Honeypot and sandbox mutually enhanced malicious program behavior processing method and system

Abstract

The invention discloses a malicious program behavior processing method and system based on mutual enhancement of a honeypot and a sandbox. The honeypot induces and captures malicious codes; the captured malicious codes and generated information are sent to a sandbox; the sandbox generates a code running environment configuration file; the sandbox generates a malicious code running environment according to the malicious code running environment configuration file; in the malicious code operation environment, the sandbox triggers the operation of the malicious code to analyze the operation process of the malicious code; the sandbox analyzes network communication behaviors in the operation process and sends the network communication behaviors to the honeypot and the virtual network; after receiving the network communication behaviors, the honeypot interacts with known network communication behaviors, and learns unknown network communication behaviors by recording the interaction process of the sandbox and the virtual network to improve the capture capability; and the malicious codes are induced and captured again through the learned honeypot. The honeypot can capture malicious samples more efficiently, and the sandbox can analyze the malicious samples more efficiently and safely.

Description

technical field [0001] The invention relates to the technical field of malicious program processing, in particular to a malicious program behavior processing method and system in which honeypots and sandboxes reinforce each other. Background technique [0002] The statements in this section merely mention the background technology related to the present invention and do not necessarily constitute the prior art. [0003] In the traditional concept, a honeypot is a device acquisition program used to capture malicious samples, while a sandbox can perform various detailed analyzes on malicious samples. These two concepts are isolated from each other in principle. However, judging from the current deployment of honeypots and sandboxes, the two are often working in isolation from each other with only a small amount of interaction. For the honeypot, after the honeypot captures the malicious code, it will send it to the sandbox subroutine for analysis, but in the process, the honey...

AI Technical Summary

Problems solved by technology

However, the above considerations have not yet been realized by relevant technologies.

Images