Method and system for automatically analyzing malicious codes based on virtual hardware environment

Abstract

The invention discloses a method and a system for automatically analyzing malicious codes based on a virtual hardware environment, and belongs to the technical field of network security. By establishing an operating environment required by the malicious codes on the basis of the virtual hardware environment and operating and controlling virtual CPU instructions and the access operation of multiplekinds of virtual hardware, multiple kinds of operation information of the malicious codes is collected, the running process of the malicious codes is controlled, all collected data is analyzed, and virtual system state information and malicious code running information are dynamically displayed. Because the data acquisition is implemented by virtual hardware, the malicious codes cannot sense thatwhether the malicious codes run in the virtual environment and also cannot distinguish that whether the malicious codes are tracked, and further the completely transparent analysis on the malicious codes is realized.

Description

technical field [0001] The invention belongs to the technical field of network security, and in particular relates to a malicious code analysis method and system. Background technique [0002] With the continuous development and progress of society, computers are more and more widely used in various fields of society. Due to the widespread existence of software vulnerabilities and the lack of user security awareness, malicious codes spread faster and faster, the scope of infection continues to expand, and the damage caused is becoming more and more serious. Traditional security protection methods are limited by analysis efficiency, and the response cycle is difficult to shorten. The response speed has gradually failed to adapt to this new situation. Therefore, it is very necessary to improve the speed and efficiency of malicious code analysis. [0003] Existing malicious code analysis methods mainly rely on traditional software analysis and debugging tools, mainly includin...

AI Technical Summary

Problems solved by technology

Since the behavior of malicious code often depends on the external environment, it is difficult to fully cover all possible behaviors of malicious code in this way.

At the same time, the characteristics of this analysis method also determine that its analysis ability has the same platform competition problem as dynamic tracking, and a large number of manual operations also greatly limit its analysis efficiency.

Today, as the amount of malicious code continues to expand, the flaws of manual analysis are more obvious

Images