Sandbox escape vulnerability monitoring method

Abstract

The invention belongs to the field of information security, and particularly relates to a sandbox escape vulnerability monitoring method, which comprises the steps of sandbox creation, human-computer interaction, data collection, malicious feature extraction and malicious detection. According to the scheme, noise of a normal system is filtered out by comparing and analyzing the two created sandboxes, malicious behaviors are identified by using a safe reference file as a reference, malicious features are conveniently extracted, and a security specialist is assisted to visually observe the behaviors of malicious software; according to the scheme, a detection rule optimization method combined with a genetic algorithm is creatively provided, through crossover and mutation operation, malicious software detection rules are optimized, malicious behavior mode evolution is simulated, the diversity of malicious behaviors is enhanced, and the detection efficiency is improved. The defect that detection rules are learned from an existing malicious mode database and an existing benign mode database through a deep learning model is overcome, and the sandbox escape detection capacity is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a sandbox escape vulnerability monitoring method. Background Art

[0002] Malware remains the main threat to system security. The sandbox escape vulnerability monitoring method refers to the method of ensuring that sandbox technology identifies malicious files and prevents malicious files from escaping in the sandbox. Sandbox escape refers to the attack technology that malicious files break through restrictions in the sandbox environment and bypass security detection mechanisms.

[0003] Among the existing similar solutions, for example, CN117272295A is a malicious file detection method for avoiding sandbox escape. This solution aims at the technical problem that a malicious file automatically exits or performs harmless actions when it detects that it is in a sandbox. This solution forces the malicious file to perform malicious operations through forced operations, so that the sandbox can detect the malicious file, thereby achieving the technical effect of avoiding sandbox escape and reducing the probability of the sandbox failing to detect malicious files. However, there is still a technical problem that it is difficult to identify malicious behavior.

[0004] In addition, CN116305091B discloses an anti-escape detection method, which addresses the technical problem of poor accuracy of traditional detection methods for malicious files escaping sandboxes. This method calculates the distance information between multiple sandboxes and determines the abnormality between sandboxes, thereby achieving the technical effect of improving detection accuracy and preventing malicious samples from escaping detection. However, there is still a technical problem that it does not take into account the continuous evolution of malicious files and the development of malicious behavior patterns. Summary of the invention

[0005] In view of the above situation, in order to overcome the defects of the prior art, the present invention provides a sandbox escape vulnerability monitoring method. In view of the technical problem that it is difficult to identify malicious behavior, this solution uses a comparative analysis method to filter out the noise of the normal system for the two groups of sandboxes created, and uses a safe benchmark file as a reference to identify malicious behavior, which is convenient for extracting malicious features, increases the accuracy of identifying malicious behavior, provides a reference for normal system behavior for malicious behavior analysis, and assists security specialists in intuitively observing the behavior of malware. In view of the technical problem that the prior art does not take into account the continuous evolution of malicious files and the development of malicious behavior patterns, this solution creatively proposes a detection rule optimization method combined with a genetic algorithm, optimizes malware detection rules through crossover and mutation operations, simulates the evolution of malicious behavior patterns, and enhances the diversity of malicious behaviors, thereby overcoming the disadvantage of learning detection rules from existing malicious pattern databases and benign pattern databases through deep learning models, and effectively improving the detection capability of sandbox escapes.

[0006] The technical solution adopted by the present invention is as follows: A sandbox escape vulnerability monitoring method provided by the present invention comprises the following steps:

[0007] Step S1: Sandbox creation, which is used to virtualize the sandbox environment at the operating system level. Specifically, two container instances are created using container technology, and the file to be detected is injected into one of the container instances, which is recorded as a malicious experiment sandbox. A support vector machine is used to determine the type of the file to be detected, and a security reference file matching the type of the file to be detected is injected into another container instance, which is recorded as a reference control sandbox. The two groups of sandboxes use the same operating system image, software tools, and libraries.

[0008] The matching security benchmark file refers to a standard file of the same type as the file to be detected, which can be run safely and has no malicious behavior;

[0009] Step S2: Human-computer interaction, which is used to implement manual real-time monitoring and specialist intervention at the front end. Specifically, a human-computer interaction interface is created at the front end, and independent views are created for process resources, file system resources, and network resources in the two groups of sandboxes. The specialists are provided with real-time task management and independent view viewing permissions, and the specialists are supported to take manual operations to dynamically change the sandbox configuration during the operation of the files to be detected.

[0010] Step S3: data collection, specifically, collecting system call logs and network traffic data packets of two groups of sandboxes at the backend;

[0011] Step S4: extract malicious features and obtain time series data;

[0012] Step S5: Malicious software detection, specifically, using a detection rule optimization method combined with a genetic algorithm to generate malware detection rules, identifying malicious programs from the time series data through the malware detection rules, and issuing a sandbox vulnerability warning through a human-computer interaction interface for the files to be detected that are identified as malicious programs to inform the specialist.

[0013] Furthermore, in step S4, the malicious feature extraction specifically includes the following steps:

[0014] Step S41: Anti-sandbox escape, used to trigger potential malicious behavior of the file to be detected, the specific operations are as follows:

[0015] Step S411: Sandbox camouflage, specifically, adding multi-core virtual processors to the two groups of sandboxes, expanding the sandbox memory capacity, adjusting the sandbox time and running time, randomly configuring the network environment, simulating real user operations, and achieving camouflage on hardware attributes and sandbox time;

[0016] Step S412: make up for the limitations of disguise, explore the conditional trigger mechanism of malicious behavior, and cover the triggering scenarios. Specifically, repeat step S411, randomly execute the sandbox disguise mode, repeatedly run the file to be detected, obtain the accumulated running data, and extract the complete system call log and network traffic data packet of the file to be detected from the accumulated running data;

[0017] Step S42: Noise filtering, the specific operation is as follows:

[0018] Step S421: reducing feature noise, specifically, recording the permission levels declared by all processes in the two sets of sandboxes, and converting the URLs involved in the network traffic data packets into IP addresses;

[0019] Step S422: reducing system noise, specifically, by comparing and analyzing the two groups of sandboxes, referring to the benchmark control sandbox, filtering out the system noise of the system call logs and network traffic data packets in the malicious experiment sandbox, and integrating the filtered system call logs and network traffic data packets into time series data according to time nodes;

[0020] The system noise is data and events generated by the benchmark sandbox, including normal system calls, CPU, memory and disk resources, thread management and network communication.

[0021] Furthermore, in step S5, the detection rule optimization method combined with the genetic algorithm specifically includes the following steps:

[0022] Step S51: generating upper layer detection rules, specifically including the following steps:

[0023] Step S511: Collect existing malware detection rules;

[0024] Step S512: optimizing rules, used to generate and optimize malware detection rules, specifically, using crossover and mutation operations to generate new malware detection rules based on existing malware detection rules. The malware detection rules are represented in the form of a tree, where the internal nodes are logical operators and the leaf nodes are API call sequence patterns;

[0025] Step S513: Evaluate malware detection rules, using the following formula: ;

[0026] In the formula, represents the objective function for evaluating the quality of malware detection rules, Represents a malware detection rule, Indicates the accuracy, represents the recall rate, Indicates the number of malicious behavior patterns successfully detected by the malware detection rule. Indicates the number of malicious behavior patterns;

[0027] Step S52: Evolution of the lower-layer malicious behavior pattern, specifically including the following steps:

[0028] Step S521: Collect existing malicious behavior patterns;

[0029] Step S522: optimizing the malware, specifically, using a genetic algorithm to simulate the evolution of malware, and generating a new malicious behavior pattern based on the existing malicious behavior pattern, wherein the malicious behavior pattern is intended to escape the malware detection rule generated by the upper layer;

[0030] Step S523: Evaluate the escapability of the generated malicious behavior pattern, using the following formula: ;

[0031] In the formula, represents the objective function for evaluating the escape capability, Indicates the number of malicious behavior patterns generated, Indicates the number of malicious behavior patterns detected by malware detection rules. Indicates A malicious behavior pattern, express Similarity to a database of known malicious patterns, represents a malicious pattern database, express Similarity to a database of benign patterns, represents a benign pattern database, express The degree of overlap with other malicious behavior patterns;

[0032] Step S53: Iterative improvement, specifically, the upper layer generates malware detection rules and passes them to the lower layer, the lower layer generates malicious behavior patterns and feeds them back to the upper layer, iteratively improving the detection capability of the malware detection rules and the escaping capability of the malicious behavior patterns.

[0033] The present invention provides a sandbox escape vulnerability monitoring method. The beneficial effects achieved by the present invention using the above scheme are as follows:

[0034] (1) To address the technical problem of difficulty in identifying malicious behavior, this solution uses a comparative analysis method to filter out the noise of normal systems by creating two sets of sandboxes, and uses a secure benchmark file as a reference to identify malicious behavior, making it easier to extract malicious features and increase the accuracy of identifying malicious behavior. It also provides a reference for normal system behavior for malicious behavior analysis, and helps security specialists intuitively observe the behavior of malware.

[0035] (2) In order to address the technical problem that the existing technology does not take into account the continuous evolution of malicious files and the development of malicious behavior patterns, this solution creatively proposes a detection rule optimization method combined with a genetic algorithm. Through crossover and mutation operations, it optimizes malware detection rules, simulates the evolution of malicious behavior patterns, and enhances the diversity of malicious behaviors. It overcomes the drawbacks of learning detection rules from existing malicious pattern databases and benign pattern databases through deep learning models, and effectively improves the detection capability of sandbox escapes. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A flow chart of a sandbox escape vulnerability monitoring method provided by the present invention;

[0037] Figure 2 is a schematic diagram of step S4;

[0038] Figure 3 is a schematic diagram of step S5;

[0039] Figure 4 is a schematic diagram of step S51;

[0040] Figure 5 is a schematic diagram of step S52.

[0041] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0042] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0043] In the description of the present invention, it should be understood that terms such as “upper”, “lower”, “front”, “back”, “left”, “right”, “top”, “bottom”, “inside” and “outside” indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as limiting the present invention.

[0044] Example 1, see Figures 1 to 5 The present invention provides a sandbox escape vulnerability monitoring method, which comprises the following steps:

[0045] Step S1: Sandbox creation, which is used to virtualize the sandbox environment at the operating system level. Specifically, two container instances are created using container technology, and the file to be detected is injected into one of the container instances, which is recorded as a malicious experiment sandbox. A support vector machine is used to determine the type of the file to be detected, and a security reference file matching the type of the file to be detected is injected into another container instance, which is recorded as a reference control sandbox. The two groups of sandboxes use the same operating system image, software tools, and libraries.

[0046] The matching security benchmark file refers to a standard file of the same type as the file to be detected, which can be run safely and has no malicious behavior;

[0047] Step S2: Human-computer interaction, which is used to implement manual real-time monitoring and specialist intervention at the front end. Specifically, a human-computer interaction interface is created at the front end, and independent views are created for process resources, file system resources, and network resources in the two groups of sandboxes. The specialists are provided with real-time task management and independent view viewing permissions, and the specialists are supported to take manual operations to dynamically change the sandbox configuration during the operation of the files to be detected.

[0048] Step S3: data collection, specifically, collecting system call logs and network traffic data packets of two groups of sandboxes at the backend;

[0049] Step S4: extract malicious features and obtain time series data;

[0050] Step S5: Malicious software detection, specifically, using a detection rule optimization method combined with a genetic algorithm to generate malware detection rules, identifying malicious programs from the time series data through the malware detection rules, and issuing a sandbox vulnerability warning through a human-computer interaction interface for the files to be detected that are identified as malicious programs to inform the specialist.

[0051] Example 2, see Figure 1 and Figure 2 This embodiment is based on the above embodiment. In step S4, the malicious feature extraction specifically includes the following steps:

[0052] Step S41: Anti-sandbox escape, used to trigger potential malicious behavior of the file to be detected, the specific operations are as follows:

[0053] Step S411: Sandbox camouflage, specifically, adding multi-core virtual processors to the two groups of sandboxes, expanding the sandbox memory capacity, adjusting the sandbox time and running time, randomly configuring the network environment, simulating real user operations, and achieving camouflage on hardware attributes and sandbox time;

[0054] Step S412: make up for the limitations of disguise, explore the conditional trigger mechanism of malicious behavior, and cover the triggering scenarios. Specifically, repeat step S411, randomly execute the sandbox disguise mode, repeatedly run the file to be detected, obtain the accumulated running data, and extract the complete system call log and network traffic data packet of the file to be detected from the accumulated running data;

[0055] Step S42: Noise filtering, the specific operation is as follows:

[0056] Step S421: reducing feature noise, specifically, recording the permission levels declared by all processes in the two sets of sandboxes, and converting the URLs involved in the network traffic data packets into IP addresses;

[0057] Step S422: reducing system noise, specifically, by comparing and analyzing the two groups of sandboxes, referring to the benchmark control sandbox, filtering out the system noise of the system call logs and network traffic data packets in the malicious experiment sandbox, and integrating the filtered system call logs and network traffic data packets into time series data according to time nodes;

[0058] The system noise is data and events generated by the benchmark sandbox, including normal system calls, CPU, memory and disk resources, thread management and network communication.

[0059] Example 3, see Figures 1 to 3 This embodiment is based on the above embodiment. In step S5, the detection rule optimization method combined with the genetic algorithm specifically includes the following steps:

[0060] Step S51: generating upper layer detection rules;

[0061] Step S52: Evolution of lower-level malicious behavior patterns;

[0062] Step S53: Iterative improvement, specifically, the upper layer generates malware detection rules and passes them to the lower layer, the lower layer generates malicious behavior patterns and feeds them back to the upper layer, iteratively improving the detection capability of the malware detection rules and the escaping capability of the malicious behavior patterns.

[0063] Example 4, see Figures 1 to 4 This embodiment is based on the above embodiment. In step S51, the upper layer detection rule is generated, which specifically includes the following steps:

[0064] Step S511: Collect existing malware detection rules;

[0065] Step S512: optimizing rules, used to generate and optimize malware detection rules, specifically, using crossover and mutation operations to generate new malware detection rules based on existing malware detection rules. The malware detection rules are represented in the form of a tree, where the internal nodes are logical operators and the leaf nodes are API call sequence patterns;

[0066] Step S513: Evaluate malware detection rules, using the following formula: ;

[0067] In the formula, represents the objective function for evaluating the quality of malware detection rules, Represents a malware detection rule, Indicates the accuracy, represents the recall rate, Indicates the number of malicious behavior patterns successfully detected by the malware detection rule. Indicates the number of malicious behavior patterns.

[0068] Example 5, see Figures 1 to 5 This embodiment is based on the above embodiment. In step S52, the lower malicious behavior pattern evolves, specifically including the following steps:

[0069] Step S521: Collect existing malicious behavior patterns;

[0070] Step S522: optimizing the malware, specifically, using a genetic algorithm to simulate the evolution of malware, and generating a new malicious behavior pattern based on the existing malicious behavior pattern, wherein the malicious behavior pattern is intended to escape the malware detection rule generated by the upper layer;

[0071] Step S523: Evaluate the escapability of the generated malicious behavior pattern, using the following formula: ;

[0072] In the formula, represents the objective function for evaluating the escape capability, Indicates the number of malicious behavior patterns generated, Indicates the number of malicious behavior patterns detected by malware detection rules. Indicates A malicious behavior pattern, express Similarity to a database of known malicious patterns, represents a malicious pattern database, express Similarity to a database of benign patterns, represents a benign pattern database, express The degree of overlap with other malicious behavior patterns;

[0073] Example 6, see Figure 1 This embodiment is based on the above embodiment. In step S1, the container instance is specifically a gVisor container instance.

[0074] Embodiment 7, see Figures 1 to 3 This embodiment is based on the above embodiment. In step S411, the multi-core is a quad-core.

[0075] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0076] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

[0077] The present invention and its embodiments are described above, and such description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if ordinary technicians in the field are inspired by it, without departing from the purpose of the invention, they can design a structure and embodiment similar to the technical solution without creativity, which should belong to the protection scope of the present invention.

Claims

1. A sandbox escape vulnerability monitoring method, characterized by: The method comprises the following steps: Step S1: Sandbox creation, which is used to virtualize the sandbox environment at the operating system level. Specifically, two container instances are created using container technology, and the file to be detected is injected into one of the container instances, which is recorded as a malicious experiment sandbox. A support vector machine is used to determine the type of the file to be detected, and a security reference file matching the type of the file to be detected is injected into another container instance, which is recorded as a reference control sandbox. The two groups of sandboxes use the same operating system image, software tools, and libraries. The matching security benchmark file refers to a standard file of the same type as the file to be detected, which can be run safely and has no malicious behavior; Step S2: Human-computer interaction, which is used to implement manual real-time monitoring and specialist intervention at the front end. Specifically, a human-computer interaction interface is created at the front end, and independent views are created for process resources, file system resources, and network resources in the two groups of sandboxes. The specialists are provided with real-time task management and independent view viewing permissions, and the specialists are supported to take manual operations to dynamically change the sandbox configuration during the operation of the files to be detected. Step S3: data collection, specifically, collecting system call logs and network traffic data packets of two groups of sandboxes at the back end; Step S4: extract malicious features and obtain time series data; Step S5: Malicious software detection, specifically, using a detection rule optimization method combined with a genetic algorithm to generate malware detection rules, identifying malicious programs from the time series data through the malware detection rules, and issuing a sandbox vulnerability warning through a human-computer interaction interface for files to be detected that are identified as malicious programs to inform the specialist.

2. A sandbox escape vulnerability monitoring method according to claim 1, characterized in that: In step S4, the malicious feature extraction specifically includes the following steps: Step S41: Anti-sandbox escape, used to trigger potential malicious behavior of the file to be detected, the specific operations are as follows: Step S411: Sandbox camouflage, specifically, adding multi-core virtual processors to the two groups of sandboxes, expanding the sandbox memory capacity, adjusting the sandbox time and running time, randomly configuring the network environment, simulating real user operations, and achieving camouflage on hardware attributes and sandbox time; Step S412: make up for the limitations of disguise, explore the conditional trigger mechanism of malicious behavior, and cover the triggering scenarios. Specifically, repeat step S411, randomly execute the sandbox disguise mode, repeatedly run the file to be detected, obtain the accumulated running data, and extract the complete system call log and network traffic data packet of the file to be detected from the accumulated running data; Step S42: Noise filtering, the specific operation is as follows: Step S421: reducing feature noise, specifically, recording the permission levels declared by all processes in the two sets of sandboxes, and converting the URLs involved in the network traffic data packets into IP addresses; Step S422: reducing system noise, specifically, by comparing and analyzing the two groups of sandboxes, referring to the benchmark control sandbox, filtering out the system noise of the system call logs and network traffic data packets in the malicious experiment sandbox, and integrating the filtered system call logs and network traffic data packets into time series data according to time nodes; The system noise is data and events generated by the benchmark sandbox, including normal system calls, CPU, memory and disk resources, thread management and network communication.

3. A sandbox escape vulnerability monitoring method according to claim 2, characterized in that: In step S5, the detection rule optimization method combined with the genetic algorithm specifically includes the following steps: Step S51: generating upper layer detection rules, specifically including the following steps: Step S511: Collect existing malware detection rules; Step S512: optimizing rules, used to generate and optimize malware detection rules, specifically, using crossover and mutation operations to generate new malware detection rules based on existing malware detection rules. The malware detection rules are represented in the form of a tree, where the internal nodes are logical operators and the leaf nodes are API call sequence patterns; Step S513: Evaluate malware detection rules, using the following formula: ； In the formula, represents the objective function for evaluating the quality of malware detection rules, Represents a malware detection rule, Indicates the accuracy, represents the recall rate, Indicates the number of malicious behavior patterns successfully detected by the malware detection rule. Indicates the number of malicious behavior patterns; Step S52: Evolution of the lower-layer malicious behavior pattern, specifically including the following steps: Step S521: Collect existing malicious behavior patterns; Step S522: optimizing the malware, specifically, using a genetic algorithm to simulate the evolution of malware, and generating a new malicious behavior pattern based on the existing malicious behavior pattern, wherein the malicious behavior pattern is intended to escape the malware detection rule generated by the upper layer; Step S523: Evaluate the escapability of the generated malicious behavior pattern, using the following formula: ； In the formula, represents the objective function for evaluating the escape capability, Indicates the number of malicious behavior patterns generated, Indicates the number of malicious behavior patterns detected by malware detection rules. Indicates A malicious behavior pattern, express Similarity to a database of known malicious patterns, represents a malicious pattern database, express Similarity to a database of benign patterns, represents a benign pattern database, express The degree of overlap with other malicious behavior patterns; Step S53: Iterative improvement, specifically, the upper layer generates malware detection rules and passes them to the lower layer, the lower layer generates malicious behavior patterns and feeds them back to the upper layer, iteratively improving the detection capability of the malware detection rules and the escaping capability of the malicious behavior patterns.

Images