Code analysis method and related system

Abstract

The present application discloses a code analysis method, executed by a code analysis system. The system is configured to analyze whether a code file to be detected comprises a malicious code. The method comprises: acquiring a code file to be detected, and acquiring a sandbox mirror image configuration file corresponding to said code file; on the basis of the number of sandbox mirror image configuration files, scaling the load, performance or number of at least one sandbox; then, running said code file in the scaled sandbox; and on the basis of a behavior feature of the code file in an execution process, obtaining a code analysis result, the code analysis result being used for representing whether said code file comprises a malicious code. Therefore, the load, performance or number of sandboxes can be adjusted adaptively with a change in the number of analysis tasks (positively correlated with the number of sandbox mirror image configuration files), so that the waste of resources caused by idle sandboxes due to a small number of analysis tasks, or the backlog of tasks caused by a large number of analysis tasks is avoided.

Description

A code analysis method and related system

[0001] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office on September 21, 2023, with application number 202311231331.1 and invention name “A code analysis method and related system”, and claims priority to the Chinese patent application filed with the State Intellectual Property Office on December 13, 2023, with application number 202311717893.7 and invention name “A code analysis method and related system”, the entire contents of which are incorporated by reference into this application. Technical Field

[0002] The present application relates to the technical field of code analysis, and in particular to a code analysis method, system, computing device cluster, computer-readable storage medium, and computer program product. Background Art

[0003] In recent years, with the rapid development of technologies like artificial intelligence, an increasing number of new malicious codes have leveraged AI to evade detection software, launching attacks through methods like code encryption and automatic deformation. Improving detection capabilities for these new malicious codes has become a hot topic in the industry.

[0004] Currently, malicious code detection can be achieved through dynamic analysis. Dynamic analysis involves running the file to be detected (e.g., the executable file of the program to be detected) in a virtual environment (e.g., a sandbox) and monitoring its behavior during execution. Based on this behavior, it is determined whether the file contains malicious code.

[0005] However, the above solutions usually pre-set a certain number of sandboxes. If there are few scanning tasks, the idle sandboxes may result in a waste of resources. If there are many scanning tasks, the sandboxes may run at full capacity, resulting in a backlog of tasks and excessive task execution time. This makes it difficult to meet business needs.

[0006] Summary of the Invention

[0007] This application provides a code analysis method that scales the load, performance, or number of at least one sandbox by combining the number of sandbox image configuration files corresponding to the code files to be tested. This method avoids wasting resources due to idle sandboxes caused by a small number of analysis tasks, or a backlog of tasks caused by a large number of analysis tasks, thereby achieving adaptive adjustment of the sandbox to meet business needs. This application also provides a code analysis system, computing device cluster, computer-readable storage medium, and computer program product corresponding to the above method.

[0008] In the first aspect, the present application provides a code analysis method. The method can be executed by a code analysis system, which is used to analyze whether the code file to be detected includes malicious code. Among them, the code analysis system can be a software system, and the software system can be deployed in a computing device cluster (for example, a cloud computing cluster provided by a cloud platform), and the computing device cluster executes the program code of the software system, thereby executing the code analysis method of the present application. The code analysis system can be deployed in a public cloud and provided to users through cloud services; or the code analysis system can also be deployed on the client side through a private cloud. The code analysis system can also be deployed on the client side in the form of a software package, etc. In some examples, the code analysis system can also be a hardware system, such as a computing device cluster with a code analysis function, which executes the code analysis method of the present application when the computing device cluster is running.

[0009] Specifically, the code analysis system obtains the code file to be detected and the sandbox image configuration file corresponding to the code file to be detected, and then scales the load, performance or number of at least one sandbox according to the number of sandbox image configuration files, runs the code file to be detected in the scaled sandbox, and obtains the code analysis result based on the behavioral characteristics of the code file during the execution process. The code analysis result is used to characterize whether the code file to be detected includes malicious code.

[0010] Among them, the number of sandbox image configuration files is usually positively correlated with the number of analysis tasks. According to the number of sandbox image configuration files, the load, performance or number of the sandbox can be automatically elastically scaled, so that the load, performance or number of the sandbox can be adaptively adjusted as the number of analysis tasks changes, avoiding the waste of resources caused by idle sandboxes due to a small number of analysis tasks, or task backlogs due to a large number of analysis tasks, thereby meeting business needs.

[0011] In some possible implementations, when there is a first sandbox in which the number of sandbox mirror configuration files is greater than a first threshold value and a second sandbox in which the number of sandbox mirror configuration files is less than the first threshold value, the code analysis system may migrate at least one sandbox mirror configuration file in the load of the first sandbox to the load of the second sandbox. Specifically, each sandbox may include a task pool, which includes analysis tasks to be processed, wherein the analysis tasks are used to analyze the code files to be detected to determine whether malicious code is included. Based on this, the task pool can be regarded as the load of the sandbox. The execution of the analysis task depends on the sandbox mirror configuration file, and the number of sandbox mirror configuration files is positively correlated with the number of analysis tasks. The number of sandbox mirror configuration files is greater than the first threshold value, indicating that the load is large, and the number of sandbox mirror configuration files is less than the first threshold value, indicating that the load is small. Based on this, the code analysis system may migrate at least one sandbox mirror configuration file in the load of the first sandbox to the load of the second sandbox.

[0012] In this way, task backlog in the first sandbox and resource waste in the second sandbox can be avoided, load balancing between sandboxes can be achieved, and overall resource utilization can be improved.

[0013] In some possible implementations, the number of sandbox image configuration files in the payload of at least one sandbox is greater than a first threshold. For the sandbox image configuration files in the payload of at least one sandbox, when the number of files that meet the similarity condition is greater than a second threshold, the code analysis system may add the type of sandbox image configuration files adapted by at least one sandbox to expand the performance of the at least one sandbox. Alternatively, for the sandbox image configuration files in the payload of at least one sandbox, when the number of files that meet the similarity condition is less than the second threshold, the code analysis system may deploy a new sandbox to expand the number of at least one sandbox.

[0014] This method resolves the contradiction between sandbox planning and actual sandbox utilization in the code analysis system by elastically expanding sandbox performance or quantity. When the resources of the sandbox cluster cannot bear the pressure of the analysis task, the system stability is guaranteed by adjusting the scale of the sandbox cluster or the allocation of resources.

[0015] In some possible implementations, the number of sandbox image configuration files in the load of at least one sandbox is less than a first threshold. The code analysis system may reduce the types of sandbox image configuration files adapted by the at least one sandbox to reduce the performance of the at least one sandbox. Alternatively, the code analysis system may delete a target sandbox from the at least one sandbox to reduce the number of the at least one sandboxes.

[0016] This method solves the contradiction between sandbox planning and actual sandbox utilization in the code analysis system by elastically scaling down sandbox performance or number. When the number of pending analysis tasks in the task pool of the sandbox cluster is low, the scale or resource allocation of the sandbox cluster is reduced as much as possible, thereby reducing the cost overhead caused by the waste of idle resources.

[0017] In some possible implementations, the target sandbox includes a sandbox with zero pending analysis tasks or a sandbox whose sandbox image configuration files meet a certain similarity requirement. This can reduce resource waste caused by idle sandboxes while still meeting the analysis task processing requirements.

[0018] In some possible implementations, the code analysis system may receive the code file to be detected uploaded by the user, and may also identify configuration information of the code file to be detected and generate a sandbox image configuration file based on the configuration information.

[0019] This approach automatically generates a sandbox image configuration file for each code file to be tested, allowing the deployment of an appropriate sandbox. This automated sandbox image configuration file generation eliminates the need for human intervention, reducing maintenance costs. Furthermore, this method eliminates the need for pre-configuring the sandbox, reducing storage costs.

[0020] In some possible implementations, the configuration information includes at least one of an operating system, a database, a language tool, and dependency information. Based on the configuration information, the code analysis system can obtain the corresponding operating system, database, language tool, or dependency information, thereby forming a complete sandbox environment and laying the foundation for executing code files in the sandbox.

[0021] In some possible implementations, the code analysis system can also compile a sandbox image configuration file and, based on the compilation result, deploy at least one sandbox for executing the code files to be tested. This allows for automated sandbox deployment without human intervention, reducing maintenance costs. It also eliminates the need for pre-configured sandboxes, reducing storage costs.

[0022] In a second aspect, the present application provides a code analysis system. The code analysis system is used to analyze whether a code file to be detected contains malicious code, and the code analysis system includes:

[0023] An interactive module, configured to obtain the code file to be detected;

[0024] An elastic scaling module, configured to obtain a sandbox image configuration file corresponding to the code file to be detected, and scale the load, performance, or number of at least one sandbox according to the number of the sandbox image configuration files;

[0025] A sandbox running module, used to run the code file to be tested in the expanded sandbox;

[0026] The dynamic analysis module is used to obtain a code analysis result based on the behavioral characteristics of the code file during execution, and the code analysis result is used to indicate whether the code file to be detected includes malicious code.

[0027] In some possible implementations, the elastic scaling module is specifically configured to:

[0028] When there is a first sandbox whose number of sandbox image configuration files is greater than a first threshold and a second sandbox whose number of sandbox image configuration files is less than the first threshold, at least one sandbox image configuration file in the payload of the first sandbox is migrated to the payload of the second sandbox.

[0029] In some possible implementations, the number of sandbox image configuration files in the load of the at least one sandbox is greater than a first threshold, and the elastic scaling module is specifically configured to:

[0030] For the sandbox image configuration file in the load of the at least one sandbox, when the number of files that meet the similarity condition is greater than a second threshold, increase the type of sandbox image configuration file adapted by the at least one sandbox to expand the performance of the at least one sandbox; or

[0031] For the sandbox image configuration file in the load of the at least one sandbox, when the number of files meeting the similarity condition is less than a second threshold, a new sandbox is deployed to expand the number of the at least one sandbox.

[0032] In some possible implementations, the number of sandbox image configuration files in the load of the at least one sandbox is less than a first threshold, and the elastic scaling module is specifically configured to:

[0033] reducing the types of sandbox image configuration files adapted by the at least one sandbox to reduce the performance of the at least one sandbox; or

[0034] A target sandbox in the at least one sandbox is deleted to reduce the number of the at least one sandbox.

[0035] In some possible implementations, the target sandbox includes a sandbox whose number of pending analysis tasks is zero or a sandbox whose similarity of sandbox image configuration files meets a condition.

[0036] In some possible implementations, the interaction module is specifically configured to:

[0037] Receiving the code file to be tested uploaded by the user;

[0038] The system further comprises:

[0039] An execution environment identification module, used to identify the configuration information of the code file to be detected;

[0040] The sandbox image configuration generation module is used to generate the sandbox image configuration file according to the configuration information.

[0041] In some possible implementations, the configuration information includes at least one of an operating system, a database, a language tool, and dependency information.

[0042] In some possible implementations, the elastic scaling module is further configured to:

[0043] Compile the sandbox image configuration file, and deploy the at least one sandbox for executing the code file to be detected according to the compilation result.

[0044] In a third aspect, the present application provides a computing device cluster. The computing device cluster includes at least one computing device, and the at least one computing device includes at least one processor and at least one memory. The at least one processor and the at least one memory communicate with each other. The at least one processor is configured to execute instructions stored in the at least one memory, so that the computing device or computing device cluster performs the code analysis method described in the first aspect or any implementation of the first aspect.

[0045] In a fourth aspect, the present application provides a computer-readable storage medium, in which instructions are stored, and the instructions instruct a computing device or a computing device cluster to execute the code analysis method described in the above-mentioned first aspect or any implementation of the first aspect.

[0046] In a fifth aspect, the present application provides a computer program product comprising instructions, which, when executed on a computing device or a computing device cluster, enables the computing device or computing device cluster to execute the code analysis method described in the first aspect or any one of the implementations of the first aspect.

[0047] Based on the implementation methods provided in the above aspects, this application can also be further combined to provide more implementation methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical methods of the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments.

[0049] FIG1 is a flowchart of a malicious code analysis system provided by the present application for performing malicious code detection;

[0050] FIG2 is a schematic diagram of the architecture of a code analysis system provided by this application;

[0051] FIG3 is a flow chart of a code analysis method provided by the present application;

[0052] FIG4 is a flowchart of a sandbox elastic scaling method provided by the present application;

[0053] FIG5 is a flowchart of automatic sandbox deployment in a code analysis method provided by this application;

[0054] FIG6 is a schematic diagram of a sandbox image configuration file provided by the present application;

[0055] FIG7 is a schematic diagram of the structure of a computing device provided by the present application;

[0056] FIG8 is a schematic diagram of the structure of a computing device cluster provided by this application;

[0057] FIG9 is a schematic diagram of the structure of another computing device cluster provided by the present application;

[0058] FIG10 is a schematic diagram of the structure of another computing device cluster provided in this application. DETAILED DESCRIPTION

[0059] The terms "first" and "second" in the embodiments of this application are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Therefore, features specified as "first" or "second" may explicitly or implicitly include one or more of the features.

[0060] First, some terms involved in the embodiments of this application are introduced.

[0061] Malicious code, also known as malware, malicious programs, or malicious scripts, is harmful computer code or scripts designed to exploit system vulnerabilities, potentially leading to backdoors, security breaches, information and data theft, and other potential damage to files and computer systems. Malicious code can be implemented through executable files, source code scripts, and other carriers, such as backdoors, viruses, Trojans, and ransomware.

[0062] Code analysis involves analyzing the code of applications (APPs) to detect the presence of malicious code. Applications, short for application programs, typically refer to programs written for a specific user purpose, such as text processors, spreadsheets, accounting applications, browsers, media players, flight simulators, command-line games, and image editors. For software systems with a microservices architecture, applications can be microservices within the system.

[0063] Code analysis can be divided into static analysis and dynamic analysis. Static analysis usually extracts features from the source code for detection without running the source code. Dynamic analysis usually runs the application code (such as binary code) in a virtual environment, monitors the behavior of the application, and extracts features from the application behavior for detection. Among them, a virtual environment refers to an execution environment that isolates applications to prevent the execution of the application from affecting other applications. Typical examples of virtual environments include sandboxes. A sandbox can be a lightweight virtual machine. The operations of the application (software) in the sandbox will not affect the real physical system, and it is used to execute applications safely.

[0064] While static analysis can quickly detect malicious code with known characteristics, it has limited detection capabilities for new malicious code that uses artificial intelligence to evade malware detection software or incorporates attacks through methods like code encryption and automatic transformation. Dynamic analysis, which runs application code in a virtual environment and monitors its behavior, is a valuable complement to static analysis. Dynamic analysis can detect hidden malicious characteristics by monitoring the execution of malicious code in real time. Due to its unique characteristics, dynamic analysis has become an essential strategy for malware detection.

[0065] Figure 1 shows an architectural diagram of a malicious code analysis system (also referred to as a code analysis system for short). The system supports inputting a file to be detected (usually an executable file) into an adapted sandbox in a sandbox execution environment for execution, monitoring the behavior of the execution process of the file to be detected, and determining whether the file to be detected contains malicious code based on the behavior.

[0066] The malicious code analysis system in Figure 1 uses dynamic analysis, also known as a malicious code dynamic analysis engine based on a sandbox execution environment. The analysis process of the malicious code analysis system is as follows:

[0067] Step 1: The pre-setting module uses virtualization technology to install the sandbox, and pre-sets N sandboxes to form a sandbox execution environment;

[0068] Step 2: The upload module uploads the file set to be detected to the malicious code analysis system;

[0069] Step 3: The execution environment identification module detects the uploaded file to be tested and determines the dynamic execution environment required by the file to be tested;

[0070] Step 4: The sandbox running module selects an adaptive sandbox from the sandbox execution environment generated in step 1 according to the dynamic execution environment. If an adaptive sandbox exists, the file to be tested is executed in the adaptive sandbox and the behavioral characteristics of the execution process are monitored in real time. If no adaptive sandbox exists, the detection ends.

[0071] Step 5: The dynamic analysis module uses rules, artificial intelligence, and other technologies to determine whether there is malicious code based on the behavioral characteristics obtained in step 4;

[0072] Step 6: The analysis result disposal module submits the malicious code to the security disposal personnel for disposal. The files to be detected that do not contain malicious code can enter the computer system and run normally.

[0073] However, the number of open source software packages in the software supply chain has reached 5 million, with thousands to hundreds of thousands of new ones added daily. Related technologies pre-set a certain number of sandboxes. If there are few scan tasks on a given day, the idle sandboxes waste resources. If there are many scan tasks, the sandboxes run at full capacity, resulting in a backlog and excessive execution time. In other words, this method is not directly applicable to malicious code detection scenarios targeting source code files.

[0074] In view of this, the present application provides a code analysis method. The method can be executed by a code analysis system (for example, a malicious code analysis system, or an analysis system, a scanning system, or a detection system), which is used to analyze whether the code file to be detected includes malicious code. Among them, the code analysis system can be a software system, and the software system can be deployed in a computing device cluster (for example, a cloud computing cluster provided by a cloud platform), and the computing device cluster executes the program code of the software system, thereby executing the code analysis method of the present application. Among them, the code analysis system can be deployed in a public cloud and provided to users through cloud services; or the code analysis system can also be deployed on the client side through a private cloud. The code analysis system can also be deployed on the client side in the form of a software package, etc. In some examples, the code analysis system can also be a hardware system, such as a computing device cluster with a code analysis function, and the computing device cluster executes the code analysis method of the present application when it is running.

[0075] Specifically, the code analysis system obtains the code file to be detected and the sandbox image configuration file corresponding to the code file to be detected. Then, the code analysis system can scale the load, performance, or number of at least one sandbox according to the number of sandbox image configuration files, run the code file to be detected in the scaled sandbox, and obtain the code analysis results according to the behavioral characteristics of the code file during execution. The code analysis results are used to characterize whether the code file to be detected includes malicious code. Among them, the number of analysis tasks is positively correlated with the number of sandbox image configuration files. According to the number of sandbox image configuration files, the load, performance, or number of the sandbox is automatically and elastically scaled, so that the load, performance, or number of the sandbox can be adaptively adjusted as the number of analysis tasks changes, thereby avoiding the waste of resources caused by the idle sandbox due to a small number of analysis tasks, or the backlog of tasks caused by a large number of analysis tasks.

[0076] In order to make the technical solution of the present application clearer and easier to understand, the system architecture of the code analysis system of the present application is introduced below with reference to the accompanying drawings.

[0077] Referring to the schematic diagram of the code analysis system architecture shown in Figure 2, this code analysis system 20 supports automatic elastic scaling of the sandbox. Specifically, code analysis system 20 can analyze the code files to be tested in the set of files to be tested uploaded by the upload module to obtain code analysis results. Code analysis system 20 can be used as a standalone service for users to call, and returns the code analysis results to the analysis result processing module.

[0078] As shown in Figure 2, the code analysis system 20 includes an interaction module (not shown in Figure 2), an elastic scaling module 202, a sandbox operation module 204, and a dynamic analysis module 206. The functions of the modules included in the code analysis system 20 are described below.

[0079] The interactive module is used to obtain the code file to be detected. The elastic scaling module 202 is used to obtain the sandbox image configuration file corresponding to the code file to be detected. Among them, the sandbox image configuration file can be used to deploy a sandbox adapted to the code file to be detected. The elastic scaling module 202 is also used to scale the load, performance or quantity of at least one sandbox according to the number of sandbox image configuration files. The number of sandbox image configuration files is usually positively correlated with the number of analysis tasks (such as tasks for analyzing whether the code file to be detected includes malicious code). By scaling the load, performance or quantity of the sandbox according to the number of sandbox image configuration files, the load, performance or quantity of the sandbox can be automatically elastically scaled along with the number of analysis tasks.

[0080] Among them, the elastic scaling module 202 can scale the load of the sandbox by migrating at least one sandbox mirror configuration file in the load of the sandbox to the load of other sandboxes. Specifically, the elastic scaling module 202 can be used to migrate at least one sandbox mirror configuration file in the load of the first sandbox to the load of the second sandbox when there is a first sandbox in which the number of sandbox mirror configuration files is greater than a first threshold and a second sandbox in which the number of sandbox mirror configuration files is less than the first threshold. In this way, part of the analysis tasks to be processed in the first sandbox is transferred to the second sandbox and processed by the second sandbox. The first threshold can be set according to an empirical value, and the first threshold can support adaptive adjustment. After completing the above migration, the number of sandbox mirror configuration files in the load of the first sandbox and the second sandbox is less than the first threshold. The elastic scaling module 202 can elastically scale the performance of the sandbox by dynamically modifying the sandbox mirror configuration file (also known as mirror configuration information) to increase or decrease the types of sandbox mirror configuration files that the sandbox (or sandbox environment) can adapt to. The elastic scaling module 202 can elastically scale the number of sandboxes by adding sandboxes (deploying new sandboxes) or reducing sandboxes (deleting at least one sandbox).

[0081] The sandbox execution module 204 is used to execute the code file to be tested in the expanded sandbox. The dynamic analysis module 206 is used to obtain code analysis results based on the behavioral characteristics of the code file during execution. The code analysis results are used to indicate whether the code file to be tested contains malicious code. The dynamic analysis module 206 can combine rules or artificial intelligence (AI) algorithms to obtain code analysis results based on the behavioral characteristics of the code file during execution.

[0082] In some possible implementations, the code analysis system 20 also includes a backend storage module 208. The backend storage module 208 is used to store files for deploying sandboxes, including but not limited to operating systems, language interpreters, databases, or dependent software packages. Accordingly, the elastic scaling module 202 can call at least one of the required operating systems, language interpreters, databases, or dependent software packages from the backend storage module 208 according to the sandbox image configuration file to deploy a new sandbox and achieve sandbox expansion. Specifically, a complete sandbox execution environment can be formed by deploying at least one of the operating system, language interpreter, database, or dependent software package in an empty sandbox, and the sandbox execution environment is adapted to the sandbox image configuration file.

[0083] Furthermore, considering that different binary files usually only require a small number of sandbox types to cover all sandbox execution environments, but different source code files need to run in different operating systems and execution environments, the execution environment requires a large number of different types of sandboxes based on the differences in operating systems, language interpreter versions, and dependent files (millions of types). The code analysis system 20 can also support automatic deployment of sandboxes without the need to manually pre-set the types and quantities of sandboxes, thereby being able to be ported to malicious code detection scenarios for source code files.

[0084] Specifically, the code analysis system 20 may further include an execution environment identification module 201 and a sandbox image configuration generation module 203. The execution environment identification module 201 is configured to receive a code file to be tested uploaded by a user, such as a code file to be tested from a set of files to be tested uploaded by the user through the upload module, and identify the configuration information of the code file to be tested. The execution environment identification module 201 may identify the configuration information of the code file to be tested through clustering or configuration information processing methods. Configuration information processing methods may include configuration information identification based on text matching or configuration information identification based on code analysis. For example, the execution environment identification module 201 may identify a file whose name includes ".config" through conditional judgment and extract various configuration information from the file. The sandbox image configuration generation module 203 is configured to generate a sandbox image configuration file based on the configuration information. The sandbox image configuration generation module 203 may extract at least one of the operating system, language interpreter, database, or dependent software package from the configuration information and automatically assemble it into a complete sandbox image configuration file. Accordingly, the elastic scaling module 202 may automatically deploy a sandbox that is compatible with the sandbox image configuration file based on the sandbox image configuration file.

[0085] Next, the code analysis method provided in this application is introduced from the perspective of the code analysis system 20 in combination with an embodiment.

[0086] 3 shows a flowchart of a code analysis method. The method may be performed by a code analysis system 20. The code analysis system 20 is used to analyze whether a code file to be detected includes malicious code. The method includes the following steps:

[0087] S301: The code analysis system 20 obtains a code file to be detected.

[0088] The code file to be tested can be a source code file (source file), such as a source code file written in a high-level language, including but not limited to source code files based on at least one of Python, Java, and JavaScript. The code file to be tested can also be a binary file or a code snippet embedded in an image or document.

[0089] The code analysis system 20 may provide the user with a code analysis interface, which may be a graphical user interface (GUI) or a command user interface (CUI). The user may trigger the operation of uploading a code file through the code analysis interface, and the code analysis system 20 may receive the code file to be tested uploaded by the user. For example, the user may enter the path of the code file to be tested through the code analysis interface and then click the submit control or enter a submit command to trigger the operation of uploading the code file. The code analysis system 20 may obtain the code file to be tested uploaded by the user based on the path of the code file to be tested entered by the user.

[0090] S302: The code analysis system 20 obtains a sandbox image configuration file corresponding to the code file to be detected.

[0091] A sandbox image configuration file is the image configuration file of the sandbox used to execute the code file to be detected. A sandbox image configuration file usually corresponds to an analysis task. This analysis task is used to analyze whether the code file to be detected contains malicious code.

[0092] The elastic scaling module 202 in the code analysis system 20 may receive at least one sandbox image configuration file generated by the sandbox image configuration generation module 203. The sandbox image configuration file indicates at least one of an operating system, a language interpreter, a database, or a dependent software package required to execute the code file to be detected.

[0093] S304. The code analysis system 20 scales the load, performance, or number of at least one sandbox according to the number of sandbox image configuration files.

[0094] The number of sandbox image configuration files is positively correlated with the number of analysis tasks. In some examples, each sandbox image configuration file corresponds to an analysis task, and the number of analysis tasks is the number of received sandbox image configuration files. The code analysis system 20 can decide on a scaling method for at least one sandbox based on the number of sandbox image configuration files (e.g., the number of analysis tasks). The scaling method can be automatic elastic scaling of the load of at least one sandbox, or automatic elastic scaling of the performance of at least one sandbox, or automatic elastic scaling of the number of at least one sandbox.

[0095] Wherein, each sandbox can be configured with a task pool, which includes the analysis tasks to be processed by the sandbox, based on which the task pool can be regarded as the load of the sandbox. The execution of the analysis task can rely on the sandbox deployed based on the sandbox mirror configuration file, based on which the task pool can include the sandbox mirror configuration file. The code analysis system 20 can make a decision to expand or shrink the sandbox based on the number of analysis tasks to be processed in the task pool of the sandbox (also referred to as the number of task pool queues), and then automatically elastically scale according to the decision result. Wherein, the number of task pool queues is positively correlated with the number of sandbox mirror configuration files. For example, the number of task pool queues can be equal to the number of sandbox mirror configuration files. When the number of task pool queues is large, for example, the number of analysis tasks to be processed in the task pool is greater than the first threshold, it means that the load of the sandbox is large, and the load of the sandbox (such as the task pool) can be shrunk, or the performance or quantity of the sandbox can be expanded; when the number of task pool queues is small, for example, the number of analysis tasks to be processed in the task pool is less than the first threshold, it means that the load of the sandbox is small, and the load of the sandbox (such as the task pool) can be expanded, or the performance or quantity of the sandbox can be shrunk.

[0096] Among them, the scaling (expansion / contraction) method of the sandbox can be divided into elastic scaling of the load or performance of the same sandbox and elastic scaling of the number of sandboxes. When the sandbox image configuration files corresponding to the analysis tasks in the task pool (that is, the sandbox image configuration files used by the analysis tasks when analyzing the code files to be detected) have similarity (for example, the similarity meets the conditions), the code analysis system 20 can elastically scale the performance of the same sandbox. The code analysis system 20 can achieve loose coupling between image configurations by dynamically modifying the sandbox image configuration files, thereby achieving elastic scaling of the performance of the same sandbox.

[0097] In specific implementation, the code analysis system 20 can increase the types of sandbox image configuration files that a single sandbox can adapt to by dynamically modifying the sandbox image configuration file, for example, converting a sandbox that adapts to one sandbox image configuration file into a sandbox that adapts to 2 to N sandbox image configuration files, thereby achieving elastic expansion of sandbox performance. Wherein, N is related to the maximum performance of the sandbox. Alternatively, the code analysis system 20 can reduce the types of sandbox image configuration files that a single sandbox can adapt to by dynamically modifying the sandbox image configuration file, for example, converting a sandbox that adapts to 2 to N sandbox image configuration files into a sandbox that adapts to 1 sandbox image configuration file, thereby achieving elastic shrinkage of sandbox performance. It should be noted that elastic scaling of sandbox performance includes elastic scaling of resources used by the sandbox (such as computing resources, storage resources, and network resources). For example, when a sandbox is converted from adapting to one sandbox image configuration file to adapting to N sandbox image configuration files, the specifications of the central processing unit (CPU) or graphics processing unit (GPU) used by the sandbox also increase accordingly.

[0098] S306 : The code analysis system 20 runs the code file to be tested in the expanded sandbox.

[0099] The expanded sandbox includes an operating system, language interpreter, database, and dependent software packages invoked from the backend storage module 208, thus forming a complete sandbox execution environment. This sandbox environment is fully adapted to the sandbox image configuration file and can be used to execute the code file to be tested corresponding to the sandbox image configuration file. Based on this, the code analysis system 20 can run the code file to be tested in this sandbox execution environment.

[0100] The code analysis system 20 can detect the behavior of the code file during execution and obtain the behavioral characteristics of the code file during execution. The behavioral characteristics are characteristic data that extracts the behavior of the code file during execution or information related to the behavior and represents it using a formatting method. In some examples, the code analysis system 20 can characterize the behavioral characteristics of the code file during execution through the sequence of application programming interface (API) functions called by the code during execution. Among them, the API function sequence may include but is not limited to API functions for modifying the operating system registry, API functions for Transmission Control Protocol (TCP) network connections, and API functions for copying files.

[0101] S308 : The code analysis system 20 obtains a code analysis result according to the behavioral characteristics of the code file during execution.

[0102] Specifically, the code analysis system 20 can dynamically analyze the behavioral characteristics of a code file (e.g., a source code file) during execution using rules or AI algorithms to obtain a code analysis result that indicates whether the code file to be detected contains malicious code.

[0103] For example, the code analysis system 20 matches the behavioral characteristics of the code file during execution with the malicious behavior characteristics defined in the rules. If a match is successful, the code analysis system 20 can determine that the code file contains malicious code. For another example, the code analysis system 20 can input the behavioral characteristics of the code file during execution into a malicious code detection model built based on an AI algorithm. The malicious code detection model can then perform inference based on the behavioral characteristics to obtain code analysis results.

[0104] Based on the above description, the code analysis method provided by the present application obtains the code file to be detected and the sandbox image configuration file corresponding to the code file to be detected, scales the load, performance or number of at least one sandbox according to the number of sandbox image configuration files, runs the code file to be detected in the scaled sandbox, and dynamically analyzes the code file to obtain the code analysis result. The number of sandbox image configuration files is usually positively correlated with the number of analysis tasks. According to the number of sandbox image configuration files, the load, performance or number of the sandbox is automatically elastically scaled, and the load, performance or number of the sandbox can be adaptively adjusted as the number of analysis tasks changes, avoiding the waste of resources caused by the idle sandbox due to a small number of analysis tasks, or the backlog of tasks due to a large number of analysis tasks, thereby meeting business needs.

[0105] Next, the sandbox elastic scaling process in the code analysis method is described in detail in conjunction with another embodiment.

[0106] Referring to FIG4 , a flowchart of sandbox elastic scaling in a code analysis method includes the following steps:

[0107] S402, the code analysis system 20 adds the sandbox mirror configuration file corresponding to the code file to be detected to the task pool. When the number of task pool queues of the first sandbox is greater than the first threshold, if there is a second sandbox whose number of task pool queues is less than the first threshold, then execute S404; if there is no second sandbox whose number of task pool queues is less than the first threshold, and the number of files in the task pool of the first sandbox that meet the similarity condition (for example, the similarity is greater than the set value, including similar or identical situations) (recorded as Count sim) is greater than the second threshold, execute S406; if there is no second sandbox whose task pool queue number is less than the first threshold, and the number of files in the task pool of the first sandbox that meet the similarity conditions is less than the second threshold, execute S408.

[0108] Specifically, there may be multiple code files to be tested. When the number of code files to be tested exceeds the detection capability of a single sandbox, the code analysis system 20 may add the sandbox image configuration files corresponding to the code files to be tested to the task pool of multiple sandboxes. Each sandbox image configuration file may correspond to an analysis task in the task pool.

[0109] The code analysis system 20 may sequentially add sandbox image configuration files to the task pool of the sandbox. Specifically, when the detection capability of a single sandbox is m (m is greater than 1), the code analysis system 20 may add 1 to m sandbox image configuration files to the task pool of one sandbox, and add m+1 to 2m sandbox image configuration files to the task pool of the next sandbox, and so on. No further details will be given here.

[0110] Furthermore, the code analysis system 20 can also determine the similarity of code files, for example, by performing semantic analysis on the code files. The code analysis system 20 can cluster the code files according to their similarity. Accordingly, when the code analysis system 20 adds the sandbox image configuration files corresponding to the code files to be detected to the task pool, the sandbox image configuration files corresponding to the code files of the same class can be added to the same task pool.

[0111] S404 : The code analysis system 20 reduces the capacity of the task pool of the first sandbox and expands the capacity of the task pool of the second sandbox.

[0112] The number of task pool queues for the first sandbox can be the number of analysis tasks to be processed by the first sandbox, wherein the number of analysis tasks is positively correlated with the number of sandbox image configuration files, for example, the number of analysis tasks to be processed by the first sandbox can be equal to the number of sandbox image configuration files in the task pool of the first sandbox. Similarly, the number of task pool queues for the second sandbox can be the number of analysis tasks to be processed by the second sandbox, for example, the number of sandbox image configuration files in the task pool of the second sandbox. When the number of analysis tasks to be processed by the first sandbox is greater than a first threshold (denoted as α) and the number of analysis tasks to be processed by the second sandbox is less than the first threshold, the code analysis system 20 can reduce the load of the first sandbox (such as the task pool) and expand the load of the second sandbox (such as the task pool) to achieve load balancing.

[0113] Specifically, the code analysis system 20 can migrate at least one sandbox mirror configuration file in the load (such as the task pool) of the first sandbox to the load (such as the task pool) of the second sandbox, thereby transferring at least one analysis task in the task pool of the first sandbox to the task pool of the second sandbox. For example, the code analysis system 20 can transfer the code files to be detected and their corresponding sandbox mirror configuration files marked with a shrinkage mark in the task pool of the first sandbox to the task pool of the second sandbox, so that at least one analysis task in the task pool of the first sandbox is transferred to the task pool of the second sandbox, thereby shrinking the task pool of the first sandbox and expanding the task pool of the second sandbox.

[0114] S406: The code analysis system 20 expands the performance of the first sandbox.

[0115] The number of analysis tasks to be processed in the first sandbox is greater than the first threshold α, and the number of sandbox image configuration files that meet the similarity conditions in the task pool of the first sandbox is greater than the second threshold (denoted as β). Even if there is no second sandbox whose number of analysis tasks to be processed (the number of task pool queues) is less than the first threshold α, the code analysis system 20 can achieve elastic scaling of the sandbox by expanding the performance of the first sandbox.

[0116] The code analysis system 20 can increase the number of sandbox image configuration files that a single sandbox can adapt to by dynamically modifying the sandbox image configuration file. For example, the code analysis system 20 can convert a first sandbox that adapts to one sandbox image configuration file into a first sandbox that adapts to multiple (e.g., 2 to N) sandbox image configuration files. The number of sandbox image configuration file types N is related to the maximum performance of the sandbox.

[0117] S408: The code analysis system 20 expands the number of sandboxes.

[0118] The number of analysis tasks to be processed in the first sandbox is greater than the first threshold α, and the number of sandbox image configuration files that meet the similarity conditions in the task pool of the first sandbox is less than the second threshold β, and there is no second sandbox with the number of analysis tasks to be processed less than the first threshold α. The code analysis system 20 can deploy new sandboxes to expand the number of at least one sandbox.

[0119] Furthermore, when the number of task pool queues in the first sandbox is less than the first threshold, if there is a second sandbox with a number of task pool queues greater than the first threshold, execute S410; if there is no second sandbox with a number of task pool queues greater than the first threshold, and the first sandbox is adapted to multiple sandbox image configuration files, execute S412; if there is no second sandbox with a number of task pool queues greater than the first threshold, and the first sandbox is adapted to one sandbox image configuration file, execute S414.

[0120] S410 : The code analysis system 20 expands the task pool of the first sandbox and reduces the task pool of the second sandbox.

[0121] Specifically, the code analysis system 20 can transfer at least one analysis task in the task pool of the second sandbox to the task pool of the first sandbox. For example, the code analysis system 20 can transfer the code file to be detected and its corresponding sandbox image configuration file marked with shrinkage in the task pool of the second sandbox to the task pool of the first sandbox, so that at least one analysis task in the task pool of the second sandbox is transferred to the task pool of the first sandbox, thereby shrinking the task pool of the second sandbox (that is, shrinking the load of the second sandbox) and expanding the task pool of the first sandbox (that is, expanding the load of the first sandbox).

[0122] S412: The code analysis system 20 reduces the performance of the first sandbox.

[0123] Specifically, the code analysis system 20 may scale down the performance of the first sandbox by dynamically modifying the sandbox image configuration file. For example, the code analysis system 20 may delete the sandbox image configuration file that the first sandbox is adaptable to. For example, the code analysis system 20 may reduce the number of sandbox image configuration files that the first sandbox is adaptable to to the minimum one sandbox image configuration file that is adaptable to the first sandbox.

[0124] S414: The code analysis system 20 maintains the current state of the first sandbox.

[0125] The code analysis system 20 does not scale the first sandbox and maintains the current state of the first sandbox.

[0126] It should be noted that the situation where the number of task pool queues of the first sandbox is less than the first threshold value may include the situation where the number of task pool queues of the first sandbox is equal to 0. In this case, if there is a second sandbox whose number of task pool queues is greater than the first threshold value, the code analysis system 20 can expand the task pool (load) of the second sandbox. Among them, the code analysis system 20 can transfer the analysis tasks to be processed in the second sandbox whose number of task pool queues is greater than the first threshold value to the task pool of the first sandbox. In the case where the number of task pool queues of the first sandbox is equal to 0, if there is no second sandbox whose number of task pool queues is greater than the first threshold value, the code analysis system 20 can reduce the number of sandboxes, for example, by deleting the first sandbox.

[0127] The following describes how to expand and shrink the number of sandboxes.

[0128] In some possible implementations, when the number of task pool queues for the first sandbox is greater than a first threshold α, if the number of sandbox image configuration files that meet the similarity condition in the current task pool (i.e., the task pool of the first sandbox) is less than a second threshold β, and there is a sandbox to be scaled down, and the similarity between the sandbox image configuration file of the sandbox to be scaled down and the sandbox image configuration file in the current task pool does not meet the condition, the code analysis system 20 can deploy a new sandbox. If the number of sandbox image configuration files that meet the similarity condition in the current task pool (i.e., the task pool of the first sandbox) is less than the second threshold β, and there is no sandbox to be scaled down, the code analysis system 20 can directly deploy a new sandbox.

[0129] In some other possible implementations, when the number of task pool queues of the first sandbox is less than the first threshold α, if the number of sandbox image configuration files that meet the similarity conditions in the current task pool (i.e., the task pool of the first sandbox) is greater than the second threshold β, the code analysis system 20 can delete the sandboxes corresponding to the sandbox image configuration files that meet the similarity conditions. The number of sandbox deletions is dynamically adjusted according to the actual number of queues, and at least one sandbox is retained. If the number of sandbox image configuration files that meet the similarity conditions in the current task pool (such as the task pool of the first sandbox) is less than the second threshold β, the code analysis system 20 can delete some sandboxes.

[0130] The above describes the elastic scaling process under different task pool queuing conditions from the perspective of the first sandbox. The following describes the elastic scaling process of the sandbox from an overall perspective. Specifically, when there is a first sandbox in which the number of pending analysis tasks is greater than a first threshold and a second sandbox in which the number of pending analysis tasks is less than the first threshold, the code analysis system 20 can reduce the load (task pool) of the first sandbox and expand the load (task pool) of the second sandbox. If the number of pending analysis tasks of at least one sandbox is greater than the first threshold, or is less than the first threshold, the code analysis system 20 can scale the performance or quantity of at least one sandbox.

[0131] When the number of analysis tasks to be processed by at least one sandbox is greater than the first threshold, the code analysis system 20 can decide on the expansion method based on the number of files that meet the similarity conditions in the sandbox image configuration file corresponding to the analysis tasks to be processed by at least one sandbox. When the number of files that meet the similarity conditions in the sandbox image configuration file corresponding to the analysis tasks to be processed by at least one sandbox is greater than the second threshold, the code analysis system 20 can add at least one sandbox-adapted sandbox image configuration file to expand the performance of at least one sandbox. When the number of files that meet the similarity conditions in the sandbox image configuration file corresponding to the analysis tasks to be processed by at least one sandbox is less than the second threshold, the code analysis system 20 deploys a new sandbox to expand the number of at least one sandbox.

[0132] When the number of pending analysis tasks for at least one sandbox is less than a first threshold, the code analysis system 20 may reduce the sandbox image configuration file adapted by the at least one sandbox to reduce the performance of the at least one sandbox, or the code analysis system 20 may delete a target sandbox from the at least one sandbox to reduce the number of the at least one sandbox. The target sandbox may be a sandbox with zero pending analysis tasks or a sandbox with sandbox image configuration files that meet a certain similarity requirement.

[0133] It should be noted that the above S404 is a specific implementation of the code analysis system 20 migrating at least one sandbox image configuration file in the load of the first sandbox to the load of the second sandbox when there is a first sandbox with a number of sandbox image configuration files greater than a first threshold and a second sandbox with a number of sandbox image configuration files less than the first threshold. In other possible implementations of the embodiments of the present application, elastic scaling of the sandbox load can also be achieved by other methods. Similarly, the above S406 is a specific implementation of the code analysis system 20 adding a type of sandbox image configuration file adapted by the at least one sandbox to expand the performance of the at least one sandbox when the number of sandbox image configuration files in the load of at least one sandbox is greater than the first threshold, and the number of files that meet the similarity condition for the sandbox image configuration files in the load of at least one sandbox is greater than the second threshold. The above S408 is a specific implementation of deploying a new sandbox to expand the number of at least one sandbox when the number of sandbox image configuration files in the load of at least one sandbox is greater than the first threshold, and the number of files that meet the similarity condition for the sandbox image configuration files in the load of at least one sandbox is less than the second threshold. The above S412 and S414 are specific implementations of reducing the types of sandbox image configuration files adapted by at least one sandbox to reduce the performance of at least one sandbox, or deleting the target sandbox in at least one sandbox to reduce the number of at least one sandbox, when the number of sandbox image configuration files in the load of at least one sandbox is less than the first threshold.

[0134] It should also be noted that when the number of task pool queues is equal to the first threshold, it means that the number of task pool queues is moderate, and the code analysis system 20 can execute S407 to keep the task pool and sandbox performance unchanged.

[0135] Based on the above description, the embodiments of the present application automatically and elastically scale the sandbox load, performance or number according to the load of the analysis task, for example, by dynamically modifying the sandbox image configuration file to expand or shrink the sandbox performance, thereby solving the contradiction between sandbox planning and actual sandbox utilization in the code analysis system. When the resources of the sandbox cluster cannot bear the pressure of the scanning task, the system stability is guaranteed by adjusting the scale of the sandbox cluster or the allocation of resources. When the number of tasks in the sandbox cluster is low, the resource configuration of the cluster is reduced as much as possible to reduce the cost overhead caused by the waste of idle resources.

[0136] In addition, the code analysis method provided by this application also supports automatically generating a sandbox image configuration file for each code file to be detected and deploying an adapted sandbox. This will be described below with reference to an embodiment.

[0137] Referring to FIG5 , a flowchart of automatically deploying a sandbox in a code analysis method includes the following steps:

[0138] S502 : The execution environment identification module 201 of the code analysis system 20 receives the code file to be detected uploaded by the user.

[0139] S504 : The execution environment identification module 201 of the code analysis system 20 identifies configuration information of the code file to be detected.

[0140] The execution environment identification module 201 may identify the code file to be tested by extracting various configuration information from the code file to be tested through methods such as clustering and configuration information extraction. The configuration information is used to support the execution of the code file to be tested in the sandbox, and the configuration information includes at least one of the following: operating system, database (such as MySQL, NoSQL), language interpreter (such as Python, JDK and other language tools), and dependent software packages (also known as dependent third-party software, such as requests (PyPI) and uuid (npm)).

[0141] S506 : The sandbox image configuration generation module 203 of the code analysis system 20 obtains configuration information.

[0142] S508 : The sandbox image configuration generation module 203 of the code analysis system 20 integrates the configuration information according to the format of the sandbox image configuration file.

[0143] Specifically, the sandbox image configuration generation module 203 can automatically integrate all configuration information according to the fixed format of the sandbox image configuration file, and convert the configuration information into a command for making an image, such as a command for creating a sandbox using Docker technology.

[0144] The following is an example of operating system and language tool conversion.

[0145] The operating system conversion can be shown in the following table:

[0146] Table 1

[0147] The language tool conversion can be shown in the following table:

[0148] Table 2

[0149] S510 : The sandbox image configuration generation module 203 of the code analysis system 20 generates a sandbox image configuration file according to the integration result.

[0150] Specifically, the code analysis system 20 can automatically stitch together the integration results (e.g., commands that can be used to create an image). Furthermore, the code analysis system 20 can add common contextual configuration information to generate a complete sandbox image configuration file. For example, when the code analysis system 20 converts and obtains commands for creating a sandbox using Docker technology, it can stitch together the commands to generate a Docker sandbox image configuration file (referred to as a Dockerfile).

[0151] For ease of understanding, this application also provides an example Dockerfile. As shown in Figure 6, the Dockerfile includes configuration information for the code file to be tested, which is a command that can be used to create an image, converted according to the format of the sandbox image configuration file, such as FROM centos and FROM python. The Dockerfile also includes general configuration information, such as required folders (such as temporary folders, user folders for storing accounts and passwords), and files.

[0152] The above S508 to S510 are a specific implementation method of generating a sandbox image configuration file according to the configuration information. In other possible implementation methods of the embodiment of the present application, the sandbox image configuration file may also be generated by other methods.

[0153] S512 : The elastic scaling module 202 of the code analysis system 20 executes a deployment command on the sandbox image deployment configuration file to deploy a sandbox adapted to the code file to be detected.

[0154] Specifically, the code analysis system 20 can compile a complete sandbox image configuration file and automatically deploy a sandbox that can be used to execute the code file to be tested. The code analysis system 20 can use the docker build and docker run commands, respectively, to compile and run the Dockerfile, a sandbox image configuration file generated using Docker technology, thereby deploying a sandbox that is suitable for the code file to be tested.

[0155] This method automatically generates a sandbox image configuration file for each file to be tested and deploys the appropriate sandbox by identifying and processing the configuration information according to the sandbox image configuration file format. The entire generation process is automated, requiring no human intervention and reducing maintenance costs. Furthermore, automated sandbox generation eliminates the need for pre-configured sandboxes, reducing storage pressure and costs.

[0156] It should be noted that the code analysis method of this application can be applied to different deployment scenarios of current software products, including cloud scenarios and traditional physical machines. In different scenarios, the upload module and analysis result processing module may change, but the deployment form of the code analysis system can remain unchanged. In addition, the code analysis method of this application can also be applied to sub-fields such as vulnerability mining and sensitive information identification in the field of network security. Its deployment form remains unchanged, and only the file type to be detected changes.

[0157] Based on the aforementioned code analysis method, the present application also provides a code analysis system. As shown in FIG2 , the code analysis system 20 includes:

[0158] An interactive module (not shown in FIG2 ) is used to obtain the code file to be detected;

[0159] The elastic scaling module 202 is configured to obtain a sandbox image configuration file corresponding to the code file to be detected, and scale the load, performance, or number of at least one sandbox according to the number of the sandbox image configuration files;

[0160] A sandbox running module 204, configured to run the code file to be tested in the expanded sandbox;

[0161] The dynamic analysis module 206 is used to obtain a code analysis result based on the behavioral characteristics of the code file during execution. The code analysis result is used to indicate whether the code file to be detected includes malicious code.

[0162] For example, the interaction module, elastic scaling module 202, sandbox operation module 204, and dynamic analysis module 206 can be implemented by hardware or software. For ease of description, the elastic scaling module 202 is used as an example below.

[0163] When implemented by software, the elastic scaling module 202 can be an application running on a computing device, such as a computing engine. The application can be provided in the form of a virtualization service. Virtualization services can include virtual machine (VM) services, bare metal server (BMS) services, and container services. Among them, the VM service can be a service that uses virtualization technology to virtualize a virtual machine resource pool on multiple physical hosts to provide VMs for users to use on demand. The BMS service is a service that virtualizes a BMS resource pool on multiple physical hosts to provide BMSs for users to use on demand. The container service is a service that virtualizes a container resource pool on multiple physical hosts to provide containers for users to use on demand. VM is a simulated virtual computer, that is, a logical computer. BMS is a high-performance computing service that can be elastically scalable. Its computing performance is no different from that of a traditional physical machine and has the characteristics of secure physical isolation. Containers are a kernel virtualization technology that can provide lightweight virtualization to achieve the purpose of isolating user space, processes, and resources. It should be understood that the VM service, BMS service and container service in the above-mentioned virtualization services are only specific examples. In actual applications, virtualization services can also be other lightweight or heavyweight virtualization services, which are not specifically limited here.

[0164] When implemented by hardware, the elastic scaling module 202 may include at least one computing device, such as a server. Alternatively, the elastic scaling module 202 may be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. Similarly, the sandbox operation module and the dynamic analysis module may include at least one computing device, such as a server, or the sandbox operation module and the dynamic analysis module may be devices implemented using an ASIC or a PLD. The interaction module may be implemented using a transceiver, etc.

[0165] In some possible implementations, the elastic scaling module 202 is specifically configured to:

[0166] When there is a first sandbox whose number of sandbox image configuration files is greater than a first threshold and a second sandbox whose number of sandbox image configuration files is less than the first threshold, at least one sandbox image configuration file in the payload of the first sandbox is migrated to the payload of the second sandbox.

[0167] In some possible implementations, the number of sandbox image configuration files in the load of the at least one sandbox is greater than a first threshold, and the elastic scaling module 202 is specifically configured to:

[0168] For the sandbox image configuration file in the load of the at least one sandbox, when the number of files that meet the similarity condition is greater than a second threshold, increase the type of sandbox image configuration file adapted by the at least one sandbox to expand the performance of the at least one sandbox; or

[0169] For the sandbox image configuration file in the load of the at least one sandbox, when the number of files meeting the similarity condition is less than a second threshold, a new sandbox is deployed to expand the number of the at least one sandbox.

[0170] In some possible implementations, the number of sandbox image configuration files in the load of the at least one sandbox is less than a first threshold, and the elastic scaling module 202 is specifically configured to:

[0171] reducing the types of sandbox image configuration files adapted by the at least one sandbox to reduce the performance of the at least one sandbox; or

[0172] A target sandbox in the at least one sandbox is deleted to reduce the number of the at least one sandbox.

[0173] In some possible implementations, the target sandbox includes a sandbox whose number of pending analysis tasks is zero or a sandbox whose similarity of sandbox image configuration files meets a condition.

[0174] In some possible implementations, the interaction module is specifically configured to:

[0175] Receiving the code file to be tested uploaded by the user;

[0176] The system 20 further includes:

[0177] An execution environment identification module 201 is used to identify the configuration information of the code file to be detected;

[0178] The sandbox image configuration generating module 203 is configured to generate the sandbox image configuration file according to the configuration information.

[0179] Similar to the elastic scaling module 202 , the execution environment identification module 201 and the sandbox image configuration generation module 203 may be implemented by software or hardware.

[0180] When implemented via software, the execution environment identification module 201 and the sandbox image configuration generation module 203 can be applications running on a computing device, such as a computing engine. The application can be provided via virtualization services such as VMs, BMSs, or containers. When implemented via hardware, the execution environment identification module 201 and the sandbox image configuration generation module 203 can include at least one computing device, such as a server. Alternatively, the execution environment identification module 201 and the sandbox image configuration generation module 203 can be implemented using an ASIC or a PLD.

[0181] In some possible implementations, the configuration information includes at least one of an operating system, a database, a language tool, and dependency information.

[0182] In some possible implementations, the elastic scaling module 202 is further configured to:

[0183] Compile the sandbox image configuration file, and deploy the at least one sandbox for executing the code file to be detected according to the compilation result.

[0184] This application also provides a computing device 700. As shown in Figure 7, computing device 700 includes a bus 702, a processor 704, a memory 706, and a communication interface 708. Processor 704, memory 706, and communication interface 708 communicate with each other via bus 702. Computing device 700 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in computing device 700.

[0185] Bus 702 may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, among others. Buses may be classified as address buses, data buses, control buses, and the like. For ease of illustration, FIG7 illustrates a single bus line, but this does not imply a single bus or type of bus. Bus 702 may include a path for transmitting information between various components of computing device 700 (e.g., memory 706, processor 704, and communication interface 708).

[0186] The processor 704 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0187] The memory 706 may include a volatile memory, such as a random access memory (RAM). The memory 706 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD). The memory 706 stores executable program code, and the processor 704 executes the executable program code to implement the aforementioned code analysis method. Specifically, the memory 706 stores instructions for the code analysis system 20 to execute the code analysis method.

[0188] The communication interface 708 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 700 and other devices or a communication network.

[0189] Embodiments of the present application also provide a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0190] As shown in Figure 8, the computing device cluster includes at least one computing device 700. The memory 706 of one or more computing devices 700 in the computing device cluster may store the same code analysis system 20 for executing the code analysis method.

[0191] In some possible implementations, one or more computing devices 700 in the computing device cluster may also be used to execute some of the instructions for executing the code analysis method by the code analysis system 20. In other words, the combination of one or more computing devices 700 may jointly execute the instructions for executing the code analysis method by the code analysis system 20.

[0192] It should be noted that the memories 706 in different computing devices 700 in the computing device cluster may store different instructions for executing partial functions of the code analysis system 20 .

[0193] Figure 9 shows a possible implementation. As shown in Figure 9, two computing devices 700A and 700B are connected via a communication interface 708. The memory in the computing device 700A stores instructions for executing the functions of the interaction module and the elastic scaling module 202. The memory in the computing device 700B stores instructions for executing the functions of the sandbox operation module 204 and the dynamic analysis module 206. Furthermore, the memory in the computing device 700A also stores instructions for executing the functions of the above-mentioned execution environment identification module 201 and the sandbox image configuration generation module 203. In other words, the memories 706 of the computing devices 700A and 700B jointly store instructions for the code analysis system 20 to execute the code analysis method.

[0194] The connection method between the computing device clusters shown in Figure 9 may be considered to be based on the fact that the code analysis method provided by this application requires a lot of computing power for code analysis. Therefore, it is considered to delegate the functions implemented by the sandbox operation module 204 and the dynamic analysis module 206 to the computing device 700B.

[0195] It should be understood that the functionality of the computing device 700A shown in FIG9 may also be implemented by multiple computing devices 700. Similarly, the functionality of the computing device 700B may also be implemented by multiple computing devices 700.

[0196] In some possible implementations, one or more computing devices in a computing device cluster may be connected via a network. The network may be a wide area network or a local area network, etc. FIG10 shows a possible implementation. As shown in FIG10 , two computing devices 700C and 700D are connected via a network. Specifically, the connection to the network is made through a communication interface in each computing device. In this type of possible implementation, the memory 706 in the computing device 700C stores instructions for executing the functions of the interaction module and the elastic scaling module 202. At the same time, the memory 706 in the computing device 700D stores instructions for executing the functions of the sandbox operation module 204 and the dynamic analysis module 206. Furthermore, the memory in the computing device 700C also stores instructions for executing the functions of the above-mentioned execution environment identification module 201 and the sandbox image configuration generation module 203.

[0197] The connection method between the computing device clusters shown in Figure 10 can be considered to be that the code analysis method provided by this application requires a lot of computing power for code analysis, so it is considered to entrust the functions of implementing the sandbox operation module 204 and the dynamic analysis module 206 to the computing device 700D for execution.

[0198] It should be understood that the functionality of the computing device 700C shown in FIG10 may also be accomplished by multiple computing devices 700. Similarly, the functionality of the computing device 700D may also be accomplished by multiple computing devices 700.

[0199] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive). The computer-readable storage medium includes instructions that instruct the computing device to execute the above-mentioned code analysis system 20 for executing the code analysis method.

[0200] The present application also provides a computer program product comprising instructions. The computer program product may be software or a program product comprising instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device executes the aforementioned code analysis method.

[0201] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the protection scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A code analysis method, characterized in that: The method is performed by a code analysis system, wherein the code analysis system is used to analyze whether the code file to be detected includes malicious code. The method includes: Obtain the code file to be detected, and obtain a sandbox image configuration file corresponding to the code file to be detected; Scaling the load, performance or quantity of at least one sandbox according to the number of the sandbox image configuration files; The code file to be detected is run in the expanded sandbox, and a code analysis result is obtained according to the behavior characteristics of the code file during the execution process, wherein the code analysis result is used to indicate whether the code file to be detected includes malicious code.

2. The method according to claim 1, characterized in that The step of scaling the load, performance or quantity of at least one sandbox according to the number of the sandbox image configuration files includes: When there is a first sandbox whose number of sandbox image configuration files is greater than a first threshold and a second sandbox whose number of sandbox image configuration files is less than the first threshold, at least one sandbox image configuration file in the load of the first sandbox is migrated to the load of the second sandbox.

3. The method according to claim 1, characterized in that The number of sandbox image configuration files in the load of the at least one sandbox is greater than a first threshold, and scaling the load, performance, or number of the at least one sandbox according to the number of the sandbox image configuration files includes: For the sandbox image configuration file in the load of the at least one sandbox, when the number of files that meet the similarity condition is greater than a second threshold, increase the type of sandbox image configuration file adapted by the at least one sandbox to expand the performance of the at least one sandbox; or For the sandbox image configuration file in the load of the at least one sandbox, when the number of files satisfying the similarity condition is less than a second threshold, a new sandbox is deployed to expand the number of the at least one sandbox.

4. The method according to claim 1, characterized in that The number of sandbox image configuration files in the load of the at least one sandbox is less than a first threshold, and scaling the load, performance, or number of the at least one sandbox according to the number of the sandbox image configuration files includes: reducing the types of sandbox image configuration files adapted by the at least one sandbox to reduce the performance of the at least one sandbox; or, A target sandbox in the at least one sandbox is deleted to reduce the number of the at least one sandbox.

5. The method according to claim 4, characterized in that The target sandbox includes a sandbox whose number of analysis tasks to be processed is zero or a sandbox whose similarity of sandbox image configuration files meets a condition.

6. The method according to any one of claims 1 to 5, characterized in that: The obtaining of the code file to be detected includes: Receiving the code file to be detected uploaded by the user; The method further comprises: Identify the configuration information of the code file to be detected, and generate the sandbox image configuration file according to the configuration information.

7. The method according to claim 6, characterized in that The configuration information includes at least one of an operating system, a database, a language tool, and dependency information.

8. The method according to claim 6 or 7, characterized in that: The method further comprises: The sandbox image configuration file is compiled, and the at least one sandbox for executing the code file to be detected is deployed according to the compilation result.

9. A code analysis system, characterized in that: The code analysis system is used to analyze whether the code file to be detected includes malicious code, and the code analysis system includes: An interactive module, used for obtaining the code file to be detected; An elastic scaling module, used to obtain a sandbox image configuration file corresponding to the code file to be detected, and scale the load, performance or number of at least one sandbox according to the number of the sandbox image configuration files; A sandbox running module, used to run the code file to be tested in the expanded sandbox; The dynamic analysis module is used to obtain a code analysis result according to the behavior characteristics of the code file during execution, and the code analysis result is used to characterize whether the code file to be detected includes malicious code.

10. The system according to claim 9, characterized in that The elastic expansion module is specifically used for: When there is a first sandbox whose number of sandbox image configuration files is greater than a first threshold and a second sandbox whose number of sandbox image configuration files is less than the first threshold, at least one sandbox image configuration file in the load of the first sandbox is migrated to the load of the second sandbox.

11. The system according to claim 9, characterized in that The number of sandbox image configuration files in the load of the at least one sandbox is greater than a first threshold, and the elastic scaling module is specifically used to: For the sandbox image configuration file in the load of the at least one sandbox, when the number of files satisfying the similarity condition is greater than a second threshold, increasing the type of sandbox image configuration file adapted by the at least one sandbox to expand the performance of the at least one sandbox; or, For the sandbox image configuration file in the load of the at least one sandbox, when the number of files satisfying the similarity condition is less than a second threshold, a new sandbox is deployed to expand the number of the at least one sandbox.

12. The system according to claim 9, characterized in that The number of sandbox image configuration files in the load of the at least one sandbox is less than a first threshold, and the elastic scaling module is specifically used to: reducing the types of sandbox image configuration files adapted by the at least one sandbox to reduce the performance of the at least one sandbox; or, A target sandbox in the at least one sandbox is deleted to reduce the number of the at least one sandbox.

13. The system according to claim 12, characterized in that The target sandbox includes a sandbox whose number of analysis tasks to be processed is zero or a sandbox whose similarity of sandbox image configuration files meets a condition.

14. The system according to any one of claims 9 to 13, characterized in that The interaction module is specifically used for: Receiving the code file to be detected uploaded by the user; The system further comprises: An execution environment identification module, used to identify the configuration information of the code file to be detected; The sandbox image configuration generation module is used to generate the sandbox image configuration file according to the configuration information.

15. The system according to claim 14, characterized in that The configuration information includes at least one of an operating system, a database, a language tool, and dependency information.

16. The system according to claim 14 or 15, characterized in that The elastic expansion module is also used for: The sandbox image configuration file is compiled, and the at least one sandbox for executing the code file to be detected is deployed according to the compilation result.

17. A computing device cluster, characterized in that: The computing device cluster includes at least one computing device, and the at least one computing device includes at least one processor and at least one memory, wherein the at least one memory stores computer-readable instructions; the at least one processor executes the computer-readable instructions so that the computing device cluster performs the code analysis method as described in any one of claims 1 to 8.

18. A computer-readable storage medium, characterized in that: The method comprises computer-readable instructions; the computer-readable instructions are used to implement the code analysis method according to any one of claims 1 to 8.

19. A computer program product, characterized in that The method comprises computer-readable instructions; the computer-readable instructions are used to implement the code analysis method according to any one of claims 1 to 8.

Images