Osiris: A Malware Behavior Capturing System Implemented at Virtual Machine Monitor Layer

摘要: To perform behavior based malware analysis, capturing is an important prerequisite. In this paper, we present Osiris system which a tool to capture behaviors of executable files in Windows system. It collects API calls invoked not only by main process the analysis file, but also child processes are created process, injected if injection happens, and service creates services. By modifying source code Qemu, implemented at virtual machine monitor layer has following advantages. First, it does rewrite binary file or interfere with its normal execution, so that data obtained more stealthily transparently. Second, employs multi-virtual framework simulate network environment for stimulated large extend. Third, besides environment, simulates most common host events stimulate potential malicious malware. The experimental results show automates provides good detection algorithm.