Software detection method and related device

Abstract

A software detection method, comprising: acquiring an executable file of software to be subjected to detection; during the process of executing the executable file in an isolated environment, continuously acquiring application programming interface (API) sequences executed in the isolated environment, wherein the API sequences comprise a first API sequence executed in the isolated environment before a first moment; on the basis of the first API sequence executed in the isolated environment before the first moment, analyzing the executable file to obtain an analysis result; when the analysis result indicates that a malicious code is detected in the executable file, releasing resources for executing the executable file in the isolated environment; and when the analysis result indicates that no malicious code is detected in the executable file, analyzing the executable file on the basis of a second API sequence executed in the isolated environment before a second moment. By means of continuously analyzing whether there is maliciousness in a file to be subjected to detection during the dynamic execution of said file and advancing the timing of analysis, API sequence extraction and API sequence analysis can be performed in parallel, thereby improving the efficiency of analysis of a malicious code.

Description

A software testing method and related equipment

[0001] This application claims priority to Chinese Patent Application No. 202410678329.7, filed on May 27, 2024, entitled "A Software Detection Method and Related Equipment", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of software testing, and more particularly to a software testing method, a malicious code analysis system, a computing device cluster, a computer-readable storage medium, and a computer program product. Background Technology

[0003] In recent years, an increasing number of software applications have relied on open-source software. According to surveys by relevant organizations, 99% of organizations use open-source software in their information systems. For example, many companies choose to use open-source software directly as their office software, or customize and modify it for use as office software.

[0004] As open-source software becomes a major component of the software supply chain, software supply chain security issues are becoming increasingly serious. For example, attackers can deploy malware with package names easily confused with legitimate open-source software in the open-source community, hijack legitimate open-source software, or inject malicious code into open-source projects that provide information to the global supply chain. Once a software package at the upstream of the software supply chain is actually attacked, it may have a destructive impact on downstream software developers and end users.

[0005] To ensure security, it is necessary to test open-source software. Currently, the most widely used detection solutions in the industry are based on sandbox execution environments for malware detection. However, sandbox-based malware detection is inefficient and unsuitable for software supply chains that add thousands or even hundreds of thousands of new open-source packages daily. Summary of the Invention

[0006] This application provides a software detection method that continuously analyzes the file for malicious activity based on extracted local application programming interface (API) sequences during the dynamic execution of the file to be detected. This advances the analysis time, eliminating the need to wait for all API sequences to be extracted, enabling parallel extraction and analysis of API sequences, thus improving the efficiency of malicious code analysis. Furthermore, when malicious code is detected in the file based on the local API sequences, the analysis process can be terminated, releasing resources used to execute executable files in isolated environments (such as resources in a sandbox), further enhancing detection efficiency and resource utilization. This application also provides a malicious code analysis system, computing device cluster, computer-readable storage medium, and computer program product corresponding to the software detection method.

[0007] Firstly, this application provides a software detection method. This software detection method can be executed by a malware analysis system. The malware analysis system can be software, which can be standalone or integrated into other software as a plugin, app, or functional module. The malware analysis system can be provided to the customer as a software package for self-deployment. Alternatively, the malware analysis system can be deployed to the customer via a private cloud. Or, the malware analysis system can be provided to the user as a service. For example, the malware analysis system can be deployed on a public cloud, and the cloud provider can sell the corresponding service to users through the public cloud. In some examples, the malware analysis system can also be hardware, such as a cluster of computing devices with malware analysis capabilities. When the computing device cluster runs, it executes the software detection method of this application.

[0008] Specifically, the malware analysis system obtains the executable file of the software to be detected. During the execution of the executable file in the isolated environment, it continuously acquires the Application Programming Interface (API) sequence executed within that environment. This API sequence includes the first API sequence executed in the isolated environment prior to a certain point in time. The first API sequence is a partial API sequence from the full API sequence called by the executable file during execution in the isolated environment. The malware analysis system can analyze the executable file based on the first API sequence executed in the isolated environment prior to the first point in time, obtaining analysis results. These results indicate whether malware was detected or not in the executable file. When the analysis result indicates that malware was detected, the resources used to execute the executable file in the isolated environment are released. When the analysis result indicates that no malware was detected, the executable file is analyzed based on the second API sequence executed in the isolated environment prior to a certain point in time. This second API sequence is a partial API sequence from the full API sequence.

[0009] This method continuously analyzes whether a file to be detected is malicious based on extracted local API sequences during the dynamic execution of the file to be detected. This advances the analysis time, eliminating the need to wait for all API sequences to be extracted. It enables parallel extraction and analysis of API sequences, improving the efficiency of malicious code analysis. Furthermore, when malicious code is detected in the file to be detected based on local API sequences, the analysis process for the file to be detected can be terminated, releasing resources for executing executable files in the isolated environment (such as resources in a sandbox), thereby improving detection efficiency and resource utilization.

[0010] In some possible implementations, the malware analysis system can match the first API sequence executed in the isolated environment before the first moment with malware detection rules. The malware analysis system can extract behavioral semantics based on the first API sequence executed in the isolated environment before the first moment, and perform malware detection on the executable file based on the behavioral semantics. And / or, the malware analysis system can input the first API sequence executed in the isolated environment before the first moment into an artificial intelligence (AI) model, and use the AI ​​model to perform malware detection on the executable file.

[0011] This method analyzes API sequences (such as local API sequences like the first API sequence) by providing at least one analysis method. On the one hand, it can improve analysis efficiency, as the analysis can end when at least one analysis method detects malicious code, thus avoiding waste of resources. On the other hand, it can improve the comprehensiveness of the analysis by using different analysis methods, thereby increasing the detection rate of malicious code.

[0012] In some possible implementations, the malware analysis system can obtain the first API sequence executed in the isolated environment before the first moment, and the incremental API sequence executed between the first and second moments. The malware analysis system can then obtain the second API sequence based on the first and incremental API sequences. For example, the malware analysis system can concatenate the first and incremental API sequences to obtain the second API sequence.

[0013] This method obtains incremental API sequences between different times and continuously obtains API sequences executed before different times based on the incremental API sequences. This can reduce the transmission overhead of API sequences, such as the transmission overhead from the sequence extraction module to the sequence analysis module, thereby improving analysis efficiency and resource utilization.

[0014] In some possible implementations, once the first API sequence has been analyzed, the malware analysis system can add annotation information to it. This annotation information indicates that the first API sequence has been analyzed. Based on the first API sequence with added annotation information and the incremental API sequence, the malware analysis system obtains the second API sequence.

[0015] This method, by annotating the analyzed local API sequences (e.g., the first API sequence), avoids the repeated analysis of the analyzed local API sequences when analyzing local API sequences executed before other times, thereby reducing resource waste, improving resource utilization, and increasing analysis efficiency.

[0016] In some possible implementations, once the executable file finishes execution, the analysis results based on the full API sequence executed in the isolated environment indicate that no malicious code was detected in the executable file. The malicious code analysis system can also release the resources in the isolated environment used to execute the aforementioned executable file.

[0017] In this method, if no malicious code is detected based on the local API sequence after the executable file has finished executing, the malicious code analysis system can then perform analysis based on the full API sequence. This can improve the accuracy of the analysis while ensuring the efficiency of the analysis.

[0018] In some possible implementations, the isolated environment includes sandboxes, virtual machines, containers, or hardware environments with restricted access. By executing the executable file of the software to be tested in a sandbox, virtual machine, container, or hardware environment with restricted access, malicious code can be prevented from damaging the computing system, data, etc., thus ensuring the security of the computing system or data.

[0019] Secondly, this application provides a malicious code analysis system. The system includes:

[0020] The interaction module is used to obtain the executable file of the software to be tested;

[0021] The sequence extraction module is used to continuously acquire the application programming interface (API) sequence executed in the isolated environment during the execution of the executable file in the isolated environment. The API sequence includes a first API sequence executed in the isolated environment before a first moment. The first API sequence is a partial API sequence in the full API sequence called by the executable file in the isolated environment.

[0022] The sequence analysis module is used to analyze the executable file based on the first API sequence executed in the isolated environment before the first moment, and obtain analysis results. The analysis results are used to indicate whether malicious code is detected or not in the executable file.

[0023] The resource management module is used to release the resources in the isolated environment used to execute the executable file when the analysis results indicate that malicious code has been detected in the executable file;

[0024] The sequence analysis module is further configured to analyze the executable file based on the second API sequence executed in the isolated environment before the second time step when the analysis result indicates that no malicious code was detected in the executable file, wherein the second API sequence is a partial API sequence in the full API sequence.

[0025] In some possible implementations, the sequence analysis module is specifically used for:

[0026] Match the first API sequence executed in the isolated environment prior to the first moment with the malicious code detection rules; and / or,

[0027] Behavioral semantics are extracted based on the first API sequence executed in the isolated environment prior to the first moment, and malicious code detection is performed on the executable file based on the behavioral semantics; and / or,

[0028] The first API sequence executed in the isolated environment before the first moment is input into the artificial intelligence (AI) model, and the AI ​​model is used to detect malicious code in the executable file.

[0029] In some possible implementations, the sequence extraction module is specifically used for:

[0030] Obtain the first API sequence executed in the isolated environment before the first moment, and obtain the incremental API sequence executed between the first moment and the second moment;

[0031] The second API sequence is obtained based on the first API sequence and the incremental API sequence.

[0032] In some possible implementations, the sequence extraction module is specifically used for:

[0033] Once the first API sequence has been analyzed, annotation information is added to the first API sequence, the annotation information being used to indicate that the first API sequence has been analyzed;

[0034] The second API sequence is obtained based on the first API sequence with the added annotation information and the incremental API sequence.

[0035] In some possible implementations, the resource management module is also used for:

[0036] Once the executable file finishes execution, the analysis results based on the full API sequence executed in the isolated environment indicate that no malicious code was detected in the executable file, and the resources used to execute the executable file in the isolated environment are released.

[0037] In some possible implementations, the isolated environment includes a sandbox, a virtual machine, a container, or a hardware environment with restricted access permissions.

[0038] Thirdly, this application provides a computing device cluster. The computing device cluster includes at least one computing device, which includes at least one processor and at least one memory. The at least one processor and the at least one memory communicate with each other. The at least one processor is configured to execute instructions stored in the at least one memory to cause the computing device or the computing device cluster to perform the software detection method as described in any implementation of the first or second aspect.

[0039] Fourthly, this application provides a computer-readable storage medium storing instructions that instruct a computing device or a cluster of computing devices to execute the software detection method described in any of the implementations of the first or second aspect above.

[0040] Fifthly, this application provides a computer program product containing instructions that, when run on a computing device or a cluster of computing devices, causes the computing device or cluster of computing devices to execute the software detection method described in any of the implementations of the first or second aspect above.

[0041] Based on the implementation methods provided in the above aspects, this application can be further combined to provide more implementation methods. Attached Figure Description

[0042] To more clearly illustrate the technical methods of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly described below.

[0043] Figure 1 is a schematic diagram of a malicious code detection process based on a sandbox execution environment provided in this application;

[0044] Figure 2 is a schematic diagram of the structure of a malicious code analysis system provided in this application;

[0045] Figure 3 is a flowchart of a software detection method provided in this application;

[0046] Figure 4 is a schematic diagram of an application scenario of a software detection method provided in this application;

[0047] Figure 5 is a schematic diagram of a rule-based scanning process for API sequences provided in this application;

[0048] Figure 6 is a schematic diagram of the structure of a computing device provided in this application;

[0049] Figure 7 is a schematic diagram of the structure of a computing device cluster provided in this application;

[0050] Figure 8 is a schematic diagram of another computing device cluster provided in this application;

[0051] Figure 9 is a schematic diagram of another computing device cluster provided in this application. Detailed Implementation

[0052] The terms "first" and "second" used in the embodiments of this application are for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first" and "second" may explicitly or implicitly include one or more of that feature.

[0053] First, some technical terms involved in the embodiments of this application will be introduced.

[0054] Open source software (OSS), also known as open-source software, is computer software whose source code is freely available. The copyright holder of open source software retains certain rights under the software license, allowing users to learn, modify, and distribute the software to anyone for any purpose. Open source software can include software released in the open source community, or software that is further developed (such as modified or enhanced) based on software released in the open source community.

[0055] Malicious code, also known as malware, malicious programs, or malicious scripts, refers specifically to software or scripts with malicious intent that may harm computer systems, data, or users. Malicious code may include backdoors, viruses, worms, Trojans, spyware, and ransomware.

[0056] Due to the rich functionality, features, and low cost of open-source software, an increasing number of software products rely on it. Related research reports indicate that 99% of organizations use open-source software in their information systems (such as office automation systems). The use and diversification of open-source software has exacerbated software supply chain security issues. Supply chain status reports show a rapid increase in open-source software (such as open-source components) poisoning incidents.

[0057] Open-source software supply chain poisoning refers to the act of injecting malicious code into the open-source software supply chain. There are numerous methods for open-source software supply chain poisoning, such as package name obfuscation and hijacking legitimate packages. The source code of open-source software may expose a large number of attack surfaces that can be exploited by attackers, exposing it to potential security threats. Attackers actively and proactively inject malicious code into open-source projects that provide information to the global supply chain. Once open-source software upstream in the software supply chain is actually attacked, it can have a destructive impact on downstream software developers and end users.

[0058] Therefore, poison detection can be performed on open-source software. Poison detection for open-source software can be divided into static detection (or static analysis) and dynamic detection (or dynamic analysis). Static detection is implemented by analyzing the source code. Static detection has advantages such as low analysis resource consumption and short detection time, but it relies heavily on prior knowledge of vulnerabilities and is difficult to detect runtime vulnerabilities. Dynamic detection relies on sandboxing of open-source software and capturing runtime system calls to identify hidden attacks that are difficult to detect by static detection, but it is time-consuming and resource-intensive.

[0059] A sandbox is an isolated environment used to run untrusted code or applications to prevent them from harming the host system or other applications. It is commonly used for malware analysis, software testing, and security research. A sandbox provides a restricted environment that prevents malicious code from accessing sensitive data or system resources. In some examples, a sandbox can be a virtual machine, a container, or a dedicated sandbox application.

[0060] Faced with a vast number of open-source software applications, how to quickly and accurately identify risks and reduce the scope of impact has become a key concern in the industry. Related technologies have proposed a solution using sandbox clusters for batch detection of open-source software. This solution involves inputting the file to be detected (such as the executable file of open-source software) into the sandbox cluster for execution, monitoring the behavior of the file during execution, and determining whether the file contains malicious code based on this behavior. Figure 1 illustrates a flowchart of a malicious code detection process based on a sandbox execution environment, specifically including the following steps:

[0061] Step 1: The user uploads the file to be tested and configures the testing duration or the system sets the maximum execution time;

[0062] Step 2: The system pre-configures N sandboxes to form a sandbox execution cluster, extracts basic file attributes such as file type and size, uploads the file to the sandbox, and monitors the behavior characteristics of the execution process in real time, extracts the runtime application programming interface (API) sequence and parameters, and ends the sandbox when the file execution is completed or the configured maximum execution time is reached.

[0063] Step 3: The dynamic analysis engine uses rules or artificial intelligence (AI) and other technologies to determine whether there is malicious code based on the API sequence and parameters obtained in Step 2.

[0064] These rules can include logical expressions describing the characteristics of malicious code, which can be used to quickly identify specific malicious code. For example, the rules for scanning Python malicious code are as follows:

[0065] In the aforementioned approach, the sandbox typically involves extracting all API sequences and then calling a dynamic analysis engine to analyze these sequences and identify whether the file to be detected contains malicious code. However, this detection method, where the dynamic analysis engine performs a unified analysis after the sandbox extracts features, is inefficient and unsuitable for scenarios involving thousands or even hundreds of thousands of new open-source software releases daily. It is therefore difficult to directly apply to malicious code detection scenarios within the open-source software supply chain.

[0066] In view of this, this application provides a software detection method. This software detection method can be executed by a malicious code analysis system. The malicious code analysis system can use dynamic analysis to detect whether software (such as open-source software) contains malicious code; therefore, the malicious code analysis system can also be called a dynamic malicious code analysis system. It should be noted that the aforementioned malicious code analysis system and dynamic malicious code analysis system can also be simply referred to as a code analysis system, dynamic analysis system, dynamic detection system, or dynamic fuzzing system. The malicious code analysis system can be software, which can be standalone or integrated into other software as a plugin, app, or functional module. The malicious code analysis system can be provided to customers as a software package for user deployment. The malicious code analysis system can also be deployed to the customer side via a private cloud. Alternatively, the malicious code analysis system can be provided to users as a service. For example, the malicious code analysis system can be deployed on a public cloud, and cloud providers can sell corresponding services to users through the public cloud. In some examples, the malicious code analysis system can also be hardware, such as a cluster of computing devices with malicious code analysis capabilities. When the computing device cluster runs, it executes the software detection method of this application.

[0067] Specifically, the malware analysis system obtains the executable file of the software to be detected. During the execution of the executable file in an isolated environment, it continuously acquires the API sequences executed within that environment. These API sequences include a first API sequence executed in the isolated environment prior to a certain point in time. This first API sequence is a partial API sequence (e.g., a part of the full API sequence, also called a sub-sequence) within the full API sequence called by the executable file during execution in the isolated environment. Then, based on the first API sequence executed in the isolated environment prior to the first point in time, the executable file is analyzed to obtain analysis results. These results indicate whether malicious code is detected or not within the executable file. If the analysis result indicates that malicious code is detected, the resources used to execute the executable file in the isolated environment are released. If the analysis result indicates that no malicious code is detected, the executable file is analyzed based on a second API sequence executed in the isolated environment prior to a certain point in time. This second API sequence is a partial API sequence within the full API sequence. It should be noted that the first and second API sequences can be different API sequences.

[0068] This method continuously analyzes the file under test for maliciousness based on the extracted local API sequences during the dynamic execution of the file under test. This advances the analysis time, eliminating the need to wait for all API sequences to be extracted. It enables parallel extraction and analysis of API sequences, improving the efficiency of malicious code analysis. Furthermore, when malicious code is detected in the file under test based on the local API sequences, the analysis process for the file under test can be terminated, releasing resources for executing executable files in the isolated environment (such as resources in a sandbox), thereby improving detection efficiency and resource utilization.

[0069] To make the technical solution of this application clearer and easier to understand, the architecture of the malicious code analysis system of this application is described below with reference to the accompanying drawings.

[0070] Referring to Figure 2, a schematic diagram of a malicious code analysis system is shown. The malicious code analysis system 10 includes an interaction module (not shown in Figure 2), a sequence extraction module 102, a sequence analysis module 104, and a resource management module 106.

[0071] The interaction module is used to obtain the executable file of the software to be tested. The executable file can be a file generated by compiling and packaging the source code files of the software to be tested, and can be executed on a computing device; for example, the executable file can be an .exe file. The sequence extraction module 102 is used to continuously obtain the API sequences executed in the isolated environment during the execution of the executable file. For example, the sequence extraction module 102 can periodically obtain the API sequences executed in the isolated environment. The API sequence includes the first API sequence executed in the isolated environment before the first moment. The first API sequence is a partial API sequence from the full API sequence called by the executable file in the isolated environment.

[0072] An isolated environment refers to an environment with restricted access permissions, including but not limited to sandboxes, virtual machines, containers, or hardware environments with restricted access permissions. Figure 2 illustrates this with an example of a sandbox within a sandbox cluster. In the example in Figure 2, the sandbox cluster can be an elastically scalable sandbox cluster. An elastically scalable sandbox cluster can scale up or down elastically based on the load, which can be represented by the number of files to be analyzed. Specifically, the elastically scalable sandbox cluster can dynamically analyze files by sending them to different sandboxes, and elastically add or remove sandboxes as needed. In each sandbox, the API sequence called during the execution of the files to be analyzed is recorded in real time.

[0073] API sequences, also known as dynamic APIs, include sequences of system functions or application functions called during execution. API sequences can include function call sequences; furthermore, when functions include input or output parameters, the sequence extraction module 102 can also extract the passed parameters. For ease of understanding, this application provides an example. For instance, malicious code includes malicious operations that modify the registry. The API sequence called during the execution of this malicious code includes RegCreateKeyExlw, and the passed parameters can include: {"name":"Handle","value":"0x00000060"}, {"name":"Access","value":"44335566"}, {"name":"Registry","value":"0x20000002"}, {"name":"Class","value":"2"}, {"name":"SubKey","value":"Software\\xxx"}. Dynamic APIs can reflect the behavioral patterns and intentions of malicious code and can be used for the analysis and identification of malicious code.

[0074] The sequence analysis module 104 analyzes the executable file based on the first API sequence executed in the isolated environment before the first moment, obtaining analysis results that indicate whether malicious code was detected or not. The sequence analysis module 104 can be implemented through dynamic analysis; for example, it can be a dynamic analysis engine. The sequence extraction module 102 passes the API sequence and parameters obtained from the sandbox to the dynamic analysis engine for malicious code identification.

[0075] In some possible implementations, the sequence analysis module 104 supports dynamic analysis in multiple ways. For example, the sequence analysis module 104 matches the first API sequence executed in the isolated environment before the first moment with malicious code detection rules. The sequence analysis module 104 can also extract behavioral semantics from the first API sequence executed in the isolated environment before the first moment, and perform malicious code detection on the executable file based on the behavioral semantics. Alternatively, the sequence analysis module 104 can also input the first API sequence executed in the isolated environment before the first moment into an AI model, and use the AI ​​model to perform malicious code detection on the executable file.

[0076] The sequence analysis module 104 is further configured to analyze the executable file based on a second API sequence executed in the isolated environment prior to a second time step when the analysis result indicates that no malicious code was detected in the executable file. The second time step is later than the first time step. The second API sequence is a partial API sequence from the full API sequence called by the executable file during execution in the isolated environment. The second API sequence differs from the first API sequence; for example, the second API sequence can be a concatenation of the first API sequence and the incremental API sequence from the first time step to the second time step. For any executable file, before execution is complete, the sequence analysis module 104 can perform analysis based on the API sequence executed in the isolated environment prior to the current time step (e.g., a partial API sequence), and stop analysis when malicious code is detected.

[0077] The resource management module 106 is used to release resources in the isolated environment used to execute the executable file when the analysis results indicate that malicious code has been detected in the executable file. For example, the dynamic analysis engine performs rule-based scanning, behavior semantic scanning, and AI-based scanning based on the API sequence (such as the first API sequence) executed before the current time provided by the sequence extraction module 102. If any of the scanning methods detects malicious code at the current time, the analysis of the current file to be detected can be terminated and the sandbox resources can be released.

[0078] In some possible implementations, the resource management module 106 is used to release the resources in the isolated environment used to execute the executable file when the executable file has finished executing, based on the analysis results of the full API sequence executed in the isolated environment indicating that no malicious code was detected in the executable file.

[0079] Based on the aforementioned malicious code analysis system 10, this application provides a software detection method. The specific implementation of the software detection method of this application will be described below with reference to the accompanying drawings.

[0080] Referring to Figure 3, a flowchart of a software detection method is shown. The method includes the following steps:

[0081] S302, Malicious code analysis system 10 obtains the executable file of the software to be detected.

[0082] The software to be detected can be software intended for malware detection. In some scenarios, the software to be detected can be newly released software from the open-source community. When releasing software, developers can release the source code and executable files of the open-source software. The malware analysis system 10 can obtain the executable files of the open-source software from the open-source community through a web crawler. An executable file is a file that can be executed on a computing device. For example, for software to be detected developed for desktop systems, the executable file can be an .exe file. The executable file can be obtained by compiling and packaging source code files. The source code files can be written in high-level languages ​​such as Python, Java, and JavaScript. The executable file can also be a binary file, or a code snippet embedded in an image or document. In other scenarios, the software to be detected can also be user-configured software that needs to be detected for malware. Specifically, the malware analysis system 10 can provide an upload interface, through which users can upload the executable files of the software to be detected.

[0083] S304. During the execution of an executable file in an isolated environment, the malicious code analysis system 10 continuously acquires the API sequence executed in the isolated environment.

[0084] An isolated environment refers to an environment with restricted access permissions. Executing executable files in an isolated environment can prevent damage to the computing system or the data within it. An isolated environment can include a sandbox, virtual machine, container, or a physical environment with restricted access permissions. A physical environment with restricted access permissions can be hardware-provided with restricted access permissions. For ease of description, a sandbox will be used as an example to illustrate the concept of an isolated environment.

[0085] When the executable file of the software to be detected is executed in an isolated environment such as a sandbox, the malware analysis system 10 can continuously acquire the API sequences executed in the sandbox. The malware analysis system 10 can acquire API sequences periodically or non-periodically. For example, the malware analysis system 10 can acquire API sequences at times T1, T2, ..., Tn. The API sequences may include the first API sequence executed in the isolated environment before the first time step. The first API sequence may be a partial API sequence from the full API sequence called by the executable file executed in the isolated environment.

[0086] In some possible implementations, if the API sequence called during executable execution involves parameter passing, the malicious code analysis system 10 can also obtain the parameters passed when executing the API sequence. For example, the API sequence includes the following API: RegCreateKeyExlw, and the passed parameters may include: {"name":"Handle","value":"0x00000060"}, {"name":"Access","value":"44335566"}.

[0087] S306. The malicious code analysis system 10 analyzes the executable file based on the first API sequence executed in the isolated environment before the first moment and obtains the analysis results. If the analysis results indicate that malicious code was detected in the executable file, S308 is executed; if the analysis results indicate that no malicious code was detected in the executable file, S310 is executed.

[0088] In this application, the malicious code analysis system 10 analyzes the executable file using a dynamic analysis algorithm based on the first API sequence executed in the isolated environment prior to the first moment, and obtains the analysis results. The analysis results are used to indicate whether malicious code was detected or not in the executable file.

[0089] The dynamic analysis algorithm can include rule-based dynamic analysis algorithms, behavior-semantic-based dynamic analysis algorithms, or AI model-based analysis algorithms. The malicious code analysis system 10 can analyze the executable file using one or more of these algorithms to obtain analysis results.

[0090] Specifically, the malware analysis system 10 can match the first API sequence executed in the isolated environment before the first moment with malware detection rules. If the match is successful, it indicates that malware has been detected in the executable file. If the match fails, it indicates that no malware has been detected based on the first API sequence. Alternatively, the malware analysis system 10 can extract behavioral semantics from the first API sequence executed in the isolated environment before the first moment, and perform malware detection on the executable file based on the behavioral semantics. The first API sequence reflects the behavior of the executable file in the isolated environment. The malware analysis system 10 can extract behavioral semantics from the first API sequence using a semantic recognition algorithm, and classify the behavior based on the behavioral semantics, such as classifying it as malicious behavior or non-malicious behavior, thereby achieving malware detection on the executable file. In some examples, the malware analysis system 10 can also input the first API sequence executed in the isolated environment before the first moment into an AI model, and use the AI ​​model to perform malware detection on the executable file. The AI ​​model can be a data-driven neural network model. For example, the AI ​​model can be trained using sample data through deep learning (DL). The sample data may include API sequences labeled with malicious or non-malicious intent. Accordingly, the AI ​​model can be trained through supervised learning, semi-supervised learning, or self-supervised learning.

[0091] Supervised learning is a method of machine learning that learns or builds a pattern (function / learning model) from training data (such as sample data) and uses this pattern to infer new instances. In supervised learning, the sample data is labeled data, specifically data labeled with the expected output. In a malicious code detection scenario, the expected output can be a malicious or non-malicious label, and the labeled data can be a sequence of APIs labeled with malicious or non-malicious labels. Semi-supervised learning is a branch of machine learning that uses a small amount of labeled data and a large amount of unlabeled data during training, aiming to alleviate the problem of limited labeled data in training data. Self-supervised learning is a paradigm in machine learning used to process unlabeled data to obtain useful representations to aid downstream learning tasks.

[0092] If the analysis results indicate that malicious code was detected in the executable file, it means that the software being detected is malicious software, and the analysis of the executable file can be stopped, proceeding to step S308. If the analysis results indicate that no malicious code was detected in the executable file, step S310 can be executed to continue analyzing the executable file.

[0093] S308, Malicious Code Analysis System 10 releases resources in the isolated environment used to execute executable files.

[0094] Specifically, the malware analysis system 10 can terminate processes or threads in the isolated environment, thereby releasing resources in the isolated environment used to execute executable files. For example, the malware analysis system 10 can terminate the sandbox process, end the analysis of the currently detected file, and release the resources in the sandbox used to execute the currently detected file.

[0095] The malicious code analysis system 10 can also output analysis results. Furthermore, when the analysis results based on the first API sequence indicate that malicious code has been detected in the executable file, the malicious code analysis system 10 can also output the first API sequence to indicate that malicious code was detected based on the first API sequence. Considering business needs, the malicious code analysis system 10 can also determine the target API from the first API sequence. The target API can be at least one API that successfully matches the malicious code detection rules, or an API whose behavioral semantics meet the requirements, or at least one API that is classified as malicious by the AI ​​model, and output the target API. This can assist in the accurate location of malicious code and help in patching vulnerabilities. For example, if the executable file of the software to be tested is executed in an isolated environment, and the malicious code analysis system 10 detects malicious code (malicious operation) based on the first API executed, it can output the aforementioned first API. The malicious code analysis system 10 can list only the first API in the test report, indicating that malicious operation or malicious code was detected when the first API was executed.

[0096] S310, the malicious code analysis system 10 analyzes the executable file based on the second API sequence executed in the isolated environment before the second moment.

[0097] Specifically, the malware analysis system 10 can obtain the first API sequence executed in the isolated environment before the first moment, and the incremental API sequence executed between the first moment and the second moment. Then, based on the first API sequence and the incremental API sequence, it obtains the second API sequence. In some examples, the malware analysis system 10 can also directly obtain the second API sequence executed in the isolated environment before the second moment. Taking the isolated environment as a sandbox example, the sandbox can periodically or non-periodically record the API sequences executed in the isolated environment, and the malware analysis system 10 can obtain the second API sequence executed in the isolated environment before the second moment. The second API sequence can be a partial API sequence from the full API sequence called by the executable file executed in the isolated environment. Typically, the second API sequence differs from the first API sequence; for example, the second API sequence is longer than the first API sequence, and the first API sequence is a subsequence of the second API sequence.

[0098] Similar to the first API sequence, the malware analysis system 10 can analyze the executable file using a dynamic analysis algorithm based on the second API sequence executed in the isolated environment before the second time step, and obtain the analysis results. Specifically, the malware analysis system 10 can match the second API sequence executed in the isolated environment before the second time step with malware detection rules to perform malware detection. Alternatively, the malware analysis system 10 can extract behavioral semantics based on the second API sequence executed in the isolated environment before the second time step, and perform malware detection on the executable file based on the behavioral semantics. In some examples, the malware analysis system 10 can also input the second API sequence executed in the isolated environment before the second time step into an AI model, and use the AI ​​model to perform malware detection on the executable file.

[0099] Furthermore, to improve detection efficiency, the malware analysis system 10 can reuse the analysis results of the first API sequence already analyzed in the second API sequence when analyzing the second API sequence. Specifically, after the first API sequence has been analyzed, the malware analysis system 10 can add annotation information to the first API sequence, indicating that the first API sequence has been analyzed. The malware analysis system 10 can then obtain the second API sequence based on the first API sequence with the added annotation information and the incremental API sequence. Correspondingly, when analyzing the second API sequence, the malware analysis system 10 can analyze other subsequences in the second API sequence besides the first API sequence and its subsequences based on the annotation information, without needing to repeatedly analyze the first API sequence and its subsequences.

[0100] The malware analysis system 10 can continuously extract and analyze API sequences, thereby achieving continuous detection of executable files. If no malware is detected based on the second API sequence, the malware analysis system 10 can analyze the executable file using a dynamic analysis algorithm based on the API sequences executed before the next time period (next cycle) to obtain analysis results. Furthermore, when the executable file finishes execution, if the malware analysis system 10 indicates that no malware was detected in the executable file based on the analysis results of the full API sequences executed in the isolated environment, the malware analysis system 10 can stop analyzing the executable file and release the resources in the isolated environment used to execute the executable file.

[0101] As described above, the software detection method of this application continuously analyzes whether the file to be detected is malicious based on the extracted local API sequences during the dynamic execution of the file to be detected. This advances the analysis time, eliminating the need to wait for all API sequences to be extracted. It enables parallel extraction and analysis of API sequences, improving the efficiency of malicious code analysis. Furthermore, when malicious code is detected in the file to be detected based on the local API sequences, the analysis process for the file to be detected can be terminated, releasing the resources for executing executable files in the isolated environment, thereby improving detection efficiency and resource utilization.

[0102] Next, the software testing method of this application will be explained in conjunction with specific application scenarios.

[0103] Referring to Figure 4, which illustrates an application scenario of a software detection method, the executable file of the software to be detected is passed to a sandbox cluster. Sandboxes 1 to n in the sandbox cluster can execute different executable files in parallel. The software detection system 10 can analyze the executable file based on the API sequence executed in sandboxes 1 to n, specifically including the following steps:

[0104] Step 1: The sequence extraction module in the software detection system 10 acquires the API sequence executed in the sandbox at time T1, and inputs the acquired API sequence into the sequence analysis module (e.g., dynamic analysis engine) for analysis.

[0105] Step 2: The dynamic analysis engine calls rule-based scanning to check if the malicious code detection rules are hit, calls behavior semantic scanning to analyze whether the API sequence is called when malicious code is executed, and calls AI-based scanning to determine whether the executable file contains malicious code by analyzing behavior.

[0106] The dynamic analysis engine can call multiple scanning methods in parallel to detect malicious code, thereby improving the efficiency of malicious code detection.

[0107] Step 3: If the analysis results of any one of the three scanning methods in Step 2 indicate that malicious code is detected in the executable file, the resource management module in the software detection system 10 can terminate the sandbox. Otherwise, when entering time T2, the sequence extraction module in the software detection system 10 acquires the incremental API sequence from time T1 to T2. The sequence extraction module annotates the analyzed API sequence and merges it with the incremental API sequence, then inputs the merged API sequence into the dynamic analysis engine for analysis. If the analysis results of any one of the three scanning methods indicate that malicious code is detected in the executable file, the resource management module can terminate the sandbox.

[0108] Among them, when the analysis results of any scanning method indicate that malicious code is detected in the executable file, the software detection system 10 terminates the sandbox in advance and releases the current analysis resources, which can improve resource utilization.

[0109] Step 4: When the executable file finishes execution, the software detection system 10 obtains the full API sequence of the executable file in the sandbox and inputs it into the dynamic analysis engine. It then executes rule-based scanning, behavior semantic scanning, and AI-based scanning in parallel and outputs the final analysis results.

[0110] Specifically, the API sequences at times T1, T2, ..., Tn have all been analyzed. The analysis results based on the API sequences at times T1, T2, ..., Tn indicate that no malicious code was detected in the executable file. When time TE is reached, the executable file has finished executing. The sequence extraction module in the software detection system 10 can obtain the full API sequence, which can be the API sequence concatenated from the API sequences before time Tn and the incremental API sequences between time Tn and time TE. Then, the full API sequence is input into the dynamic analysis engine.

[0111] To facilitate understanding, the analysis process will be illustrated below using a rule-based scanning method.

[0112] Referring to Figure 5, a flowchart illustrating a rule-based scan of an API sequence is shown, which specifically includes the following steps:

[0113] Step a: At time T1, the sequence extraction module in the software detection system 10 obtains the API sequence executed in the sandbox (e.g., one of the sandboxes from sandbox 1 to sandbox n) before time T1 and inputs it into the rule engine for matching.

[0114] The API sequence executed in the sandbox before time T1 can be any sequence of APIs executed in the sandbox from the start of executable file execution to time T1. The rule engine can include malicious code detection rules. The rule engine can match the API sequence with these malicious code detection rules to achieve rule-based scanning.

[0115] Step b: The sequence extraction module in the software detection system 10 annotates the API sequences executed in the sandbox before the analyzed time T1.

[0116] The annotation information can be used to indicate that the API sequence executed in the sandbox before time T1 has been analyzed.

[0117] Step c: At time Tn, the sequence extraction module in the software detection system 10 inputs the API sequence (T1…Tn-1,Tn) executed in the sandbox before time Tn into the rule engine for matching.

[0118] Step d: The rule engine can analyze whether Tn-1 has been analyzed. If it has been analyzed, the rule engine analyzes the subsequences that include at least one API from the incremental API sequence, which are part of the API sequence executed in the sandbox before time Tn.

[0119] Specifically, the rule engine will not re-analyze the subsequences of the API sequences executed in the sandbox before time Tn. Instead, it will obtain the unanalyzed API sequences, such as subsequences that include at least one API in the incremental API sequence. When the analysis is completed at time Tn, the rule engine can continue to annotate until malicious code is detected or the executable file is completed.

[0120] Among them, the scanning process based on behavioral semantics, the scanning process based on AI, and the rule scanning process based on API sequences are similar. The dynamic analysis engine will not repeat the analysis of API sequences before time Tn, but will only analyze the newly added API sequences. Finally, it will perform a comprehensive analysis based on the analysis results at each time to obtain the final analysis result.

[0121] It should be noted that the software detection method of this application does not require user configuration or system settings for maximum execution time. If no malicious code is detected during the execution of each executable file, the analysis is performed based on the full API sequence upon completion of execution, and the analysis ends when the analysis results indicate that no malicious code is detected. This solves the problem in related technologies where the actual runtime of different executable files is uncertain, and configuring the same maximum execution time (or execution time threshold) for each executable file leads to the waste of resources such as sandboxes.

[0122] Based on the aforementioned software detection method, this application provides a malicious code analysis system 10. The malicious code analysis system 10 of this application embodiment will be described below with reference to the accompanying drawings.

[0123] Referring to Figure 2, which shows a schematic diagram of the structure of a malicious code analysis system 10, the malicious code analysis system 10 includes:

[0124] The interactive module (not shown in Figure 2) is used to obtain the executable file of the software to be tested;

[0125] Sequence extraction module 102 is used to continuously acquire the application programming interface (API) sequence executed in the isolated environment during the execution of the executable file in the isolated environment. The API sequence includes a first API sequence executed in the isolated environment before a first moment. The first API sequence is a partial API sequence in the full API sequence called by the executable file in the isolated environment.

[0126] The sequence analysis module 104 is used to analyze the executable file based on the first API sequence executed in the isolated environment before the first moment, and obtain the analysis result, which is used to indicate whether malicious code is detected or not in the executable file;

[0127] Resource management module 106 is used to release resources in the isolated environment used to execute the executable file when the analysis results indicate that malicious code is detected in the executable file;

[0128] The sequence analysis module 104 is further configured to analyze the executable file based on the second API sequence executed in the isolated environment before the second time step when the analysis result indicates that no malicious code was detected in the executable file, wherein the second API sequence is a partial API sequence in the full API sequence.

[0129] For example, the above-mentioned interaction module, sequence extraction module 102, sequence analysis module 104, and resource management module 106 can be implemented in hardware or in software.

[0130] When implemented in software, the interaction module, sequence extraction module 102, sequence analysis module 104, and resource management module 106 can be applications running on computing devices. Taking sequence extraction module 102 as an example, the application can be a computing engine. The application can also be provided to users in the form of virtualization services. Virtualization services can include virtual machine (VM) services, bare metal server (BMS) services, or container services. VM services can be services that use virtualization technology to create virtual machine (VM) resource pools on multiple physical hosts to provide VMs for users to use on demand. BMS services are services that create virtual BMS resource pools on multiple physical hosts to provide BMS for users to use on demand. Container services are services that create virtual container resource pools on multiple physical hosts to provide containers for users to use on demand. A VM is a simulated virtual computer, that is, a logical computer. A BMS is a scalable, high-performance computing service with computing performance indistinguishable from traditional physical machines and features secure physical isolation. Containers are a kernel virtualization technology that provides lightweight virtualization to isolate user space, processes, and resources. It should be understood that the VM service, BMS service, and container service mentioned above are merely specific examples. In practical applications, virtualization services can also include other lightweight or heavyweight virtualization services, which are not specifically limited here.

[0131] When implemented in hardware, the sequence extraction module 102, sequence analysis module 104, and resource management module 106 may include at least one computing device, such as a server. Alternatively, the sequence extraction module 102, sequence analysis module 104, and resource management module 106 may also be implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof. The interaction module can be implemented using a transceiver, which may include a transceiver module or a network interface card.

[0132] In some possible implementations, the sequence analysis module 104 is specifically used for:

[0133] Match the first API sequence executed in the isolated environment prior to the first moment with the malicious code detection rules; and / or,

[0134] Behavioral semantics are extracted based on the first API sequence executed in the isolated environment prior to the first moment, and malicious code detection is performed on the executable file based on the behavioral semantics; and / or,

[0135] The first API sequence executed in the isolated environment before the first moment is input into the artificial intelligence (AI) model, and the AI ​​model is used to detect malicious code in the executable file.

[0136] In some possible implementations, the sequence extraction module 102 is specifically used for:

[0137] Obtain the first API sequence executed in the isolated environment before the first moment, and obtain the incremental API sequence executed between the first moment and the second moment;

[0138] The second API sequence is obtained based on the first API sequence and the incremental API sequence.

[0139] In some possible implementations, the sequence extraction module 102 is specifically used for:

[0140] Once the first API sequence has been analyzed, annotation information is added to the first API sequence, the annotation information being used to indicate that the first API sequence has been analyzed;

[0141] The second API sequence is obtained based on the first API sequence with the added annotation information and the incremental API sequence.

[0142] In some possible implementations, the resource management module 106 is further configured to:

[0143] Once the executable file finishes execution, the analysis results based on the full API sequence executed in the isolated environment indicate that no malicious code was detected in the executable file, and the resources used to execute the executable file in the isolated environment are released.

[0144] In some possible implementations, the isolated environment includes a sandbox, a virtual machine, a container, or a hardware environment with restricted access permissions.

[0145] This application also provides a computing device 600. As shown in FIG6, the computing device 600 includes: a bus 602, a processor 604, a memory 606, and a communication interface 608. The processor 604, the memory 606, and the communication interface 608 communicate with each other via the bus 602. The computing device 600 may be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 600.

[0146] Bus 602 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, only one line is used in Figure 6, but this does not imply that there is only one bus or one type of bus. Bus 602 can include pathways for transmitting information between various components of computing device 600 (e.g., memory 606, processor 604, communication interface 608).

[0147] Processor 604 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0148] Memory 606 may include volatile memory, such as random access memory (RAM). Memory 606 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0149] The memory 606 stores executable program code, which the processor 604 executes to implement the aforementioned software detection method. Specifically, the memory 606 stores instructions from the malicious code analysis system 10 for executing the software detection method. For example, the memory 606 may store instructions for the interaction module, sequence extraction module 102, sequence analysis module 104, and resource management module 106 of the malicious code analysis system 10, which, when executed, implement the functions of the aforementioned modules.

[0150] The communication interface 608 uses transceiver modules, such as, but not limited to, network interface cards and transceivers, to enable communication between the computing device 600 and other devices or communication networks.

[0151] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0152] As shown in Figure 7, the computing device cluster includes multiple computing devices 600. The memory 606 of the computing devices 600 in the computing device cluster may store the same malicious code analysis system 10 instructions for executing software detection methods.

[0153] In some possible implementations, one or more computing devices 600 in the computing device cluster can also be used to execute some of the instructions used by the malware analysis system 10 to perform software detection methods. In other words, a combination of one or more computing devices 600 can jointly execute the instructions used by the malware analysis system 10 to perform software detection methods. The memory 606 in different computing devices 600 in the computing device cluster can store different instructions for performing some functions of the malware analysis system 10.

[0154] Figure 8 illustrates one possible implementation. As shown in Figure 8, two computing devices 600A and 600B are connected via a communication interface 608. The memory in computing device 600A stores instructions for executing the functions of the interaction module and the sequence extraction module 102. The memory in computing device 600B stores instructions for executing the functions of the sequence analysis module 104 and the resource management module 106. In other words, the memory 606 of computing devices 600A and 600B jointly stores the instructions used by the malicious code analysis system 10 to execute software detection methods.

[0155] The connection method between the computing device clusters shown in Figure 8 can be considered because the software detection method provided in this application requires a lot of computing resources for API sequence analysis. Therefore, it is considered that the functions implemented by the sequence extraction module 102 and the sequence analysis module 104 are executed by different computing devices.

[0156] It should be understood that the functions of computing device 600A shown in Figure 8 can also be performed by multiple computing devices 600. Similarly, the functions of computing device 600B can also be performed by multiple computing devices 600.

[0157] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN) or a local area network (LAN), etc. Figure 9 illustrates one possible implementation. As shown in Figure 9, two computing devices 600C and 600D are connected via a network. Specifically, they are connected to the network through communication interfaces in each computing device. In this type of possible implementation, the memory 606 in computing device 600C stores instructions for executing the functions of the interaction module and the sequence extraction module 102. Simultaneously, the memory 606 in computing device 600D stores instructions for executing the functions of the sequence analysis module 104 and the resource management module 106.

[0158] It should be understood that the functions of computing device 600C shown in Figure 9 can also be performed by multiple computing devices 600. Similarly, the functions of computing device 600D can also be performed by multiple computing devices 600.

[0159] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that a computing device can store, or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct a computing device to execute the software detection method described above for use in the malicious code analysis system 10. This application also provides another computer-readable storage medium. This computer-readable storage medium includes instructions that instruct a computing device to execute the software detection method described above for use in the malicious code analysis system 10.

[0160] This application also provides a computer program product containing instructions. The computer program product may be software or a program product containing instructions, capable of running on a computing device or stored on any usable medium. When the computer program product is run on at least one computing device, it causes the at least one computing device to perform the aforementioned software detection method. This application also provides a computer program product containing instructions. When the computer program product is run on at least one computing device, it causes the at least one computing device to perform the aforementioned software detection method.

[0161] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the protection scope of the technical solutions of the embodiments of the present invention.

Claims

1. A software detection method, characterized in that, The method includes: Obtain the executable file of the software to be tested; During the execution of the executable file in the isolated environment, the sequence of application programming interfaces (APIs) executed in the isolated environment is continuously acquired. The API sequence includes the first API sequence executed in the isolated environment before the first moment. The first API sequence is a partial API sequence in the full API sequence called by the executable file in the isolated environment. Based on the first API sequence executed in the isolated environment prior to the first moment, the executable file is analyzed to obtain analysis results, which are used to indicate whether malicious code is detected or not in the executable file; When the analysis result indicates that malicious code is detected in the executable file, the resources used to execute the executable file in the isolation environment are released. When the analysis result indicates that no malicious code is detected in the executable file, the executable file is analyzed according to the second API sequence executed in the isolation environment before the second time, wherein the second API sequence is a partial API sequence in the full API sequence.

2. The method according to claim 1, characterized in that, The step of analyzing the executable file based on the first API sequence executed in the isolated environment prior to the first moment includes: Match the first API sequence executed in the isolated environment prior to the first moment with the malicious code detection rules; and / or, Behavioral semantics are extracted based on the first API sequence executed in the isolated environment prior to the first moment, and malicious code detection is performed on the executable file based on the behavioral semantics; and / or, The first API sequence executed in the isolated environment before the first moment is input into the artificial intelligence (AI) model, and the AI ​​model is used to detect malicious code in the executable file.

3. The method according to claim 1 or 2, characterized in that, The continuous acquisition of the sequence of application programming interface (API) sequences executed in the isolated environment includes: Obtain the first API sequence executed in the isolated environment before the first moment, and obtain the incremental API sequence executed between the first moment and the second moment; The second API sequence is obtained based on the first API sequence and the incremental API sequence.

4. The method according to claim 3, characterized in that, The step of obtaining the second API sequence based on the first API sequence and the incremental API sequence includes: Once the first API sequence has been analyzed, annotation information is added to the first API sequence, the annotation information being used to indicate that the first API sequence has been analyzed; The second API sequence is obtained based on the first API sequence with the added annotation information and the incremental API sequence.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: Once the executable file finishes execution, the analysis results based on the full API sequence executed in the isolated environment indicate that no malicious code was detected in the executable file, and the resources used to execute the executable file in the isolated environment are released.

6. The method according to any one of claims 1 to 5, characterized in that, The isolated environment includes sandboxes, virtual machines, containers, or hardware environments with restricted access permissions.

7. A malicious code analysis system, characterized in that, The system includes: The interaction module is used to obtain the executable file of the software to be tested; The sequence extraction module is used to continuously acquire the application programming interface (API) sequence executed in the isolated environment during the execution of the executable file in the isolated environment. The API sequence includes a first API sequence executed in the isolated environment before a first moment. The first API sequence is a partial API sequence in the full API sequence called by the executable file in the isolated environment. The sequence analysis module is used to analyze the executable file based on the first API sequence executed in the isolated environment before the first moment, and obtain analysis results. The analysis results are used to indicate whether malicious code is detected or not in the executable file. The resource management module is used to release the resources in the isolated environment used to execute the executable file when the analysis results indicate that malicious code has been detected in the executable file; The sequence analysis module is further configured to analyze the executable file based on the second API sequence executed in the isolated environment before the second time step when the analysis result indicates that no malicious code was detected in the executable file, wherein the second API sequence is a partial API sequence in the full API sequence.

8. The system according to claim 7, characterized in that, The sequence analysis module is specifically used for: Match the first API sequence executed in the isolated environment prior to the first moment with the malicious code detection rules; and / or, Behavioral semantics are extracted based on the first API sequence executed in the isolated environment prior to the first moment, and malicious code detection is performed on the executable file based on the behavioral semantics; and / or, The first API sequence executed in the isolated environment before the first moment is input into the artificial intelligence (AI) model, and the AI ​​model is used to detect malicious code in the executable file.

9. The system according to claim 7 or 8, characterized in that, The sequence extraction module is specifically used for: Obtain the first API sequence executed in the isolated environment before the first moment, and obtain the incremental API sequence executed between the first moment and the second moment; The second API sequence is obtained based on the first API sequence and the incremental API sequence.

10. The system according to claim 9, characterized in that, The sequence extraction module is specifically used for: Once the first API sequence has been analyzed, annotation information is added to the first API sequence, the annotation information being used to indicate that the first API sequence has been analyzed; The second API sequence is obtained based on the first API sequence with the added annotation information and the incremental API sequence.

11. The system according to any one of claims 7 to 10, characterized in that, The resource management module is also used for: Once the executable file finishes execution, the analysis results based on the full API sequence executed in the isolated environment indicate that no malicious code was detected in the executable file, and the resources used to execute the executable file in the isolated environment are released.

12. The system according to any one of claims 7 to 11, characterized in that, The isolated environment includes sandboxes, virtual machines, containers, or hardware environments with restricted access permissions.

13. A computing device cluster, characterized in that, The computing device cluster includes at least one computing device, the at least one computing device including at least one processor and at least one memory, the at least one memory storing computer-readable instructions; the at least one processor executes the computer-readable instructions to cause the computing device cluster to perform the method as described in any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that, Includes computer-readable instructions; the computer-readable instructions are used to implement the method according to any one of claims 1 to 6.

15. A computer program product, characterized in that, Includes computer-readable instructions; the computer-readable instructions are used to implement the method according to any one of claims 1 to 6.

Images