What is the antivirus setting called DeepScreen?

hx1997

http://blog.avast.com/2014/02/07/research-buzz-undercover-technology/

tl;dr  DeepScreen 分为两个组件：avast! 沙盒和 SafeMachine 2（一个动态二进制翻译工具及通用解包器）。

DeepScreen is a new technology inside avast! Antivirus 2014. When you are about to run a suspicious program which is not yet known to the other core antivirus technologies, DeepScreen is invoked. Its task is to simply distinguish between good and bad software. Although it seems obvious and simple, it is not.

How DeepScreen uses The Force for good

This (magic) technology is served by two software components (the Jedi, if you will) which work hand-in-hand. One of them is well known from the past: The avast! Sandbox.

When a file is “DeepScreened,” it is actually run in the Sandbox, which is mainly responsible for keeping things isolated while watching for various high-level events and behavior of the program running. For example, it monitors the system call invocation and overall behavior of the program which is being executed. This seems to be just enough to distinguish between the Dark Side and the Light Side of the Force, but unfortunately, it is not that simple.

Firstly, how can you tell good and bad behavior apart? There are plenty of legitimate software products that use “weird” techniques to protect themselves. On the other hand, there is a bunch of malware samples that look innocent and behave well.

Secondly, malware is used to hiding away from the vigilant eyes of the Sandbox. The most common and powerful technique is encryption. In fact, there are more ways of encrypting and packing these well - known bad guys and rendering them undetectable than there are distinct malware samples.

SafeMachine: The new Jedi Order

Now, let me introduce you to our new good guy: SafeMachine 2, a dynamic binary instrumentation tool and generic unpacker. Yes, a real Jedi Knight!

With the latest version of avast! Antivirus 2014, this technology is fully involved in fighting the bad guys. Whenever DeepScreen runs something in the Sandbox, it also performs binary instrumentation of the process.


So what exactly is dynamic binary instrumentation? It is a fine-grained analysis of the running code, achieved by disassembling it on the fly, instruction by instruction, and watching for interesting low-level code events and their effects on the underlying memory. This way we can see various obfuscation techniques used mainly to delay the execution of the “bad code” in order to avoid its detection by the behavioral shield. We are also able to see the diverse decryption loops and the memory buffers where these decryption loops decrypt their payload. This is the most important SafeMachine 2 feature. In other words, we let the bad guy reveal himself and then we fling him out naked to our string scanner, which in turn looks for well-known malware patterns and… Hey look, there is a string we already know!

Is this approach successful, is there any measurable gain in the number of detections?

Absolutely! After approximately three months of this technology working, we have seen a nearly 15% growth in detections in DeepScreen contributed by the SafeMachine technology. And almost all of these malware samples were known before; they were just so obfuscated and packed, that the static analysis couldn’t see them.

Here in Avast research, we are constantly enhancing and bettering this technology to reach its full detection potential and to increase the level of your protection.

Acknowledgement:

The author would like to thank to all of his colleagues who have been pushing this technology to a new level over the past two years, namely Jakub Jermar who put an incredibly huge amount of his work into this beast, Jan Gahura  author of the original DBI concept and the first version of SafeMachine, and Research and Virus Lab teams who made this happen. Credits go to Brett Jordan for the picture of Darth Vader in trouble.

下一世的轮回

采用谷歌翻译，小部分自己的渣补充！水平有限，求大神指点！


deepscreen是一种新的技术在avast！2014杀毒。你要运行一个可疑的程序，没有已知的其他反病毒技术的核心时，deepscreen调用。它的任务是简单区分好的和坏的软件之间的。虽然这似乎是显而易见的，简单的，它不是。

如何deepscreen用善的力量

这（魔法）技术是由两个软件组件服务（绝地，如果你愿意），携手。其中之一是众所周知的从过去：avast！沙盒。

当一个文件被“deepscreened，“这实际上是运行在沙箱，这主要是负责保持隔离，看各种高层次的事件和行为的程序运行。例如，它监视正在执行的程序的系统调用和整体行为。这似乎是足以区分黑暗与光明之间的力，但不幸的是，这并不简单。

首先，你怎么能分辨好的和坏的行为吗？有合法的软件产品，使用“古怪”的技术来保护自己，很多。另一方面，有一些恶意软件样本，看看无辜和表现良好。

其次，恶意软件是用来躲避沙箱的警惕的眼睛。最常见的和强大的技术是加密的。事实上，有更多的加密方式和包装这些著名的坏人和使他们不比有明显的恶意软件样本。

safemachine：新绝地武士团

现在，让我向你介绍我们的新好男人：safemachine 2，动态二进制仪器仪表工具和通用的解包。是的，一个真正的绝地武士！

最新版本的avast！2014杀毒，该技术充分参与对抗坏人。每当deepscreen约莫在沙盒中，也执行过程的二进制仪器。

那么什么是动态二进制仪器？这是运行的代码的细粒度的分析，通过分解它飞了，指令的指令，和看有趣的低级别的代码事件和潜在的记忆效果。这样，我们可以看到主要用于以行为盾避免检测的“恶意代码”的执行延迟各种混淆技术。我们也能看到不同的解密循环和内存缓冲这些解密的解密其有效载荷循环。这是最重要的safemachine 2特征。换句话说，我们让坏人透露自己然后我们把他裸体我们的字符串的扫描仪，这反过来找知名的恶意软件模式和……看看，那里是一个字符串，我们已经知道了！

这种方法是成功的，在检测数任何可衡量的收益？

绝对正确！约三个月后，这一技术的工作，我们所看到的deepscreen检测了近15%的增长贡献的safemachine技术。几乎所有的恶意软件样本被称为前；他们只是很模糊的包装，使静态分析看不到他们。

在一研究中，我们不断加强和改进这项技术达到检测电位和增加你的保护水平。

确认：

作者要感谢所有的同事们一直在推动这一技术在过去的两年里，一个新的水平，Jakub Jermar他像只野兽一样的投入这份工作，Jan Gahura 的原作者和safemachine DBI概念的第一个版本，研发和病毒实验室团队他们创造了这一切。感谢布雷特乔丹为达斯维德的图片中的费心。

Miostartos

求分析能力加强。。

jmxc

不明觉厉，反正是个好东西。

tomochan

感觉现在deepscreen没以前自动入沙+分析来得给力

zxcqwe

avast还得每天添加dyna系列的规则才行，目前升级频率太低了

lx02611

反正是好东西