恶意代码动态分析中的反虚拟化问题研究

Anti-Virtualization in Dynamic Analysis of Malicious Code

反虚拟化是当前影响恶意代码动态分析系统全面获取样本行为数据的重要因素.本文提出从恶意代码动态分析环境的主机环境,网络环境和用户交互环境进行系统的反虚拟化对抗方法,并将反虚拟化对抗实现在已有的动态分析系统上,实验结果表明反虚拟化对抗有效的增强了动态分析系统获取样本行为数据的能力.

Anti-virtualization is currently an important factor affecting the overall acquisition of sample behaviour data by a dynamic analysis system of malicious code.This study proposes a systematic anti-virtualization confrontation method from host environment,network environment,and user interaction environment of dynamic analysis environment of malicious code,and implements the anti-virtualization confrontation in the existing dynamic analysis system. Experimental results show that the anti-virtualization confrontation effectively enhances the dynamic analysis system's ability to capture sample behavior data.