Detection method for APTs (Advanced Persistent Threat) based on instruction monitoring

Abstract

The invention discloses a detection method for APTs (Advanced Persistent Threat) based on instruction monitoring. The method is characterized in that identification for virtual machine execution behaviors on an Hypervisor level is realized through an ExKVM and a virtual machine introspection library LibVMI, monitoring outside a virtual machine for an operating state of a malicious code in the virtual machine is realized and vulnerability exploitation attacks are discovered by use of a dynamic offline taint analysis method; monitoring for a user-layer API and kernel-layer API execution is carried out without an invasion by use of a #BP address injection method outside the virtual machine; and tracking for kernel stack allocation is realized through the injection of the kernel memory allocation function and the kernel module structure operating function of Windows. The offline taints are analyzed and the malicious behaviors are discovered through tracking and recording write, exchange and branch instructions between a memory and a register during the malicious code execution. According to the invention, the vulnerability exploitation during the APT attack can be monitored effectively and the detection rate of malicious samples is improved.

Description

technical field [0001] The invention relates to an APT advanced threat detection method based on instruction monitoring. Background technique [0002] APT attacks are destructive, concealed, and technically complex: In recent years, APT attacks have emerged in an endless stream, with an exponential growth trend, and gradually evolved into a complex of various social engineering attacks and various 0day exploits. Threats of cyber attacks. Malicious codes that utilize various system or software vulnerabilities to infiltrate have become the main means of APT attacks, and using or embezzling legal authentication signatures, using browser vulnerabilities and watering hole attacks to replace mail attacks will become the development trend of APT attacks. At the same time, attackers also pay more attention to the anti-detection technology of the virtual environment, so as to avoid the dynamic detection of security vendors. Unknown threats represented by APT attacks are very easy t...

AI Technical Summary

Problems solved by technology

Traditional detection technologies such as firewalls, intrusion detection, security gateways, antivirus software, and anti-spam systems are mainly detected at the network border and host border, and they all lack the ability to detect unknown attacks and analyze traffic in depth.

This delayed response approach has been unable to adapt to the new security situation

Images