Sandbox operation method and device and sandbox hybrid disk acceleration system
By introducing a hybrid disk acceleration system into the sandbox, the write disk operation is mapped into a write memory operation, which solves the IO pressure problem when multiple sandbox instances are concurrent, and achieves more efficient sandbox detection performance.
Patent Information
- Application Number
- CN202510472913.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-04-15
- Publication Date
- 2025-07-25
AI Technical Summary
In the prior art During sandbox detection, when multiple sandbox instances are run concurrently, IO operations are finally mapped to the host physical disk, resulting in high pressure on the host IO performance, affecting system performance and response speed.
The hybrid disk acceleration system is used to start the sandbox through the pre-created hybrid disk. The memory area is mapped to the host memory and the disk area is mapped to the host hard disk. Write operation events are monitored during the sandbox operation, and data is written to the memory area or disk area according to preset rules. The data corresponding to the write operation event is written to the memory area first to reduce the pressure on the physical disk.
Reduces the physical disk pressure during high concurrency of sandboxes, reduces the write delay and loss of virtual disks, and improves the performance of sandbox operation engine system.
Smart Images
Figure CN120372601A_ABST
Abstract
Description
Technical Field
[0001] This application relates to, but is not limited to, the field of information security technology, and particularly relates to a sandbox operation method, apparatus, and sandbox hybrid disk acceleration system. Background Art
[0002] With the increasing number of cyberattacks and malware, sandbox malicious sample detection technology, as an advanced security detection means, has gradually become an important part of the network security field. The core concept of sandbox technology is to run unknown code in an isolated virtualized environment, observe its behavior and effects, and thus determine whether it is a malicious sample or virus. This technology can perform a security assessment on suspicious files or programs without affecting the real operating system and network environment.
[0003] In a sandbox environment, virtualization technology is widely used to create an isolated running environment, where the virtual disk is a key component. The virtual disk is actually a separate file stored on the physical disk of the host operating system. In the virtualized environment, this file is regarded as a virtual disk and is managed and accessed by virtualization software. However, there is a significant problem in the prior art: all IO operations during sandbox sample detection will be mapped to the disk IO operations of the host. When multiple sandbox instances are running on the host simultaneously, this mapping will cause a huge pressure on the IO performance of the host, thereby affecting the overall performance and response speed of the system.
[0004] To alleviate this problem, some acceleration schemes have been proposed in the prior art.
[0005] For example, Virtio (a virtualization standard) optimizes the data transfer method between the sandbox and the host through Paravirtualized I / O technology. Virtio significantly reduces the CPU burden and latency by directly accessing the host hardware, reducing data replication, and interrupt handling. In addition, Virtio also utilizes zero-copy technology and an efficient caching strategy to improve the throughput and response speed of disk I / O. These optimization measures enable the sandbox to access and manage storage devices in a more efficient and reliable manner, thereby achieving a significant performance improvement in the virtualized environment.
[0006] For another example, the prior art (such as patent number CN114020406A) uses SPDK to create a vhost user scsi controller, takes over the target volume through SPDK bdve, and associates the virtual machine with the vhost user scsi controller to optimize the process of the virtual machine writing data to the disk. Although the SPDK technology is used to optimize the process of the virtual machine writing data to the disk, the IO read and write operations within the sandbox are ultimately converted into the read and write operations of the host machine's disk. When multiple sandboxes are running on the host machine simultaneously, it will still cause a very large pressure on the host machine's IO.
[0007] In summary, although the above acceleration scheme alleviates the IO performance problem to a certain extent, it still causes a relatively large pressure on the host machine's IO performance. Summary of the Invention
[0008] The following is an overview of the subject matter described in detail in this document. This overview is not intended to limit the scope of protection of the claims.
[0009] This application provides a sandbox operation method, apparatus, and sandbox hybrid disk acceleration system, which map at least part of the sandbox's disk writing operations to memory writing operations, thereby reducing the physical disk pressure during high concurrency of the sandbox, reducing the write latency and loss of the virtual disk during sandbox operations, and improving the performance of the sandbox operation engine system.
[0010] An embodiment of this application provides a sandbox operation method, including: Starting a sandbox based on a pre-created hybrid disk; wherein, the hybrid disk includes a memory area and a disk area; the memory area is mapped to the memory of the host machine, and the disk area is mapped to the hard disk of the host machine; During the running of the sandbox, monitoring the write operation events generated within the sandbox, and when a write operation event is detected within the sandbox, writing the data corresponding to the write operation event to the memory area or the disk area of the hybrid disk according to a preset rule; wherein, at least part of the data corresponding to the write operation events is written to the memory area of the hybrid disk.
[0011] An embodiment of this application further provides a sandbox operation apparatus, including: a memory and a processor; The memory is used to store the program for sandbox operation; The processor is used to read the program for sandbox operation and execute the sandbox operation method as described in any embodiment of this application.
[0012] An embodiment of this application further provides a sandbox hybrid disk acceleration system, including: a hybrid disk drive module and a hybrid disk policy module; The hybrid disk drive module is used to monitor write operation events generated in the sandbox during the sandbox running process, and when a write operation event is detected in the sandbox, send the write operation event to the hybrid disk policy module; The hybrid disk policy module is used to write the data corresponding to the write operation event into the memory area or disk area of the hybrid disk according to a preset rule; wherein, at least part of the data corresponding to the write operation event is written into the memory area of the hybrid disk.
[0013] Compared with the prior art that finally maps the IO operations in the sandbox to the physical disk of the host, a sandbox operation method, device and sandbox hybrid disk acceleration system provided by an embodiment of the present application start the sandbox based on a pre-created hybrid disk, and then during the sandbox running process, monitor the write operation events generated in the sandbox, and when a write operation event is detected in the sandbox, write at least part of the data corresponding to the write operation event into the memory area of the hybrid disk (that is, map the operation of writing to the disk in the sandbox to the operation of writing to the memory), so as to reduce the physical disk pressure during high concurrency of the sandbox, and further reduce the write latency and loss of the virtual disk during the sandbox operation, and improve the performance of the sandbox operation engine system.
[0014] Other features and advantages of the present application will be described in the subsequent specification, and part of them will become obvious from the specification, or be understood by implementing the present application. Other advantages of the present application can be realized and obtained through the solutions described in the specification and the drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] The drawings are used to provide an understanding of the technical solutions of the present application, and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the technical solutions of the present application, and do not constitute a limitation to the technical solutions of the present application.
[0016] Figure 1 It is a brief flowchart of the sandbox operation method according to an embodiment of the present application; Figure 2 It is a schematic diagram of the sandbox operation device according to an embodiment of the present application; Figure 3 It is a schematic diagram of the sandbox hybrid disk acceleration system according to an embodiment of the present application; Figure 4 It is a flowchart of the sandbox detection method according to an embodiment of the present application; Figure 5 It is a schematic diagram of the composition of the sandbox detection system according to an embodiment of the present application; Figure 6 It is a schematic diagram of the usage mode of the hybrid disk under multiple sandboxes according to an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0017] This application describes multiple embodiments, but the description is exemplary rather than restrictive, and it will be apparent to those of ordinary skill in the art that there can be more embodiments and implementation solutions within the scope of the embodiments described in this application. Although many possible combinations of features are shown in the drawings and discussed in the detailed description, many other combinations of the disclosed features are also possible. Unless specifically restricted, any feature or element of any embodiment can be used in combination with any other feature or element in any other embodiment, or can replace any other feature or element in any other embodiment.
[0018] This application includes and contemplates combinations with features and elements known to those of ordinary skill in the art. The embodiments, features, and elements already disclosed in this application can also be combined with any conventional features or elements to form a unique inventive solution. Any feature or element of any embodiment can also be combined with features or elements from other inventive solutions to form another unique inventive solution. Therefore, it should be understood that any feature shown and / or discussed in this application can be implemented alone or in any suitable combination. Therefore, the embodiments are not subject to other limitations except those made in accordance with the appended claims and their equivalents. In addition, various modifications and changes can be made within the scope of the protection of the appended claims.
[0019] Furthermore, when describing representative embodiments, the specification may have presented the method and / or process as a specific sequence of steps. However, to the extent that the method or process does not depend on the specific order of the steps described herein, the method or process should not be limited to the specific order of steps described. As will be understood by those of ordinary skill in the art, other step orders are possible. Therefore, the specific order of steps set forth in the specification should not be construed as a limitation on the claims. In addition, the claims directed to the method and / or process should not be limited to performing their steps in the order written, and those skilled in the art can readily understand that these orders can vary and still remain within the spirit and scope of the embodiments of this application.
[0020] The existing acceleration solutions still have the following deficiencies: Cause high IO pressure during high concurrency: When multiple sandbox instances are running simultaneously on the host, since the IO operations within the sandbox are ultimately mapped to the physical disks of the host, it will cause relatively large IO pressure, which will affect the performance of the host and may lead to a decrease in the response speed of sandbox detection, and even affect the performance of other applications; Cause disk write latency and wear: Disk write operations in a sandbox environment are real-time and need to ensure data security and consistency. Such write operations cause the disk to be frequently accessed and data written, thereby increasing the IO load and latency and reducing the overall response speed and efficiency of the system; Cause performance loss and resource waste: In a virtualized environment, traditional IO operations usually involve copying data and handling interrupts. These operations consume a large amount of CPU resources and increase latency. These additional overheads and complexities may limit the performance improvement space of virtual machines or sandbox environments.
[0021] For this reason, an embodiment of the present application provides a sandbox operation method, as Figure 1 shown, which may include the following steps: Step S110: Start the sandbox based on a pre-created hybrid disk; wherein, the hybrid disk includes a memory area and a disk area; the memory area is mapped to the memory of the host, and the disk area is mapped to the hard disk of the host; Step S120: During the running of the sandbox, monitor the write operation events generated in the sandbox, and when a write operation event is detected in the sandbox, write the data corresponding to the write operation event into the memory area or the disk area of the hybrid disk according to a preset rule; wherein, at least part of the data corresponding to the write operation event is written into the memory area of the hybrid disk.
[0022] Compared with the prior art in which the IO operations in the sandbox are finally mapped to the physical disk of the host, the sandbox operation method of this embodiment starts the sandbox based on a pre-created hybrid disk, and then during the running of the sandbox, monitors the write operation events generated in the sandbox, and writes at least part of the data corresponding to the write operation event into the memory area of the hybrid disk (i.e., maps the write disk operation of the sandbox to a write memory operation), thereby reducing the physical disk pressure during high concurrency of the sandbox, reducing the write latency and wear of the virtual disk during sandbox operations, and improving the performance of the sandbox operation engine system.
[0023] Exemplarily, the hybrid disk is disposable, and a new one is rebuilt before each sandbox startup to restore the sandbox environment.
[0024] In an exemplary embodiment, the method further includes: during the running of the sandbox, monitor the read operation events generated in the sandbox, and when a read operation event is detected in the sandbox, perform data reading.
[0025] It should be noted that the data written to the memory is read from the memory, and the data written to the disk is read from the disk.
[0026] In an exemplary embodiment, writing the data corresponding to the write operation event to the memory area or disk area of the hybrid disk according to a preset rule may include: When the memory used by the hybrid disk is less than or equal to a preset memory threshold, writing the data corresponding to the write operation event to the memory area of the hybrid disk; when the memory used by the hybrid disk is greater than the preset memory threshold, writing the data corresponding to the write operation event to the disk area of the hybrid disk.
[0027] In an example of this embodiment, writing the data corresponding to the write operation event to the memory area or disk area of the hybrid disk according to a preset rule may further include: writing the data corresponding to the write operation event to the memory area or disk area of the hybrid disk according to the opening and closing of an acceleration policy switch; when the acceleration policy switch is on, executing the acceleration policy (that is, writing data to the memory area of the hybrid disk preferentially as described in the above embodiment); when the acceleration policy switch is off, stopping the execution of the acceleration policy, and directly writing the data to the disk area of the hybrid disk regardless of whether the memory used by the hybrid disk is less than or equal to the preset memory threshold.
[0028] In the sandbox operation method of this embodiment, the data corresponding to the write operation event is preferentially written to the memory area of the hybrid disk, which can improve the performance of the sandbox as much as possible (because the memory resources of the server are limited, and a large number of sandbox inspection processes running concurrently will also occupy a large amount of memory, so the design goal is to improve the average IO performance of the sandbox as much as possible under the same hardware specifications, so the overall strategy is to preferentially let most samples hit the memory area of the hybrid disk, and when the memory occupancy is too high, write to the disk area). In addition, the sandbox operation method of this embodiment does not blindly write all the data corresponding to the write operation event to the memory area of the hybrid disk, but also sets a disk area for the hybrid disk, and still can meet the requirement of writing data to the disk area under special conditions.
[0029] In an exemplary embodiment, the size of the memory area of the hybrid disk is configured according to a preset policy, and the preset policy may include: Configuring the size of the memory area of the hybrid disk according to the remaining memory size of the host when the hybrid disk is created; and / or, when the sandbox is used for malicious sample detection, configuring the size of the memory area of the hybrid disk according to the type of the sample to be detected.
[0030] In an example of this embodiment, the size of the memory area of the hybrid disk can be set to be within 200 - 500MB according to the server configuration. For example, the default size of the memory area can be set to 400MB.
[0031] Exemplarily, when the host memory is lower than a preset minimum memory ratio (for example, the host memory is less than 10%), the memory allocation can be reduced. For example, the size of the hybrid disk memory area can be reduced to 300 MB.
[0032] Exemplarily, when the sample types to be detected are exe, dll, etc., the memory allocation can be reduced. For example, the size of the hybrid disk memory area can be reduced to 350 MB.
[0033] Exemplarily, when the sample types to be detected depend on other components (such as document - type and script - type sample types, and these script types will generate temporary files, cache files, log files, etc. and occupy a large amount of memory because they need to start basic environments such as office, adobe, chrome, etc.), the memory allocation can be increased. For example, the size of the hybrid disk memory area can be increased to 500 MB.
[0034] It should be noted that during the sandbox test, when adjusting the memory size, the occupied memory remains unchanged, that is, the mapping of the allocated logical blocks remains unchanged, and it is only valid for the subsequent new IOs.
[0035] The sandbox operation method of this embodiment can flexibly allocate the memory size of the hybrid disk according to a preset policy, realize reasonable control of the host memory occupied by the hybrid disk, and avoid affecting the normal use of the host memory by other functions due to excessive memory occupation during the sandbox operation.
[0036] In an exemplary embodiment, before starting the sandbox based on the pre - created hybrid disk, it further includes: during the process of creating the hybrid disk, establishing a mapping relationship between the logical address of the sandbox and the storage blocks in the memory area or disk area; The writing of the write operation event to the memory area or disk area of the hybrid disk may include: writing the data corresponding to the write operation event to the memory area or disk area of the hybrid disk according to the logical address.
[0037] In an example of this embodiment, the writing of the data corresponding to the write operation event to the memory area of the hybrid disk may include: Applying for a block of memory space from the memory area through the block device driver of the sandbox as the target memory block; Writing the data corresponding to the write operation event to the memory area of the hybrid disk according to the logical address corresponding to the target memory block.
[0038] The sandbox operation method of this embodiment maps the operation of writing to the disk by the sandbox to the operation of writing to the memory, reduces the physical disk pressure during high - concurrency of the sandbox, reduces the write latency and loss of the virtual disk during the sandbox operation, and improves the performance of the sandbox operation engine system.
[0039] In an exemplary embodiment, before starting the sandbox based on the pre-created hybrid disk, it may further include: modifying the block device driver of the sandbox to a hybrid disk driver to monitor the write operation events generated within the sandbox.
[0040] The sandbox operation method of this embodiment realizes the monitoring of the IO read and write operations generated within the sandbox by modifying the block device driver of the sandbox. In this way, when a write operation is executed within the sandbox, the data corresponding to the write operation event can be written into the memory area of the hybrid disk.
[0041] In an exemplary embodiment, when the sandbox runs to an end, the hybrid disk is destroyed.
[0042] The sandbox operation method of this embodiment destroys the hybrid disk when the sandbox runs to an end, avoiding continuously occupying the disk memory space. It should be noted that the maximum running time of the sandbox is usually only a few minutes, so the already allocated memory will be released quickly.
[0043] An embodiment of the present application further provides a sandbox operation device, as Figure 2 shown, including: a memory and a processor; The memory is used to save the program for sandbox operation; The processor is used to read the program for sandbox operation and execute the sandbox operation method as described in any embodiment of the present application.
[0044] An embodiment of the present application further provides a sandbox hybrid disk acceleration system, as Figure 3 shown, which may include: a hybrid disk driver module and a hybrid disk policy module; The hybrid disk driver module is used to monitor the write operation events generated within the sandbox during the running process of the sandbox, and when the write operation events generated within the sandbox are detected, send the write operation events to the hybrid disk policy module; The hybrid disk policy module is used to write the data corresponding to the write operation events into the memory area or disk area of the hybrid disk according to preset rules; wherein, at least part of the data corresponding to the write operation events is written into the memory area of the hybrid disk.
[0045] Compared with the prior art where the IO operations within the sandbox are ultimately mapped to the physical disk of the host machine, in the sandbox hybrid disk acceleration system of this embodiment, during the operation of the sandbox, write operation events generated within the sandbox are monitored, and when a write operation event is detected within the sandbox, at least part of the data corresponding to the write operation event is written into the memory area of the hybrid disk (i.e., mapping the operation of writing to the disk in the sandbox to the operation of writing to the memory), thereby reducing the physical disk pressure during high concurrency in the sandbox, reducing the write latency and loss of the virtual disk during sandbox operations, and improving the performance of the sandbox operation engine system.
[0046] In an exemplary embodiment, writing the data corresponding to the write operation event into the memory area or disk area of the hybrid disk according to a preset rule may include: when the memory used by the hybrid disk is less than or equal to a preset memory threshold, writing the data corresponding to the write operation event into the memory area of the hybrid disk; when the memory used by the hybrid disk is greater than the preset memory threshold, writing the data corresponding to the write operation event into the disk area of the hybrid disk.
[0047] Exemplarily, when the hybrid disk driver module sends a write operation event to the hybrid disk policy module, in addition to sending information related to the write operation event to the hybrid disk policy module, system information (such as how much memory the hybrid disk of the current sandbox is using and what the preset memory threshold of the hybrid disk memory area of the current sandbox is) will also be sent to the hybrid disk policy module, so that the hybrid disk policy module can decide whether to write the data corresponding to the write operation event into the memory area or disk area of the hybrid disk based on the system information.
[0048] In an exemplary embodiment, the size of the memory area of the hybrid disk is configured according to a preset policy, and the preset policy may include: Configuring the size of the memory area of the hybrid disk according to the remaining memory size of the host machine when the hybrid disk is created; and / or, when the sandbox is used for malicious sample detection, configuring the size of the memory area of the hybrid disk according to the type of the sample to be detected.
[0049] The sandbox hybrid disk acceleration system of this embodiment can flexibly allocate the memory size of the hybrid disk according to a preset policy, realize reasonable control of the memory occupied by the hybrid disk on the host machine, and avoid affecting the normal use of the host machine memory by other functions due to excessive memory occupation by sandbox operations.
[0050] It should be noted that the hybrid disk policy module is used to determine the size of the memory area, but the opening of the logical block space of the disk is controlled and implemented by the hybrid disk driver module.
[0051] In an exemplary embodiment, the hybrid disk drive module can also be used to modify the block device driver of the sandbox into a hybrid disk drive to monitor write operation events generated within the sandbox.
[0052] In the sandbox hybrid disk acceleration system of this embodiment, by modifying the block device driver of the sandbox, monitoring of IO read and write operations generated within the sandbox is achieved. When a write operation is executed within the sandbox, the hybrid disk drive module captures the write operation event and sends the write operation event to the hybrid disk policy module, and then it can be determined whether the data corresponding to the write operation event is written to the memory area or the disk area.
[0053] In an exemplary embodiment, the hybrid disk policy module writing the data corresponding to the write operation event to the memory area or the disk area of the hybrid disk may include: Applying for a block of memory space from the memory area through the block device driver of the sandbox as the target memory block; Writing the data corresponding to the write operation event to the memory area of the hybrid disk according to the logical address corresponding to the target memory block.
[0054] In an exemplary embodiment, the hybrid disk policy module can also be used to close the sandbox.
[0055] In summary, the sandbox hybrid disk acceleration system of this embodiment realizes the optimization of disk I / O read and write operations during the sandbox operation process, thereby reducing the negative impact of write operations on the detection performance.
[0056] It should be noted that since the greatest advantage of the technical solution of this application is to reduce the physical disk pressure during high concurrency of the sandbox, thereby reducing the write latency and loss of the virtual disk during sandbox detection and improving the performance of the sandbox operation engine system, the technical solution of this application is particularly applicable to the malicious sample sandbox detection scenario because this scenario has high requirements for the IO performance in the initial stage of sandbox startup. Of course, the technical solution of this application does not limit the application scenarios. For example, it can also be applied to scenarios such as development and testing, model verification, etc.
[0057] Next, taking the application of the sandbox operation method of this application to sandbox detection as an example, the solution of this application will be described. As Figure 4 shown, it may include the following steps S410 - step S440: Step S410: Loading the sandbox hybrid disk acceleration system, including: the sandbox simulator loading the hybrid disk drive module and the hybrid disk policy module.
[0058] Exemplarily, the loading of the hybrid disk drive module by the sandbox simulator may include: embedding the block device driver of the hybrid disk in the virtualization platform, so that the block device driver of the sandbox can be modified, thereby enabling monitoring of the IO read and write operations generated within the sandbox.
[0059] Exemplarily, when implementing the sandbox simulator based on QEMU (Quick Emulator, virtual machine emulator), modifying the block device driver of the sandbox means modifying the qcow2 driver (the qcow2 driver is located in block / qcow2.c), and mainly modifying the I / O processing part of qcow2 to intercept reads and writes.
[0060] Exemplarily, the hybrid disk drive module can be embedded in sandbox virtualization simulators such as QEMU. This module is responsible for controlling the opening of the logical block space of disks such as qcow2, supports mapping some logical blocks to memory space, and also supports using disk space for some disk blocks, thereby realizing the mixed use of memory and disk blocks; the hybrid disk policy module can be responsible for receiving information such as write operation event information and system load of the sandbox, and flexibly allocating the memory size of the hybrid disk according to preset policies, and making decisions to trigger corresponding policy events, such as memory block application events, disk block application events, sandbox closing events, etc.
[0061] Step S410: Create a sandbox base image, including: installing an operating system using a base disk image and deploying a sandbox detection environment thereon.
[0062] The base image created in this step S410 contains the operating system and necessary software environments, which can provide a standardized base environment for subsequent sandbox deployment.
[0063] Step S420: Create multiple detection sandboxes based on the base image, where each sandbox has an independent running environment and configuration.
[0064] In this step S420, by cloning multiple detection sandboxes from the base image, and each sandbox has an independent running environment and configuration, so that multi-sample concurrent detection can be achieved, improving the detection efficiency and throughput.
[0065] Step S430: Start the sandbox based on the sandbox memory snapshot and the pre-created hybrid disk; where the hybrid disk includes a memory area and a disk area; the memory area is mapped to the memory of the host, and the disk area is mapped to the hard disk of the host.
[0066] Step S440: During the running of the sandbox, monitor the write operation events generated within the sandbox, and when a write operation event is detected within the sandbox, write the data corresponding to the write operation event into the memory area or disk area of the hybrid disk according to preset rules.
[0067] Exemplarily, data can be preferentially written to the memory area of the hybrid disk, and after there is no space in the memory area of the hybrid disk, the data is written to the disk area of the hybrid disk. For example, it can be first determined whether the memory used by the current hybrid disk reaches a threshold. If the used memory does not reach the threshold, a write memory acceleration strategy is executed; if the used memory has reached the threshold, a write disk strategy is executed. Based on this example, during the running of the sandbox, when the memory size is not exceeded, the data triggering the write operation event (files released during the operation of software such as the operating system, office, and sample data) will be preferentially written to the memory area, and will be written to the disk area only when the storage space of the memory area is insufficient. This means that if fewer files are generated during this period and all data is written to the memory without triggering a write to the disk, in this case, the entire sample detection process is read-only for the disk, so the disk I / O is reduced. Of course, if more files are generated during this period and all data cannot be written to the memory (the data exceeding the memory size is written to the disk), but the data written to the disk is still reduced, and the disk I / O can still be reduced to a certain extent.
[0068] Exemplarily, when implementing a sandbox simulator based on QEMU, writing the data corresponding to the write operation event to the memory area of the hybrid disk includes: the qcow2 block device driver applies for a piece of memory as the cluster space of qcow2, maps the write operation to the logical address of this memory, and then executes the write operation.
[0069] It should be noted that during the running of the sandbox, the data written to the memory is read from the memory, and the data written to the disk is read from the disk.
[0070] In an exemplary embodiment, the schematic diagram of the malicious sample sandbox detection system after using the hybrid disk can be referred to Figure 5 as Figure 5 shown. The sandbox is started based on the sandbox memory snapshot and the hybrid disk. At this time, the virtualization platform reads the operating system in the sandbox base image according to the snapshot disk chain to complete the startup. At this time, the write operations generated by the malicious samples in the sandbox will be written to the memory area of the hybrid disk through the copy-on-write mechanism, avoiding write operations to the host disk. In addition, the following is about Figure 5Brief introduction of the modules included: The basic image disk storage operating system environment is the backing file of the working disk; there can be multiple working sandbox disks, such as win10-1.qcow2, win10-2.qcow2, ……, win10-N.qcow2, which are responsible for storing the environment during sandbox operation (such as different office versions) and are the backing files of the hybrid disk; the hybrid disk is the disk that the sandbox needs to read and write during detection, used to store the data and changes generated during the detection process (such as storing the temporary data during the detection of the current sample), and the malicious sample detection engine will be started based on this hybrid disk.
[0071] In an exemplary embodiment, the usage mode of the hybrid disk under multiple sandboxes can refer to Figure 6 . Among them, base.qcow2 refers to the basic image file, VM.qcow2 (VM1.qcow2, VM2.qcow2, VM3.qcow2) refers to the virtual machine disk image file, snapshot disk.qcow2 refers to the memory snapshot of the sandbox, VMM Image drive refers to the driver or component used by the virtual machine manager to manage the virtual machine disk image, and Guest OS refers to the operating system.
[0072] In summary, in this embodiment, through the copy-on-write technology (COW, Copy-On-Write), the operation of writing to the sandbox disk is mapped to the operation of writing to memory, and reading still operates on the disk. That is to say, in an ideal situation (when the data generated during the sandbox operation does not exceed the size of the hybrid disk memory), all the data generated during the sandbox operation can be written into memory. It can be seen that the solution of this embodiment realizes the optimization of the disk I / O read and write operations during the sandbox operation to read-only, thereby reducing the physical disk pressure during high concurrency of the sandbox, as well as the write latency and loss of the virtual disk during the sandbox detection, and improving the performance of the sandbox detection engine system.
[0073] It should be noted that "optimizing the disk I / O read and write operations during the sandbox operation to read-only" means that the environment office relied on by the operating system during initialization is read from the disk, and then if the data generated during the sandbox operation does not exceed the hybrid disk memory threshold, all the data will be written into memory (that is, no data will be written to the disk), so it is called "optimizing the disk I / O read and write operations during the sandbox operation to read-only". It should be noted that the data written to the memory area during the sandbox operation is read from the memory area.
[0074] In the research on key technologies for advanced persistent threat detection, the performance optimization of the sandbox is crucial. Through the optimization of hybrid disks, the device inspection performance can be improved, reducing lags and enhancing the overall detection rate of the malicious sample inspection system. It has been verified that by using the technical solution of this application, when writing to the hybrid disk memory area according to the strategy, the write performance in the sandbox can be increased by more than 100 times.
[0075] As can be seen from the above embodiments, this application provides a hybrid disk acceleration technology. By introducing a hybrid disk drive module and a hybrid disk policy module inside the sandbox, this technology realizes accelerating the write disk operation into a write memory operation, effectively reducing the number of writes to the actual disk and lowering the performance overhead, thus significantly improving the performance and operation efficiency of the sandbox.
[0076] The optimized sandbox detection technology can improve the detection efficiency and performance, enhance the malware analysis ability, and reduce the operation and maintenance costs of the sandbox system, having significant market prospects and application potential in the current information security field. For example, it can be used in multiple security fields such as malware analysis, threat intelligence collection, and vulnerability research, and has strong versatility and applicability.
[0077] Those of ordinary skill in the art will understand that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, and their appropriate combinations. In the hardware implementation, the division of the functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, one physical component can have multiple functions, or one function or step can be executed by several physical components in cooperation. Some or all components can be implemented as software executed by a processor, such as a digital signal processor or a microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include a computer storage medium (or non-transitory medium) and a communication medium (or transitory medium). As is well known to those of ordinary skill in the art, the term "computer storage medium" includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable instructions, data structures, program modules, or other data. Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that a communication medium typically contains computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transmission mechanism, and can include any information delivery medium.
[0078] In the description of this specification, the descriptions referring to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.
[0079] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present application. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.
Claims
1. A sandbox operation method, characterized in that, Comprising: Starting a sandbox based on a pre-created hybrid disk; wherein, the hybrid disk includes a memory area and a disk area; the memory area is mapped to the memory of the host, and the disk area is mapped to the hard disk of the host; During the running of the sandbox, monitoring write operation events generated in the sandbox, and when a write operation event is detected in the sandbox, writing the data corresponding to the write operation event into the memory area or the disk area of the hybrid disk according to a preset rule; wherein, at least part of the data corresponding to the write operation event is written into the memory area of the hybrid disk.
2. The sandbox operation method according to claim 1, wherein The writing the data corresponding to the write operation event into the memory area or the disk area of the hybrid disk according to the preset rule includes: When the memory used by the hybrid disk is less than or equal to a preset memory threshold, writing the data corresponding to the write operation event into the memory area of the hybrid disk; when the memory used by the hybrid disk is greater than the preset memory threshold, writing the data corresponding to the write operation event into the disk area of the hybrid disk.
3. The sandbox operation method according to claim 1, wherein The size of the memory area of the hybrid disk is configured according to a preset policy, and the preset policy includes: Configuring the size of the memory area of the hybrid disk according to the remaining memory size of the host when the hybrid disk is created; and / or, when the sandbox is used for malicious sample detection, configuring the size of the memory area of the hybrid disk according to the type of the sample to be detected.
4. The sandbox operation method according to claim 1, wherein: Before starting the sandbox based on the pre-created hybrid disk, it further includes: during the process of creating the hybrid disk, establishing a mapping relationship between the logical address of the sandbox and the storage block in the memory area or the disk area; The writing the write operation event into the memory area or the disk area of the hybrid disk includes: writing the data corresponding to the write operation event into the memory area or the disk area of the hybrid disk according to the logical address.
5. The sandbox operation method according to claim 1, wherein Before starting the sandbox based on the pre-created hybrid disk, it further includes: Modifying the block device driver of the sandbox to a hybrid disk driver to monitor write operation events generated in the sandbox.
6. The sandbox operation method according to claim 4, characterized in that The writing the data corresponding to the write operation event into the memory area of the hybrid disk includes: Applying for a memory space from the memory area through the block device driver of the sandbox as a target memory block; Writing the data corresponding to the write operation event into the memory area of the hybrid disk according to the logical address corresponding to the target memory block.
7. A sandbox operating device, comprising: A memory and a processor, wherein: The memory is used to save a program for sandbox operation; The processor is used to read the program for sandbox operation and execute the sandbox operation method according to any one of claims 1 to 6.
8. A sandbox hybrid disk acceleration system, characterized in that, Comprising: A hybrid disk driver module and a hybrid disk policy module; The hybrid disk driver module is used to monitor write operation events generated in the sandbox during the running of the sandbox, and when a write operation event is detected in the sandbox, sending the write operation event to the hybrid disk policy module; The hybrid disk policy module is used to write the data corresponding to the write operation event into the memory area or disk area of the hybrid disk according to a preset rule; wherein, at least part of the data corresponding to the write operation event is written into the memory area of the hybrid disk.
9. The sandbox hybrid disk acceleration system according to claim 8, wherein The writing of the data corresponding to the write operation event into the memory area or disk area of the hybrid disk according to the preset rule includes: When the memory used by the hybrid disk is less than or equal to a preset memory threshold, writing the data corresponding to the write operation event into the memory area of the hybrid disk; when the memory used by the hybrid disk is greater than the preset memory threshold, writing the data corresponding to the write operation event into the disk area of the hybrid disk.
10. The sandbox hybrid disk acceleration system according to claim 8, wherein: The hybrid disk driver module is further used to modify the block device driver of the sandbox into a hybrid disk driver to monitor the write operation events generated in the sandbox.