一种新的恶意软件行为分析系统的设计与实现.doc

文档介绍：一种新的恶意软件行为分析系统的设计与实现
凌冲余忠慧孙乐昌刘京菊张亮
(解放军电子工程学院合肥 230037)
摘要:基于虚拟化技术的恶意软件行为分析是近年来出现的分析恶意软件的方法。该方法利用虚拟化平台良好的隔离性和控制力对恶意软件的运行时行为进行分析,但存在两方面的不足:一方面,现有虚拟机监视器(Virtual Machine Monitor,VMM)的设计初衷是提高虚拟化系统的通用性和高效性,并没有充分考虑虚拟化系统的透明性,导致现有的VMM很容易被恶意软件的环境感知测试所发现;另一方面,源代码较为庞大和复杂,提供了很多恶意软件行为分析不需要的功能,带来了更多的“边缘效应”和漏洞。为此,提出一种基于硬件辅助虚拟化技术的恶意软件行为分析系统——THVA。THVA是一个利用了安全虚拟机(SVM)、二级页表(NPT)、外部设备访问保护(EAP)和虚拟机自省等多种虚拟化技术完成的、专门针对恶意软件行为分析的微型VMM。实验结果表明,THVA在虚拟机自省、行为监控和反恶意软件检测方面表现良好,%左右。
关键词:硬件辅助虚拟化;恶意软件行为分析;虚拟机自省;二级页表;外部设备访问保护
中图法分类号: 文献标识码:A
Design and achievement of malware analysis system based on Hardware-assisted Virtualization Monitor
LING Chong YU Zhong-hui SUN Le-chang LIU Jing-ju ZHANG Liang
(Electronic Engineering Institute, PLA, Hefei 230037, China)
Abstract: Malware analysis based on Hardware-assisted Virtualization Monitor has been recently presently, which utilize the strong isolation and the ability to control Guest OS of virtualization platform to analyze the malware runtime behavior. But there are two shortages: one is that the design motive of VMM is not for transparency but for functionality and performance, which induce VMM to be detected by malware’s virtualization environment detection; another is that VMM’s code are too large plex, and part of their function is unnecessary. These features bring more “side-effects” and vulnerabilities. Therefore, a malware analysis system based on Hardware-assisted Virtualization Monitor—THVA is presented. THVA is thin VMM, which only about 6000 lines code,utilizing the SVM, NPT, EAP and virtual machine introspection technologies to achieve, and special for malware analysis. The result of experiments shows that THVA is good for virtual machine introspection, behavior monitor and anti-detection, etc. In addi
tion, THVA utilizes the Security Mode Transition technology to enhance the performance itself for about %.
Key words: Hardware-assisted Virtualization Monitor; malware analysis; virtual machine intr