基于环境自动进化的恶意代码沙箱检测技术研究  

ANTI-MALWARE SANDBOX DETECTION TECHNOLOGY BASED ON AUTOMATIC ENVIRONMENT EVOLUTION

作　　者：杨珂 王栋 玄佳兴 王晓满 赵丽花 汪秋云 Yang Ke;Wang Dong;Xuan Jiaxing;Wang Xiaoman;Zhao Lihua;Wang Qiuyun(State Grid Electronic Commerce Co.,Ltd./State Grid Xiong’an Financial Technology Group Co.,Ltd.,Beijing 100053,China;Blockchain Technology Laboratory,State Grid Corporation of China,Beijing 100053,China;Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China)

机构地区：[1]国网电子商务有限公司(国网雄安金融科技集团有限公司),北京100053 [2]国家电网有限公司区块链技术实验室,北京100053 [3]中国科学院信息工程研究所,北京100093

出　　处：《计算机应用与软件》2025年第1期319-327,共9页Computer Applications and Software

基　　金：国家重点研发计划项目(2018YFB0805005)。

摘　　要：具有对抗沙箱分析能力的恶意代码占比逐渐升高。为了对抗恶意代码的沙箱规避,设计并开发出一种新的沙箱结构,除了具备基本的监控功能外,基于恶意代码的执行条件依赖图自动化进行环境调整,来对抗恶意代码逃避沙箱检测行为。81个Gh0st样本的检测结果表明,所设计的沙箱,比微步云具有更好的对抗恶意代码规避的效果,在延迟触发、人为交互模拟、Hook隐藏等方面具有较强的对抗能力。所设计的沙箱样本分析的平均用时比Noriben沙箱快23秒,验证了该方法的正确性和有效性。The proportion of malicious code with anti-sandbox analysis ability is gradually increasing.In order to solve the sandbox evasion of malicious code,a new sandbox structure is designed and developed in this paper.In addition to the basic monitoring function,the environment can be adjusted automatically based on the execution condition dependence graph of malicious code to combat the behavior of malicious code escaping from sandbox detection.The test results of 81 Gh0st samples show that the sandbox designed in this paper has better anti malicious code avoidance effect than Threatbook cloud sandbox,and has strong anti-malicious ability in delay trigger,human interaction simulation,hook hiding and so on.The average analysis time of the sandbox designed in this paper is 23 seconds faster than that of Noriben sandbox.The correctness and effectiveness of the proposed method are verified.

关 键 词：恶意代码 沙箱规避 行为规避 执行依赖图 微步云沙箱 Noriben沙箱 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]