摘要
安全厂商普遍使用虚拟环境来分析恶意软件,但是很多恶意软件都使用了检测虚拟机的技术来对抗对其的分析。文章介绍了3种主要的检测虚拟环境方法,给出了相应的对抗措施来防止对虚拟环境的检测。设计了一种新的基于性能比较的检查虚拟机和模拟器的方法,实验结果表明,该方法能够有效地检测出虚拟机和模拟器,如VMware软件和模拟器Qemu。
Security Companies usually apply virtual environment to analyze malware,whereas a large amount of current malware already adopts various VMware detection techniques in order to resist analysis.In this paper,three main methods for detecting the presence of virtual environment are presented,as well as their countermeasures.A performance related method to detect the presence of virtual machine or emulator is designed,which can successfully detect the presence of virtual environment,such as VMware and Qemu,etc.
出处
《信息与电子工程》
2010年第3期364-367,共4页
information and electronic engineering
关键词
木马分析
虚拟机
模拟器
虚拟环境
malware analysis
virtual machine monitor
emulator
virtual environment
