A malware analysis system and method

Abstract

The present application provides a kind of malware analysis system and method, belong to malware analysis field.The system includes: sample acquisition module, for utilizing multiple acquisition methods to collect malware samples, and the malware samples are stored;Threat intelligence integration module, for utilizing multiple platforms to collect threat intelligence, and the threat intelligence is integrated and stored;Automated analysis module, utilizes automated analysis tool, combines analysis process and automated process, generates the automated analysis result of malware;Result verification module, utilizes selected verification method, combines multiple verification indexes, and the credibility of automated analysis result is checked;And report generation module, generates corresponding defense measures, generates malware analysis report.The present application improves the update speed of threat intelligence and the detection efficiency of new malware, reduces the false alarm rate, improves the determination accuracy, shortens the deployment time of defense measures, and reduces the amount of manual operation.

Description

Technical Field

[0001] This invention relates to the field of malware analysis technology, and more specifically to a malware analysis system and method. Background Technology

[0002] Malware poses a serious threat to computer systems and devices. Once it appears on a computing system or device, it can lead to the loss of personal, financial, or other sensitive information. The widespread existence of malware is partly due to the range and diversity of its variants, which can take the form of viruses, worms, Trojans, keyloggers, spyware, adware, and ransomware, among others. New types of each are constantly emerging, thus necessitating the analysis and handling of malware by malware analysis systems.

[0003] Existing malware analysis systems suffer from delayed threat intelligence updates and operate independently of the sample analysis process, failing to provide real-time guidance for analysis strategies and resulting in the missed detection of new malware. The output of single analysis tools in malware analysis systems contains false positives and lacks multi-dimensional verification mechanisms. Furthermore, traditional malware analysis systems only present technical data in their analysis reports, without generating actionable defense measures, requiring users to manually convert rules, which delays emergency response. Summary of the Invention

[0004] The purpose of this invention is to provide a malware analysis system and method to solve the problems of delayed threat intelligence updates, lack of multi-dimensional verification mechanisms, and failure to generate executable defense measures in existing malware analysis systems.

[0005] To achieve the above objectives, the present invention provides a malware analysis system, comprising: a sample collection module for collecting malware samples using various collection methods and storing the malware samples; a threat intelligence integration module for collecting threat intelligence using multiple platforms and integrating and storing the threat intelligence; an automated analysis module for generating automated malware analysis results based on the stored malware samples and stored threat intelligence, using automated analysis tools and combining analysis processes with automated processes; a result verification module for verifying the credibility of the automated analysis results using selected verification methods and combining multiple verification indicators; and a report generation module for generating corresponding defense measures based on the automated analysis results and generating a malware analysis report by combining the automated analysis results and the corresponding defense measures.

[0006] Optionally, the integration of the threat intelligence includes: performing standardization processing on the heterogeneous data of the threat intelligence to generate standardized threat intelligence; performing correlation analysis on the standardized threat intelligence and the malware sample to generate correlation analysis results; and dynamically updating the threat intelligence database based on the correlation analysis results to achieve the integration of threat intelligence.

[0007] Optionally, the analysis process includes static analysis, dynamic analysis, and behavioral analysis, wherein the static analysis includes: analyzing the file structure of malware samples and threat intelligence; extracting suspicious strings based on the file structure; and detecting and analyzing the encryption algorithm and hash value of the suspicious strings;

[0008] Based on the encryption algorithm and hash value, it is matched with the characteristics of known malware.

[0009] Optionally, the dynamic analysis includes: running the malware sample in a sandbox environment; monitoring the operation of the malware sample and recording its behavior; and analyzing the system APIs called by the malware based on the behavior.

[0010] Optionally, the behavioral analysis includes: using a rule engine to detect abnormal behavior during the execution of the malware sample; and matching the abnormal behavior with a threat intelligence database.

[0011] Optionally, the automated process includes: building an automated analysis pipeline to perform static analysis, dynamic analysis, and behavioral analysis in sequence; using multi-threading or multi-nodes to process the malware samples in parallel; and using a task scheduler to set the priority of malware sample analysis based on the danger level of the malware samples.

[0012] Optionally, the step of using automated analysis tools, combined with analysis and automation processes, to generate automated analysis results for malware includes: using a packer identification tool to determine whether the malware sample is protected by a packer, and combining cryptographic analysis methods to determine whether the malware sample uses a hard-coded key; when the malware sample is protected by a packer and uses a hard-coded key, triggering dynamic analysis; running the malware sample in a sandbox environment, and when a process injection chain is captured, confirming persistent behavior and triggering behavioral analysis; matching the persistent behavior with the threat intelligence database to generate automated analysis results for the malware sample.

[0013] Optionally, the verification method includes expert verification, cross-validation, and historical data verification. The verification indicators include accuracy, completeness, and timeliness. The step of using the selected verification method and combining multiple verification indicators to verify the credibility of the automated analysis results includes: retrieving the automated analysis results using a verification console and comparing them with the ATT&CK technology library to generate verification results for the expert verification method; using multiple automated analysis tools to automatically analyze malware samples from multiple sources, generating multiple sets of automated analysis results, comparing these sets to obtain verification results for the cross-validation method; using a historical database to retrieve matching results between the automated analysis results and historical data, and combining this with a similarity algorithm to generate verification results for the historical data verification method; mapping the verification results of the expert verification method, the cross-validation method, and the historical data verification method to corresponding verification indicators, and calculating a credibility verification score using a comprehensive credibility model; if the credibility verification score exceeds a preset threshold, the automated analysis result is rated as high credibility; if the credibility verification score does not exceed the preset threshold, the automated analysis result is rated as low credibility.

[0014] Optionally, generating the malware analysis report includes: generating basic information about the malware sample based on the malware sample; generating automated analysis results based on the results of static analysis, dynamic analysis, and behavioral analysis; generating the correlation between the malware sample and the threat intelligence based on the correlation analysis results; generating corresponding malware defense measures based on the correlation; and integrating the basic information, automated analysis results, correlation, and defense measures to generate the malware analysis report.

[0015] On the other hand, the present invention provides a malware analysis method, the method comprising: collecting malware samples using multiple collection methods and storing the malware samples; collecting threat intelligence using multiple platforms and integrating and storing the threat intelligence; generating automated malware analysis results using automated analysis tools, combining analysis processes and automated processes, based on the stored malware samples and stored threat intelligence; verifying the credibility of the automated analysis results using selected verification methods, combined with multiple verification indicators, based on the automated analysis results; and generating corresponding defense measures based on the automated analysis results, and generating a malware analysis report by combining the automated analysis results and the corresponding defense measures.

[0016] Through the above technical solutions, this invention improves the speed of threat intelligence updates and the efficiency of detecting new malware by using dynamic and correlation analysis in the threat intelligence integration module and pipeline design in the automated analysis module; it reduces the false alarm rate and improves the accuracy of identifying high-risk malware samples by using expert verification, cross-validation, and historical data verification methods in the result verification module; and it significantly shortens the deployment time of defense measures and reduces the amount of manual operation by using correlation and defense measures in the report generation module.

[0017] Other features and advantages of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0018] The accompanying drawings are provided to further illustrate embodiments of the present invention and form part of the specification. They are used together with the following detailed description to explain the embodiments of the present invention, but do not constitute a limitation thereof. In the drawings:

[0019] Figure 1 This is a flowchart illustrating a malware analysis system according to the present invention;

[0020] Figure 2 This is a flowchart illustrating the threat intelligence integration process in this invention;

[0021] Figure 3 This is a flowchart illustrating the automated analysis results of generating malware in this invention.

[0022] Figure 4 This is a flowchart illustrating the process of verifying the credibility of automated analysis results in this invention.

[0023] Figure 5 This is a schematic diagram of the process for generating a malware analysis report in this invention;

[0024] Figure 6 This is a flowchart illustrating a malware analysis method according to the present invention. Figure 1 ;

[0025] Figure 7 This is a flowchart illustrating a malware analysis method according to the present invention. Figure 2 . Detailed Implementation

[0026] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the present invention.

[0027] It should be noted that the acquisition, transmission, storage, use, and processing of data in the technical solution of this application all comply with relevant laws and regulations. In the embodiments of this application, certain existing industry solutions such as software, components, and models may be mentioned. These should be considered exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions.

[0028] Please refer to Figure 1 This invention provides a malware analysis system, comprising: a sample collection module for collecting and storing malware samples using various methods; a threat intelligence integration module for collecting, integrating, and storing threat intelligence using multiple platforms; an automated analysis module for generating automated malware analysis results based on the stored malware samples and stored threat intelligence, using automated analysis tools and combining analysis and automation processes; a result verification module for verifying the credibility of the automated analysis results using selected verification methods and multiple verification indicators; and a report generation module for generating corresponding defense measures based on the automated analysis results and generating a malware analysis report by combining the automated analysis results and the corresponding defense measures.

[0029] In this embodiment of the invention, the sample acquisition module can be used to acquire malware samples using various acquisition methods and store the malware samples.

[0030] The methods employed to collect malware samples include: network packet capture tools deployed on perimeter firewalls to capture malicious traffic (e.g., using DPI technology, which analyzes network packets byte-by-byte to identify application layer protocols and application types) to filter abnormal traffic and extract PE files (portable executable files that store program code, resources, and data that can run on Windows systems); lightweight virtual machines deployed in sandbox environments to run malware and collect its malicious payloads; honeypot tools deployed on networks to capture malware and record its information (e.g., building simulated industrial control systems, such as fake PLC services, to attract targeted attacks); and obtaining malware samples using publicly available malware libraries.

[0031] In a preferred embodiment of the present invention, when storing malware samples, a distributed file system can be used to store malware samples. For example, a MinIO object storage cluster (MinIO is a high-performance, open-source object storage server suitable for storing unstructured data, such as images, videos, log files, backup data, etc.) can be used, and the samples can be stored in buckets according to the sample collection time. Basic information of malware samples can be recorded, such as automatically extracting and storing four core attributes: file name, MD5 value, file size, and collection source. Tags (e.g., family, type, danger level, etc.) can be added to samples according to the collection method.

[0032] In this embodiment of the invention, the threat intelligence integration module can be used to collect threat intelligence using multiple platforms and to integrate and store the threat intelligence.

[0033] These platforms can include public threat intelligence platforms (e.g., subscriptions to AlienVault OTX (an open-source threat intelligence platform that allows security professionals, researchers, and enthusiasts to share, access, and analyze various cyber threat intelligence), ThreatConnect (a threat intelligence platform deployed on-premises or in the cloud that provides advanced analytics capabilities for threat intelligence, incident response, and security operations analysis by effectively aggregating, analyzing, and acting on complex cyberattacks), private threat intelligence repositories (e.g., attack indicators integrated with an enterprise's internal SIEM system), open-source threat intelligence (e.g., threat intelligence projects on GitHub (a hosting platform for open-source and private software projects), and partner sharing (e.g., sharing threat intelligence with other organizations).

[0034] Please refer to Figure 2 In a preferred embodiment of the present invention, integrating threat intelligence may include:

[0035] Step S110: Based on the heterogeneous data of threat intelligence, perform standardization processing to generate standardized threat intelligence.

[0036] For example, key fields (such as IP addresses, domain names, and file hashes) can be extracted from heterogeneous data and forcibly aligned to the STIX 2.1 object model through a standardization engine (STIX 2.1 is a structured threat information representation, and the object model is a standard model used in the cybersecurity field to describe, share, and exchange threat intelligence). This generates a bundle data package that conforms to the STIX 2.1 specification (i.e., a packaged and bundled collection of data), containing threat indicators and malware objects with unified semantics, thus eliminating differences in the formats of multi-source data.

[0037] The standardization engine is a tool used to achieve standardization processing. It can perform standardization operations on various types of data, converting data of different formats and ranges into a unified format and range, removing noise, outliers, etc., to improve data quality and usability, and facilitate subsequent analysis, storage, and sharing.

[0038] Step S120: Perform correlation analysis based on standardized threat intelligence and malware samples to generate correlation analysis results.

[0039] For example, the MD5 value extracted from the static analysis of malware samples can be compared with the hash of File objects in the threat intelligence database to match known malicious files. Then, the domain name of the C&C server (command and control server, also known as the master server, which is the core device used by attackers to control the compromised computer) captured by dynamic analysis can be matched with the domain name object in the intelligence database to trace the infrastructure of the malware attack. Finally, a STIXRelationship object is generated (STIX is a structured threat information expression used to represent and exchange network threat intelligence. STIXRelationship is used to describe the relationship between different objects in STIX. For example, the STIXRelationship object can be [sample]-uses-[C&C server]) to construct a threat intelligence graph as the result of the correlation analysis.

[0040] Step S130: Based on the correlation analysis results, dynamically update the threat intelligence database to achieve threat intelligence integration.

[0041] For example, public intelligence sources can be polled every 5 minutes to capture only newly added or modified threat intelligence data. After standardization, this data is injected into the threat intelligence database. IP / domain-type IoCs are automatically marked as expired if there is no activity for 30 days and moved to the historical archive. Tactical intelligence is marked as abandoned if it has not been updated for 1 year. This maintains a highly active threat intelligence database (e.g., expired data accounts for ≤5%) and ensures the timeliness of correlation analysis.

[0042] In a preferred embodiment of the present invention, the format of threat intelligence may include storing and transmitting threat intelligence in STIX / TAXII format. For example, the core threat intelligence database uses STIX (a standard language for representing and sharing network threat intelligence, enabling different organizations and systems to communicate and analyze network security-related information more effectively) to describe attack patterns, and distributes threat intelligence through the TAXII 2.0 protocol (a protocol for standardizing trusted, automated network threat information exchange, a version of the TAXII protocol that defines a set of services and message exchanges, enabling organizations to share actionable network threat information with each other). Threat intelligence may also be stored in JSON format (a lightweight data exchange format that is easy for humans to read and write, and also easy for machines to parse and generate, such as a list of C&C server IPs) or YAML format (a readable data serialization format used for configuration files, data exchange, etc., using indentation and line breaks to represent data structures, with a concise format and support for data types such as scalars, lists, and maps).

[0043] In this embodiment of the invention, the automated analysis module can be used to generate automated analysis results of malware based on stored malware samples and stored threat intelligence, using automated analysis tools and combining analysis processes with automated processes.

[0044] In a preferred embodiment of the present invention, the analysis process includes static analysis, dynamic analysis, and behavioral analysis. Static analysis may include: analyzing the file structure of malware samples and threat intelligence, such as extracting file headers, PE structures, etc., and parsing anomalies in the import / export tables of PE files; extracting suspicious strings based on the file structure, such as scanning C&C domain names in ASCII / Unicode strings; detecting and analyzing the encryption algorithms and hash values ​​of suspicious strings, for example, identifying the characteristics of AES-256 key (the encryption key used by the Advanced Symmetric Encryption Standard algorithm with a 256-bit key length); and matching the encryption algorithms and hash values ​​with the characteristics of known malware, for example, matching code snippets of known malware using the YARA rule base. The YARA rule base is a collection of YARA rules based on text string and binary pattern matching, and is an open-source tool for detecting malware, identifying specific file types, or finding specific patterns in files. YARA rules describe the characteristics of files by writing rules, and then applying these rules to target files to determine whether the file contains matching characteristics.

[0045] In a preferred embodiment of the present invention, dynamic analysis may include: running malware samples in a sandbox environment, for example, running samples in a Windows 10 environment of the Cuckoo Sandbox (i.e., an open-source automated malware analysis system that can execute suspicious files or programs in an isolated environment and analyze the characteristics, activities and potential harms of malware by monitoring their behavior); monitoring the running of malware samples and recording their running behavior, for example, recording the creation of malware sample process trees and registry persistence operations; and analyzing the system APIs called by malware based on the running behavior, for example, hooking 18 high-risk API call sequences such as NtCreateFile (i.e., a function of native API in the Windows operating system, whose main function is to create, open or truncate a file, directory, physical disk, volume, console buffer, mail slot, pipe and other objects).

[0046] In a preferred embodiment of the present invention, behavioral analysis may include: using a rule engine to detect abnormal behavior during the execution of malware samples. For example, a rule engine can be used to identify fileless attack characteristics. The rule engine is a component embedded in the application, which separates business decisions from the application code and uses predefined semantic modules to write business decisions. Rules are usually represented in an easy-to-understand way (e.g., in the form of "if...then...") and stored in a rule base. Based on the abnormal behavior, it is matched with a threat intelligence database. For example, the external IP of the malware sample can be compared with the threat intelligence database in real time and matched.

[0047] In a preferred embodiment of the present invention, the automated process may include: constructing an automated analysis pipeline to sequentially perform static analysis, dynamic analysis, and behavioral analysis, with a fixed execution sequence of "static analysis → dynamic analysis → behavioral analysis," and terminating if the preceding sequence fails; utilizing multi-threading or multi-nodes to process malware samples in parallel, for example, achieving concurrent analysis of hundreds of samples based on a Kubernetes cluster. A Kubernetes cluster is a set of nodes (physical machines or virtual machines) used to run containerized applications, consisting of a control plane and worker nodes. The control plane is responsible for managing and maintaining the state of the entire cluster and coordinating various resources and operations within the cluster. Worker nodes are where applications run. Kubernetes clusters can achieve automated application deployment, scaling, failover, load balancing, and other functions, improving the reliability and maintainability of applications; and using a task scheduler to manage analysis tasks, for example, using Airflow to set the priority of malware sample analysis according to the danger level of the malware samples.

[0048] Please refer to Figure 3In a preferred embodiment of the present invention, the automated analysis results of malware are generated by using automated analysis tools, combining analysis processes with automated processes, and may include:

[0049] Step S210: Use a packer identification tool to determine whether the malware sample is protected by a packer, and combine cryptographic analysis methods to determine whether the malware sample uses a hard-coded key.

[0050] For example, a packer detection tool (PEiD) can be used to detect abnormal offsets in the entry point of malware samples and overlapping section tables (e.g., .text and .data sections intersect). By matching the signature rules of executable file compression tools, it can be determined that the malware sample is protected by packers. Then, by converting machine language (binary code) into assembly language code, the fixed hexadecimal value at the offset abnormality can be located. Combined with the encrypted API call pattern, it can be confirmed as a hard-coded key.

[0051] Step S220: When the malware sample is protected by a packer and a hard-coded key, trigger dynamic analysis.

[0052] For example, when two high-risk features are detected—packing (avoiding analysis) and key hard-coding (C&C encrypted communication evidence)—the automated process generates a dynamic analysis instruction, carrying the C&C server web address extracted from static analysis as a monitoring parameter, and triggers the dynamic analysis process.

[0053] Step S230: Run the malware sample in the sandbox environment. When the process injection chain is captured, confirm the persistence behavior and trigger behavior analysis.

[0054] For example, the sample can be run in an isolated Windows 10 environment, forcibly enabling network blocking rules to block all outbound traffic, forcing the malware sample to activate a backup attack chain. Through environmental restrictions, the behavior pattern of the malware sample in a real restricted network is exposed. The process injection chain of the attack chain is captured. Using the CAPE malware analysis platform, hooking techniques are employed to capture the call sequence of a series of high-risk APIs called by the malware during its operation. The high-risk API sequence is analyzed to identify the malware's behavior patterns, functional characteristics, and attack intentions. A fake file is released and functions in the application programming interface (API) are called to set hidden attributes. Registry startup items ensure that the malware sample runs automatically after the system restarts. Combined with the file hiding attribute, long-term persistence and stealth are achieved. The released fake file is the execution target of the API function in the injection chain, proving that the injection behavior serves persistence.

[0055] Step S240: Match persistent behavior with the threat intelligence database to generate automated analysis results of malware samples.

[0056] For example, memory dumps of process injection chains can be extracted to discover the IP address pointing to the reverse shell command stream (i.e., the controlled end actively initiates a connection to the control end to establish an interactive command-line session, through which the attacker can execute commands on the target host and control the target system). The captured C&C server web address can be compared with the threat intelligence database in real time (e.g., matching activities that match the attacker's techniques described in STIX format, and associating them with API organizations). The MD5 value of the released spoofed file can be collided with known malware to form new types of malware after mutation, thus tracing the lineage of malware samples.

[0057] In this embodiment of the invention, the result verification module can be used to verify the credibility of the automated analysis results by using a selected verification method and combining multiple verification indicators based on the automated analysis results.

[0058] In a preferred embodiment of the present invention, the verification method may include an expert verification method, a cross-validation method, and a historical data verification method, and the verification indicators may include accuracy, completeness, and timeliness.

[0059] Among them, the expert verification method uses a web console to allow security experts to manually verify the automated analysis results; the cross-validation method uses other analysis tools to generate analysis results and compares them with the automated analysis results; and the historical data verification method compares the analysis results based on historical malware samples with the automated analysis results.

[0060] Accuracy refers to the consistency between the analysis results and the actual results, and the false alarm rate of automated analysis is calculated based on the results of manual verification; completeness refers to whether all preset detection dimensions are covered (e.g., files / networks / registries); timeliness refers to whether the analysis speed meets the requirements, that is, the total time taken from the statistical sample entering the database to the completion of verification.

[0061] Please refer to Figure 4 In a preferred embodiment of the present invention, the credibility verification of automated analysis results is performed using a selected verification method combined with multiple verification indicators, which may include:

[0062] Step S310: Use the verification console to retrieve the automated analysis results and compare them with the ATT&CK technology library to generate the verification results of the expert verification method.

[0063] In a preferred embodiment of the present invention, security experts can retrieve the following core data through the verification console: retrieve registry key data modified by malware samples by dynamically analyzing screen recording clips, and capture DNS tunnel request data by network traffic; then compare with the ATT&CK technology library to confirm that registry auto-start and DNS protocol communication match, and obtain the verification result of the expert verification method.

[0064] Step S320: Utilize various automated analysis tools to automatically analyze malware samples from multiple sources, generate multiple sets of automated analysis results, compare the multiple sets of automated analysis results, and obtain the verification results of the cross-validation method.

[0065] In a preferred embodiment of the present invention, various automated analysis tools may include the CuckooSandbox tool, which detects registry persistence behavior and determines that it is consistent with Sysmon log records; the CAPE extension tool, which captures DNS tunnel API and determines that it matches the traffic characteristics of the network protocol analyzer; and the Volatility tool, which outputs a process tree and determines that it is the same as the process chain recorded by the EDR terminal (i.e., the endpoint detection and response terminal, used for real-time monitoring and response to security threats to endpoint devices (such as computers, servers, etc.). The above results are compared to obtain the verification results of the cross-validation method.

[0066] Step S330: Using the historical database, retrieve the matching results between the automated analysis results and the historical data, and combine them with the similarity algorithm to generate the verification results of the historical data verification method.

[0067] In a preferred embodiment of the present invention, a similarity algorithm is used to calculate the degree of similarity between two or more analysis results and historical data. The verification result of the historical data verification method can be obtained through the similarity value, which can be expressed by the following formula:

[0068]

[0069] Step S340: Map the verification results of the expert verification method, the cross-validation method, and the historical data verification method to the corresponding verification indicators, and use the comprehensive credibility model to calculate the credibility verification score.

[0070] In a preferred embodiment of the present invention, when the verification result is mapped to the corresponding verification index, security experts directly determine whether the analysis result is true by reviewing key evidence based on experience (e.g., dynamic screen recording analysis) and calculating the true positive rate confirmed manually, which can contribute to the accuracy verification. Experts check the coverage of preset detection items and calculate the coverage rate, which can contribute to the integrity verification. The analysis results of multiple automated analysis tools are cross-verified to eliminate single-point errors, and the consistency rate of the results of multiple tools is calculated, which can contribute to the accuracy verification. The complementary capabilities of multiple automated analysis tools discover hidden features and calculate feature increments, which can contribute to the integrity verification. Historical patterns are used as a benchmark reference, and the similarity between the sample and the historical database is calculated, which can contribute to the accuracy verification. The time taken from the start of historical retrieval to the output of results is statistically analyzed, and the ratio of the verification time to the total verification time is calculated, which can contribute to the timeliness verification.

[0071] In a preferred embodiment of the present invention, the comprehensive credibility model is a comprehensive model used to evaluate and quantify the credibility of things. It can comprehensively consider multiple different factors, dimensions or information sources, and integrate these factors through specific algorithms and rules to obtain an evaluation result such as a numerical value or level of credibility of the target object.

[0072] The credibility verification score can be expressed by the following formula:

[0073]

[0074] in, Indicates the accuracy contribution value. Indicates the integrity contribution value. This indicates the contribution value based on timeliness.

[0075] Step S350: If the credibility verification score exceeds the preset threshold (e.g., 80%), the automated analysis result is rated as high credibility; if the credibility verification score does not exceed the preset threshold, the automated analysis result is rated as low credibility.

[0076] In this embodiment of the invention, the report generation module can be used to generate corresponding defense measures based on the automated analysis results, and combine the automated analysis results with the corresponding defense measures to generate a malware analysis report.

[0077] Please refer to Figure 5 In a preferred embodiment of the present invention, generating a malware analysis report may include:

[0078] Step S410: Generate basic information about the malware sample based on the malware sample.

[0079] In a preferred embodiment of the present invention, basic attributes of malware samples can be extracted from distributed storage, such as filename, MD5 value, file size and collection source, etc., and tag system information of malware samples can also be added, such as initial tags and post-analysis tags, etc.

[0080] Step S420: Generate automated analysis results based on the results of static analysis, dynamic analysis, and behavioral analysis.

[0081] In a preferred embodiment of the present invention, the integration of static analysis results may include, for example, analysis of the structure of packed files, extracted strings (C&C server, release path), cryptographic analysis (hard-coded key), and feature matching (YARA rule hits); the integration of dynamic analysis results may include, for example, sandbox execution (activating DNS tunnel after network blocking), behavior monitoring (registry persistence, file operations), and API call analysis; the integration of behavioral analysis results may include, abnormal behavior detection (abnormal process tree entropy, DNS traffic pattern matching), and threat intelligence matching (IP association with APT groups), thereby generating automated analysis results.

[0082] Step S430: Based on the correlation analysis results, generate the correlation between malware samples and threat intelligence.

[0083] In a preferred embodiment of the present invention, generating the association may include first parsing the structured threat information expression object, such as [sample]-uses-[infrastructure:94.130.178.23], [sample]-variant of-[malicious software:Emotet]; then associating it with the attacking organization, such as belonging to the hacker organization TA542 (historical activity: banking Trojan distribution); and finally mapping the ATT&CK framework (registry self-starting, DNS protocol communication) to generate the association between the malware sample and the threat intelligence.

[0084] Step S440: Based on the association, generate corresponding malware defense measures.

[0085] In a preferred embodiment of the present invention, network layer defense measures are generated for the C&C server communication behavior captured by dynamic analysis. Firewall rules can be used to generate instructions to block malicious IP addresses and prevent terminal devices from connecting to the C&C server IP addresses discovered by analysis. These rules directly act on the network egress and can immediately cut off the communication channel between the malware sample and the attacker. At the same time, specific rules are created to block malicious domain name resolution requests for DNS covert tunneling behavior, preventing malware samples from penetrating data through the DNS protocol.

[0086] In a preferred embodiment of the present invention, terminal-level defense measures are generated based on persistent residency and process behavior discovered through behavioral analysis. This can be achieved by utilizing EDR response commands to generate commands that forcibly terminate malicious processes (e.g., terminating a process named spoolv.exe (an executable file associated with a print spooler program; abnormal spoolv.exe processes, such as those consuming excessive system resources or exhibiting abnormal network connections, may indicate system infection)). This command immediately terminates running malicious activities and simultaneously creates registry repair instructions (e.g., deleting the PrintSpooler (a print spooler service in Windows that manages print jobs) startup entry), clearing the persistence mechanism established by the malware sample in the system, and ensuring that malicious code is not reactivated after a system restart. These commands can be executed directly within the terminal security system, achieving automated repair.

[0087] In a preferred embodiment of the present invention, hunting detection rules are generated based on unique features discovered by static analysis. YARA rules can be used to dynamically generate detection rules based on binary features. For example, YARA rules that precisely match hard-coded key features discovered by cryptographic analysis can be created. These rules can be deployed to terminals or network sensors to actively scan for variants of the same source malware code in memory or file systems, thereby enhancing the ability to hunt persistent threats.

[0088] Step S450: Integrate basic information, automated analysis results, correlation information, and defense measures to generate a malware analysis report.

[0089] In a preferred embodiment of the present invention, when generating a malware analysis report, a report template can be selected first, for example, using a standard structure with a cover / table of contents / chapter index, and adding a "Lateral Movement Detection Suggestion" chapter according to user configuration; then, a format conversion engine is used for HTML / PDF rendering and JSON / XML output, for example, injecting JSON analysis data into a Jinja2 template (a powerful and widely used template engine for Python that allows developers to combine dynamic data with static template files to generate the final text output, such as HTML web pages, configuration files, etc.), using WeasyPrint (an open-source library written in Python for converting HTML and CSS documents into PDF files, conforming to Web standards, and capable of generating high-quality PDFs precisely according to the style and layout of web page design) to generate a PDF with a table of contents, preserving the original data structure, and adding ATT&CK mapping fields; finally, visual charts (e.g., behavior sequence diagrams, threat score radar charts) are embedded.

[0090] Please refer to Figure 6 and Figure 7This invention also provides a malware analysis method, which includes:

[0091] Step S1: Collect malware samples using various collection methods and store the malware samples.

[0092] Step S2: Collect threat intelligence using multiple platforms, and integrate and store the threat intelligence.

[0093] Step S3: Based on the stored malware samples and stored threat intelligence, use automated analysis tools, combined with analysis and automation processes, to generate automated analysis results for malware.

[0094] Step S4: Based on the automated analysis results, use the selected verification method and combine multiple verification indicators to verify the credibility of the automated analysis results.

[0095] Step S5: Based on the automated analysis results, generate corresponding defense measures, and combine the automated analysis results with the corresponding defense measures to generate a malware analysis report.

[0096] Accordingly, this invention provides a malware analysis system, comprising: a sample collection module for collecting malware samples using various methods and storing the malware samples; a threat intelligence integration module for collecting threat intelligence using multiple platforms and integrating and storing the threat intelligence; an automated analysis module for generating automated malware analysis results based on the stored malware samples and stored threat intelligence, using automated analysis tools and combining analysis processes with automated processes; a result verification module for verifying the credibility of the automated analysis results using selected verification methods and combining multiple verification indicators; and a report generation module for generating corresponding defense measures based on the automated analysis results, and generating a malware analysis report by combining the automated analysis results and the corresponding defense measures. Through the above technical solutions, this invention improves the speed of threat intelligence updates and the efficiency of detecting new malware by using dynamic and correlation analysis in the threat intelligence integration module and pipeline design in the automated analysis module; it reduces the false alarm rate and improves the accuracy of identifying high-risk malware samples by using expert verification, cross-validation, and historical data verification methods in the result verification module; and it significantly shortens the deployment time of defense measures and reduces the amount of manual operation by using correlation and defense measures in the report generation module.

[0097] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0099] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0100] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0101] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0102] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0103] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0104] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0105] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A malware analysis system, characterized in that, The analysis system includes: The sample acquisition module is used to collect malware samples using various acquisition methods and store the malware samples. The threat intelligence integration module is used to collect threat intelligence using multiple platforms and to integrate and store the threat intelligence. The automated analysis module is used to generate automated analysis results of malware based on stored malware samples and stored threat intelligence, using automated analysis tools and combining analysis processes with automated processes. The result verification module is used to verify the credibility of the automated analysis results using a selected verification method and multiple verification indicators; and The report generation module is used to generate corresponding defense measures based on the automated analysis results, and to generate a malware analysis report by combining the automated analysis results with the corresponding defense measures. The method of using automated analysis tools, combining analysis processes with automation processes, to generate automated analysis results for malware includes: Using packer identification tools, determine whether the malware sample is protected by packer, and combine cryptographic analysis methods to determine whether the malware sample uses a hard-coded key; When the malware sample is protected by a packer and a hard-coded key, dynamic analysis is triggered. The malware sample was run in a sandbox environment. When a process injection chain was captured, persistent behavior was confirmed, and behavioral analysis was triggered. The persistent behavior is matched with a threat intelligence database to generate automated analysis results of malware samples.

2. The analysis system according to claim 1, characterized in that, The integration of the threat intelligence includes: Based on the heterogeneous data of the threat intelligence, standardized processing is performed to generate standardized threat intelligence; Based on the standardized threat intelligence and the malware sample, a correlation analysis is performed to generate correlation analysis results; Based on the correlation analysis results, the threat intelligence database is dynamically updated to achieve the integration of threat intelligence.

3. The analysis system according to claim 1, characterized in that, The analysis process includes static analysis, dynamic analysis, and behavioral analysis, wherein the static analysis includes: Analyze the file structure of malware samples and threat intelligence; Based on the file structure, extract suspicious strings; Detect and analyze the encryption algorithm and hash value of the suspicious string; Based on the encryption algorithm and hash value, it is matched with the characteristics of known malware.

4. The analysis system according to claim 3, characterized in that, The dynamic analysis includes: Run the malware sample in a sandbox environment; Monitor the execution of the malware sample and record its behavior; Based on the aforementioned operational behavior, the system APIs invoked by the malware were analyzed.

5. The analysis system according to claim 3, characterized in that, The behavioral analysis includes: The rule engine is used to detect abnormal behavior during the execution of the malware sample; Based on the aforementioned abnormal behavior, a match is made with the threat intelligence database.

6. The analysis system according to claim 3, characterized in that, The automated process includes: Build an automated analysis pipeline to perform static analysis, dynamic analysis, and behavioral analysis sequentially; The malware sample is processed in parallel using multiple threads or multiple nodes; Using a task scheduler, the priority of malware sample analysis is set based on the danger level of the malware sample.

7. The analysis system according to claim 1, characterized in that, The verification methods include expert verification, cross-validation, and historical data verification. The verification indicators include accuracy, completeness, and timeliness. The process of using the selected verification methods, combined with multiple verification indicators, to verify the credibility of the automated analysis results includes: The automated analysis results are retrieved using the verification console and compared with the ATT&CK technology library to generate verification results for the expert verification method. Using a variety of automated analysis tools, the malware samples from multiple sources are analyzed automatically, generating multiple sets of automated analysis results. By comparing the multiple sets of automated analysis results, the verification results of the cross-validation method are obtained. Using a historical database, the matching results between the automated analysis results and historical data are retrieved, and combined with a similarity algorithm, the verification results of the historical data verification method are generated. The verification results of the expert verification method, the cross-validation method, and the historical data verification method are mapped to corresponding verification indicators, and a credibility verification score is calculated using a comprehensive credibility model. If the credibility verification score exceeds the preset threshold, the automated analysis result will be rated as high credibility. If the credibility verification score does not exceed the preset threshold, the automated analysis result will be rated as low credibility.

8. The analysis system according to claim 1, characterized in that, The generated malware analysis report includes: Based on the malware sample, generate basic information about the sample; Automated analysis results are generated based on the results of static analysis, dynamic analysis, and behavioral analysis. Based on the correlation analysis results, the correlation between the malware sample and the threat intelligence is generated; Based on the aforementioned associations, corresponding malware defense measures are generated; By integrating the basic information, automated analysis results, correlation information, and defense measures, a malware analysis report is generated.

9. A method for analyzing malware, characterized in that, The analytical method includes: Malware samples are collected using multiple acquisition methods and then stored. Collect threat intelligence using multiple platforms, and integrate and store the threat intelligence; Based on stored malware samples and stored threat intelligence, automated analysis tools are used, combined with analysis and automation processes, to generate automated analysis results for malware. Based on the automated analysis results, the reliability of the automated analysis results is verified using the selected verification method and multiple verification indicators; and Based on the automated analysis results, corresponding defense measures are generated, and a malware analysis report is generated by combining the automated analysis results with the corresponding defense measures. The method of using automated analysis tools, combining analysis processes with automation processes, to generate automated analysis results for malware includes: Using packer identification tools, determine whether the malware sample is protected by packer, and combine cryptographic analysis methods to determine whether the malware sample uses a hard-coded key; When the malware sample is protected by a packer and a hard-coded key, dynamic analysis is triggered. The malware sample was run in a sandbox environment. When a process injection chain was captured, persistent behavior was confirmed, and behavioral analysis was triggered. The persistent behavior is matched with a threat intelligence database to generate automated analysis results of malware samples.

Images