Trojan horse decision system based on dynamic code sequence tracking analysis

Abstract

The invention provides a Trojan horse decision system based on dynamic code sequence tracking analysis. The system comprises an interaction module, a decision module, a virtual analysis module, a malicious intention decision sub-module, an encrypting / decrypting module and a report generating and storing module. The interaction module is a carrier of the interaction between a user and a server; the decision module is used for deciding whether a program uploaded by the user is a portable executable (PE) program or not, and whether the program is analyzed or not; the virtual analysis module is used for statically and dynamically analyzing behavior operation of suspicious programs and deciding the malicious intentions and classifications of the programs; the malicious intention decision sub-module is used for completing the decision of the malicious intention of the programs to be detected; the encrypting / decrypting module is used for encrypting / decrypting the files and data transmitted between the virtual analysis module and a server system; the report generating and storing module is used for generating an analysis report and storing the analysis report data and analyzed suspicious program samples. The Trojan horse decision system provided by the invention realizes the efficient detection, and has an effect of recognizing new varied Trojan horses.

Description

technical field [0001] The present invention relates to the field of computer systems, more specifically, to a Trojan horse analysis system based on dynamic code sequence tracking. Background technique [0002] With the rapid development of the Internet, the number and propagation speed of Trojan horses also increase geometrically. A large number of Trojan horse programs will undoubtedly bring a huge impact to the traditional analysis methods. Traditional static scanning has many problems such as not being able to detect Trojan horse variants in time. However, the current dynamic analysis based on sandboxes and virtual machines requires manual intervention, which seriously affects the analysis efficiency. The determination method is not effective enough, and there are a large number of subjective factors. Matching is often based on existing features, making it difficult to effectively monitor unknown Trojans and special Trojans. . Therefore, determining whether a program i...

AI Technical Summary

Problems solved by technology

[0003] In order to solve the above-mentioned main problems in the background technology, the present invention implements a Trojan judgment system based on dynamic code sequence tracking analysis, which solves the problems of fast positioning of known Trojans and judgment and analysis of unknown Trojans, and significantly improves the detection and analysis. efficiency

Images