CN102833240B - A kind of malicious code catching method and system - Google Patents

Abstract

The invention relates to a malicious code capturing method and system. The malicious code capture method includes: obtaining email data from various email data sources; analyzing the email data, recording files that cannot be excluded according to the set false negative rate in the email data as suspicious files, and recording the suspicious files The files are stored in the suspicious file database; the suspicious files are detected by using the malicious code feature database and manual detection, and the suspicious files whose detection results are abnormal are stored in the malicious code sample database. The method and system for capturing malicious codes of the present invention can be applied to related honeypots and honeynet systems, can increase the coverage of captured objects, and improve the ability to capture malicious codes.

Description

A malicious code capture method and system

technical field

The invention relates to the technical field of network information security, in particular to a malicious code capture method and system.

Background technique

Malicious codes such as network worms, Trojan horses, and botnets emerge in an endless stream, which has brought great harm to network information security. In order to better analyze and detect malicious codes, defenders should first research ways to obtain a large amount of malicious codes in the Internet, and honeypot and honeynet technologies emerged and gradually emerged. Honeypot technology means that defenders provide virtual or real hosts, servers, and other intelligent terminals, or simulate related services, to be scanned and invaded by attackers, and then achieve the purpose of obtaining relevant malicious codes. A honeynet is a network with a certain topology composed of several interrelated honeypots, which can be regarded as a large-scale distributed honeypot system. Generally speaking, honeypots are not used as normal hosts, servers, and other intelligent terminals. They are mainly used to attract attackers to invade, analyze and detect based on captured attack information, and then design relevant defense strategies to prevent or weaken attackers. hazards.

Traditional honeypots can be divided into three categories: virtual honeypots, virtual machine honeypots and physical honeypots. Virtual honeypots trick attackers into invading by simulating network topology, operating system, and network services. Although this type of honeypot occupies less resources, it has low interaction ability and can only capture low-interaction malicious codes, such as some network worms. A virtual machine honeypot is designed to lure attackers into invading through the design of certain loopholes or weaknesses in the virtual machine. The advantage of this type of honeypot is that it saves resources, supports certain interactions, and can obtain relatively complete attack information, but it is easy to be discovered by attackers using virtual machine detection technology, and loses the role of capturing malicious code. Physical honeypots use real devices and design certain loopholes or weaknesses to trick attackers into invading. This type of honeypot can highly interact with attackers and is not easy to be detected. However, physical honeypots are expensive and not suitable for large-scale deployment. .

In honeypot and honeynet technology, how to capture more malicious codes per unit time is one of the core issues, and this problem is closely related to the means of spreading malicious codes. Generally speaking, the means of dissemination of malicious code can be divided into two categories: one is to spread by exploiting vulnerabilities, and the other is to spread by using social engineering. Vulnerability propagation does not require interaction with victims, and traditional honeypot technologies are mostly designed based on such propagation methods. Social engineering communication is to achieve the purpose of deception and intrusion by analyzing and utilizing the victim's instinctive reaction, curiosity, trust, greed and other weaknesses. The communication process requires the participation of users. With the development of network services and applications, social engineering communication presents a trend of diversification and complexity. In recent years, more and more malicious codes have adopted such means of propagation (that is, social engineering propagation), such as Koobface, Stuxnet, Zues, etc.

Existing honeypots can capture malicious codes spread based on vulnerabilities very well, but for some malicious codes spread based on social engineering, there is still a lack of efficient capture methods, especially malicious codes spread using social engineering based on Email networks. code. This type of malicious code spreads along the veins of the Email network, pushes trap emails with malicious codes or access methods to user mailboxes, entices victims to execute the malicious codes in the trap emails, or Access (such as web page link download) malicious code and execute it, and then achieve the purpose of invading the victim's computer. This kind of malicious code often uses the victim's mailbox to send trap emails to the victim's Email friends, thereby infecting more Email users.

It can be seen that the above-mentioned malicious code may spread by using the trust relationship between users in the Email network. Email network is a social network formed by mailbox users through email contacts, and it is also an important application type of complex networks. Researchers usually abstract the complex network into a graph for analysis. For the above-mentioned Email network, each user mailbox is represented by a "point", and the emails and the number between users are represented by "edges" and "weights" (if a If there is no mail between two users, there is no border between the corresponding two points). In social networks, the average network distance is small, the clustering coefficient is large, and the node degree presents an exponential distribution.

However, the existing honeypot and honeynet technologies have not fully considered the malicious codes spread by social engineering based on the Email network, and have not made use of the above-mentioned social network features to capture more types of malicious codes. It can be seen that the existing honeypot and honeynet technologies cannot effectively capture large-scale malicious codes spread by social engineering based on the Email network.

Contents of the invention

The technical problem to be solved by the present invention is to provide a method and system for capturing malicious codes, which can improve the ability to capture malicious codes spread by social engineering based on Email network.

In order to solve the above technical problems, the present invention proposes a malicious code capture method, comprising:

Get email data from various email data sources;

Analyzing the mail data, recording the files in the mail data that cannot be excluded according to the set false negative rate as suspicious files, and saving the suspicious files in the suspicious file database;

The suspicious files are detected by using the malicious code feature database and manual detection, and the suspicious files whose detection results are abnormal are stored in the malicious code sample database.

Further, the above malicious code capture method may also have the following characteristics, including:

Obtain a malicious code sample from the malicious code sample database, run the malicious code sample in a sandbox, record the characteristic information of the malicious code sample and save it in the malicious code characteristic database.

Further, the above-mentioned malicious code capturing method may also have the following characteristics, before obtaining the email data from various email data sources, it also includes:

The selection and deployment algorithm of the e-mail terminal virtual honeypot is used to allocate and optimize the use of virtual honeypot resources. The selection and deployment algorithm of the e-mail terminal virtual honeypot is as follows: the e-mail network for malicious code propagation is abstracted into an A weighted directed graph model of a social network with the characteristics of a small-world model composed of points and edges, where a point represents an email account, an edge represents a communication email between email accounts, and the weight of an edge represents a communication email within a certain period of time The in-degree of a point indicates the number of senders at that point within a certain period of time, and the out-degree indicates the number of recipients at that point within a certain period of time.

Further, the above malicious code capture method may also have the following characteristics, the acquisition of mail data from various email data sources includes:

Obtain email data source information according to the preset first configuration information, and extract the type of email data source, the type of email data source is provided by the email terminal for automatic registration, volunteer email account or related institutions email data to remove private information;

If the e-mail data source is an e-mail terminal or a volunteer e-mail account for automatic application registration, when the polling period of the e-mail data source is up, obtain the pending e-mails of the e-mail data source, and the pending e-mails The mail data is written into a large amount of mail original information database, and the mail data includes the header information of the source code of the mail to be processed, the summary information generated according to the header information, the source text of the mail to be processed and the accessible files of the mail to be processed;

If the e-mail data source is the e-mail data without privacy information provided by the relevant organization, standardize the data of the e-mail data source, remove the private information of the e-mail to be processed, and write the e-mail data of the e-mail to be processed into a large amount of original e-mail information A database, wherein the email data includes header information of the source code of the email to be processed, abstract information generated according to the header information, the source code text of the email to be processed, and accessible files of the email to be processed.

Further, the above malicious code capture method may also have the following characteristics, the header information of the source code of the mail to be processed includes language, encoding type, attachment type, sender IP address information, recipient IP address information, IP-based Mail routing information.

Furthermore, the above malicious code capture method may also have the following features, the content of the summary information includes the recipient, sender, subject, length of the text, whether there are attachments, and the data source type of the email.

Further, the above-mentioned malicious code capture method may also have the following features: analyze the mail data, record the files in the mail data that cannot be excluded according to the set false negative rate as suspicious files, and save the suspicious files in the suspicious file. in the document database; including:

performing initialization according to preset second configuration information;

Analyzing the header information and source code text of the source code of the mail to be processed, and saving the abnormal header information and/or source code text to the malicious code sample database;

Filtering the accessible files of the pending emails according to the set false negative rate, excluding normal files, and storing the files that cannot be excluded as suspicious files in the suspicious file database.

Further, the above-mentioned malicious code capture method may also have the following characteristics, using the malicious code feature library and manual detection to detect the suspicious files, and saving the suspicious files whose detection results are abnormal to the malicious code sample database includes:

performing initialization according to preset second configuration information;

Detecting the suspicious file according to the malicious code feature information stored in the malicious code feature database, and saving the suspicious file containing the malicious code feature information into the malicious code sample database;

For suspicious files that cannot be detected according to the characteristic information of malicious codes, manual detection is performed according to a preset expert system, and new characteristic information generated by suspicious files judged to be malicious codes during the manual detection process is saved in the malicious code characteristic database.

In order to solve the above-mentioned technical problems, the present invention also proposes a malicious code capture system, comprising:

The acquisition module is used to acquire email data from various email data sources;

An analysis module, configured to analyze the mail data obtained by the acquisition module, record the files in the mail data that cannot be excluded according to the set false negative rate as suspicious files, and save the suspicious files in the suspicious file database;

The detection module is configured to use the malicious code feature database and manual detection to detect suspicious files output by the parsing module, and save suspicious files whose detection results are abnormal in the malicious code sample database.

Further, the above-mentioned malicious code capture system may also have the following characteristics, including:

The sandbox module is used to obtain a malicious code sample from the malicious code sample database, run the malicious code sample in the sandbox, record the characteristic information of the malicious code sample and save it in the malicious code characteristic database.

Further, the above-mentioned malicious code capture system can also have the following characteristics, and also includes the one connected with the acquisition module:

The algorithm selection module is used to allocate and optimize the use of virtual honeypot resources by adopting the selection and deployment algorithm of the virtual honeypot of the email terminal. The selection and deployment algorithm of the virtual honeypot of the email terminal is: The email network is abstracted as a weighted directed graph model of a social network with the characteristics of a small world model composed of points and edges, where a point represents an email account, an edge represents the communication between email accounts, and the weight of the edge Indicates the number of communication emails within a certain period of time, the in-degree of a point indicates the number of senders at that point within a certain period of time, and the out-degree indicates the number of recipients at that point within a certain period of time.

Further, the above-mentioned malicious code capture system may also have the following characteristics, and the acquisition module includes:

The extracting unit is used to obtain the email data source information according to the preset first configuration information, and extract the type of the email data source, the type of the email data source is an email terminal for automatic application registration, a volunteer email Account number or email data provided by related organizations;

The first acquisition unit is used to acquire new emails of the email data source when the email data source is an email terminal for automatic application registration or a volunteer email account, when the polling period of the email data source expires , write the mail data of the mail to be processed into the massive mail original information database, the mail data includes the header information of the mail source code to be processed, the summary information generated according to the header information, the source code body of the mail to be processed, and the text of the mail to be processed accessible files;

The second acquisition unit is used to standardize the data of the email data source when the email data source is the email data provided by the relevant organization, remove the private information of the email to be processed, and write the email data of the email to be processed Enter a massive mail original information database, the mail data includes the header information of the mail source code to be processed, the summary information generated according to the header information, the text of the mail source code to be processed and the accessible files of the mail to be processed.

Further, the above-mentioned malicious code capture system can also have the following characteristics, the header information of the source code of the mail to be processed includes language, encoding type, attachment type, sender IP address information, recipient IP address information, IP-based Mail routing information.

Further, the above malicious code capturing system may also have the following features, the content of the summary information includes the recipient, sender, subject, length of the text, whether there are attachments, and the data source type of the email.

Further, the above-mentioned malicious code capture system may also have the following characteristics, and the parsing module includes:

a first initialization unit, configured to perform initialization according to preset second configuration information;

A parsing unit, configured to parse the header information and source code text of the email source code to be processed, and save the abnormal header information and/or source code text to the malicious code sample database;

The filtering unit is configured to filter the accessible files of the mail to be processed according to the set false negative rate, exclude normal files, and store files that cannot be excluded as suspicious files in the suspicious file database.

Further, the above-mentioned malicious code capture system can also have the following characteristics, and the detection module includes:

a second initialization unit, configured to perform initialization according to preset second configuration information;

The first detection unit is configured to detect the suspicious file according to the malicious code characteristic information stored in the malicious code characteristic database, and save the suspicious file containing the malicious code characteristic information in the malicious code sample database;

The second detection unit is used to manually detect suspicious files that cannot be detected according to the characteristic information of malicious codes according to a preset expert system, and save new characteristic information generated by suspicious files that are judged as malicious codes during the manual detection process. to the malicious code signature database.

The method and system for capturing malicious codes of the present invention can be applied to related honeypots and honeynet systems, can increase the coverage of captured objects, and improve the ability to capture malicious codes.

Description of drawings

Fig. 1 is the flowchart of the acquisition steps of malicious code capturing method in the embodiment of the present invention;

Fig. 2 is the flowchart of the analysis steps of malicious code capture method in the embodiment of the present invention;

Fig. 3 is the flowchart of the detection step of malicious code capture method in the embodiment of the present invention;

Fig. 4 is a structural diagram of a malicious code capturing system in an embodiment of the present invention.

detailed description

The principles and features of the present invention are described below in conjunction with the accompanying drawings, and the examples given are only used to explain the present invention, and are not intended to limit the scope of the present invention.

The invention adopts the selection and deployment algorithm of the Email terminal virtual honeypot to allocate and optimize the use of virtual honeypot resources. This algorithm (that is, the selection and deployment algorithm of the virtual honeypot of the Email terminal, the same below) abstracts the Email network where the malicious code spreads into a social network weighted directed graph model composed of points and edges with the characteristics of a small-world model (denote is G=<V, E>). Among them, a point (denoted as v _i ) represents an Email account, an edge (denoted as e _k ) represents the communication email between Email accounts, and the weight of the edge (denoted as w(e _k )) represents the number of communication mails within a certain period of time. Quantity, the in-degree of a point (recorded as id(v _i )) indicates the number of senders at this point within a certain period of time, and the out-degree (recorded as od(v _i )) indicates the number of recipients at this point within a certain period of time. The main idea of the algorithm is: to conduct cluster analysis on the Email network, find out the sub-network with a higher average clustering coefficient in the network, obtain the available Email accounts in the sub-network, according to the in-degree and activity of the point (unit time) The number of sent emails) and the clustering coefficient are weighted to calculate the comprehensive evaluation index (the weight is configured and adjusted by the administrator), and the above-mentioned Email accounts are sorted in descending order according to the index value, and the predetermined number (configured and adjusted by the administrator) is extracted. Email account, join the virtual honeypot collection. For example, administrators can select nodes with higher ingress, activity, and clustering coefficients (for example, terminals with the top 30% of the three indicators) according to the attributes and characteristics of the actual Email network to calculate comprehensive evaluation indicators.

The present invention proposes a kind of malicious code capture method, and this method comprises the following steps:

Step 1, obtaining email data from various email data sources;

Step one is called the acquisition step.

Among them, the types of email data sources can include three types: Email terminals for automatic application registration, email accounts of volunteers, and private email data provided by relevant organizations (such as email service providers). The first two categories can be classified as email account information, and the last category is called coordination email data. "Removing privacy information" refers to the automatic or semi-automatic replacement of real people and events that may be involved in email data on the premise of basically satisfying the need to obtain suspicious files, so as to protect personal privacy and sensitive information.

The Email terminal is used as a virtual honeypot, and the small-world network characteristics of the Email network are used to deploy a virtual honeypot to form a virtual honeynet with a specific topology, which can capture more malicious codes more effectively. A "small-world network" is a type of graph in a dynamical network in which most of the nodes in this graph can form communication links through a small number of other nodes. Small-world network characteristics mainly include: clustering coefficient, average path length and node degree distribution.

In the embodiment of the present invention, the mail data may include header information of email source code, abstract information generated according to the header information, email source code text and email accessible files. Wherein, an email accessible file refers to an attachment that can be directly extracted from an email, such as an embedded picture in an email body, a hyperlink downloadable file in an email, or an attachment file of an email. Summary information is an abstraction of the entire email. The content of the summary information may include the number of words in the email, the size of email attachments, and the storage location of email attachments.

FIG. 1 is a flow chart of the acquisition steps of the malicious code capture method in the embodiment of the present invention. As shown in Figure 1, in the embodiment of the present invention, the obtaining step (that is, step 1) may specifically include the following sub-steps:

Step 101, obtaining email data source information;

Specifically, email data source information may be acquired according to the first configuration information, and the type of email data source (Email account information or coordinated mail data) may be extracted. . Wherein, the first configuration information is preset by the administrator. The content of the first configuration information suspiciously includes the address of the original information database of massive emails, the access account password, the email terminal account information list, and the like.

Step 102, judging whether it is email account information, if so, execute step 103, otherwise execute step 111;

Step 103, obtaining the last access time of the target account;

Here, the target account refers to the email account in step 102.

Step 104, judging whether the polling cycle of the target account is reached, if so, execute step 105, otherwise execute step 109;

Step 105, accessing the target account;

Step 106, judging whether the target account has new emails, if so, go to step 107, otherwise go to step 109;

The new email of the target account is the target email mentioned below, that is, the pending email.

Step 107, generating summary information of the target email;

The target email is the pending email, the same below.

Step 108, writing the source text and summary information of the target email into a massive email original information database;

At the same time, the accessible file of the target mail can also be stored in the file system related to the database, and the file path of the accessible file of the target mail can be written into the massive mail original information database.

Step 109, judging whether it is the last target account, if so, execute step 118, otherwise execute step 110;

Step 110, locate the next account, and execute step 103;

Step 111, judging whether it is coordination mail data, if so, execute step 112, otherwise execute step 118;

Step 112, standardize the multi-source email data;

Here, "standardized processing" refers to uniform processing of mail data from different mail data sources, extracting and generating mail source codes in a unified format and recognizable by the system (such as eml file format).

Step 113, locate the target mail;

Step 114, removing the private information of the target email;

Step 115, generating summary information of the target email;

Suspicious content of the summary information includes the email recipient, sender, subject, body length, attachment, email data source type, etc.

Step 116, writing the target email and summary information into a massive email original information database;

Step 117, judging whether there are unprocessed mails, if so, execute step 113, otherwise execute step 118;

Step 118, end.

Step 1 uses a variety of email data sources as system input, which can capture malicious codes spread based on Email networks on a large scale.

Step 2, analyzing the mail data, recording the files in the mail data that cannot be excluded according to the set false negative rate as suspicious files, and saving the suspicious files in the suspicious file database;

Step two is called the parsing step.

Fig. 2 is a flow chart of the analysis steps of the malicious code capture method in the embodiment of the present invention. As shown in Figure 2, in the embodiment of the present invention, the parsing step (that is, step 2) may specifically include the following sub-steps:

Step 201, initialize according to the second configuration information;

The initialization in this step refers to initialization of parameters, resources, and the like.

The second configuration information is preset by the administrator. The content of the second configuration information may include the number of parsed emails, the number of available servers, database address information, and the like. Another item in the second configuration information is "the number of crawler programs". In the present invention, the number of crawler programs is greater than 1. Therefore, the present invention uses parallel crawler technology.

Step 202, analyzing email header information;

Email header information can include language, encoding type, attachment type, sender IP address information, recipient IP address information, IP-based mail routing information, etc.

Step 203, determine whether the header information is abnormal, if so, execute step 204, otherwise execute step 205;

Specifically, according to the standard format of the mail protocol, any mail whose header format does not match is regarded as abnormal. There are various situations for judging that the header is abnormal. For example, whether the header information is abnormal can be judged according to the following abnormality of the header information. Abnormal header information includes: there is forged information in the header information, the sender’s IP has been tampered with, the sender’s address has been tampered with, the sender’s name has been tampered with, and so on.

Step 204, record abnormal information into the database of suspicious files, and execute step 205;

Step 205, analyzing email content information;

The email content is also the email body.

Step 206, judging whether there is a link to the accessible file, if so, execute step 209, otherwise execute step 207;

Among them, the accessible files include pictures embedded in the body of the email, files that can be downloaded by hyperlinks, files in attachments, and so on.

Step 207, judging whether the content of the email is abnormal, if so, execute step 208, otherwise execute step 213;

Abnormal email content includes forged information in the body and forged information in attachments. Abnormal email contents are mainly divided into forgery of text and forgery of attachments. Forgery of text includes forgery of email header information and forgery of email body content information; there are many types of attachment forgery, including bundling executable files with attachment files, stealing illegal data, Tampering with normal file formats, etc.

Step 208, record abnormal information into the database of suspicious files, and execute step 213;

Step 209, extracting or crawling accessible files;

It can be seen from the above steps 206, 207 and 209 that the collection method in the present invention is an active collection method that supports interaction.

Step 210, judging whether the accessible file in step 209 can be judged as a normal file, if so, go to step 212, otherwise go to step 211;

This step preliminarily filters accessible files, which can exclude normal files with a high rate of false positives. Files that cannot be excluded are suspicious files. These suspicious files may be malicious code and require further detection. The "missing negative rate" is set by the administrator in the configuration. The value range of the false negative rate is (0,1). Generally, a false negative rate of more than 50% is set to ensure the lowest possible false positive rate.

Step 211, store in suspicious file database, execute step 213;

Step 212, delete the target file;

Step 213, end.

The embodiment shown in Fig. 2 is based on parallel crawler technology and mass email analysis technology, and obtains suspicious malicious code samples from relevant Email terminals in an active collection mode that supports interaction, which makes up for the passive acquisition of honeypot and honeypot technology in the prior art The lack of malicious code enhances the capture. "Parallel crawler technology" refers to running several crawler programs on one server at the same time, starting multiple such servers at the same time, and sharing a database. And "active collection that supports interaction" refers to the ability to simulate the behavior of email users to obtain malicious codes spread by social engineering, such as: identifying hyperlinks in emails and accessing related files, interacting with malicious sending sources to obtain suspicious files, etc.

Step 3, using the malicious code feature database and manual detection to detect the suspicious files obtained in step 2, and saving the suspicious files whose detection results are abnormal to the malicious code sample database;

Step three is called the detection step.

Fig. 3 is a flow chart of the detection steps of the malicious code capture method in the embodiment of the present invention. As shown in Figure 3, in the embodiment of the present invention, the detection step (that is, step 3) may specifically include the following sub-steps:

Step 301, initialize according to the third configuration information;

The initialization in this step refers to initialization of parameters, resources, and the like.

The third configuration information is preset by the administrator. The content of the third configuration information may include configuring the number of merging processing processes, the number of malicious code detection servers, the analysis and detection time of the expert system, and the like.

Step 302, suspicious files are merged and processed;

Here, the integration process is an abbreviation of "induction and integration" process. The merging process adopts merging processing for similar files, file comparison deduplication and merging processing based on hash (hash) algorithm, etc., to reduce storage space and save subsequent calculation costs.

Step 303, malicious code detection based on the feature database (referring to the malicious code feature database, the same below);

The specific method based on the signature database detection can be: if the suspicious file contains the signature code in the malicious code signature database, then the suspicious file is malicious code; if the suspicious file does not contain the signature code in the malicious code signature database, then the suspicious file is not Malicious code.

Step 304, judging whether the suspicious file can be judged, if so, go to step 305, otherwise go to step 307;

Step 305, judge whether the target file is malicious code, if execute step 306, otherwise execute step 312;

Step 306, storing the file to the malicious code sample database;

In this step, the files stored in the malicious code sample database refer to suspicious files judged to be malicious codes based on the malicious code feature database.

Step 307, analysis and detection based on expert system;

The "expert system" mentioned in the present invention is an extension of the traditional expert system. It takes a number of security experts with experience in malicious code analysis as the core, takes the suspicious files of this method as input, and uses reverse analysis techniques and behaviors of manual participation. Analysis technology judges malicious codes, and then makes up for the lack of automatic detection methods, and discovers unknown malicious codes that cannot be detected by automatic detection methods.

Step 308, judge whether the target file is malicious code, if execute step 309, otherwise execute step 312;

Step 309, storing the file to the malicious code sample database;

Step 310, judging whether there are new features of malicious code, if so, execute step 311, otherwise execute step 312;

Step 311, optimize the malicious code feature database, and execute step 303;

If during the detection process based on the expert system, the target malicious code generates a new feature code, the new feature code is stored in the malicious code feature database to optimize the malicious code feature database and improve detection accuracy and efficiency.

Step 312, end.

Step 4: Obtain a malicious code sample from the malicious code sample database, run the malicious code sample in a sandbox, record the characteristic information of the malicious code sample and save it in the malicious code characteristic database.

The sandbox mentioned in step four can be any sandbox. In a preferred embodiment of the invention, a lightweight sandbox may be employed. The lightweight sandbox can save computing resources to a certain extent.

Malicious code capture method of the present invention can be realized with computer program, and these programs can use C/C ++, Python language development, use PHP, JavaScript language development foreground interface, use Mysql to build relevant database, and use self-defined file storage mode to store relevant data Data information.

The malicious code capturing method of the present invention has the following beneficial effects:

1) Select Email terminals as virtual honeypots to form a distributed virtual honeynet, which greatly reduces the cost of honeynet construction and deployment, and can quickly and effectively capture more email network malicious codes;

2) Using crawler-based in-depth interactive collection methods and massive email analysis methods, it makes up for the shortcomings of honeypots and passive methods of honeypot technology, and can capture more complex email network malicious codes;

3) Using and processing multiple email data sources as input can greatly increase the scope and comprehensiveness of capturing email network malicious code.

The malicious code capture method of the present invention can be applied to related honeypots and honeynet systems, can increase the coverage of captured objects, and improve the capture capability of malicious codes.

The present invention also proposes a system for capturing malicious codes, which is used to implement the above method for capturing malicious codes.

Fig. 4 is a structural diagram of a malicious code capturing system in an embodiment of the present invention. As shown in FIG. 4 , in this embodiment, the malicious code capture system includes an acquisition module 410 , an analysis module 420 , a detection module 430 and a sandbox module 440 connected in sequence. Wherein, the acquiring module 410 is used for acquiring mail data from various email data sources. The parsing module 420 is used for parsing the email data acquired by the acquisition module 410, recording files in the email data that cannot be excluded according to the set false negative rate as suspicious files, and saving the suspicious files in the suspicious file database. The detection module 430 is used to detect suspicious files output by the parsing module 420 by using the malicious code feature database and manual detection, and save suspicious files whose detection results are abnormal in the malicious code sample database. The sandbox module 440 is used to obtain a malicious code sample from the malicious code sample database, run the malicious code sample in the sandbox, record the characteristic information of the malicious code sample and save it in the malicious code characteristic database.

In other embodiments of the present invention, the malicious code capture system may not have the sandbox module 440 .

In other embodiments of the present invention, the algorithm selection module that can also be connected with the acquisition module 410 in the malicious code capture system is used to allocate and optimize the use of virtual honeypot resources by using the selection and deployment algorithm of the virtual honeypot of the email terminal, The selection and deployment algorithm of the e-mail terminal virtual honeypot is as follows: the e-mail network for malicious code propagation is abstracted into a social network weighted directed graph model composed of points and edges with the characteristics of a small-world model. Represents an e-mail account, the edge represents the communication between e-mail accounts, the weight of the edge represents the number of communication e-mails within a certain period of time, the in-degree of a point represents the number of senders at that point within a certain period of time, and the out-degree represents a certain The number of recipients at that point in time.

Wherein, the acquiring module 410 may further include an extracting unit, a first acquiring unit and a second acquiring unit. The extracting unit is used to obtain email data source information according to the preset first configuration information, and extract the type of email data source, the type of email data source is an email terminal for automatic application registration, volunteer email account or related Email data provided by the institution. The first acquisition unit is used to acquire new emails of the email data source when the email data source is an email terminal for automatic application registration or a volunteer email account, when the polling period of the email data source expires, Write the email data of pending emails into a massive database of original email information. The email data includes the header information of the source code of the email to be processed, the summary information generated according to the header information, the body of the source code of the email to be processed, and the accessible files of the email to be processed. The second acquisition unit is used to standardize the data of the email data source when the email data source is the email data provided by the relevant organization, remove the private information of the mail to be processed, and write the mail data of the mail to be processed into Massive mail original information database, mail data includes the header information of the source code of the mail to be processed, the summary information generated according to the header information, the body of the source code of the mail to be processed and the accessible files of the mail to be processed.

Wherein, the header information of the mail source code to be processed may include language, encoding type, attachment type, sender's IP address information, recipient's IP address information, IP-based mail routing information, and the like.

Wherein, the content of the summary information may include the recipient, sender, subject, length of the text, whether there are attachments, the type of the data source of the email, etc. of the email.

The parsing module 420 may further include a first initialization unit, a parsing unit and a filtering unit. The first initialization unit is configured to perform initialization according to preset second configuration information. The parsing unit is used for parsing the header information and the source code body of the mail source code to be processed, and saving the abnormal header information and/or source code body into the malicious code sample database. The filtering unit is used to filter the accessible files of the mail to be processed according to the set false negative rate, exclude normal files, and save the files that cannot be excluded as suspicious files to the suspicious file database.

The detection module 430 may further include a second initialization unit, a first detection unit and a second detection unit. The second initialization unit is configured to perform initialization according to preset second configuration information. The first detection unit is used to detect suspicious files according to the malicious code characteristic information stored in the malicious code characteristic database, and save the suspicious files containing the malicious code characteristic information in the malicious code sample database. The second detection unit is used to manually detect suspicious files that cannot be detected based on malicious code feature information according to a preset expert system, and save new feature information generated by suspicious files that are judged to be malicious code in the manual detection process to the malicious code. feature database.

The workflow of the malicious code capture system of the present invention is the same as the aforementioned malicious code capture method of the present invention, and will not be repeated here.

The meaning of each noun in the malicious code capturing system of the present invention is the same as that of the same nouns in the description of the malicious code capturing method of the present invention, so no repeated explanations will be given for the terms appearing in the malicious code capturing system.

The malicious code capturing system of the present invention has the following beneficial effects:

1) Select Email terminals as virtual honeypots to form a distributed virtual honeynet, which greatly reduces the cost of honeynet construction and deployment, and can quickly and effectively capture more email network malicious codes;

2) Using crawler-based in-depth interactive collection methods and massive email analysis methods, it makes up for the shortcomings of honeypots and passive methods of honeypot technology, and can capture more complex email network malicious codes;

3) Using and processing multiple email data sources as input can greatly increase the scope and comprehensiveness of capturing email network malicious code.

The malicious code capture system of the present invention can be applied to related honeypots and honeynet systems, can increase the coverage of captured objects, and improve the capture capability of malicious codes.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection of the present invention. within range.

Claims (14)

1. a malicious code catching method, is characterized in that, comprising:

Mail data is obtained from multiple e-mail data source;

Resolve described mail data, be apocrypha by the file record cannot got rid of according to the rate of failing to report of setting in described mail data, and this apocrypha is saved in apocrypha database;

Utilizing malicious code property data base and manual detection to detect described apocrypha, is that abnormal apocrypha is saved in described malicious code sample database by testing result; Specifically comprise:

The second configuration information according to presetting carries out initialization;

Malicious code characteristic information according to preserving in malicious code property data base detects described apocrypha, and the apocrypha comprising described malicious code characteristic information is saved in malicious code sample database;

For the apocrypha that cannot detect according to described malicious code characteristic information, expert system according to presetting carries out manual detection, will be judged to be that the new feature information that the apocrypha of malicious code produces is saved in malicious code property data base in manual detection process.

2. malicious code catching method according to claim 1, is characterized in that, also comprise:

From described malicious code sample database, obtain malicious code sample, in sandbox, run this malicious code sample, record the characteristic information of this malicious code sample and be saved in described malicious code property data base.

3. malicious code catching method according to claim 1, is characterized in that, described from multiple e-mail data source, obtain mail data before, also comprise:

The selection of e-mail terminal Virtual honeypot and Deployment Algorithm is adopted to distribute and optimize the use of Virtual honeypot resource, selection and the Deployment Algorithm of described e-mail terminal Virtual honeypot are: the electronic mail network propagated by malicious code is abstract is a social networks Weighted Directed Graph model with Small World Model feature formed with point and limit, wherein, point expression email accounts, while represent the communication mail between email accounts, the weights on limit represent the quantity of communication mail in certain hour, the in-degree of point represents sender's quantity of this point in certain hour, out-degree represents addressee's quantity of this point in certain hour.

4. malicious code catching method according to claim 1, is characterized in that, describedly from multiple e-mail data source, obtains mail data comprise:

The first configuration information according to presetting obtains e-mail data source information, and extract the kind in e-mail data source, what e-mail terminal, volunteer's email accounts or associated mechanisms that the kind in described e-mail data source is applied for the registration of for automation provided removes privacy information mail data;

The e-mail terminal that if e-mail data source is automation applies for the registration of or volunteer's email accounts, polling cycle then in this e-mail data source then, obtain the pending mail in this e-mail data source, by the mail data of this pending mail write mass mailings original information data storehouse, the header information that described mail data comprises pending mail source code, the summary info, the source code text of pending mail and the accessible file of pending mail that generate according to this header information;

If what e-mail data source provided for associated mechanisms removes privacy information mail data, then standardization is carried out to the data in this e-mail data source, remove the privacy information of pending mail, by the mail data of pending mail write mass mailings original information data storehouse, the header information that described mail data comprises pending mail source code, the summary info, the source code text of pending mail and the accessible file of pending mail that generate according to this header information.

5. malicious code catching method according to claim 4, it is characterized in that, the header information of described pending mail source code comprises languages, type of coding, type of attachment, sender IP address's information, addressee IP address information, IP-based mail routing information.

6. malicious code catching method according to claim 4, is characterized in that, the content of described summary info comprise the addressee of Email, sender, theme, text size, with or without annex, e-mail data Source Type.

7. malicious code catching method according to claim 4, it is characterized in that, resolve described mail data, be apocrypha by the file record cannot got rid of according to the rate of failing to report of setting in described mail data, and this apocrypha is saved in apocrypha database; Comprise:

The header information of described pending mail source code and source code text are resolved, the header information of exception and/or source code text are saved in malicious code sample database.

8. a malicious code capture systems, is characterized in that, comprising:

Acquisition module, for obtaining mail data from multiple e-mail data source;

Parsing module, for resolving the mail data that described acquisition module obtains, being apocrypha by the file record cannot got rid of according to the rate of failing to report of setting in described mail data, and being saved in apocrypha database by this apocrypha;

Testing result, for utilizing malicious code property data base and manual detection to detect the apocrypha that described parsing module exports, is that abnormal apocrypha is saved in described malicious code sample database by detection module; Described detection module comprises:

Second initialization unit, for carrying out initialization according to the second configuration information preset;

First detecting unit, for detecting described apocrypha according to the malicious code characteristic information preserved in malicious code property data base, is saved in malicious code sample database by the apocrypha comprising described malicious code characteristic information;

Second detecting unit, for for the apocrypha that cannot detect according to described malicious code characteristic information, expert system according to presetting carries out manual detection, will be judged to be that the new feature information that the apocrypha of malicious code produces is saved in malicious code property data base in manual detection process.

9. malicious code capture systems according to claim 8, is characterized in that, also comprise:

Sandbox module, for obtaining malicious code sample from described malicious code sample database, runs this malicious code sample in sandbox, records the characteristic information of this malicious code sample and is saved in described malicious code property data base.

10. malicious code capture systems according to claim 8, is characterized in that, also comprises being connected with described acquisition module:

Algorithms selection module, distribute for adopting the selection of e-mail terminal Virtual honeypot and Deployment Algorithm and optimize the use of Virtual honeypot resource, selection and the Deployment Algorithm of described e-mail terminal Virtual honeypot are: the electronic mail network propagated by malicious code is abstract is a social networks Weighted Directed Graph model with Small World Model feature formed with point and limit, wherein, point expression email accounts, while represent the communication mail between email accounts, the weights on limit represent the quantity of communication mail in certain hour, the in-degree of point represents sender's quantity of this point in certain hour, out-degree represents addressee's quantity of this point in certain hour.

11. malicious code capture systems according to claim 8, it is characterized in that, described acquisition module comprises:

Extraction unit, for obtaining e-mail data source information according to the first configuration information preset, and extract the kind in e-mail data source, the e-mail data that e-mail terminal, volunteer's email accounts or associated mechanisms that the kind in described e-mail data source is applied for the registration of for automation provide;

First acquiring unit, for in e-mail data source be automation apply for the registration of e-mail terminal or volunteer's email accounts time, polling cycle in this e-mail data source then, obtain the new mail in this e-mail data source, by the mail data of pending mail write mass mailings original information data storehouse, the header information that described mail data comprises pending mail source code, the accessible file of summary info, pending mail source code text and pending mail generated according to this header information;

Second acquisition unit, for provide for associated mechanisms in e-mail data source e-mail data time, standardization is carried out to the data in this e-mail data source, remove the privacy information of pending mail, by the mail data of pending mail write mass mailings original information data storehouse, the header information that described mail data comprises pending mail source code, the accessible file of summary info, pending mail source code text and pending mail generated according to this header information.

12. malicious code capture systems according to claim 11, it is characterized in that, the header information of described pending mail source code comprises languages, type of coding, type of attachment, sender IP address's information, addressee IP address information, IP-based mail routing information.

13. malicious code capture systems according to claim 11, is characterized in that, the content of described summary info comprise the addressee of Email, sender, theme, text size, with or without annex, e-mail data Source Type.

14. malicious code capture systems according to claim 11, it is characterized in that, described parsing module comprises:

Resolution unit, for resolving the header information of described pending mail source code and source code text, is saved in malicious code sample database by the header information of exception and/or source code text.