Abstract:Anti-virtualization is currently an important factor affecting the overall acquisition of sample behaviour data by a dynamic analysis system of malicious code. This study proposes a systematic anti-virtualization confrontation method from host environment, network environment, and user interaction environment of dynamic analysis environment of malicious code, and implements the anti-virtualization confrontation in the existing dynamic analysis system. Experimental results show that the anti-virtualization confrontation effectively enhances the dynamic analysis system's ability to capture sample behavior data.