【摘要】 动态分析是恶意代码分析与检测的关键技术，能够刻画样本在运行时的真实行为特征。在攻防博弈的过程中，恶意代码采用动态分析对抗技术逃避分析，安全研究人员则通过反对抗技术提升分析系统应对规避型恶意软件的能力。已有综述大多聚焦于攻防技术的设计与实现，缺乏对其与恶意代码动态分析各核心环节之间关联的系统梳理。为此，该研究以恶意代码动态分析的工作流程为主线，从攻防对抗的视角出发，对相关技术进行了系统综述。首先，介绍了动态分析的典型工作流程；其次，总结了对抗技术的设计与实现方式，包括恶意载荷隐藏、分析环境感知、行为捕获逃避及分析模型欺骗技术，剖析其规避机制；再次，整理与归纳了相应的反对抗技术，包括恶意载荷捕获、环境感知规避、行为触发与监控增强及分析模型增强技术，揭示动态分析系统演变背后的攻防对抗逻辑；最后，探讨了恶意代码动态分析领域未来的发展趋势与重点研究方向，以期为恶意代码分析与检测研究提供参考。更多还原

【Abstract】 Dynamic analysis serves as a fundamental technique in malicious code analysis and detection, enabling the observation of real-time behaviors exhibited by malicious samples. In the ongoing adversarial arms race, malicious code employs dynamic analysis evasion techniques to evade detection, while defenders develop countermeasures to enhance the capability of dynamic analysis systems to cope with evasive malware. Existing surveys predominantly focus on the design and implementation of individual offensive and defensive techniques, lacking a comprehensive examination of their integration with the core stages of dynamic malicious code analysis. To address this limitation, a systematic survey of evasion techniques and anti-evasion techniques was conducted from an adversarial perspective, structured around the dynamic analysis workflow. First, the typical workflow of malicious code dynamic analysis was introduced. Next, the design and implementation methods of evasion techniques were summarized, including malware payload hiding, environment detection, behavior capture evasion, and analysis model deception, and their evasion strategies were analyzed. Then, the corresponding countermeasures were reviewed, including malicious payload extraction, evasion-resistant environment construction, behavior triggering and monitoring enhancements, and model hardening, and the adversarial interplay driving the evolution of dynamic analysis systems was revealed. Finally, the future development trends and key research directions in the field of dynamic analysis of malicious code were discussed, with the aim of providing references for the research on malicious code analysis and detection.更多还原