CN102622536B - Method for catching malicious codes - Google Patents

Abstract

The invention discloses a method for capturing malicious codes, which belongs to the technical field of network security. The method is: 1) configure the hardware emulator, load and start the target operating system; 2) the hardware emulator reads the virtual memory of the target operating system, identifies all processes and the export table in the dynamic library loaded by the process, and obtains the Export the addresses of all APIs in the table and intercept the network receiving API function; 3) According to the return value of the network receiving API function, mark the data packet received by the process from the network as a tainted data packet; 4) The hardware simulator disassembles the current process execution 5) Determine whether abnormal behavior occurs in the state of the current process during the taint propagation process, if abnormal behavior occurs, determine that the current process is malicious code, and extract the malicious code image from the memory of the target operating system . The invention realizes completely transparent analysis of malicious codes, and has higher efficiency and accuracy.

Description

A Malicious Code Capturing Method

technical field

The invention belongs to the technical field of network security, and in particular relates to a malicious code capture method based on a hardware simulator and stain propagation.

Background technique

With the continuous development and progress of society, computers are more and more widely used in various fields of society. Due to the widespread existence of software vulnerabilities and the lack of security awareness of users, Trojan horses spread faster and faster, the scope of infection continues to expand, and the damage caused is becoming more and more serious. Due to the limitations of analysis efficiency and user technical level, the traditional malicious code capture and analysis methods are difficult to shorten the response cycle, and the response speed has gradually been unable to adapt to this new situation. Therefore, it is necessary to improve the ability to capture and analyze malicious code.

Existing malicious code capture tools, such as 360 Cloud Security Platform, Kingsoft Cloud Security Platform, etc., must modify the operating system, such as Hook system functions, or register callback functions through PsSetCreateProcessNotifyRoutine to achieve corresponding capture functions. Since the modification of the operating system itself will cause integrity problems, the modified data patches or registered functions are easy to be discovered by malicious code, and corresponding countermeasures are generated. At the same time, because the current malicious code capture platform runs on the same operating system as the malicious code, it competes with the malicious code for control of the system, which is not conducive to accurate and stable malicious code capture.

The current malicious code capture technology usually uses the following methods:

1. System integrity check

The system integrity verification method first creates a system snapshot or a record of file hash data in the system on a clean system. When the system is running randomly or after a specific behavior is executed, the recorded system snapshot or file hash value is compared with the current Comparing the files, when there is a difference in the comparison results, it is considered that the malicious code is infected and a sample of the malicious code is extracted.

2. Heuristic detection, extraction of violations

The method of heuristic detection is to define the normal operation, compare the behavior generated in the code execution process with it as a benchmark, and measure the difference between the current malicious code behavior and the normal operation. When the behavior deviates far from the normal operation, it is considered malicious Behavior, extract malicious code samples that perform the behavior.

Currently, the virtual machine debugging analysis method for analyzing malicious codes in hidden processes is implemented by using virtual machine systems such as VMware and VirtualPC. The virtual machine system directly sends the virtual instructions to the local real CPU for execution, and at the same time, it has a backdoor. The malicious code in the hidden process can judge that it is running on a virtual system by checking the code execution time or calling the backdoor function of the virtual machine, and take actions to hide the real function.

To sum up, the main drawbacks of current malicious code sample extraction are: the hidden process and malicious code are at the same level, which is easy to be detected by malicious code and generate corresponding countermeasures; only malicious code samples can be extracted, but the behavior and attack process Insufficient analysis.

Contents of the invention

For the technical problems existing in the prior art, the object of the present invention is to provide a kind of malicious code capturing method based on hardware simulator, by constructing malicious code operating environment, manipulate and control the access operation of simulated CPU instruction and various simulated hardware, The data acquisition module in the hardware simulator collects information of all processes in the system, uses CR3 as a symbol, and analyzes the process execution process; monitors the running process of all processes, directly extracts the malicious code image from the virtual memory, and analyzes the attack data and attack process Interrelationships to extract behavioral features of malicious code execution and attack data features.

Technical scheme of the present invention is:

A malicious code capture method, the steps are:

1) configure the hardware emulator, the hardware emulator loads and starts the target operating system;

2) The hardware simulator reads the virtual memory of the target operating system, identifies all processes executed in the current system and the export table in the dynamic library loaded by the process, obtains the addresses of all APIs in the export table and intercepts the network receiving API function ;

3) According to the return value of the network receiving API function, the data packet received by the network is marked as a tainted data packet by the process;

4) The hardware emulator disassembles the instruction executed by the current process. If the source operand offset address and length of the instruction are within the range of the tainted data packet, the taint propagation calculation is performed on the instruction. If the instruction is an API function call instruction, Then obtain the API name according to the API address and query whether the offset and length of the incoming parameters belong to the taint data range, and if it belongs to the taint data range, perform taint propagation calculation on the API call;

5) Determine whether abnormal behavior occurs in the state of the current process during the taint propagation process. If abnormal behavior occurs, it is determined that the current process is malicious code, and the malicious code image is extracted from the memory of the target operating system.

Further, the configuring the hardware simulator includes: configuring the simulated memory size, the type of the simulated CPU, and the virtual hard disk of the hardware simulator.

Further, the method for configuring the virtual hard disk of the hardware emulator is: using linear addressing to create a virtual image file, and using the created virtual image file as a virtual hard disk.

Further, the method for obtaining the addresses of all APIs in the export table is: comparing the names in the export table of the dynamic library with the names in the API table, and obtaining the addresses of all APIs in the export table.

Further, the taint propagation calculation method is: according to the instructions executed by the current process, determine the variables and registers affected by the taint data generated by the taint data packet.

Further, the abnormal behavior includes: the return address of the function in the corresponding stack of the current process is covered by the tainted data packet or the tainted data generated by the tainted data packet, and the API call sequence executed by the current process matches the predefined abnormal behavior sequence.

Further, the method for determining whether abnormal behavior occurs in the state of the current process is as follows:

1) An abnormal behavior sequence is set, and the hardware simulator reads and maintains a single-linked list data structure of an abnormal behavior sequence in memory;

2) Create a taint record in the corresponding structure of the current process; at the same time, establish a taint behavior list to record the instructions and API calls that the current process operates on the taint data packet or the taint data generated by the taint data packet;

3) From the moment when the network data receiving function of the current process returns, analyze each instruction executed subsequently by the process:

If the instruction manipulates tainted data, add the result obtained by the current instruction as the taint generated by the tainted data packet to the tainted record, and add the instruction to the tainted behavior list; if it is an API call, and the API call If the parameter contains a tainted data packet or tainted data generated by a tainted data packet, add the API call to the tainted behavior list;

4) Determine whether the target address of the tainted data operation covers the return address of the function. If it is covered, it is determined that abnormal behavior occurs in the state of the current process; according to the tainted behavior list, determine whether the API call executed by the process matches the abnormal behavior sequence in the memory. If match, it is determined that the state of the current process has abnormal behavior.

Further, the method of extracting the malicious code image is: backtracking the tainted behavior list, and finding the tainted data that the behavior sequence of the process depends on according to the API called by the abnormal behavior process and the executed instructions, which is the captured malicious code image. Code; at the same time extract the offset, length and content of the data executed by the attack process in the entire tainted data packet.

Further, the abnormal behavior sequence is a series of continuous API operations.

A malicious code capture method, its usage is as follows:

1. Configure the image path, the simulated memory size of the hardware emulator and the type of simulated CPU; the hardware emulator loads the operating system image to start the target system;

2. Use the hardware simulator to read the current system memory, analyze the system memory data, identify all processes executed in the current system and the export table in the dynamic library loaded by the process; compare the name and API in the export table of the dynamic library name in the table, obtain the addresses of all APIs in the export table and intercept the API functions WSARecv, recv and RecvFrom of the predefined network (that is, the network receiving API).

3. According to the return value of the network receiving API function intercepted in the second step, obtain the data packet received by the process from the network, and mark the data packet as tainted data.

4. The hardware simulator disassembles and analyzes the instructions executed by the current process during the execution of the current process. If the address and offset of the source operand of the current process instruction belong to the taint source data generated in step 2, the instruction needs to be Perform taint propagation calculations. If the instruction is an API function call instruction, obtain the API name according to the API address and query whether the address and offset of the incoming parameters belong to taint data, and if it belongs to taint data, perform taint propagation calculation on the API call; taint propagation operation , that is, determine the tainted data packet and the variables and registers affected by the tainted data generated by the data packet according to the instructions executed by the current process. In order to perform propagation operations, we parse the opcode, source operand, and destination operand of CPU instructions. For each instruction, if its source operand references tainted data, its destination operand is also marked as tainted data. The purpose of taint propagation is to more accurately extract the processing of network input data during process execution. In the process of taint propagation, determine the state of the current process, such as: whether the return address in the corresponding stack of the current process is covered by taint data, whether a continuous API call sequence is executed to achieve data forwarding, etc.

5. Define abnormal behavior: During program execution, determine whether the function return address in the corresponding stack of the current process is overwritten by the tainted data packet or the tainted data generated by the tainted data packet, or whether the API call sequence executed by the current process is consistent with a predefined exception Behavior sequence matching; abnormal behavior is judged by the above two methods. If abnormal behavior is found, start to trace back the entire taint propagation calculation process, determine the different data ranges in the taint data and their effects on the attack process, and obtain their offset, length, content and role information in the taint source And output in log file format.

Further, if an illegal change of the process state is detected in the above step 4, the sample is automatically extracted. The process is: when the monitoring program integrated in the hardware simulator monitors the execution instructions of the process, it obtains the process loading address according to the obtained process EPROCESS structure, reads the code in the physical memory from this address, and analyzes the process executable file According to the PE structure, determine the range of the file to be read in the memory; and find the location of the corresponding memory page in the virtual physical memory according to the memory page table, and read it at one time according to the obtained address offset and the file length in the memory Mirror the code.

Compared with prior art, advantage and positive effect of the present invention are as follows:

1. In the present invention, since the data acquisition is realized by hardware simulation technology, instead of putting malicious codes on the real CPU for execution, malicious codes cannot perceive whether they are running in a virtual environment, nor can they tell whether they are being tracked, so as to realize the detection of malicious codes. Code fully transparent analysis.

2. All virtual CPU instructions and various hardware operations of the simulated hardware device of the present invention are simulated and executed after translation, instead of directly using code fragments to execute on a real machine, and the instruction can be accurately calculated during the operation of the instruction. time, thereby ensuring the transparency of the virtual environment.

3. The present invention analyzes malicious codes based on taint propagation, and judges malicious operations and attack behaviors by identifying the operation process of tainted data, which has higher efficiency and accuracy.

Description of drawings

Figure 1 is a schematic diagram of a malicious code capture method based on hardware simulator and taint propagation.

Figure 2 is a flowchart of a malicious code capture method based on hardware simulator and taint propagation.

Detailed ways

The technical scheme of the present invention is described in detail below in conjunction with accompanying drawing:

As shown in Figure 1, a method and system for capturing malicious code based on hardware simulator and taint propagation, including steps:

1. Create the operating system image required for the target file to run

The invention adopts a linear addressing method to create a virtual image file, which is used as a virtual hard disk, and an operating system is installed on a virtual analysis platform based on the file.

2. Configure and start the hardware emulator

Configure the image path of the operating system to obtain the location of the actual running operating system image; configure the simulated physical memory size, system startup time and simulated CPU type of the hardware emulator, and the hardware emulator allocates a corresponding amount of memory space according to the input memory size , as the simulated physical memory; set the system clock of the simulator according to the input system startup time; select the corresponding instruction decoding engine according to the type of the simulated CPU, and realize the translation and execution of the source instruction and the target instruction. After the above operations are completed, the hardware emulator reads the boot code in the operating system image, and jumps the EIP to the boot code to start the operating system.

Wherein, the virtual memory of the present invention is simulated by directly applying for memory of a corresponding size on a real machine. Configuring the size of the simulated memory is the basis for running the virtual operating system. The larger the simulated memory setting, the faster the running of the virtual operating system. This embodiment provides that the size of the simulated memory is configured between 216M and 1G.

The invention defines the type of the current simulated CPU, which is obtained through the decoding module of the hardware simulator, so that the instructions of the simulated CPU are converted into instructions of the local CPU and then run, and the operating system running on the virtual machine can correctly execute the instructions. The present invention Various CPUs can be simulated. For example: if the current mirror image is read from a P4 machine, then the present invention needs to configure the hardware emulator to emulate the CPU type as P4, instead of other types of CPUs such as ARM or MIPS, otherwise the operating system cannot run correctly. If real CPU is Intel P4, and the CPU simulated by hardware emulator of the present invention is ARM, then need utilize decoding module to convert the instruction of ARM into the instruction of one or more Intel P4.

3. The hardware simulator executes the instructions of the target operating system, and identifies the system calls and executed instructions of the process

Programs in the application layer access the operating system through APIs. In this embodiment, the method of address comparison is used to obtain the system call. Before the process is scheduled for execution, the code of the process has not been executed at this time, but its own executable file and the dynamic library required by the process have been mapped into the memory. Therefore, after the process is loaded and before the code is executed, the present invention reads the memory of the process through the memory management module machine of the hardware simulator, and analyzes the export table in the dynamic library loaded by the process. The export table includes the API name and the API address. The invention compares the API name in the export table with the name in the API table by adopting a character comparison method, obtains the addresses of all APIs in the export table, and adds all API addresses to the API table, and the API table includes API names, API addresses and API parameters and return values. During the execution of the hidden process, the EIP value of the hidden process is matched and compared with the parameters of the function address in the API table one by one.

If the EIP value matches the first instruction of each function in the API table, call the parsing function, read the general-purpose registers in the stack and the current CPU, get the function parameters and return address, and read when the function executes to the return address The eax register obtains the return value of the function; the data acquisition module in the hardware simulator records the instruction and the data executed by the instruction. The data executed by the instruction includes the file opened by the instruction, the port opened, the data sent through a certain port, and the accessed data. Files, created processes and threads, created or terminated services, created or used operating system synchronization/mutex, content of network data sending operations, file names of file creation operations, etc.

4. Judgment of abnormal program execution and illegal behavior

The taint propagation analysis is carried out on the process execution process, and the network taint source marking rules are manually set, and all data packets received by the network are marked as taint sources. This process is automatically carried out by the hardware simulator according to the rules. The judgment process of abnormal program execution and illegal behavior is as follows:

1) In order to identify the malicious operation of the process, we first set the abnormal behavior sequence, which represents a series of continuous API operations, and the collection of the sequence is stored in a configuration file, which is read by the hardware simulator and stored in the memory Maintain a singly linked list data structure of a sequence of abnormal behaviors.

2) When a certain process in the target system receives network data, mark the acquired network data packet as a tainted data packet, create a corresponding tainted record in the corresponding structure of the process, and create a tainted behavior list to record the tainted data Instructions and API calls that operate on packets or tainted data generated by tainted packets.

3) From the moment when the network data receiving function returns, analyze each instruction executed subsequently by the process. If the instruction manipulates tainted data, add the result obtained by the current instruction as the taint generated by the tainted data packet to the tainted record. , and add the instruction to the taint behavior list; if it is an API call, and the parameters of the API call contain taint data packets or taint data generated by taint data packets, the API call also needs to be added to the taint behavior list. While the process is executing, determine whether the target address of the tainted data operation covers the return address of the function; at the same time, match the API call executed by the process with the abnormal behavior sequence in the memory. The matching method for the abnormal behavior sequence is: if the name and parameters of the current API call are the same as the first API in the abnormal linked list, use the same method to continue comparing subsequent records in the sequence; if there is a difference, find Use the same method to match the first API of other predefined exception API sequences. If the taint propagation path can match the predefined abnormal operation sequence, it can be determined that the process being executed at this time is malicious code.

5. Collect and analyze data

After determining the malicious code, samples of malicious code and attack data need to be extracted. The extraction of malicious code samples is realized by reading files directly from the target operating system image loaded by the hardware simulator, and the attack data samples are realized by dumping the tainted data packets received by the process. In order to better extract malicious codes, the present invention traces back to the list of tainted behaviors generated during the analysis process, and finds the tainted data that the behavior sequence of the process depends on according to the API called and the executed instructions of the process in which the abnormal behavior occurs, and extracts The malicious code image, wherein the taint data includes its offset, length and content in the whole taint data packet. The data analysis module receives and stores the data collected by the above data collection module, and returns the data to the user.

The malicious code capture method based on the hardware simulator and taint propagation proposed by the present invention, for those skilled in the art, they can configure various environmental information according to their needs, design analysis and capture methods, so as to comprehensively analyze the malicious code in the hidden process code.

Although specific embodiments and drawings of the present invention are disclosed for the purpose of illustration, the purpose is to help understand the content of the present invention and implement it accordingly, but those skilled in the art can understand that: without departing from the present invention and the appended claims Various substitutions, changes and modifications are possible within the spirit and scope of . Therefore, the present invention should not be limited to the content disclosed in the preferred embodiments and drawings, and the protection scope of the present invention should be defined by the claims.

Claims (8)

1. a malicious code catching method, the steps include:

1) configure hardware simulator, hardware simulator loads and starts destination OS;

2) hardware simulator reads the virtual memory of destination OS, and the derived table in the dynamic base that all processes of carrying out in identification current system and process load obtains the address of all API in described derived table and tackles network reception api function;

3) according to network, receive the rreturn value of api function, the packet marking that process is received by network is stain packet;

4) instruction that hardware simulator dis-assembling current process is carried out, if the source operand offset address of this instruction and length are within the scope of stain packet, this instruction is carried out to tainting calculating, if this instruction is api function call instruction, according to this API Name of API address acquisition and inquire about its skew of importing parameter into and whether length belongs to stain data area, if belong to stain data area, this API Calls is carried out to tainting calculating;

5) in judgement tainting process, whether the state of current process there is abnormal behaviour, if there is abnormal behaviour, judges that current process is as malicious code, and from the internal memory of destination OS, extracts malicious code mirror image; The method whether state of wherein, judging current process abnormal behaviour occurs as:

51) an abnormal behaviour sequence is set, hardware simulator reads and safeguards in internal memory the single linked list data structure of an abnormal behaviour sequence;

52) in the counter structure of current process, create stain record; Set up stain behavior list simultaneously, record instruction and API Calls that current process operates stain packet or the stain data that produced by stain packet;

53) the moment of returning from current process network data receiver function, analyze each instruction of the follow-up execution of this process: if this command operating stain data, the result present instruction being obtained joins in described stain record as the stain being produced by stain packet, and this instruction is added to stain behavior list; If API Calls, and the parameter of this API Calls is containing the stain data that have a stain packet or produced by stain packet, this API Calls is added to stain behavior list;

54) judge whether the destination address of stain data manipulation has covered the return address of function, if covered, judge the state generation abnormal behaviour of current process; Whether the API Calls of carrying out according to stain behavior list determinating processes mates with the abnormal behaviour sequence in internal memory, if mated, judges the state generation abnormal behaviour of current process.

2. the method for claim 1, is characterized in that described configure hardware simulator comprises: the emulated memory size of configure hardware simulator, type, the virtual hard disk of simulation CPU.

3. method as claimed in claim 2, is characterized in that the method for the virtual hard disk of configure hardware simulator is: adopt the method for linear addressing to create virtual image file, using created virtual image file as virtual hard disk.

4. method as claimed in claim 3, is characterized in that the method for obtaining the address of all API in described derived table is: the title in the title in the derived table of more described dynamic base and API table, the address that obtains all API in described derived table.

5. method as claimed in claim 1 or 2 or 3 or 4, is characterized in that the method that described tainting calculates is: the instruction of carrying out according to current process, judge variable and register that stain data that stain packet produces affect.

6. method as claimed in claim 5, is characterized in that described abnormal behaviour comprises: API Calls sequence and predefined abnormal behaviour sequences match that the function return address in current process corresponding stack is carried out by stain packet or the stain data cover being produced by stain packet, current process.

7. the method for claim 1, it is characterized in that the method for extracting described malicious code mirror image is: stain behavior list is recalled, the API calling according to abnormal behaviour process and the instruction of execution, the stain data that find the behavior sequence dependence of this process, are the malicious code capturing; Extract data that attack process carries out skew, length and the content in whole stain packet simultaneously.

8. the method for claim 1, is characterized in that described abnormal behaviour sequence is a series of continuous API operations.