CN104200161B - Method for achieving intelligent sandbox file detection and intelligent sandbox detection system based on method - Google Patents

Abstract

The invention relates to the field of malicious code detection, and aims to provide a method for realizing sandbox intelligent detection of files and a sandbox intelligent detection system thereof. This method for realizing the intelligent detection of files in the sandbox, when the file behavior detection is performed in the sandbox, after submitting the detected file to the sandbox for operation, the detection module calls the detected file, and monitors the running behavior of the program through the API HOOK module, At the same time, the intelligent simulation module of the detection module can fully restore the running conditions of the detected files in the real environment. The invention realizes the simulated manual operation through the proprietary program, and solves the problem that the running track of the program cannot be fully restored in the current dynamic behavior analysis process, which leads to the underreporting of malicious behavior; through the API HOOK hijacking technology, it solves the anti-corruption problem of the detected file in the file detection process. Problems with virtualization.

Description

A method for realizing sandbox intelligent detection of files and its sandbox intelligent detection system

technical field

The invention relates to the field of malicious code detection, in particular to a method for realizing sandbox intelligent detection of files and a sandbox intelligent detection system thereof.

Background technique

Today's malware uses some tricks, such as inserting junk code, swapping code positions, reallocating registers, and replacing equivalent codes, etc. to evade the detection of traditional signature-based anti-malware software. In order to solve such problems, many manufacturers The sandbox method is used to enhance the ability to detect malicious code attacks.

In the process of using the sandbox to detect malicious code, the judgment of malicious behavior is basically based on feature matching. For example, in the patent application of CN201410032004.8, a Chinese patent, a method and device for automatic processing of malicious code samples, A method using extracted static feature matching is proposed, while using dynamic feature matching as a supplement. Although many sandboxes also use dynamic analysis methods, there is a problem that the running track of the detected files cannot be truly restored in the sandbox environment during the dynamic analysis process.

In the process of using the sandbox as a file analysis, how to judge that the current file has been tested, each manufacturer also has its own standards, the common practice is to set the maximum running time of a program, and determine the program detection when the program reaches the maximum running time Done, end to end the current detection task. The problem with this method is that the time for a single file is too long, and even if the file has no follow-up operations, it still needs to wait for the timeout to run, resulting in useless work in the detection process and reducing the detection efficiency.

Contents of the invention

The main purpose of the present invention is to overcome the deficiencies in the prior art, and to provide a method and system for realizing the sandbox intelligent detection of files. In order to solve the problems of the technologies described above, the solution of the present invention is:

A method for realizing intelligent sandbox detection of files is provided for performing file execution behavior detection on files, which specifically includes the following steps:

Step 1: The sandbox module receives the file to be detected, generates a detection task according to the rules, writes the detection task into the database, and marks the detection task status as pending detection;

Described detection task comprises the task ID of self-incrementing type, the file preservation path of detection file and file type (obtain file type in conjunction with file suffix by Magic mode: if Magic mode can obtain file type, then the type that then will obtain with Magic mode as The file type of the current file, if Magic cannot obtain the program file type, the file name suffix is used as the file type of the executable file), the check value of the detected file (use the hash algorithm to obtain the check value of the detected file), Specify the detection time of the current detection file;

Step 1 is executed repeatedly, and Step 1 is executed cyclically using a separate thread;

Step 2: The sandbox module connects to and queries the database, and checks whether there is a task in the database whose detection task status is pending detection. If there is no detection task in this state, the sandbox module waits for a specific time and then performs the query operation again;

If the sandbox module finds that the detection task status is a task to be detected, the sandbox module calls the public interface function of the virtual host (for example, using the VBoxManage showvminfo function to obtain the current running status of the virtual host) to query whether there is currently a virtual host that can be used to perform the detection task (Virtual hosts that have been closed or saved can be used to perform detection tasks): If the current virtual host cannot perform task detection, the sandbox module waits for a specific time to reacquire the status of the virtual host. If there is currently a task detection that can be used Virtual host, call the public interface of the virtual host (for example, use VBoxManage startvm) to start the virtual host;

After the virtual host is started, the detection module started together with the virtual host starts the monitoring work of the specified port (the monitoring port number can be specified in the detection module program); the sandbox module is connected to the monitoring port of the virtual host, and the sandbox module is through the network. Submit the task to be detected to the detection module in the virtual host used for this task detection; the sandbox module marks the status of the currently submitted task as submitted, and keeps the connection waiting for the data return of the detection module;

The detection module receives the detection task, reads the file type in the task, and queries whether there is a corresponding execution program in the current system that can be used to execute the file to be detected. If it exists, it returns initialization success, otherwise it returns initialization failure;

Step 3: The sandbox module receives the initialization information returned by the detection module in step 2, and judges whether the virtual host can perform the current detection task according to whether the initialization is successful. If the initialization is successful, it means that the current file can be detected, and continue to the processing of step 4; if If the initialization fails, it means that the current detection task cannot be executed, and the detection task ends; the sandbox module marks the current detection task status in the database as undetectable;

Step 4: The sandbox module uploads the file to be detected to the detection module through the network. After the transmission of the file to be detected is completed, the sandbox module saves the connection with the virtual host to receive the detection result information; the sandbox module marks the current task status as detection ;

Step 5: The detection module in the virtual host receives the file to be detected, calculates the check value of the file to be detected, and compares it with the check value in the detection task to confirm whether the file to be detected is complete (if the check value is consistent, it means data transmission complete); if the transmission of the file to be detected is incomplete, the detection module communicates with the sandbox module and requires the sandbox module to retransmit the file to be detected; if the transmission of the file to be detected is complete, the detection module starts the file to be detected and uses the suspend parameter to suspend the File process, start timer simultaneously to record the time that this file has been carried out; After file is suspended operation, detection module transfers APIHOOK module and injects in the running space of detected file (API HOOK typical application is the processmonitor of microsoft, and the present invention uses the same The idea is to perform API HOOK operations; the API HOOK module in the present invention runs on the virtual host, and is mainly used for system functions on the HOOK virtual host, including but not limited to creating process functions, reading and writing file functions, deleting file functions, and network connection functions , access the registry function, and output the recorded running information of the detected file to the detection module; at the same time, the API HOOK function also implements the access hijacking operation for partial file access. When the detected file tries to access a specific resource of the system, For example, when the detection module tries to access the VBoxService file of the virtual host, the API HOOK module hijacks the access request and directly returns the file access failure, so as to prevent the detected file from judging whether the current operating environment is a virtual machine by accessing the virtual machine feature file Purpose, the typical application of API hijacking is the file firewall used by some anti-virus software, this example uses the same idea to implement), after the API HOOK module is successfully injected, the detection module resumes the operation of the detected file, and the API HOOK module records the relevant information of the detected file Behavior information and return the detection result to the detection module; the API HOOK module does not detect the detected file within a certain period of time, calls the HOOK system function in the API HOOK module, and returns "no operation for a certain time" to the detection module, and the detection module according to this feature Judging that the file detection is completed, jump to step 7 for execution; the detection module transmits the received file behavior information returned by the API HOOK module to the sandbox module through the network; if the file to be detected fails to start or the API HOOK module fails to inject, the detection ends , and return the detection exception instruction to the sandbox module at the same time; after the sandbox module receives the detection failure information, it marks the current detection task status in the database as detection failure, and skips to step 7 for execution;

Step 6: The detection module starts the intelligent simulation module. The intelligent simulation module refers to the running window that identifies the detected file (the file is an exe type) through the program, and compares the obtained window title with the program by obtaining the button and button title in the window. Pre-set titles (pre-set titles are the titles of some buttons that need to be operated in advance in the intelligent simulation module, these titles include but are not limited to "yes", "ok", "install", "agree", "run", "continue", "finish", "accept", "extract", "accept", "agree", "next", "complete") are consistent, and are used to determine whether manual intervention is required on the detected file, To achieve the purpose of restoring the file running environment, try to obtain the detected file running window, sub-window and window button (the typical application of obtaining program running window, sub-window, and button related operations is the SPY++ tool of microsoft, and the present invention uses the same thinking with it to obtain relevant information);

If the intelligent simulation module obtains the detected file running window, sub-window and window button successfully, then match the obtained window button title with the preset title: if the matching is successful, the intelligent simulation module moves the mouse to the button that matches the title , execute the operation of left-clicking the mouse, and then repeat step 6; if the matching is unsuccessful, the detection time set in the current detection task will be used to judge whether the running of the detected file is over. If it is within the detection time range, the program will exit normally , then execute step eight, if the running time of the detected file reaches the detection time set in the detection task, the detected file is still running, execute step seven;

Step 7: The detection module calls the Processkill function to end the detected file;

Step 8: The detection module returns the detection completion command to the sandbox module;

Step 9: If the sandbox module receives the abnormal detection command returned by the detection module, mark the current detection task as abnormal detection;

If the sandbox module does not receive an abnormal detection command before receiving the detection completion command, the sandbox module marks the current detection task as detection complete, saves the file detection result to a file, and appends the detection result file path to the current detection task , for use by other programs;

The sandbox module calls the virtual host public interface function (such as VBoxManage controlvm) to close the virtual host that performs the current detection task after receiving the instruction that the detection is completed;

After the shutdown of the virtual host is completed, the sandbox module calls the image recovery function (such as VBoxManage snapshot) to restore the virtual host image, and when the detection task is completed, repeat step 2.

A sandbox intelligent detection system based on the method for realizing sandbox intelligent detection files is provided, including a sandbox module and a virtual host; the sandbox module and the virtual host constitute the main body of the sandbox; the database is included in the sandbox module , the detection module and its attached intelligent simulation module and API HOOK module run in the virtual host;

The sandbox module is the main module of the sandbox intelligent detection system, responsible for receiving files to be detected and generating detection tasks, managing detection tasks, initiating file detection, scheduling and managing virtual hosts, receiving and saving detection results;

The database can use any type of database for storing detection tasks for use by the sandbox module to generate detection tasks and manage detection tasks;

The detection module is a detection execution program running on a virtual host, used to communicate with the sandbox module, obtain detection tasks and detected files, perform file detection and monitor the file execution process through the API HOOK module, and return the detected files through the network. The running behavior data of the detection file is sent to the sandbox module; the detection module is built into the virtual host and starts together with the virtual host system; among them, the file to be detected refers to the file that has not been submitted for detection in the detection task, and the file is submitted to the virtual host When testing, it is called the detected file;

Described virtual host is the virtualization program running under the sandbox environment and the operating system (such as the windows operating system running in the VirtualBox virtualization software) running under the virtualization program, and the virtual host saves the state after starting as restoring point.

The working principle of the present invention: when the sandbox performs file behavior detection, after the detected file is submitted to the sandbox for operation, the detection module calls the detected file, and monitors the running behavior of the program through the API HOOK module, and at the same time through the intelligent simulation of the detection module module to fully restore the operation of the detected file in the real environment.

Compared with prior art, the beneficial effect of the present invention is:

The simulation of manual operation is realized through a proprietary program, which solves the problem that the current dynamic behavior analysis process cannot completely restore the running track of the program, which leads to the underreporting of malicious behavior; through the API HOOK hijacking technology, it solves the anti-virtualization of detected files in the file detection process The problem.

Description of drawings

Fig. 1 is a main flow chart of file detection in the present invention.

Fig. 2 is a flow chart of realizing intelligent detection in the present invention.

Figure 3 is a chart of the comparison table between file types and execution programs.

detailed description

First of all, it should be explained that the present invention relates to malicious code detection technology, which is an application of computer technology in the field of information security technology. During the implementation of the present invention, the application of multiple software function modules will be involved. The applicant believes that, after carefully reading the application documents and accurately understanding the realization principle and purpose of the present invention, combined with existing known technologies, those skilled in the art can fully implement the present invention by using their software programming skills. The aforementioned software functional modules include but are not limited to: sandbox module, detection module, API HOOK module, and intelligent simulation module. All mentioned in the application documents of the present invention belong to this category, and the applicant will not list them one by one.

Below in conjunction with accompanying drawing and specific embodiment the present invention is described in further detail:

A method for realizing a sandbox intelligent detection file, which is used for detecting a file to be detected, specifically includes the following steps:

Step 1: The sandbox module cyclically receives the detected files, according to the rules (the file type can be obtained by combining the file suffix with the Magic method, the file type can be obtained by the Magic method, and the type obtained in this way is used as the file type of the current file, and Magic cannot When the program file type is obtained, use the file name suffix as the file type of the executable file; use the hash algorithm to obtain the verification value of the file to be detected; specify the detection time of the current task to be detected) to generate the task to be detected, and the detection task The status is marked as pending, and the task is written to the task table in the mysql database.

Step 2: The sandbox module connects to mysql data, queries the task table, and tries to obtain the detection tasks whose detection task status is pending detection. If there are detection tasks whose detection task status is pending detection, the sandbox module calls the VBoxManageshowvminfo function to query whether there are currently closed tasks. Or the suspended virtual host can be used for the current detection task. If the current virtual host is running, the sandbox module will reacquire the status of the virtual host every 1 second. If there is currently a virtual host that can be used for detection, it will call the virtual The VBoxManage startvm function starts the virtual host; the sandbox module tries to connect to port 8000 of the virtual host (port 8000 is the port for communication monitoring after the detection module starts), the port is successfully connected, and the sandbox uploads the detection task to the detection through the http protocol in the form of a file module, the detection task upload is completed, the sandbox module modifies the current pending detection task in the mysql database as submitted, and waits for the initialization result returned by the detection module;

The detection module starts with the virtual host, and starts port 8000 for communication monitoring. After the detection module receives the detection task file uploaded by the sandbox module, it reads the current detection task file, and according to the file type in the detection task file combined with the internal definition of the program File type execution mode, to judge whether the file can run normally. When the above conditions are met, the detection module returns the initialization success to the sandbox main program, and continues the processing of step 3; if the initialization fails, the detection module returns the initialization failure information to the sandbox Box module, after the sandbox module receives the message of initialization failure, modify the status of the detection task in the mysql database to be undetectable, and perform step 6;

Step 3: After the sandbox module receives the information that the initialization is successful, the sandbox module uploads the file to be detected to the detection module through http. After the detection module completes the receiving work of the file to be detected, it calculates the check value of the file to be detected, and Compare the file verification values recorded in the detection task file. If the verification values are inconsistent, it means that the file upload is abnormal. The detection module returns the file abnormality to the sandbox module and requires the sandbox module to retransmit the detected file; if the verification values are consistent It means that the file upload is successful, the detection module uses the suspend parameter to execute the file to be detected, and at the same time the detection module calls the timer function to record the running time of the file; after the file to be detected is executed and suspended, the detection module calls the API Hook module to inject the running time of the detected file space, the API HOOK module is successfully injected, the detection module resumes the operation of the detected file, and receives the file behavior information of the detected file returned by the API HOOK module, and sends these behaviors back to the sandbox module through http; if the API HOOK module injection fails, the detection module sends injection failure information to the sandbox module, and the sandbox module modifies the current task status in the mysql database to detection failure; perform step 4;

During the execution of the detected file by the detection module, if the API HOOK module does not detect that the detected file calls the HOOK system function in the API HOOK module within a specific time, the API HOOK module returns "no operation for a specific time" to the detection module; The detection module performs step 4 after receiving the "no operation at a specific time" returned by the API HOOK module;

During the execution of the detected file by the detection module, if the API HOOK module monitors that the detected file requests to obtain a virtual host-related feature file, it hijacks the file request through the Windows API hook technology, and returns the result information that the requested file does not exist to the detected file. test file;

Among them, the specific process of the detection module performing behavior detection on the detected file is as follows:

A. The detection module uses the suspend mode to start the detected file;

B. The sandbox module generates a timer to record the running time of the program;

C. After the detected file is suspended, the detection module calls the API HOOK module to perform a process injection operation. After the process injection is successful, the API HOOK module starts to filter and record the file behavior information, and returns the relevant file behavior information to the detection module;

D. After the program is injected into the program, the detection module calls the intelligent simulation module. The specific work of the intelligent simulation module includes:

a. Obtain the program running window information through the EnumWindows function and EnumWindowsProc function;

b. Obtain the visible window through the IsWindowVisible function;

c. Obtain the child window through EnumChildWindows;

d. Obtain the window whose window property is Button through the GetClassName function;

e. Obtain the text information of Button through GetWindowsText;

f. Obtain the coordinate range of the Button's screen relative to the upper left corner through GetWindowRect;

g. Compare whether the obtained button text is in the text list preset by the detection module (the text list is: {yes, ok, install, agree, run, continue, finish, accept, extract, accept, agree, next step, complete }), if the Button text is within the range of the text list, call the SetForegroundWindow function to bring the current window to the front, call the SetCursorPos function to move the current mouse to the current Button coordinate range, and call the mouse_event function to execute the mouse left button click operation; if the Button text is not If it is within the scope of the text list, continue to obtain the information of the next Button file;

h. Repeat step D;

E. If the detected file exits during the execution of step D, then perform step 6;

F. If the API HOOK module does not detect that there is a file operation behavior on the detected file within a specific time, the API HOOK module will return "no operation for a specific time" to the detection module; after the detection module receives the feature returned by the API HOOK module , execute step 4;

G. If step D does not obtain the text information that exists in the text list, or the detected file has not completed the detection and exits the program within the time range set by the detection task, then perform step 4;

Step 4: The detection module calls the ExitProcess function to end the execution process of the currently detected file

Step 5: The detection module returns the detection completion command to the sandbox module;

Step 6: If the sandbox module receives the abnormal detection command returned by the detection module, it will mark the current detection task as a detection abnormality; if the sandbox module does not receive the abnormal detection command before receiving the detection completion command, the sandbox module will mark When the detection task is completed, save the file detection result to a file, and attach the detection result file path to the current detection task for use by other programs;

After the sandbox module receives the instruction that the detection is completed, it calls the public interface function VBoxManagecontrolvm of the virtual host to close the virtual host that performs the current detection task;

After the virtual host is shut down, the sandbox module calls the image recovery function VBoxManage snapshot to restore the virtual host image. When the detection task is completed, repeat step 2;

The present invention provides a sandbox intelligent detection system based on the method for realizing sandbox intelligent detection files, including a sandbox, a sandbox module, a detection module, and a virtual host; a sandbox, a sandbox module, a detection module, and a virtual host The specific connection between them is: the sandbox module and the virtual host constitute the main body of the sandbox. The detection module runs on the virtual host and is mainly used to communicate with the sandbox, obtain detection tasks and files to be detected, and execute files to be detected. File detection tasks, and send the detection results back to the sandbox module; the detection module is configured in the booting of the virtual host and starts together with the virtual host;

The present invention is only aimed at the file behavior analysis process in the intelligent sandbox system, and the malicious code analysis based on file behavior is not within the scope of the present invention;

The sandbox module described in the present invention is the main module of the sandbox intelligent detection system, responsible for receiving files to be detected and generating detection tasks, managing detection tasks, initiating file detection, scheduling and managing virtual hosts, receiving and saving detection results;

The database described in the present invention can be any type of database, which is used to store detection tasks, and is used by the sandbox module to generate detection tasks and manage detection tasks;

The detection module described in the present invention is a detection execution program running on a virtual host, which is used to communicate with the sandbox module, obtain detection tasks and detected files, execute file detection and monitor the file execution process through the API HOOK module, in a network manner Return the running behavior data of the detected file to the sandbox module; the detection module is built into the virtual host and starts together with the virtual host system;

The virtual host described in the present invention is the virtualization program running under the sandbox environment and the operating system (such as the windows operating system running in the VirtualBox virtualization software) running under the virtualization program, and the virtual host will start the state save as a restore point;

The file to be detected in the present invention refers to the file that has not been submitted for detection in the detection task, and when the file is submitted to the virtual host for detection, it is called the detected file;

The following examples can enable those skilled in the art to understand the present invention more comprehensively, but do not limit the present invention in any way.

A sandbox intelligent detection system, the system realizes the following functions:

Step 1: Obtain the file to be detected and generate a detection task;

The first step is called the task generation step, and the task generation step is executed in a loop using a separate thread.

Among them, the types of files to be detected for task acquisition include the following four types: PE format files under windows, including exe files, dll files, and document type files, including word documents, excel tables, ppt presentation documents, PDF documents, script files, Including bat files, cmd files, vbs files, parsing program files, including py files, jar files. There are two types of file sources: one is to use flow monitoring and other means to obtain specified types of files and submit them for detection by means of traffic file separation, and the other is to manually submit acceptable files to the sandbox system for detection by technicians.

The task generation step sub-steps include:

Step 101, the sandbox reads the file to be detected, and obtains the complete file storage path of the file to be detected.

Step 102, the sandbox module calls the Magic mode to extract the file type of the file to be detected, if the file type cannot be obtained, use the file name suffix as the file type of the file;

Step 103, the sandbox module uses hash algorithms such as MD5 and CRC to calculate the verification value of the file to be detected;

Step 104, the sandbox module obtains the execution time of the current task of the file to be detected. If the task execution time is not specified when generating the task, the sandbox module uses 5 minutes as the file detection task execution by default;

Step 105, the sandbox obtains the current time as the task submission time;

Step 106, the sandbox obtains the last task ID existing in the task database, and increments the task ID value of the current last task by 1 as the task ID of the new task;

Step 107, the sandbox module writes the obtained information into the detection task table in the mysql database through the sql statement, generates the current detection task, and marks the state of the task as the state to be detected.

Step 2: The sandbox module submits the task to be detected to the virtual host for detection, and retrieves the detection result;

Step 2 is called the task execution step, and may specifically include the following sub-steps.

Step 201, the sandbox module judges whether there is an idle virtual host available for new task detection by detecting the status of the virtual host

If there is a virtual host whose status is closed and saved, then there is a virtual host that can be used for new task detection, and step 202 is performed

If the current virtual hosts are all in the running state, the sandbox module waits for 1 second, and re-queries the status of the virtual host until there is a virtual host whose status is closed or saved, and then execute step 202

Step 202, the sandbox module queries the detection task table of the mysql database, and finds whether there is a task whose task status is to be detected in the detection task table;

If there is no task whose task state is to be detected in the detection task table in the current mysql database, the sandbox module waits for 1 second, and repeats the search work of the task to be detected;

If only one task to be detected is found in the detection task table, the sandbox module executes step 203 to submit the task;

If multiple tasks to be detected are found in the detection task table, the sandbox module obtains the detection tasks sequentially according to the order of task submission, performs step 203 to submit the task, and marks the current task as submitted; the sandbox module can submit at most simultaneously The number of tasks for file detection is less than or equal to the number of virtual hosts configured in the sandbox;

Step 203, the sandbox module submits the task to the virtual host, and retrieves the file detection record, and the specific steps include:

The sandbox module performs the following operations:

1), the sandbox module calls the VBoxManage startvm function to start the virtual host;

2), the sandbox module tries to connect to port 8000 of the virtual host, and if the port is successfully connected, it means that the virtual host is started;

3), the sandbox module transmits the task list to the virtual host through http, and waits for the detection module to return the initialization result; if the detection module returns the initialization success, then execute step 4, if the detection module returns the initialization failure, then execute step 204; sandbox The module marks the current detection task as undetectable;

The sandbox module receives the virtual host and returns the system initialization success, reads the file to be detected, and transmits the file to be detected to the detection module through http;

After the virtual host starts, perform the following operations:

1) After the virtual host is started, the detection module built in the virtual host starts together with the virtual host;

2), the detection module opens port 8000 for port monitoring;

3), the detection module receives the task configuration information uploaded by the sandbox module, reads the configuration file, obtains the file type of the file to be detected, and checks whether there is currently a corresponding program through the file type and execution program comparison table (Figure 3). Execute the file to be detected;

If there is an execution program corresponding to the file to be detected, the detection module returns initialization success to the sandbox module through port 8000, indicating that the file to be detected can be received;

If there is no execution program corresponding to the file to be detected, the detection module returns an initialization failure to the sandbox module through port 8000, indicating that the current system cannot complete the detection of this type of file, and the detection module executes step 206;

4), the detection module completes the receiving work of the file to be detected, calls the hash algorithm to calculate the verification value of the file to be detected, and compares the verification value of the file to be detected in the configuration file, if the verification value is consistent, it means that the program is complete, and execute 5 ), if the verification value is inconsistent, delete the currently accepted file, and ask the sandbox module to retransmit the file until the file is complete, then execute 5);

5), the detection module executes the file to be detected in the suspend parameter mode, after the file to be detected is suspended, the detection module calls the API HOOK module to perform the API HOOK injection operation; if the execution of the file to be detected fails, or the API HOOK injection fails, then go directly to step 206 ;

6) If the file to be detected is successfully executed and the API HOOK injection is successful, the detection module calls the intelligent simulation module to perform simulation detection; the execution steps of the intelligent simulation module are detailed in the specific process of the detection module performing behavior detection on the detected file in the content of the invention Step D, no more details here;

7), during the execution of file detection, if the API HOOK module does not detect that the detected file calls the system function of HOOK in the APIHOOK module within 10 seconds, then return "no operation for a specific time" to the detection module, and execute step 204;

8), during the execution of file detection, if the detected file exits normally, execute step 206;

9) During the execution of file detection, the detected file continues to execute, and the API HOOK module does not return "no operation for a specific time" to the detection module. If the detection time reaches the time set in the detection task (the default is 5 minutes), execute Step 204;

Step 204, the detection module calls the ExitProcess function to close the detected file process;

Step 205, the detection module returns detection success;

Step 206, the sandbox module calls the VBoxManage controlvm function to close the virtual host that performs the current detection task; the sandbox module modifies the current detection task status of the detection task table in the mysql database to detection completion; the sandbox module saves the received file behavior information to the directory of the disk, and add the path information of the file to the task result of the detection task table;

Step 207, the sandbox module uses the VBoxManage snapshot function to restore the virtual host image;

So far, the detection task of a file to be detected is completed.

Finally, it should be noted that the above-listed are only preferred embodiments of the present invention, and are not intended to limit the present invention. Those skilled in the art can directly derive or associate all the deformations from the content disclosed in the present invention. All should be included in the scope of protection of the present invention.

Claims (2)

1. a kind of method realizing sandbox Intelligent Measurement file, for file is carried out with file process performing detection, its feature exists In specifically including following step:

Step one: sandbox module receives file to be detected, generates Detection task according to rule, and by Detection task write into Databasce In, Detection task status indication is to be detected；

Described Detection task is included from task id of increasing type, the file storing path of detection file and file type, detection literary composition The check value of part, the specified detection time when secondary detection file；

Step one repeats, and step one uses individual threads circulation execution；

Step 2: sandbox module connects and inquire about data base, it is to be detected for whether there is Detection task state in inquiry data base Task, if the Detection task of no this state, sandbox module re-starts inquiry operation after waiting special time；

If sandbox module polls are task to be detected to Detection task state, sandbox module calls the open interface letter of fictitious host computer The current fictitious host computer that can be used for perform detection task that whether there is of number inquiry: if current virtual main frame all cannot be carried out task inspection Survey, then sandbox module waits special time to reacquire fictitious host computer state, if there is currently can be used for carrying out task detection Fictitious host computer, then call the open interface of fictitious host computer to start fictitious host computer；

After fictitious host computer starts, start the monitoring work of designated port with the detection module that fictitious host computer together starts；Sandbox mould Block connects the listening port of fictitious host computer, and sandbox module passes through network mode, and task to be detected is submitted to for this subtask Detection module in the fictitious host computer of detection；The current task status submitted to is labeled as having been filed on by sandbox module, and keeps even Connect wait detection module data to return；

Detection module receives Detection task, the file type in reading task, and inquires about in current system with the presence or absence of correspondence Configuration processor can be used for executing this file to be detected, if existed; would return initialize successfully, otherwise return initialize unsuccessfully；

Step 3: whether the initialization information that in sandbox module receiving step two, detection module returns, successfully come according to initialization Judge whether this fictitious host computer can carry out current detection task, if initializing successfully, representing and can detect current file, continuing The process of continuous step 4；If initializing unsuccessfully, representing and can not execute current detection task, Detection task terminates；Sandbox module will Current detection task status in data base is labeled as undetectable；

Step 4: sandbox module uploads file to be detected to detection module by network mode, file end of transmission to be detected, husky Tank module preserves the connection with fictitious host computer, for receiving testing result information；Sandbox module marks current task state is inspection In survey；

Step 5: detection module in fictitious host computer receives file to be detected, calculates the check value of file to be detected, and with detection Check value in task is compared, and confirms whether file to be detected is complete；If file transmission to be detected is imperfect, detect mould Block is communicated with sandbox module it is desirable to sandbox module retransmits file to be detected；If file transmission to be detected is complete, detection module starts File to be detected, and suspend this document process using suspend parameter, starts intervalometer simultaneously and has executed recording this document Time；After file is suspended operation, detection module calls api hook module to be injected in the running space of detected file, After the injection success of api hook module, detection module recovers detected running paper, and apihook module record is detected file Testing result is simultaneously returned to detection module by corelation behaviour information；Api hook module is not detected by being detected in special time File calls the system function of hook in api hook module, returns " special time no operates " to detection module, detection module Judge that file detection completes according to this feature, jump to step 7 execution；The api receiving hook module is returned by detection module The file behavioural information returned is transferred to sandbox module by network mode；If file start failure to be detected or api hook module Inject unsuccessfully then detection terminate, simultaneously return detection exceptional instructions to sandbox module；Sandbox module detects unsuccessfully receiving After information, in registration database, current detection task status is to detect unsuccessfully, and jumps to step 7 execution；

Step 6: detection module starts artificial intelligence module, artificial intelligence module refers to by the detected file of program mode (PM) identification Human window, and by obtaining button and button title in window, contrast in the window title that gets and program and set in advance Whether the title put is consistent, is used for judging whether to need to implement manual simulation intervention to detected file, to reach also original The purpose of running environment, attempts obtaining detected running paper window, subwindow and window button；

If artificial intelligence module obtains detected running paper window, subwindow and window button success, coupling gets Window button title is mated with the title pre-setting: if the match is successful, the mobile mouse of artificial intelligence module is to matching On the button of title, execute left mouse button single-click operation, then repeated execution of steps six；If coupling is unsuccessful, with when time inspection In survey task, judging whether detected running paper terminates, if in the range of detection time, program is just for the detection time of setting Often exit, then execution step eight, if the detected running paper time reaches the detection time of setting in Detection task, be detected literary composition Part is still running, execution step seven；

Step 7: detection module calls processkill function to terminate detected file；

Step 8: detection module returns detection and completes instruction to sandbox module；

Step 9: if sandbox module receives the detection exceptional instructions of detection module return, labelling is inspection when time Detection task Survey abnormal；

If sandbox module does not receive detection exceptional instructions before receiving detection and completing instruction, sandbox module marks are when time inspection Survey task completes for detection, preserves file detection result to file, and testing result file path is attached to current detection and appoint In business, so that other programs use；

Sandbox module, after receiving the instruction that detection completes, calls the open interface function of fictitious host computer to close execution current detection The fictitious host computer of task；

After the completion of fictitious host computer cuts out, sandbox module calls image recovery function to recover fictitious host computer mirror image, when secondary Detection task Complete, repeated execution of steps two.

2. the sandbox intelligent checking system based on a kind of method realizing sandbox Intelligent Measurement file described in claim 1, its It is characterised by, including sandbox module, fictitious host computer；Sandbox module and fictitious host computer constitute the main body of sandbox；Data base comprises In sandbox module, detection module and its attached artificial intelligence module, api hook module run in fictitious host computer；

Described sandbox module is the main body module of sandbox intelligent checking system, is responsible for receiving file to be detected and generating detection appointing Business, management Detection task, initiation file detect, dispatch and manage fictitious host computer, receive and preserve testing result；

Described data base can adopt any type of data base, for storing Detection task, generates Detection task for sandbox module And manage Detection task use；

Described detection module is the detection configuration processor operating on fictitious host computer, for communicating with sandbox module, obtains detection Task is detected with detected file, execution file and is returned by api hook module monitors file implementation procedure, with network mode Pass detected running paper behavioral data to sandbox module；Detection module is built in fictitious host computer, with fictitious host computer system one With startup；Wherein, file to be detected refers to the file not having submitted detection in Detection task, and this document is submitted to virtual master When being detected in machine, then it is referred to as detected file；

Described fictitious host computer is virtualization program and the operation system running under virtualization program operating under sandbox environment System, the state after starting is saved as restoration point by fictitious host computer.