Method and device for analyzing suspicious codes

Abstract

The embodiment of the invention provides a method for analyzing suspicious codes. A virtual executing environment of codes is created and is used for creating a common process of a host system; the operation of the common process of the suspicious codes to the host system is redirected to the process created by the virtual executing environment of the codes; the operation of the suspicious codes to a file system or a registration table of the host system is redirected to a virtual file system or a virtual registration table created by the virtual executing environment of the codes; the behavior characteristics of the suspicious codes in operation are recorded and stored as a log file; and the log file is transmitted to the host system by a named pipe for analysis, wherein the named pipe is invisible to the suspicious codes in the virtual executing environment of the codes. The embodiment of the invention also provides a device for analyzing the suspicious codes. The embodiment prevents the suspicious codes from influencing the process of the host system.

Description

technical field [0001] The invention relates to the technical field of computer security, in particular to a suspicious code analysis method and device. Background technique [0002] The suspicious code behavior analysis environment is theoretically a virtual execution environment, and the theoretical basis for establishing this virtual execution environment is the virtual machine (virtual machine, VM) technology. [0003] The traditional virtual machine technology is the so-called hardware-level virtual machine. Its theoretical principle is to virtualize the hardware and provide an interface to the VM running on it. Each VM runs an independent GuestOS. Each GuestOS thinks that It runs independently on the hardware itself. The design and implementation of hardware-level virtual machines are very complicated, and the specific implementation schemes of each virtual machine are different, such as: VmWare, Microsoft Virtual PC, but their general idea is the same, which is to vi...

AI Technical Summary

Problems solved by technology

[0007] In the process of realizing the present invention, the inventors found that there are at least the following problems in the prior art: since the operating system-level virtual machine is dependent on the operating system, most of the operating system kernel cannot be modified, and some of the system Programs or components are closely dependent on these kernel structures, so the operating system-level virtual machine cannot fully provide virtualization; because it cannot fully provide virtualization, the existing operating system-level virtual machine can be directly used to analyze the behavior of suspicious code It is inappropriate; most of the systems implemented using this theory only mentioned how to limit VM APP (referring to the process running in the virtual machine) to the VM, but did not elaborate on how to prevent VM APP from interfering with the host system

Images