利索-全球专利检索

  1. 登录
  2. 注册
发明公开
CN103927484A 基于Qemu模拟器的恶意程序行为捕获方法 失效 - 权利终止

基于Qemu模拟器的恶意程序行为捕获方法
摘要：
本发明涉及一种基于Qemu模拟器的恶意程序行为捕获方法，其特征在于：直接在Qemu模拟器的源代码内插入恶意程序行为捕获模块，在Qemu模拟器上装载客户机操作系统，然后利用Qemu模拟器内部运行的恶意程序行为捕获模块对运行在客户机操作系统上的恶意程序样本进行行为捕获。本发明的优点在于：难以被探测和绕过，本方法直接在Qemu模拟器的源代码内插入恶意程序行为捕获模块，恶意程序行为捕获模和在客户机操作系统上运行的样本是完全隔离的，恶意程序行为捕获模块位于操作系统的下层，从理论上讲，恶意程序样本是没有办法检测到恶意程序行为捕获模块。
摘要（英）：

The invention relates to a malicious program behavior capture method based on the Qemu. The method is characterized in that a malicious program behavior capture module is directly inserted into a source code of the Qemu, a client operating system is installed on the Qemu, and then behavior capture is carried out on malicious program samples on the client operating system through the malicious program behavior capture module running in the Qemu. The method has the advantages that the malicious program behavior capture module is directly inserted into the source code of the Qemu, completely isolated from the samples running on the client operating system and located on the lower layer of the operating system, and in theory, the malicious program samples can not detect or escape the malicious program behavior capture module easily.

公开/授权文献
0/0