Unknown virus precautionary technology of the mainstream
The unknown virus takes precautions against the technical main mentality of designing is: Since the anti-virus engineer can judge whether a procedure is the virus accurately through behavior of the analysis program, could the the intersection of analysis and judgement and process automation, routinization then? The fact proves, this can be realized. Through analyzing, summing up, summarizing about the behavioral law of virus, and combine the experience that the anti-virus expert judges the virus, refine into virus and discern the regular knowledge base. Imitate the mechanism that the expert finds the new virus, through the numerous probes distributed in operating system, monitor the run program dynamically, transfer various movements of API, analyze a series of movements of the procedure that makes up the significant behavior through the logical relationship, and then the virus of integrated application discerns regular knowledge, realize that judges the virus automatically.
Xu Liu think unknown virus take precautions against technical key thinking, by with artificial anti-virus Expert System to defend the software while being initiative, the automatic analysis program behavior on user's computer, discern independently, quote and combine virus of automatic erase clearly. This is technical " Gold three rules " Including: First, can discern the unknown virus independently; Second, can quote the unknown virus clearly; Third, to unknown virus can automatic erase.
The unknown virus takes precautions against the technology system must regard possessing the anti-virus Expert System of dynamic simulation as the prerequisite, regard judging the unknown virus accurately automatically as and basically demand, control as security mechanism with the procedure behavior.
Defend the concept in the face of being present and varied and initiative, how to distinguish this? Liu Xu points out, like all anti-virus technology, the unknown virus precautionary technology must realize too that judge the properties of the procedure clearly. It is the virus, should call the police and point out users and find the virus clearly. If just the single movements to the procedure call the police, users judge whether this movement is threatened, it is not the initiative defence. The procedure movements spoken herein, mean the anti-virus software controls to the procedure and transfers a certain API that Windows offered. API is the function that Windows offers for program development, the normal procedure can use, the virus can be used too. That is to say, API does not have the difference of good and evil, if only call the police according to a movement of the procedure, then NORMSUB normal subscribers are really difficult to judge whether this movement is harmful on earth, will feel at a loss as to what to do even more, this is not obviously computer user's required anti-virus technology.
In the course of haggling with unknown virus, virtual machine technology, heuristic technology and sandbox technology are edge tolls in the hand of anti-virus manufacturer. The virtual machine technology is the technology that the use virtual machine operates paying and controlling to the computer virus, the virtual machine here means it is totally fictitious (Pure Emulator) . The intersection of virtual machine and technology to transfer whom system,etc. finish through imitate the intersection of CPU and command system, the intersection of memory and supervising system, operating system, API, this is a pure virtual environment, the virus runs among them, totally isolate with the present system. Can realize shell, the intersection of behavior and the intersection of person who judge and many kinds of functions of virus under the virtual environment.
Now, the virtual machine technology has a very large number of application in the antivirus software too, especially in the heuristic technology of killing virus. Heuristic technology screens and possesses the characteristics of virus by some characteristics to the computer virus mainly. Heuristic to divide two kinds: One kind is inspired dynamically, one is inspired by static behavior.
Dynamic inspiration utilizes the above-mentioned virtual machine function, operate the virus under the environment of virtual machine, control the behavior of the virus to realize. For example which have API of danger in the virus call, what key values of registration table are revised, what files,etc. are established. The ones that inspired depended on the virtual machine virtual depth deeply dynamically.
It is generally through mating and measuring the unique key word of virus that the static behavior is inspired. For example can not present the magnetic disc and read and write order int 13 in the Boot sector, through to have int 13 judgement of order come, brief user on, might infect the virus of Boot sector in the 512 sector. We can summarize the character string in some common virus, universal code,etc. to inspire the file to be the virus too, the rate of accuracy of this kind of inspiration is quite high.
Ding Kai, anti-virus expert of Jiang Min Company, introduces to the reporter, sandbox technology is an analog environment too in fact, the virus can run without destroying the system resource in this environment arbitrarily. The difference between it and virtual machine lies in: The operation of the sandbox is with present system resource, such as the execution of API, out of order deployment,etc., generally intercept API by way of hook. The resources that and the virtual machine uses (such as API) Need to come out completely fictitiously by oneself, do not transfer the existing resources of the system. Can understand like this, " initiative defence " that prevailed several years ago Technology was realized through the method of hook API too, it is a kind of technology of judging dynamic behavior in the Windows layer, it is a technical subset of sandbox, only intercept and not track back the function. And sandbox technology can make the virtual environment get back to the procedure a bit more primitive.
Sandbox can can be regarded as one development of virtual machine, his technological principle seem even and the virtual machine is roughly the same, but they still have difference greatly. The sandbox is a kind of more deep intrasystem kernel technology, during a program execution, the sandbox knows the take over procedure and transfers the behavior in the interface or function, and will implement " rolls " after confirming the virus behavior The mechanism, let recover systematically. The virtual machine does not possess and roll to recover the mechanism, after stimulating the virus, the fictitious chance judges it is a certain viroid according to the behavioural trait of the virus, and transfer the engine to remove this virus, there are essential differences between the two.
