Fine-grained RAT (remote administration tool) program detection method and system based on dynamic behaviors and corresponding APT (advanced persistent threat) attack detection method

Abstract

The invention discloses a fine-grained RAT (remote administration tool) program detection method and system based on dynamic behaviors and a corresponding APT (advanced persistent threat) attack detection method. The method includes the steps: acquiring dynamic data in running of a target program to serve as data to be detected; matching the data to be detected with characteristic codes of fine-grained behaviors; taking a fine-grained behavior corresponding to a successfully matched characteristic code as a label of the target program if the successfully matched characteristic code is present;judging whether the target program is a RAT program according to the label of the target program or not. According to the method, identification is performed based on dynamic data, reliability is high, and an unknown RAT and an unknown APT can be identified based on fine grains.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a fine-grained RAT program detection method and system based on dynamic behavior, and a corresponding APT attack detection method. Background technique [0002] The full name of APT is Advanced Persistent Threat (Advanced Persistent Threat). Advanced means that APT will use very advanced attack methods, such as 0day vulnerabilities and unknown malware, while traditional security defense methods are mostly signature-based detection methods, which are difficult to detect unknown malicious code. Persistence means that the attack is very targeted and the purpose is very clear. The attacker usually does a lot of investigation work, lurks in the enterprise for a long time, slowly collects information, and only breaks out under specific circumstances. At present, APT attacks are frequently reported, and the targets of the general attacks are high-value targets, suc...

AI Technical Summary

Problems solved by technology

The disadvantages are also very obvious. First, it can only detect known malicious codes, and the RATs used in APT attacks are unknown and often do not exist in the virus database.

Second, most detection objects are files, and some advanced malware can not appear in the form of files (such as loading directly in memory), then this detection method will fail

First of all, the attack methods used by APT are very advanced, the malicious code is unknown, and the traditional signature-based detection method (Signature-based Detection) is easily bypassed

Secondly, many detection systems cannot provide semantics for the detection results. Even if a suspicious program is detected, they do not know what the program does. It takes a lot of manpower to reverse analyze the malicious program.

Images