WO2016078323A1 - 检测恶意软件的方法及装置 - Google Patents

检测恶意软件的方法及装置 Download PDF

Info

Publication number
WO2016078323A1
WO2016078323A1 PCT/CN2015/077213 CN2015077213W WO2016078323A1 WO 2016078323 A1 WO2016078323 A1 WO 2016078323A1 CN 2015077213 W CN2015077213 W CN 2015077213W WO 2016078323 A1 WO2016078323 A1 WO 2016078323A1
Authority
WO
WIPO (PCT)
Prior art keywords
delay
interface
length parameter
delay length
preset
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2015/077213
Other languages
English (en)
French (fr)
Inventor
刘步
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to JP2017514330A priority Critical patent/JP6306265B2/ja
Priority to EP15861269.7A priority patent/EP3196795B1/en
Publication of WO2016078323A1 publication Critical patent/WO2016078323A1/zh
Priority to US15/491,068 priority patent/US10565371B2/en
Anticipated expiration legal-status Critical
Priority to US16/723,469 priority patent/US10963558B2/en
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • the present invention relates to the field of computer technologies, and in particular, to a method and apparatus for detecting malware.
  • Computer software refers to a collection of computer data and instructions organized in a specific order. Shortly after the birth of computer software, malware appeared. The purpose of legal software development is to strengthen and expand the working capabilities of computers. The purpose of malware development is to steal and destroy computer data. The traditional malware detection method is based on the comparison of feature codes. However, malware often evades feature code comparison by means of deformation and shelling. Among them, deformation refers to adding a lot of confusion in the software program code. The code invalidates the original signature; the shelling encrypts and packages the program code of the software to invalidate the original signature.
  • a sandbox technology (also known as sandbox) is used to detect malware.
  • the sandbox (Sandbox) is a software isolation mechanism. Its purpose is to limit the permissions of untrusted software.
  • Sandbox technology often Used to execute untested or untrusted software.
  • sandbox technology aims to protect the original state of the operating system by providing virtualized disks, memory, and network resources for untrusted software.
  • all files and registry entries created, modified, and deleted by untrusted software running in the sandbox are virtualized and redirected to the virtual operating system. Therefore, all untrusted software The operations are virtual, the real file system and registry are not changed, which ensures that malware carrying the virus cannot make changes to key parts of the operating system and damage the operating system.
  • the specific working principle of using sandbox technology to detect malware is to simulate a completely normal environment for untrusted software to run in it, and to record all actions of untrusted files during execution. Match these actions with the malicious behavior library, and if there is a match to malicious behavior, the untrusted software can be considered as malware. Since the method can directly run the malware in the sandbox, the malware can be prevented from evading detection by means of deformation and shelling, thereby improving the accuracy of detecting the malware. Compared with the traditional detection methods, the method of using sandbox to detect malware has greatly improved the detection ability. And because it uses a common malicious behavior library as a matching method, it can avoid the problem that the cardinality of the same type of malicious sample is too large.
  • the embodiment of the invention provides a method and a device for detecting malware, which are used to solve the defects of low accuracy in the prior art.
  • a method of detecting malware comprising:
  • the first delay length parameter of the interface to be invoked is adjusted to a second delay length parameter, The delay time corresponding to the second delay length parameter is less than the preset duration;
  • Comparing the recorded at least one operation with the operation of the malicious behavior determining that the software to be detected is malware based on a comparison result of the operation of the at least one operation that matches the operation of the malicious behavior .
  • the first delay length parameter of the interface to be invoked is adjusted to a second delay length parameter, which specifically includes:
  • the first delay length parameter of the interface to be called is adjusted to be a product of the first delay length parameter and a preset adjustment parameter, and the adjustment parameter is greater than 0 and less than 1.
  • the preset adjustment parameter includes a first adjustment parameter and a second adjustment parameter, where the first adjustment parameter is greater than Second adjustment parameter;
  • the first delay length parameter of the interface to be invoked is adjusted to the second delay length parameter, and specifically includes:
  • the first delay length parameter of the called interface to be the first delay length parameter and the The product of the first adjustment parameter
  • the first delay length parameter of the interface to be invoked is adjusted to a second delay length parameter, which specifically includes:
  • the delay duration corresponding to the third delay length parameter is smaller than the delay duration corresponding to the second delay length parameter.
  • the method further includes:
  • the interface includes at least one interface or a combination of multiple interfaces:
  • an apparatus for detecting malware including:
  • a running unit for running the software to be tested in a sandbox
  • a recording unit configured to record at least one operation performed by the software to be detected within a preset duration after starting the running
  • a detecting unit configured to detect, during the recording of the at least one operation, whether at least one interface with a delay attribute in the sandbox is called;
  • a determining unit configured to determine, when the interface is called, whether the delay duration corresponding to the first delay length parameter of the called interface is greater than the preset duration
  • an adjusting unit configured to: if the delay duration corresponding to the first delay length parameter is greater than the preset duration, adjust the first delay length parameter of the called interface to a second delay length a parameter, the delay time corresponding to the second delay length parameter is less than the preset duration;
  • a comparing unit configured to compare the recorded at least one operation with the operation of the malicious behavior, and determine the waiting to be based on a comparison result of the operation of the at least one operation that matches the operation of the malicious behavior
  • the detection software is malware.
  • the adjusting unit is specifically configured to:
  • Adjusting the first delay length parameter of the interface to be called to the first delay length The product of the parameter and a preset adjustment parameter that is greater than zero and less than one.
  • the preset adjustment parameter includes a first adjustment parameter and a second adjustment parameter, where the first adjustment parameter is greater than Second adjustment parameter;
  • the adjusting unit adjusts the first delay length parameter of the called interface to the second delay length parameter, specifically:
  • the first delay length parameter of the called interface to be the first delay length parameter and the The product of the first adjustment parameter
  • the adjusting unit is specifically configured to:
  • the delay duration corresponding to the third delay length parameter is smaller than the delay duration corresponding to the second delay length parameter.
  • the comparing unit is further configured to:
  • a sending unit configured to send a software running end message to the sandbox based on a comparison result of the operation of the at least one operation that does not match the operation of the malicious behavior
  • the recording unit is further configured to: record the software to be detected at the predetermined time to the preset At least one operation performed during a time period between arrivals;
  • the comparing unit is further configured to compare the at least one operation performed by the recorded software to be detected in a time period between the predetermined time and the arrival of the preset time period, and the operation of the malicious behavior, Determining, according to the recorded comparison result of the operation of the to-be-detected software that is performed in the period between the predetermined time and the arrival of the preset duration, determining an operation that matches the operation of the malicious behavior, determining The software to be detected is malware.
  • the interface detected by the detecting unit includes at least one interface or a combination of multiple interfaces :
  • the detection accuracy is low by delaying the detection of the malicious operation, and the detection accuracy is low.
  • the software to be detected is run in the sandbox, and the preset duration of the software to be detected after starting the operation is recorded.
  • At least one operation performed within the process during the recording of at least one operation, detecting whether at least one interface having a delay attribute in the sandbox is called; determining that the interface is called when any interface is detected is called Whether the delay duration corresponding to the delay length parameter is greater than the preset duration; if it is determined that the delay duration corresponding to the first delay length parameter is greater than the preset duration, the first delay length parameter of the called interface is adjusted to the first a delay length parameter, wherein the delay duration corresponding to the second delay length parameter is less than a preset duration; comparing the at least one recorded operation with the operation of the malicious behavior, based on the existence and malicious behavior of the at least one recorded operation Comparing the results of the operations that match the operations, determining that the software to be detected is malware, in which at least one operation is recorded When it is detected that any interface with a delay attribute in the sandbox is called, and when the delay time corresponding to the first delay length parameter is greater than the preset duration, the malicious behavior is considered to be delayed, and the
  • the delay time of execution is such that the malicious behavior is performed in the process of recording at least one operation performed within a preset period of time after the software to be detected starts running, and the malicious behavior can be exposed in advance, and effective monitoring can be realized, thereby improving detection.
  • the accuracy of the malware is such that the malicious behavior is performed in the process of recording at least one operation performed within a preset period of time after the software to be detected starts running, and the malicious behavior can be exposed in advance, and effective monitoring can be realized, thereby improving detection.
  • FIG. 1A is a flowchart of detecting malware according to an embodiment of the present invention
  • FIG. 1B is a schematic diagram of detecting malware according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of a first structure of an apparatus for detecting malware according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram of a second structure of an apparatus for detecting malware according to an embodiment of the present invention.
  • system and “network” are used interchangeably herein.
  • the term “and/or” in this context is merely an association describing the associated object, indicating that there may be three relationships, for example, A and / or B, which may indicate that A exists separately, and both A and B exist, respectively. B these three situations.
  • the letter “/” in this article generally indicates that the contextual object is an "or" relationship.
  • FIG. 1A a schematic diagram of a process for detecting malware is provided:
  • Step 100 Run the software to be detected in a sandbox, and record at least one operation performed within a preset duration after the software to be detected starts running;
  • Step 110 In the process of recording at least one operation, detecting whether at least one interface with a delay attribute in the sandbox is called;
  • Step 120 When it is detected that any interface is called, it is determined whether the delay duration corresponding to the first delay length parameter of the invoked interface is greater than a preset duration;
  • Step 130 If it is determined that the delay duration corresponding to the first delay length parameter is greater than the preset duration, the first delay length parameter of the invoked interface is adjusted to the second delay length parameter, and the second delay length parameter corresponds to The delay time is less than the preset duration;
  • Step 140 Comparing the recorded at least one operation with the operation of the malicious behavior, based on the comparison result of the operation of the at least one operation that matches the operation of the malicious behavior,
  • the software to be tested is malware.
  • the interface in the embodiment of the present invention is a programming interface provided by the operating system to a third-party application software developer other than the operating system provider and the user, and the application software can implement the specific function provided by the interface by calling the interface, and
  • the physical interfaces described in the actual application are different, such as different from the Ethernet interface.
  • the interface has a delay attribute.
  • the application software invokes the interface, and some operations performed by the application software are delayed.
  • the length of the delay may be based on the delay time corresponding to the delay length parameter of the interface. determine.
  • the interface with the delay attribute can be in the form of, for example:
  • any interface with a delay attribute is invoked as an example of the above interface, some operations of the application software will be delayed, and the delay time is the first delay of the called interface with the delay attribute.
  • the delay length corresponding to the time length parameter, and the starting time of the delayed execution is the time point at which the software to be detected starts to run.
  • the interface for obtaining time can be in the following form:
  • the above-listed interfaces with delay attributes are pre-supplied functions in the Windows operating system. These interfaces are largely related to the operating system, that is, Linux systems or other operating systems may provide other delays.
  • the interface of the attribute although these APIs (Application Programming Interface) differ in the form of naming, parameter format, etc., but the functions implemented are mostly similar. Due to the variety of operating systems and different versions of an operating system, it is difficult to enumerate all the interfaces with delay attributes. Only some interfaces with delay attributes commonly found in Windows operating systems are used as examples. .
  • the malware invokes these interfaces with delay attributes for delay, the malware will begin to perform malicious behavior when a certain time point determined according to the first delay length parameter of the interface is reached.
  • the first delay length parameter of the called interface is adjusted to the product of the first delay length parameter and the preset adjustment parameter, and the adjustment parameter is greater than 0 and less than or equal to 1.
  • the first delay length parameter is modified according to the magnification g_uiRate. If the first delay length parameter is 100, the first delay length parameter is modified to 100*g_uiRate.
  • the operating system time needs to be matched with the time delay of using the interface with the delay attribute, thereby preventing the malware from detecting that the first delay length parameter of the interface having the delay attribute has been modified.
  • the time-acquisition interface described above synchronously modifies the time of the operating system acquired by the malware. Specifically, if the current operating system time is 100, the return value of the interface needs to be obtained when the malware invokes the time-obtaining interface. Modify the call result to 100/g_uiRate.
  • the evasive means of malware delay bursts generally need to be implemented by calling an interface with a delay attribute, so that even if the malware invokes an interface with a delay attribute,
  • the delay length parameter is adjusted to the second delay length parameter, and the delay duration corresponding to the second delay length parameter is less than the preset duration, so that the malicious behavior will still be Exposure within a preset length of time increases the accuracy of the test.
  • the preset adjustment parameter includes a first adjustment parameter and a second adjustment parameter, where the first adjustment parameter is greater than the second adjustment parameter.
  • the following operations may be used:
  • the first delay length parameter of the called interface is adjusted to the product of the first delay length parameter and the first adjustment parameter, that is, the second delay, based on the comparison result that the usage rate is greater than or equal to the preset usage threshold.
  • the time length parameter is a product of the first delay length parameter and the first adjustment parameter;
  • the first delay length parameter of the called interface is adjusted to the product of the first delay length parameter and the second adjustment parameter, that is, the second delay time length, based on the comparison result that the usage rate is less than the preset usage threshold value.
  • the parameter is the product of the first delay length parameter and the second adjustment parameter;
  • the first adjustment parameter is greater than the second adjustment parameter.
  • the delay duration corresponding to the third delay length parameter is smaller than the delay duration corresponding to the second delay length parameter.
  • the usage rate of the central processing unit of the device where the sandbox is located when the usage rate of the central processing unit of the device where the sandbox is located is obtained, the usage rate of the central processing unit can be obtained by using the Nt Query System Information interface.
  • the Nt Query System Information interface Of course, other methods may also be used. No more detailed one by one.
  • the delay time corresponding to the adjusted delay length parameter is increased, thereby reducing the sandbox transport.
  • the delay time corresponding to the adjusted delay length parameter is reduced, so that the software to be detected is The behavior is accelerated, which in turn increases the use of the central processor by the sandbox operation.
  • Comparing at least one operation performed by the recorded software to be detected in a time period between a predetermined time and a preset time period is compared with the operation of the malicious behavior, based on the recorded software to be detected arriving at a predetermined time to a preset time
  • the software to be detected is determined to be malware.
  • the preset duration is 5 minutes, but when the software to be detected has been running for 4 minutes and 50 seconds in the sandbox, when there is no operation corresponding to the operation of the malicious behavior in at least one of the recorded operations, the sandbox is sent to the sandbox.
  • the software runs the end message. At this time, at least one operation performed in the time period between 4 minutes and 50 seconds to 5 minutes of arrival of the software to be detected is recorded, and the software to be detected is reached between 4 minutes and 50 seconds to 5 minutes.
  • At least one operation performed in the time period is compared with the operation of the malicious behavior, and if the software to be detected has an operation matching the malicious behavior in at least one operation performed within a time period between 4 minutes and 50 seconds to 5 minutes , to determine that the software to be detected is malware. In this way, it is also possible to force malicious samples to expose malicious behavior.
  • the interface is an interface that delays one process, an interface that delays multiple processes, an interface of a delay timer, an interface in an interface that acquires system time, or any combination of interfaces.
  • the operation that matches the operation of the malicious behavior in the at least one operation that has been recorded refers to the existence of the behavior sequence (for example, the API call sequence) corresponding to each of the at least one operation recorded.
  • Sequence of actions corresponding to actions of malicious behavior eg API calls
  • the sequence is the same operation, or the operation sequence corresponding to the operation of the malicious behavior is the same in each of the at least one operation of the recorded at least one operation.
  • the interface having the delay attribute may be in the API layer or in the NTAPI layer. If the interface is located in the API layer, when the first delay length parameter of the interface is adjusted, the driver layer may also be used. You can not pass the driver layer; if the interface is in the NTAPI layer, you must pass the driver layer when adjusting the first delay length parameter of the interface.
  • the operation performed by the software to be detected within the preset duration after the start of the operation may be a network operation. At this time, it may be implemented by network monitoring or a file operation. At this time, it may be implemented by file monitoring, or may be a registry operation. It can be implemented through registry monitoring. Some operations cannot be implemented through the above monitoring. Therefore, it can be implemented by system monitoring, as shown in Figure 1B.
  • FIG. 2 In order to better understand the embodiments of the present invention, a specific application scenario is given below, and a process for detecting malware is further described in detail, as shown in FIG. 2:
  • Step 200 Run the software to be detected in a sandbox, and record at least one operation performed by the software to be detected within 5 minutes after starting the operation;
  • Step 210 In the process of recording at least one operation, detecting whether at least one interface with a delay attribute in the sandbox is called;
  • Step 220 When it is detected that any one of the interfaces having the delay attribute is called, determine whether the delay duration corresponding to the first delay length parameter of the called interface is greater than 5 minutes. If yes, go to step 230; otherwise, return to step 210. ;
  • Step 230 Adjust the first delay length parameter of the called interface to a second delay length parameter, and the delay time corresponding to the second delay length parameter is less than 5 minutes;
  • Step 240 When the software to be detected runs for 4 minutes and 50 seconds, determine whether there is an operation that matches the operation of the malicious behavior in at least one operation that has been recorded within 4 minutes and 50 seconds, and if yes, determine that the software to be detected is malware. Otherwise, step 250 is performed;
  • Step 250 Send a software operation end message to the sandbox, and record at least one operation performed by the software to be detected during a time period between 4 minutes and 50 seconds to 5 minutes;
  • Step 260 Comparing at least one operation performed by the recorded software to be detected in a period of time between 4 minutes and 50 seconds to 5 minutes of operation is compared with the operation of the malicious behavior;
  • Step 270 Determine whether there is any operation related to the malicious behavior in the at least one operation performed in the time period between the time when the recorded software to be detected runs for 4 minutes and 50 seconds until the time when the operation reaches 5 minutes.
  • the matching operation if yes, determines that the software to be detected is malware, otherwise, determines that the software to be detected is non-malware.
  • the software to be detected is run in a sandbox, and at least one operation performed within a preset time period after the software to be detected is started is recorded; in the process of recording at least one operation, the sand is detected.
  • At least one interface having a delay attribute is called in the box; when detecting that any interface is called, determining whether the delay duration corresponding to the first delay length parameter of the called interface is greater than a preset duration; The delay length corresponding to the first delay length parameter is greater than the preset duration, and the first delay length parameter of the invoked interface is adjusted to the second delay length parameter, and the delay duration corresponding to the second delay length parameter is less than Presetting the duration; comparing the at least one recorded operation with the operation of the malicious behavior, determining that the software to be detected is malware based on a comparison result of the operation of the at least one operation that matches the operation of the malicious behavior
  • detecting that any interface with a delay attribute in the sandbox is called, and When the delay time corresponding to the first delay length parameter is greater than the preset duration, the malicious behavior is considered to be delayed.
  • the delay duration of the delay execution is shortened, so that the malicious behavior is preset after the recording of the software to be detected starts running.
  • the execution of at least one operation performed within the duration the malicious behavior can be exposed in advance, and effective monitoring can be achieved, thereby improving the accuracy of detecting malware.
  • the device 3000 for detecting malware includes an operation unit 30, a recording unit 31, a detecting unit 32, and a determining unit, as shown in FIG. 33.
  • An adjustment unit 34 and a comparison unit 35 wherein:
  • the operating unit 30 is configured to run the software to be detected in the sandbox
  • the recording unit 31 is configured to record at least one operation performed by the software to be detected within a preset duration after starting the operation;
  • the detecting unit 32 is configured to detect, during the recording of the at least one operation, whether at least one interface with a delay attribute in the sandbox is called;
  • the determining unit 33 is configured to determine, when the interface is called, whether the delay duration corresponding to the first delay length parameter of the invoked interface is greater than a preset duration;
  • the adjusting unit 34 is configured to: if it is determined that the delay duration corresponding to the first delay length parameter is greater than the preset duration, adjust the first delay length parameter of the invoked interface to the second delay length parameter, and the second delay length The delay time corresponding to the parameter is less than the preset duration;
  • the comparing unit 35 is configured to compare the at least one recorded operation with the operation of the malicious behavior, and determine that the software to be detected is malware based on a comparison result of the operation of the at least one operation that matches the operation of the malicious behavior .
  • the adjusting unit 34 is specifically configured to:
  • the first delay length parameter of the called interface is adjusted to the product of the first delay length parameter and the preset adjustment parameter, and the adjustment parameter is greater than 0 and less than 1.
  • the preset adjustment parameter includes a first adjustment parameter and a second adjustment parameter, where the first adjustment parameter is greater than the second adjustment parameter;
  • the adjusting unit 34 adjusts the first delay length parameter of the called interface to the second delay length parameter, specifically:
  • the first delay length parameter of the called interface is adjusted to the product of the first delay length parameter and the second adjustment parameter based on the comparison result that the usage rate is less than the preset usage threshold.
  • the adjusting unit 34 is specifically configured to:
  • the delay duration corresponding to the third delay length parameter is smaller than the delay duration corresponding to the second delay length parameter.
  • the comparing unit 35 is further configured to:
  • the recording unit 31 is further configured to: record at least one operation performed by the software to be detected in a period between a predetermined time and a preset time period;
  • the comparing unit 35 is further configured to: compare the at least one operation performed by the recorded software to be detected in a time period between the scheduled time and the arrival of the preset time period, and the operation of the malicious behavior, based on the recorded software to be detected. There is a comparison result of the operation matching the operation of the malicious behavior in at least one operation performed in the time period between the arrival of the preset time and the determination of the software to be detected as malware.
  • the device for detecting malware provided in the embodiment of the device may be a device in which the sandbox is located in the method embodiment, or a functional module in the device, and the device may be integrated in a network device such as a firewall or a gateway device, and may also be integrated in the network device.
  • a network device such as a firewall or a gateway device, and may also be integrated in the network device.
  • a file server or web server for other additional functions that can be implemented by the device for detecting malware, please refer to the description in the method embodiment, and details are not described herein again.
  • the device for detecting malware runs the software to be detected in a sandbox, and records at least one operation performed within a preset time period after the software to be detected starts running; in the process of recording at least one operation, detecting the sand Whether at least one interface having a delay attribute is called in the box; when detecting that any interface is called, determining whether the delay duration corresponding to the first delay length parameter of the called interface is greater than a preset duration; The delay length corresponding to the first delay length parameter is greater than the preset duration, and the first delay length parameter of the invoked interface is adjusted to the second delay length parameter, and the delay duration corresponding to the second delay length parameter is less than The preset duration; comparing the at least one recorded operation with the operation of the malicious behavior, determining that the software to be detected is malware based on a comparison result of the operation of the at least one operation that matches the operation of the malicious behavior.
  • the device shortens the delay duration of the delay execution by being invoked on the interface having the delay attribute, and the malicious behavior is performed in the process of recording at least one operation performed within a preset time period after the software to be detected starts running, then the malicious Behavior can be exposed in advance and can be effectively monitored, thus improving the efficiency and accuracy of detecting malware.
  • FIG. 4 another schematic structural diagram of an apparatus 3000 for detecting malware according to an embodiment of the present invention includes at least one processor 401, a communication bus 402, a memory 403, and at least one communication interface 404.
  • the communication bus 402 is used to implement the connection and communication between the above components, and the communication interface 404 Used to connect and communicate with external devices.
  • the memory 403 is configured to store executable program code, and the processor 401 executes the program code for:
  • the first delay length parameter of the invoked interface is adjusted to the second delay length parameter, and the delay corresponding to the second delay length parameter The duration is less than the preset duration
  • the at least one operation that has been recorded is compared with the operation of the malicious behavior, and the software to be detected is determined to be malware based on a comparison result of the operation of the at least one operation that matches the operation of the malicious behavior.
  • the processor 401 is further configured to:
  • the first delay length parameter of the called interface is adjusted to the product of the first delay length parameter and the preset adjustment parameter, and the adjustment parameter is greater than 0 and less than 1.
  • the preset adjustment parameter includes a first adjustment parameter and a second adjustment parameter, where the first adjustment parameter is greater than the second adjustment parameter;
  • the processor 401 is further configured to:
  • the first delay length parameter of the called interface is adjusted to the product of the first delay length parameter and the second adjustment parameter based on the comparison result that the usage rate is less than the preset usage threshold.
  • the processor 401 is further configured to:
  • the delay duration corresponding to the third delay length parameter is smaller than the delay duration corresponding to the second delay length parameter.
  • the processor 401 is further configured to:
  • Comparing at least one operation performed by the recorded software to be detected in a time period between a predetermined time and a preset time period is compared with the operation of the malicious behavior, based on the recorded software to be detected arriving at a predetermined time to a preset time
  • the software to be detected is determined to be malware.
  • the interface includes at least one interface or a combination of multiple interfaces:
  • the device for detecting the malware provided in the embodiment of the device may be the device where the sandbox is located in the method embodiment, and the device may be a network device such as a firewall or a gateway device, or may be a file server or a web server.
  • a network device such as a firewall or a gateway device, or may be a file server or a web server.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus functions in one or more blocks of a flow or a flow diagram and/or block diagram of a flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions in one or more blocks of the flowchart or in a flow or block of the flowchart.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Virology (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Debugging And Monitoring (AREA)
  • Storage Device Security (AREA)

Abstract

一种检测恶意软件的方法及装置，该方法包括：在沙箱中运行待检测软件并记录至少一个操作的过程；在记录所述至少一个操作的过程中，检测到沙箱中的任意一个具有延时属性的接口被调用时，判断被调用的接口的第一延时长度参数对应的延时时长是否大于预设时长，如果大于预设时长，则认为恶意行为要延迟执行，此时，缩短延迟执行的延时时长，使恶意行为在记录所述待检测软件在开始运行后预设时长内执行的至少一个操作的过程中执行，那么恶意行为就可以提前暴露，从而实现有效监控，提高检测恶意软件的准确度。

Description

检测恶意软件的方法及装置
本申请要求于2014年11月20日提交中国专利局、申请号为201410667648.4、发明名称为“检测恶意软件的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及计算机技术领域，特别涉及一种检测恶意软件的方法及装置。
背景技术
计算机软件(Software)是指一系列按照特定顺序组织的计算机数据和指令的集合。从计算机软件诞生不久，恶意软件就出现了。合法软件的开发目的，是加强和扩展计算机的工作能力。而恶意软件的开发目的，则是为了对计算机数据进行窃取和破坏。传统的恶意软件的检测方法，是基于特征码的比对来实现，但是，恶意软件常常通过变形、加壳等手段逃避特征码对比，其中，变形，是指在软件的程序代码中加入大量混淆代码，令原有的特征码失效；加壳，是将软件的程序代码进行加密和打包，令原有的特征码失效。
为了避免上述缺陷，提出了采用沙箱技术检测恶意软件的方法，沙箱(也称沙盒，Sandbox)是一种软件的隔离运行机制，其目的是限制不可信软件的权限，沙箱技术经常被用于执行未经测试的或不可信的软件。为了避免不可信软件可能破坏其他软件的运行，沙箱技术通过采用为不可信软件提供虚拟化的磁盘、内存以及网络资源的方式来达到保护操作系统的原有状态的目的。沙箱技术在具体实现过程中，不可信软件在沙箱内运行时所创建、修改、删除的所有文件和注册表表项都虚拟化重定向到虚拟的操作系统，因此，不可信软件的所有操作都是虚拟的，真实的文件系统和注册表不会被改动，这样可以确保携带病毒的恶意软件无法对操作系统关键部位进行改动，破坏操作系统。
采用沙箱技术检测恶意软件的具体的工作原理，是模拟出一个完全正常的环境，供不可信软件在其中运行，并记录不可信文件在执行时的所有动作。 将这些动作和恶意行为库进行匹配，如果有匹配到恶意行为，则可以认为该不可信软件是恶意软件。由于该方法能直接让恶意软件在沙箱中运行起来，所以能避免恶意软件通过变形、加壳等手段躲避检测，因此，可以提高检测恶意软件的准确度。相对于传统的检测方法，利用沙箱检测恶意软件的方法在检测能力上有了极大的提升。又由于它使用了通用的恶意行为库作为匹配方式，所以可以避免相同类型恶意样本基数过大的问题。
但是，在实际应用中，由于硬件资源和软件规格的限制，过长时间的监控是不现实的，沙箱一般只能监控不可信软件开始运行后数分钟之内的行为。恶意软件利用该限制，在恶意行为爆发前加入延时操作，例如，加入长时间的Sleep语句，此语句可以让软件运行过程中的某些操作延后几十分钟甚至数小时，从而躲避检测，因此，目前检测恶意软件的方法存在准确度较低的缺陷。
发明内容
本发明实施例提供一种检测恶意软件的方法及装置，用以解决现有技术中存在的准确度较低的缺陷。
本发明实施例提供的具体技术方案如下：
第一方面，提供一种检测恶意软件的方法，包括：
在沙箱中运行待检测软件，并记录所述待检测软件在开始运行后预设时长内执行的至少一个操作；
在记录所述至少一个操作的过程中，检测所述沙箱中的至少一个具有延时属性的接口是否被调用；
在检测到任意一所述接口被调用时，判断被调用的所述接口的第一延时长度参数对应的延时时长是否大于所述预设时长；
若判定所述第一延时长度参数对应的延时时长大于所述预设时长，则将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数，所述第二延时长度参数对应的延时时长小于所述预设时长；
将已记录的所述至少一个操作与恶意行为的操作进行比较，基于已记录的所述至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定所述待检测软件为恶意软件。
结合第一方面，在第一种可能的实现方式中，将被调用的所述接口的第一延时长度参数调整为第二延时长度参数，具体包括：
将被调用的所述接口的所述第一延时长度参数调整为所述第一延时长度参数和预设的调整参数的乘积，所述调整参数大于0且小于1。
结合第一方面的第一种可能的实现方式，在第二种可能的实现方式中，所述预设的调整参数包括第一调整参数和第二调整参数，所述第一调整参数大于所述第二调整参数；
所述将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数，具体包括：
获取所述沙箱所在设备的中央处理器的使用率；
将获取的使用率与预设使用率门限值进行比较；
基于所述使用率大于或者等于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为所述第一延时长度参数与所述第一调整参数的乘积；或者
基于所述使用率小于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为所述第一延时长度参数与所述第二调整参数的乘积。
结合第一方面，在第三种可能的实现方式中，所述将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数，具体包括：
获取所述沙箱所在设备的中央处理器的使用率；
将获取的使用率与预设使用率门限值进行比较；
基于所述使用率大于或者等于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数；或者
基于所述使用率小于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为第三延时长度参数；
其中，所述第三延时长度参数对应的延时时长小于所述第二延时长度参数对应的延时时长。
结合第一方面，以及第一方面的第一种至第三种可能的实现方式，在第四种可能的实现方式中，还包括：
在所述预设时长到达前的预定时刻，将已记录的所述至少一个操作与恶 意行为的操作进行比较；
基于已记录的所述至少一个操作中不存在与恶意行为的操作相匹配的操作的比较结果，向所述沙箱发送软件运行结束消息；
记录所述待检测软件在所述预定时刻至所述预设时长到达之间的时间段内执行的至少一个操作；
将已记录的所述待检测软件在所述预定时刻至所述预设时长到达之间的时间段内执行的所述至少一个操作与恶意行为的操作进行比较，基于已记录的所述待检测软件在所述预定时刻至所述预设时长到达之间的时间段内执行的所述至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定所述待检测软件为恶意软件。
结合第一方面，以及第一方面的第一种至第四种可能的实现方式，在第五种可能的实现方式中，所述接口包括以下至少一个接口或多个接口的组合：
延时一个进程的接口、延时多个进程的接口、延时定时器的接口、或获取系统时间的接口。
第二方面，提供一种检测恶意软件的装置，包括：
运行单元，用于在沙箱中运行待检测软件；
记录单元，用于记录所述待检测软件在开始运行后预设时长内执行的至少一个操作；
检测单元，用于在记录所述至少一个操作的过程中，检测所述沙箱中的至少一个具有延时属性的接口是否被调用；
判断单元，用于在检测到任意一所述接口被调用时，判断被调用的所述接口的第一延时长度参数对应的延时时长是否大于所述预设时长；
调整单元，用于若判定所述第一延时长度参数对应的延时时长大于所述预设时长，将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数，所述第二延时长度参数对应的延时时长小于所述预设时长；
比较单元，用于将已记录的所述至少一个操作与恶意行为的操作进行比较，基于已记录的所述至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定所述待检测软件为恶意软件。
结合第二方面，在第一种可能的实现方式中，所述调整单元具体用于：
将被调用的所述接口的所述第一延时长度参数调整为所述第一延时长度 参数和预设的调整参数的乘积，所述调整参数大于0且小于1。
结合第二方面的第一种可能的实现方式，在第二种可能的实现方式中，所述预设的调整参数包括第一调整参数和第二调整参数，所述第一调整参数大于所述第二调整参数；
所述调整单元将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数时，具体为：
获取所述沙箱所在设备的中央处理器的使用率；
将获取的使用率与预设使用率门限值进行比较；
基于所述使用率大于或者等于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为所述第一延时长度参数与所述第一调整参数的乘积；或者
基于所述使用率小于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为所述第一延时长度参数与所述第二调整参数的乘积。
结合第二方面，在第三种可能的实现方式中，所述调整单元具体用于：
获取所述沙箱所在设备的中央处理器的使用率；
将获取的使用率与预设使用率门限值进行比较；
基于所述使用率大于或者等于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数；或者
基于所述使用率小于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为第三延时长度参数；
其中，所述第三延时长度参数对应的延时时长小于所述第二延时长度参数对应的延时时长。
结合第二方面，以及第二方面的第一种至第三种可能的实现方式，在第四种可能的实现方式中，所述比较单元还用于：
在所述预设时长到达前的预定时刻，将已记录的所述至少一个操作与恶意行为的操作进行比较；
还包括发送单元，用于基于已记录的所述至少一个操作中不存在与恶意行为的操作相匹配的操作的比较结果，向所述沙箱发送软件运行结束消息；
所述记录单元还用于：记录所述待检测软件在所述预定时刻至所述预设 时长到达之间的时间段内执行的至少一个操作；
所述比较单元还用于：将已记录的所述待检测软件在所述预定时刻至所述预设时长到达之间的时间段内执行的所述至少一个操作与恶意行为的操作进行比较，基于已记录的所述待检测软件在所述预定时刻至所述预设时长到达之间的时间段内执行的所述至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定所述待检测软件为恶意软件。
结合第二方面，以及第二方面的第一种至第四种可能的实现方式，在第五种可能的实现方式中，所述检测单元检测的接口包括以下至少一个接口或多个接口的组合：
延时一个进程的接口、延时多个进程的接口、延时定时器的接口、或获取系统时间的接口。
现有技术中，通过对恶意操作延时进而躲避检测，导致检测的准确度较低，本发明实施例中，在沙箱中运行待检测软件，并记录待检测软件在开始运行后预设时长内执行的至少一个操作；在记录至少一个操作的过程中，检测沙箱中的至少一个具有延时属性的接口是否被调用；在检测到任意一接口被调用时，判断被调用的接口的第一延时长度参数对应的延时时长是否大于预设时长；若判定第一延时长度参数对应的延时时长大于预设时长，则将被调用的接口的第一延时长度参数调整为第二延时长度参数，第二延时长度参数对应的延时时长小于预设时长；将已记录的至少一个操作与恶意行为的操作进行比较，基于已记录的至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定待检测软件为恶意软件，在该方案中，在记录至少一个操作的过程中，检测到沙箱中的任意一个具有延时属性的接口被调用，及判定第一延时长度参数对应的延时时长大于预设时长时，认为恶意行为要延迟执行，此时，缩短延迟执行的延时时长，让恶意行为在记录待检测软件在开始运行后预设时长内执行的至少一个操作的过程中执行，那么恶意行为就可以提前暴露，可以实现有效监控，因此，可以提高检测恶意软件的准确度。
附图说明
图1A为本发明实施例中检测恶意软件的流程图；
图1B为本发明实施例中检测恶意软件的示意图；
图2为本发明实施例中检测恶意软件的实施例；
图3为本发明实施例中检测恶意软件的装置的第一结构示意图；
图4为本发明实施例中检测恶意软件的装置的第二结构示意图。
具体实施方式
为使本发明实施例的目的、技术方案和优点更加清楚，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
另外，本文中术语“系统”和“网络”在本文中常被可互换使用。本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字母“/”，一般表示前后关联对象是一种“或”的关系。
下面结合说明书附图对本发明优选的实施方式进行详细说明，应当理解，此处所描述的优选实施例仅用于说明和解释本发明，并不用于限定本发明，并且在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
下面结合附图对本发明优选的实施方式进行详细说明。
参阅图1A所示，本发明实施例中，提供一种检测恶意软件的流程示意图：
步骤100：在沙箱中运行待检测软件，并记录待检测软件在开始运行后预设时长内执行的至少一个操作；
步骤110：在记录至少一个操作的过程中，检测沙箱中的至少一个具有延时属性的接口是否被调用；
步骤120：在检测到任意一接口被调用时，判断被调用的接口的第一延时长度参数对应的延时时长是否大于预设时长；
步骤130：若判定第一延时长度参数对应的延时时长大于预设时长，则将被调用的接口的第一延时长度参数调整为第二延时长度参数，第二延时长度参数对应的延时时长小于预设时长；
步骤140：将已记录的至少一个操作与恶意行为的操作进行比较，基于已记录的至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确 定待检测软件为恶意软件。
本发明实施例中所说的接口是操作系统向除操作系统提供商和用户之外的第三方应用软件开发者提供的编程接口，应用软件可以通过调用该接口实现该接口提供的特定功能，与实际应用中讲述的物理接口是不同的，如与以太网接口是不同的。
接口具有延时属性指的是，应用软件通过调用该接口，该应用软件所执行的一些操作将被延迟执行，具体要延迟的时间长度可以根据该接口的延时长度参数对应的延时时长来确定。
实际中，具有延时属性的接口可以为如下形式，例如：
Figure PCTCN2015077213-appb-000001
本发明实施例中，如果调用以上述接口为例的任意一具有延时属性的接口，应用软件有些操作将被延迟执行，延迟执行的时长为被调用的具有延时属性的接口的第一延时长度参数对应的延时时长，而延迟执行的时间起始点为待检测软件开始运行的时间点。
本发明实施例中，还存在一类获取时间的接口。这类接口是与上述具有延时属性的接口存在关系的，获取时间的接口可以为如下形式：
Figure PCTCN2015077213-appb-000002
Figure PCTCN2015077213-appb-000003
上述列举的具有延时属性的接口是Windows操作系统中预先提供的一些函数，这些接口很大程度上是与操作系统相关的，也就是说，Linux系统或者其他操作系统也可能提供其他具有延时属性的接口，虽然这些API(Application Programming Interface，应用程序编程接口)在命名、参数格式等形式上有所差异，但实现的功能大多类似。由于操作系统种类较多，同时一个操作系统的不同版本也有所差异，难以在这里列举所有具有延时属性的接口，仅以Windows操作系统中常见的一些具有延时属性的接口为例来进行说明。
如果是恶意软件调用这些具有延时属性的接口进行延时，当达到根据该接口的第一延时长度参数确定的某个时间点时，恶意软件将开始执行恶意行为。
本发明实施例中，将被调用的接口中的第一延时长度参数调整为第二延时长度参数的方式有多种，例如，可以采用如下方式：
将被调用的接口的第一延时长度参数调整为第一延时长度参数和预设的调整参数的乘积，调整参数大于0且小于等于1。
例如，对于具有延时属性的接口，按照倍率g_uiRate修改第一延时长度参数，如果第一延时长度参数为100，则将第一延时长度参数修改为100*g_uiRate。可选地，如果需要将操作系统时间和采用具有延时属性的接口延时后的时间相匹配，从而避免恶意软件发觉具有延时属性的接口的第一延时长度参数已经被修改，可以通过上述介绍的获取时间的接口同步地修改恶意软件获取的操作系统的时间，具体地，如果当前的操作系统时间为100，则需要在恶意软件调用获取时间的接口时，通过这类接口的返回值将调用结果修改为100/g_uiRate。
实际应用中，恶意软件延时爆发的躲避手段，一般都需要通过调用具有延时属性的接口来实现，这样，即使恶意软件调用了具有延时属性的接口，但是，由于将该接口中的第一延时长度参数调整为第二延时长度参数，而第二延时长度参数对应的延时时长又小于预设时长，这样，恶意行为还是会在 预设时长内暴露，提高了检测的准确度。
本发明实施例中，可选的，预设的调整参数包括第一调整参数和第二调整参数，第一调整参数大于第二调整参数。
进一步的，为了避免为了检测恶意软件而影响沙箱所在设备中的其他进程，将被调用的接口的第一延时长度参数调整为第二延时长度参数时，具体可以采用如下操作：
获取沙箱所在设备的中央处理器的使用率；
将获取的使用率与预设使用率门限值进行比较；
基于使用率大于或者等于预设使用率门限值的比较结果，将被调用的接口的第一延时长度参数调整为第一延时长度参数与第一调整参数的乘积，即第二延时时间长度参数为第一延时长度参数与第一调整参数的乘积；
基于使用率小于预设使用率门限值的比较结果，将被调用的接口的第一延时长度参数调整为第一延时长度参数与第二调整参数的乘积，即第二延时时间长度参数为第一延时长度参数与第二调整参数的乘积；
其中，第一调整参数大于第二调整参数。
本发明实施例中，将被调用的接口的第一延时长度参数调整为第二延时长度参数时，还可以采用如下方式：
获取沙箱所在设备的中央处理器的使用率；
将获取的使用率与预设使用率门限值进行比较；
基于使用率大于或者等于预设使用率门限值的比较结果，将被调用的接口的第一延时长度参数调整为第二延时长度参数；或者
基于使用率小于预设使用率门限值的比较结果，将被调用的接口的第一延时长度参数调整为第三延时长度参数；
其中，第三延时长度参数对应的延时时长小于第二延时长度参数对应的延时时长。
本发明实施例中，在上述过程中，获取沙箱所在设备的中央处理器的使用率时，可以Nt Query System Information接口来获取中央处理器的使用率，当然，也可以采用其他方法，在此不再进行一一详述。
上述过程中，当使用率大于或者等于预设使用率门限值时，判断出系统繁忙，此时，增加调整后的延时长度参数对应的延时时长，进而降低沙箱运 行对中央处理器的使用率，当使用率小于预设使用率门限值时，判断出系统不繁忙，此时，减小调整后的延时长度参数对应的延时时长，使待检测软件的行为加快暴露，进而提升沙箱运行对中央处理器的使用率。
在实际应用中，有些恶意行为是在延迟一定时长后执行，此时，可以通过调整具有延时属性的接口的第一延时长度参数而检测待检测软件是否为恶意软件，但是，有些恶意行为是在运行结束时才执行，不需要调用具有延时属性的接口，因此，本发明实施例中，还可以包括如下操作：
在预设时长到达前的预定时刻，将已记录的至少一个操作与恶意行为的操作进行比较；
基于已记录的至少一个操作中不存在与恶意行为的操作相匹配的操作的比较结果，向沙箱发送软件运行结束消息；
记录待检测软件在预定时刻至预设时长到达之间的时间段内执行的至少一个操作；
将已记录的待检测软件在预定时刻至预设时长到达之间的时间段内执行的至少一个操作与恶意行为的操作进行比较，基于已记录的待检测软件在预定时刻至预设时长到达之间的时间段内执行的至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定待检测软件为恶意软件。
例如，预设时长为5分钟，但是在待检测软件在沙箱中已经运行4分50秒时，已记录的至少一个操作中不存在与恶意行为的操作相匹配的操作时，向沙箱发送软件运行结束消息，此时，再记录待检测软件在4分50秒至5分钟到达之间的时间段内执行的至少一个操作，将待检测软件在4分50秒至5分钟到达之间的时间段内执行的至少一个操作与恶意行为的操作进行比较，若待检测软件在4分50秒至5分钟到达之间的时间段内执行的至少一个操作中存在与恶意行为相匹配的操作时，确定待检测软件为恶意软件。这样，同样可以达到迫使恶意样本暴露出恶意行为的目的。
本发明实施例中，接口为延时一个进程的接口、延时多个进程的接口、延时定时器的接口、获取系统时间的接口中的一个接口或者任意接口组合。
本发明实施例中，已记录的至少一个操作中存在与恶意行为的操作相匹配的操作，是指已记录的至少一个操作中每一个操作分别对应的行为序列(例如API调用序列)中存在与恶意行为的操作对应的行为序列(例如API调用 序列)完全相同的操作，或者，已记录的至少一个操作中每一个操作分别对应的行为序列中存在与恶意行为的操作对应的行为序列部分相同的操作。
本发明实施例中，具有延时属性的接口可以是在API层，也可以是位于NTAPI层，如果接口是位于API层时，调整接口的第一延时长度参数时，可以通过驱动层，也可以不通过驱动层；如果接口是位于NTAPI层时，调整接口的第一延时长度参数时，必须通过驱动层。待检测软件在开始运行后的预设时长内执行的操作可以是网络操作，此时可以通过网络监视实现，也可以是文件操作，此时可以通过文件监视实现，还可以是注册表操作，此时可以通过注册表监视实现，有些操作无法通过上述监视实现的，因此，可以通过系统监视来实现，如图1B所示。
为了更好地理解本发明实施例，以下给出具体应用场景，针对检测恶意软件的过程，作出进一步详细描述，如图2所示：
步骤200：将待检测软件在沙箱内运行，并记录待检测软件在开始运行后的5分钟内所执行的至少一个操作；
步骤210：在记录至少一个操作的过程中，检测沙箱中的至少一个具有延时属性的接口是否被调用；
步骤220：检测到具有延时属性的任意一个接口被调用时，判断被调用的接口的第一延时长度参数对应的延时时长是否大于5分钟，若是，执行步骤230，否则，返回步骤210；
步骤230：将被调用的接口的第一延时长度参数调整为第二延时长度参数，第二延时长度参数对应的延时时长小于5分钟；
步骤240：在待检测软件运行4分50秒时，判断在4分50秒之内已经记录的至少一个操作中是否存在与恶意行为的操作相匹配的操作，若是，确定待检测软件为恶意软件，否则，执行步骤250；
步骤250：向沙箱发送软件运行结束消息，记录待检测软件在运行4分50秒的时刻至5分钟到达之间的时间段内执行的至少一个操作；
步骤260：将已记录的待检测软件在运行4分50秒的时刻至运行5分钟到达之间的时间段内执行的至少一个操作与恶意行为的操作进行比较；
步骤270：判断已记录的待检测软件在运行4分50秒的时刻至运行5分钟到达之间的时间段内执行的至少一个操作中是否存在与恶意行为的操作相 匹配的操作，若是，确定待检测软件为恶意软件，否则，确定待检测软件为非恶意软件。
综上所述，本发明实施例中，在沙箱中运行待检测软件，并记录待检测软件在开始运行后预设时长内执行的至少一个操作；在记录至少一个操作的过程中，检测沙箱中的至少一个具有延时属性的接口是否被调用；在检测到任意一接口被调用时，判断被调用的接口的第一延时长度参数对应的延时时长是否大于预设时长；若判定第一延时长度参数对应的延时时长大于预设时长，则将被调用的接口的第一延时长度参数调整为第二延时长度参数，第二延时长度参数对应的延时时长小于预设时长；将已记录的至少一个操作与恶意行为的操作进行比较，基于已记录的至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定待检测软件为恶意软件，在该方案中，在记录至少一个操作的过程中，检测到沙箱中的任意一个具有延时属性的接口被调用，及判定第一延时长度参数对应的延时时长大于预设时长时，认为恶意行为要延迟执行，此时，缩短延迟执行的延时时长，让恶意行为在记录待检测软件在开始运行后预设时长内执行的至少一个操作的过程中执行，那么恶意行为就可以提前暴露，可以实现有效监控，因此，可以提高检测恶意软件的准确度。
基于上述相应方法的技术方案，参阅图3所示，本发明实施例提供一种检测恶意软件的装置3000，该检测恶意软件的装置3000包括运行单元30、记录单元31、检测单元32、判断单元33、调整单元34、比较单元35，其中：
运行单元30，用于在沙箱中运行待检测软件；
记录单元31，用于记录待检测软件在开始运行后预设时长内执行的至少一个操作；
检测单元32，用于在记录至少一个操作的过程中，检测沙箱中的至少一个具有延时属性的接口是否被调用；
判断单元33，用于在检测到任意一接口被调用时，判断被调用的接口的第一延时长度参数对应的延时时长是否大于预设时长；
调整单元34，用于若判定第一延时长度参数对应的延时时长大于预设时长，将被调用的接口的第一延时长度参数调整为第二延时长度参数，第二延时长度参数对应的延时时长小于预设时长；
比较单元35，用于将已记录的至少一个操作与恶意行为的操作进行比较，基于已记录的至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定待检测软件为恶意软件。
本发明实施例中，可选的，调整单元34具体用于：
将被调用的接口的第一延时长度参数调整为第一延时长度参数和预设的调整参数的乘积，调整参数大于0且小于1。
本发明实施例中，可选的，预设的调整参数包括第一调整参数和第二调整参数，第一调整参数大于第二调整参数；
调整单元34将被调用的接口的第一延时长度参数调整为第二延时长度参数时，具体为：
获取沙箱所在设备的中央处理器的使用率；
将获取的使用率与预设使用率门限值进行比较；
基于使用率大于或者等于预设使用率门限值的比较结果，将被调用的接口的第一延时长度参数调整为第一延时长度参数与第一调整参数的乘积；或者
基于使用率小于预设使用率门限值的比较结果，将被调用的接口的第一延时长度参数调整为第一延时长度参数与第二调整参数的乘积。
本发明实施例中，可选的，调整单元34具体用于：
获取沙箱所在设备的中央处理器的使用率；
将获取的使用率与预设使用率门限值进行比较；
基于使用率大于或者等于预设使用率门限值的比较结果，将被调用的接口的第一延时长度参数调整为第二延时长度参数；或者
基于使用率小于预设使用率门限值的比较结果，将被调用的接口的第一延时长度参数调整为第三延时长度参数；
其中，第三延时长度参数对应的延时时长小于第二延时长度参数对应的延时时长。
本发明实施例中，进一步的，比较单元35还用于：
在预设时长到达前的预定时刻，将已记录的至少一个操作与恶意行为的操作进行比较；
还包括发送单元，用于基于已记录的至少一个操作中不存在与恶意行为 的操作相匹配的操作的比较结果，向沙箱发送软件运行结束消息；
记录单元31还用于：记录待检测软件在预定时刻至预设时长到达之间的时间段内执行的至少一个操作；
比较单元35还用于：将已记录的待检测软件在预定时刻至预设时长到达之间的时间段内执行的至少一个操作与恶意行为的操作进行比较，基于已记录的待检测软件在预定时刻至预设时长到达之间的时间段内执行的至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定待检测软件为恶意软件。
本装置实施例中提供的检测恶意软件的装置可以是方法实施例中沙箱所在的设备，或者设备中的一个功能模块，该装置可以集成在防火墙、网关设备等网络设备中，还可以集成于文件服务器或网页服务器中。检测恶意软件的装置可以实现的其他附加功能，请参照方法实施例中的描述，在这里不再赘述。
本发明实施例提供的检测恶意软件的装置在沙箱中运行待检测软件，并记录待检测软件在开始运行后预设时长内执行的至少一个操作；在记录至少一个操作的过程中，检测沙箱中的至少一个具有延时属性的接口是否被调用；在检测到任意一接口被调用时，判断被调用的接口的第一延时长度参数对应的延时时长是否大于预设时长；若判定第一延时长度参数对应的延时时长大于预设时长，则将被调用的接口的第一延时长度参数调整为第二延时长度参数，第二延时长度参数对应的延时时长小于预设时长；将已记录的至少一个操作与恶意行为的操作进行比较，基于已记录的至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定待检测软件为恶意软件。该装置通过在具有延时属性的接口被调用时，缩短延迟执行的延时时长，让恶意行为在记录待检测软件在开始运行后预设时长内执行的至少一个操作的过程中执行，那么恶意行为就可以提前暴露，可以实现有效监控，因此，可以提高检测恶意软件的效率和准确度。
如图4所示，为本发明实施例提供的检测恶意软件的装置3000的另一种结构示意图，包括至少一个处理器401，通信总线402，存储器403以及至少一个通信接口404。
其中，通信总线402用于实现上述组件之间的连接并通信，通信接口404 用于与外部设备连接并通信。
其中，存储器403用于存储有可执行的程序代码，处理器401通过执行这些程序代码，以用于：
在沙箱中运行待检测软件，并记录待检测软件在开始运行后预设时长内执行的至少一个操作；
在记录至少一个操作的过程中，检测沙箱中的至少一个具有延时属性的接口是否被调用；
在检测到任意一接口被调用时，判断被调用的接口的第一延时长度参数对应的延时时长是否大于预设时长；
若判定第一延时长度参数对应的延时时长大于预设时长，则将被调用的接口的第一延时长度参数调整为第二延时长度参数，第二延时长度参数对应的延时时长小于预设时长；
将已记录的至少一个操作与恶意行为的操作进行比较，基于已记录的至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定待检测软件为恶意软件。
处理器401还用于：
将被调用的接口的第一延时长度参数调整为第一延时长度参数和预设的调整参数的乘积，调整参数大于0且小于1。
预设的调整参数包括第一调整参数和第二调整参数，第一调整参数大于第二调整参数；
处理器401还用于：
获取沙箱所在设备的中央处理器的使用率；
将获取的使用率与预设使用率门限值进行比较；
基于使用率大于或者等于预设使用率门限值的比较结果，将被调用的接口的第一延时长度参数调整为第一延时长度参数与第一调整参数的乘积；或者
基于使用率小于预设使用率门限值的比较结果，将被调用的接口的第一延时长度参数调整为第一延时长度参数与第二调整参数的乘积。
处理器401还用于：
获取沙箱所在设备的中央处理器的使用率；
将获取的使用率与预设使用率门限值进行比较；
基于使用率大于或者等于预设使用率门限值的比较结果，将被调用的接口的第一延时长度参数调整为第二延时长度参数；或者
基于使用率小于预设使用率门限值的比较结果，将被调用的接口的第一延时长度参数调整为第三延时长度参数；
其中，第三延时长度参数对应的延时时长小于第二延时长度参数对应的延时时长。
处理器401还用于：
在预设时长到达前的预定时刻，将已记录的至少一个操作与恶意行为的操作进行比较；
基于已记录的至少一个操作中不存在与恶意行为的操作相匹配的操作的比较结果，向沙箱发送软件运行结束消息；
记录待检测软件在预定时刻至预设时长到达之间的时间段内执行的至少一个操作；
将已记录的待检测软件在预定时刻至预设时长到达之间的时间段内执行的至少一个操作与恶意行为的操作进行比较，基于已记录的待检测软件在预定时刻至预设时长到达之间的时间段内执行的至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定待检测软件为恶意软件。
本发明实施例中，接口包括以下至少一个接口或多个接口的组合：
延时一个进程的接口、延时多个进程的接口、延时定时器的接口、或获取系统时间的接口。
本装置实施例中提供的检测恶意软件的装置可以是方法实施例中沙箱所在的设备，该装置可以是防火墙、网关设备等网络设备，还可以是文件服务器或网页服务器。检测恶意软件的装置可以实现的其他附加功能，请参照方法实施例中的描述，在这里不再赘述。
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通 过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中的功能的步骤。
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。
显然，本领域的技术人员可以对本发明实施例进行各种改动和变型而不脱离本发明实施例的精神和范围。这样，倘若本发明实施例的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。

Claims (11)

  1. 一种检测恶意软件的方法，其特征在于，包括：
    在沙箱中运行待检测软件，并记录所述待检测软件在开始运行后预设时长内执行的至少一个操作；
    在记录所述至少一个操作的过程中，检测所述沙箱中的至少一个具有延时属性的接口是否被调用；
    在检测到任意一所述接口被调用时，判断被调用的所述接口的第一延时长度参数对应的延时时长是否大于所述预设时长；
    若判定所述第一延时长度参数对应的延时时长大于所述预设时长，则将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数，所述第二延时长度参数对应的延时时长小于所述预设时长；
    将已记录的所述至少一个操作与恶意行为的操作进行比较，基于已记录的所述至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定所述待检测软件为恶意软件。
  2. 如权利要求1所述的方法，其特征在于，将被调用的所述接口的第一延时长度参数调整为第二延时长度参数，具体包括：
    将被调用的所述接口的所述第一延时长度参数调整为所述第一延时长度参数和预设的调整参数的乘积，所述调整参数大于0且小于1。
  3. 如权利要求2所述的方法，其特征在于，所述预设的调整参数包括第一调整参数和第二调整参数，所述第一调整参数大于所述第二调整参数；
    所述将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数，具体包括：
    获取所述沙箱所在设备的中央处理器的使用率；
    将获取的使用率与预设使用率门限值进行比较；
    基于所述使用率大于或者等于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为所述第一延时长度参数与所 述第一调整参数的乘积；或者
    基于所述使用率小于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为所述第一延时长度参数与所述第二调整参数的乘积。
  4. 如权利要求1所述的方法，其特征在于，所述将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数，具体包括：
    获取所述沙箱所在设备的中央处理器的使用率；
    将获取的使用率与预设使用率门限值进行比较；
    基于所述使用率大于或者等于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数；或者
    基于所述使用率小于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为第三延时长度参数；
    其中，所述第三延时长度参数对应的延时时长小于所述第二延时长度参数对应的延时时长。
  5. 如权利要求1-4任一项所述的方法，其特征在于，还包括：
    在所述预设时长到达前的预定时刻，将已记录的所述至少一个操作与恶意行为的操作进行比较；
    基于已记录的所述至少一个操作中不存在与恶意行为的操作相匹配的操作的比较结果，向所述沙箱发送软件运行结束消息；
    记录所述待检测软件在所述预定时刻至所述预设时长到达之间的时间段内执行的至少一个操作；
    将已记录的所述待检测软件在所述预定时刻至所述预设时长到达之间的时间段内执行的所述至少一个操作与恶意行为的操作进行比较，基于已记录的所述待检测软件在所述预定时刻至所述预设时长到达之间的时间段内执行的所述至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定所述待检测软件为恶意软件。
  6. 如权利要求1-5任一项所述的方法，其特征在于，所述接口包括以下 至少一个接口或多个接口的组合：
    延时一个进程的接口、延时多个进程的接口、延时定时器的接口、或获取系统时间的接口。
  7. 一种检测恶意软件的装置，其特征在于，包括：
    运行单元，用于在沙箱中运行待检测软件；
    记录单元，用于记录所述待检测软件在开始运行后预设时长内执行的至少一个操作；
    检测单元，用于在记录所述至少一个操作的过程中，检测所述沙箱中的至少一个具有延时属性的接口是否被调用；
    判断单元，用于在检测到任意一所述接口被调用时，判断被调用的所述接口的第一延时长度参数对应的延时时长是否大于所述预设时长；
    调整单元，用于若判定所述第一延时长度参数对应的延时时长大于所述预设时长，将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数，所述第二延时长度参数对应的延时时长小于所述预设时长；
    比较单元，用于将已记录的所述至少一个操作与恶意行为的操作进行比较，基于已记录的所述至少一个操作中存在与恶意行为的操作相匹配的操作的比较结果，确定所述待检测软件为恶意软件。
  8. 如权利要求7所述的装置，其特征在于，所述调整单元具体用于：
    将被调用的所述接口的所述第一延时长度参数调整为所述第一延时长度参数和预设的调整参数的乘积，所述调整参数大于0且小于1。
  9. 如权利要求8所述的装置，其特征在于，所述预设的调整参数包括第一调整参数和第二调整参数，所述第一调整参数大于所述第二调整参数；
    所述调整单元将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数时，具体为：
    获取所述沙箱所在设备的中央处理器的使用率；
    将获取的使用率与预设使用率门限值进行比较；
    基于所述使用率大于或者等于所述预设使用率门限值的比较结果，将被 调用的所述接口的所述第一延时长度参数调整为所述第一延时长度参数与所述第一调整参数的乘积；或者
    基于所述使用率小于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为所述第一延时长度参数与所述第二调整参数的乘积。
  10. 如权利要求7所述的装置，其特征在于，所述调整单元具体用于：
    获取所述沙箱所在设备的中央处理器的使用率；
    将获取的使用率与预设使用率门限值进行比较；
    基于所述使用率大于或者等于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为第二延时长度参数；或者
    基于所述使用率小于所述预设使用率门限值的比较结果，将被调用的所述接口的所述第一延时长度参数调整为第三延时长度参数；
    其中，所述第三延时长度参数对应的延时时长小于所述第二延时长度参数对应的延时时长。
  11. 如权利要求7-10任一项所述的装置，其特征在于，所述比较单元还用于：
    在所述预设时长到达前的预定时刻，将已记录的所述至少一个操作与恶意行为的操作进行比较；
    还包括发送单元，用于基于已记录的所述至少一个操作中不存在与恶意行为的操作相匹配的操作的比较结果，向所述沙箱发送软件运行结束消息；
    所述记录单元还用于：记录所述待检测软件在所述预定时刻至所述预设时长到达之间的时间段内执行的至少一个操作；
    所述比较单元还用于：将已记录的所述待检测软件在所述预定时刻至所述预设时长到达之间的时间段内执行的所述至少一个操作与恶意行为的操作进行比较，基于已记录的所述待检测软件在所述预定时刻至所述预设时长到达之间的时间段内执行的所述至少一个操作中存在与恶意行为的操作相匹配
    的操作的比较结果，确定所述待检测软件为恶意软件。
PCT/CN2015/077213 2014-11-20 2015-04-22 检测恶意软件的方法及装置 Ceased WO2016078323A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
JP2017514330A JP6306265B2 (ja) 2014-11-20 2015-04-22 マルウェア検出方法、及びマルウェア検出装置
EP15861269.7A EP3196795B1 (en) 2014-11-20 2015-04-22 Malware detection method and apparatus
US15/491,068 US10565371B2 (en) 2014-11-20 2017-04-19 Malware detection method and malware detection apparatus
US16/723,469 US10963558B2 (en) 2014-11-20 2019-12-20 Malware detection method and malware detection apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410667648.4 2014-11-20
CN201410667648.4A CN105678164B (zh) 2014-11-20 2014-11-20 检测恶意软件的方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/491,068 Continuation US10565371B2 (en) 2014-11-20 2017-04-19 Malware detection method and malware detection apparatus

Publications (1)

Publication Number Publication Date
WO2016078323A1 true WO2016078323A1 (zh) 2016-05-26

Family

ID=56013188

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/077213 Ceased WO2016078323A1 (zh) 2014-11-20 2015-04-22 检测恶意软件的方法及装置

Country Status (5)

Country Link
US (2) US10565371B2 (zh)
EP (1) EP3196795B1 (zh)
JP (1) JP6306265B2 (zh)
CN (1) CN105678164B (zh)
WO (1) WO2016078323A1 (zh)

Families Citing this family (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105678164B (zh) * 2014-11-20 2018-08-14 华为技术有限公司 检测恶意软件的方法及装置
CN106790195B (zh) * 2016-12-30 2019-11-19 北京神州绿盟信息安全科技股份有限公司 一种sql注入检测方法及装置
CN107682314A (zh) * 2017-08-30 2018-02-09 北京明朝万达科技股份有限公司 一种apt攻击的检测方法和装置
CN108874658A (zh) * 2017-12-25 2018-11-23 北京安天网络安全技术有限公司 一种沙箱分析方法、装置、电子设备及存储介质
CN111368295A (zh) * 2018-12-26 2020-07-03 中兴通讯股份有限公司 恶意样本检测方法、装置、系统及存储介质
GB2588822B (en) 2019-11-11 2021-12-29 F Secure Corp Method of threat detection
US10805323B1 (en) * 2020-03-02 2020-10-13 Cloudflare, Inc. Cloud computing platform that isolates suspicious third-party code in a distributed cloud computing network
CN112380540B (zh) * 2020-11-13 2024-09-03 武汉虹旭信息技术有限责任公司 Android应用安全检测方法及装置
CN112784265A (zh) * 2021-02-05 2021-05-11 北京火绒网络科技有限公司 一种虚拟沙盒针对混淆代码的优化方法

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101425016A (zh) * 2007-11-01 2009-05-06 珠海金山软件股份有限公司 运行安装软件的方法和系统
US7779472B1 (en) * 2005-10-11 2010-08-17 Trend Micro, Inc. Application behavior based malware detection
US20130007883A1 (en) * 2011-06-28 2013-01-03 Kaspersky Lab Zao Portable Security Device and Methods for Detection and Treatment of Malware
CN102930210A (zh) * 2012-10-14 2013-02-13 江苏金陵科技集团公司 恶意程序行为自动化分析、检测与分类系统及方法
CN103810427A (zh) * 2014-02-20 2014-05-21 中国科学院信息工程研究所 一种恶意代码隐藏行为挖掘方法及系统
CN103927484A (zh) * 2014-04-21 2014-07-16 西安电子科技大学宁波信息技术研究院 基于Qemu模拟器的恶意程序行为捕获方法
US20140380474A1 (en) * 2013-06-24 2014-12-25 Fireeye, Inc. System and Method for Detecting Time-Bomb Malware
WO2015042066A1 (en) * 2013-09-18 2015-03-26 Qualcomm Incorporated Data flow based behavioral analysis on mobile devices

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7392541B2 (en) 2001-05-17 2008-06-24 Vir2Us, Inc. Computer system architecture and method providing operating-system independent virus-, hacker-, and cyber-terror-immune processing environments
US7913305B2 (en) * 2004-01-30 2011-03-22 Microsoft Corporation System and method for detecting malware in an executable code module according to the code module's exhibited behavior
US8763125B1 (en) * 2008-09-26 2014-06-24 Trend Micro, Inc. Disabling execution of malware having a self-defense mechanism
US9519781B2 (en) * 2011-11-03 2016-12-13 Cyphort Inc. Systems and methods for virtualization and emulation assisted malware detection
JP2013171556A (ja) * 2012-02-23 2013-09-02 Hitachi Ltd プログラム解析システム及び方法
WO2014147618A1 (en) * 2013-03-20 2014-09-25 Israel Aerospace Industries Ltd. Accelerating a clock system to identify malware
JP2015130008A (ja) * 2014-01-06 2015-07-16 富士通株式会社 動態解析方法及び動態解析装置
CN105678164B (zh) * 2014-11-20 2018-08-14 华为技术有限公司 检测恶意软件的方法及装置
US10817606B1 (en) * 2015-09-30 2020-10-27 Fireeye, Inc. Detecting delayed activation malware using a run-time monitoring agent and time-dilation logic

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7779472B1 (en) * 2005-10-11 2010-08-17 Trend Micro, Inc. Application behavior based malware detection
CN101425016A (zh) * 2007-11-01 2009-05-06 珠海金山软件股份有限公司 运行安装软件的方法和系统
US20130007883A1 (en) * 2011-06-28 2013-01-03 Kaspersky Lab Zao Portable Security Device and Methods for Detection and Treatment of Malware
CN102930210A (zh) * 2012-10-14 2013-02-13 江苏金陵科技集团公司 恶意程序行为自动化分析、检测与分类系统及方法
US20140380474A1 (en) * 2013-06-24 2014-12-25 Fireeye, Inc. System and Method for Detecting Time-Bomb Malware
WO2015042066A1 (en) * 2013-09-18 2015-03-26 Qualcomm Incorporated Data flow based behavioral analysis on mobile devices
CN103810427A (zh) * 2014-02-20 2014-05-21 中国科学院信息工程研究所 一种恶意代码隐藏行为挖掘方法及系统
CN103927484A (zh) * 2014-04-21 2014-07-16 西安电子科技大学宁波信息技术研究院 基于Qemu模拟器的恶意程序行为捕获方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3196795A4 *

Also Published As

Publication number Publication date
US10565371B2 (en) 2020-02-18
JP2017531257A (ja) 2017-10-19
EP3196795B1 (en) 2018-12-05
EP3196795A1 (en) 2017-07-26
CN105678164B (zh) 2018-08-14
JP6306265B2 (ja) 2018-04-04
US10963558B2 (en) 2021-03-30
US20200159913A1 (en) 2020-05-21
US20170220797A1 (en) 2017-08-03
EP3196795A4 (en) 2017-07-26
CN105678164A (zh) 2016-06-15

Similar Documents

Publication Publication Date Title
WO2016078323A1 (zh) 检测恶意软件的方法及装置
US10848521B1 (en) Malicious content analysis using simulated user interaction without user involvement
US10025927B1 (en) Malicious content analysis with multi-version application support within single operating environment
US10198574B1 (en) System and method for analysis of a memory dump associated with a potentially malicious content suspect
US10169585B1 (en) System and methods for advanced malware detection through placement of transition events
US10467414B1 (en) System and method for detecting exfiltration content
US11880458B2 (en) Malware detection based on user interactions
US9781144B1 (en) Determining duplicate objects for malware analysis using environmental/context information
JP5861228B2 (ja) 仮想パーティションを監視するためのシステム、装置、プログラムおよび方法
CN105989283B (zh) 一种识别病毒变种的方法及装置
CN103390130B (zh) 基于云安全的恶意程序查杀的方法、装置和服务器
US20190318090A1 (en) Malicious software detection based on api trust
JP7404223B2 (ja) 不正なメモリダンプ改変を防ぐシステムおよび方法
CN106415577B (zh) 用于识别可疑事件来源的系统和方法
US10375576B1 (en) Detection of malware apps that hijack app user interfaces
US20190121985A1 (en) Detecting vulnerabilities in applications during execution
CN102855129B (zh) 自动创建独立进程的方法及其系统
WO2016095671A1 (zh) 一种应用程序的消息处理方法和装置
US20170302682A1 (en) Device and method for analyzing malware
CN114647843A (zh) 父进程识别方法、装置、电子设备、存储介质及程序
WO2014139295A1 (zh) 数据处理的方法及终端

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15861269

Country of ref document: EP

Kind code of ref document: A1

REEP Request for entry into the european phase

Ref document number: 2015861269

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2015861269

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2017514330

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE