基于沙盒技术的行为分析系统研究  

Research on Behavior Analysis System Based on Sandbox Technology

作　　者：陈珂[1] 柯文德[1] 王爱国[1] 郑捷[1] 张良均 

机构地区：[1]广东石油化工学院计算机科学与技术系,广东茂名525000 [2]广州太普信息技术有限公司,广东广州510663

出　　处：《计算机技术与发展》2015年第8期166-169,共4页Computer Technology and Development

基　　金：国家自然科学基金资助项目(61272382);广东省科技计划项目(2012B0101100037);广东省高等学校科技创新项目(2013kjcx0132)

摘　　要：随着恶意程序的快速增多,常用的分析技术遇到了瓶颈。文中总结与分析了国内外现有主流的恶意程序检测方法,运用了底层的多种HOOK技术,在底层驱动中利用重定向技术从文件、注册表、网络、进程、线程、窗口消息等多个方面,设计与构造了改进的混合型沙盒和行为分析器。沙盒可保证程序在运行中不会破坏真实的系统,可提高分析效率,可连续分析,不需要还原环境。行为分析器通过记录程序的函数调用序列,使用风险等级来判断程序的风险程度,运用了独创的行为分析算法来计算程序的风险级别,通过自定义的规则自动判断程序的恶意程度,同时生成分析报告,达到自动化分析的目的。经过测试,说明该系统达到了预期功能,能有效地保护真实系统,同时也能准确获取到恶意程序的行为,其分析结果是有效的。With the rapid increase of malicious programs, common analysis technology has encountered bottleneck. In this paper, summarize and analyze the domestic and foreign existing mainstream malwam detection method, using the underlying multiple HOOK technology, utilizing the redirection technology in the underlying driver from a file, registry, network, process, thread, window message and so on, design and construct an improved sandbox analyzer and behavior. Sandbox ensures application won＇ t destroy the real system in operation, which can improve the efficiency of analysis, can be used to analyze continuously, do not need to restore the environment. Behavior analyzer by recording the program sequence of function calls, using risk level to judge the risk degree of the program, using the original behavior analysis algorithm to calculate the risk level of the program, through the custom rules automatically judge the malicious degree of the program,at the same time generate analysis report,to achieve the purpose of automatic analysis. After testing,the system runs stable and extensible, the analysis result is valid.

关 键 词：虚拟执行 恶意程序检测 沙箱 行为分析 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]