一种恶意软件分析中检测虚拟环境的方法

A method to detect the presence of virtual environment in the analysis of malware

摘要:

安全厂商普遍使用虚拟环境来分析恶意软件，但是很多恶意软件都使用了检测虚拟机的技术来对抗对其的分析。文章介绍了3种主要的检测虚拟环境方法，给出了相应的对抗措施来防止对虚拟环境的检测。设计了一种新的基于性能比较的检查虚拟机和模拟器的方法，实验结果表明，该方法能够有效地检测出虚拟机和模拟器，如VMware软件和模拟器Qemu。

Abstract:

Security Companies usually apply virtual environment to analyze malware，whereas a large amount of current malware already adopts various VMware detection techniques in order to resist analysis. In this paper，three main methods for detecting the presence of virtual environment are presented，as well as their countermeasures. A performance related method to detect the presence of virtual machine or emulator is designed，which can successfully detect the presence of virtual environment，such as VMware and Qemu，etc.