetermined operation of the sample code.

2. The malicious code behavior detection method according to claim 1, characterized in that: The predetermined operation is an operation on a registry, and the response to the callback routine determines whether the sample code is malicious code, specifically including: In response to the callback routine, target key value information is determined, where the target key value information is the registry key value information after the sample code executes a predetermined operation; According to the target key value information, it is determined whether the sample code is malicious code.

3. The malicious code behavior detection method according to claim 2, characterized in that: The target key value information includes a registry key value and a registry key value type. The determining whether the sample code is malicious code according to the target key value information specifically includes: Determining whether the sample code is suspicious code according to the registry key value; If the sample code is suspicious code, whether the sample code is malicious code is determined according to the registry key type.

4. The malicious code behavior detection method according to claim 1, characterized in that: The predetermined operation is an operation on the file system, and the response to the callback routine determines whether the sample code is malicious code, specifically including: In response to the callback routine, a target file is recorded, where the target file is a file in the file system that has been operated on; According to the target file, it is determined whether the sample code is malicious code.

5. The malicious code behavior detection method according to claim 4, characterized in that: Determining whether the sample code is malicious code according to the target file specifically includes: Determine whether the target file belongs to the self-starting file directory; If the target file belongs to the self-starting file directory, the sample code is determined to be malicious code.

6. The malicious code behavior detection method according to claim 1, characterized in that: The predetermined operation is an operation on the scheduled task process, and the response to the callback routine determines whether the sample code is malicious code, specifically including: Responding to the callback routine, recording the planned task information; Determine whether the sample code is malicious code according to the planned task information.

7. The malicious code behavior detection method according to claim 6, characterized in that: The planned task information includes a process path and a command line. Determining whether the sample code is malicious code based on the process information specifically includes: Comparing the process path and the command line to determine whether they match a preset process path and a preset command line; If the process path matches the preset process path and the command line matches the preset command line, it is determined that the sample code is malicious code.

8. A malicious code behavior detection device, characterized in that: The malicious code behavior detection device comprises: Code running module, used to run sample code in the sandbox; A routine calling module, for calling a callback routine in response to a predetermined operation of the sample code; A code determination module, used to respond to the callback routine and determine whether the sample code is malicious code; The active triggering module is used to actively trigger the subsequent behavior of the sample code if the sample code is malicious code, and the subsequent behavior is the subsequent behavior of the predetermined operation of the sample code.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the malicious code behavior detection method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to implement the malicious code behavior detection method as described in any one of claims 1 to 7.

Images