Forensic rule determination and model training method and device, equipment and storage medium

Abstract

The invention discloses an evidence obtaining rule determination method and device, electronic equipment and a storage medium. The evidence obtaining rule determination method comprises the steps of obtaining attack behavior data of at least one attack scene; processing the attack behavior data by using a forensic analysis model to generate a forensic rule set corresponding to each attack scene in the at least one attack scene; the invention further discloses a model training method and device. The model training method comprises the steps that the knowledge base in the field of computer forensics is acquired; training an initial forensic analysis model by using the knowledge base to obtain a forensic analysis model; the forensic analysis model is used for processing attack behavior data of at least one attack scene to generate a forensic rule set corresponding to each attack scene in the at least one attack scene.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular to a method, device, equipment and storage medium for determining forensic rules and training a model. Background Art

[0002] In advanced persistent threat (APT) attack incidents, the tools involved in the forensics process of the attack incident are relatively scattered, the operation of each tool has high professionalism and analysis thresholds, and the uniformity of the generated data is also poor. In the face of forensic investigation scenarios with multiple hosts compromised, it is difficult to complete the tracing investigation efficiently. Summary of the invention

[0003] In order to solve the above technical problems, the embodiments of the present application provide a method, device, equipment and storage medium for determining evidence collection rules and model training.

[0004] In a first aspect, an embodiment of the present application provides a method for determining a forensic rule, and the method for determining a forensic rule includes:

[0005] Acquire attack behavior data of at least one attack scenario;

[0006] The attack behavior data is processed using a forensic analysis model to generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

[0007] In a second aspect, an embodiment of the present application provides a model training method, the model training method comprising:

[0008] Access the knowledge base in the field of computer forensics;

[0009] The knowledge base is used to train an initial forensic analysis model to obtain a forensic analysis model; the forensic analysis model is used to process attack behavior data of at least one attack scenario to generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

[0010] In a third aspect, an embodiment of the present application provides a device for determining a forensic rule, wherein the device for determining a forensic rule comprises:

[0011] A first acquisition unit, configured to acquire attack behavior data of at least one attack scenario;

[0012] The processing unit is used to process the attack behavior data using a forensic analysis model to generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

[0013] In a fourth aspect, an embodiment of the present application provides a model training device, the model training device comprising:

[0014] A second acquisition unit is used to acquire a knowledge base in the field of computer forensics;

[0015] A training unit is used to train an initial forensic analysis model using the database to obtain a forensic analysis model; the forensic analysis model is used to process attack behavior data of at least one attack scenario to generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

[0016] In a fifth aspect, an embodiment of the present application provides an electronic device, comprising: a memory and a processor, wherein the memory stores computer executable instructions, and when the processor runs the computer executable instructions on the memory, it can implement the method described in the above-mentioned first aspect embodiment, or the second aspect embodiment.

[0017] In a sixth aspect, an embodiment of the present application provides a computer storage medium having executable instructions stored thereon, which, when executed by a processor, implement the method described in the above-mentioned first aspect embodiment or the second aspect embodiment.

[0018] In an embodiment of the present application, by acquiring attack behavior data of at least one attack scenario; using a forensic analysis model to process the attack behavior data, a set of forensic rules corresponding to each attack scenario in the at least one attack scenario is generated, and different forensic rule sets can be used to collect evidence for different attack scenarios corresponding to different attack events, which can improve the efficiency of batch forensics and batch analysis of attack event forensics operations, and further improve the efficiency of tracing attack events. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 Schematic diagram of the process of determining the evidence collection rules provided in the embodiment of the present application Figure 1 ;

[0020] Figure 2 Schematic diagram of the process of determining the evidence collection rules provided in the embodiment of the present application Figure 2 ;

[0021] Figure 3 Schematic diagram of the process of determining the evidence collection rules provided in the embodiment of the present application Figure 3 ;

[0022] Figure 4 Schematic diagram of the process of determining the evidence collection rules provided in the embodiment of the present application Figure 4 ;

[0023] Figure 5A flowchart of a model training method provided in an embodiment of the present application;

[0024] Figure 6 A schematic diagram of the structure of a device for determining evidence collection rules provided in an embodiment of the present application;

[0025] Figure 7 A schematic diagram of the structural composition of the model training device provided in an embodiment of the present application;

[0026] Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0028] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not necessarily need to be defined or explained in the subsequent drawings.

[0029] The term "and / or" herein only describes an association relationship, indicating that three relationships may exist. For example, A and / or B may represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set consisting of A, B, and C.

[0030] Below, the following relevant technical terms involved in the embodiments of the present application are explained.

[0031] APT: Advanced persistent threat, is a hidden and persistent computer intrusion process, usually carefully planned by certain personnel, targeting specific targets. It is usually motivated by business or politics, targeting specific organizations or countries, and requires high concealment for a long time. Advanced persistent threats contain three elements: advanced, long-term, and threat. Advanced emphasizes the use of complex and sophisticated malware and technology to exploit vulnerabilities in the system. Long-term implies that an external force will continue to monitor specific targets and obtain data from them, and threat refers to attacks planned by humans.

[0032] Cybercrime: Often aimed at obtaining illegal economic benefits, attacks are carried out through technical means such as abusing resources (such as BlackhatSEO, mining), disrupting business (such as DDoS), and large-scale theft of sensitive information or digital assets.

[0033] IoC: Indicator Of Compromise, a special term in the field of computer attack forensics, is often a high-confidence information that can be used to indicate that a computer has been invaded, such as the Uniform Resource Locator (URL), Domain, Filehash, IP address, host registry value, etc. that are highly related to the attacker and appear in the attacked network.

[0034] C2: Command And Control Server, the attacker's command and control server, also referred to as "control server" or C2, is a server used by attackers to issue control instructions and obtain information on compromised hosts. It is also an infrastructure that attackers must deploy before launching an attack mission.

[0035] DNS: Domain Name System, is a basic service of the Internet. As a distributed database that maps domain names and IP addresses, it enables people to access the Internet more conveniently. DNS uses TCP and UDP port 53. Currently, the length of each level of domain name is limited to 63 characters, and the total length of the domain name cannot exceed 253 characters. The DNS protocol consists of DNS requests and DNS responses.

[0036] Beacon: A concept introduced by the famous post-penetration attack simulation tool in the field of penetration testing. It refers to the communication between malware deployed by attackers on the compromised host and the C2 server through various delivery methods.

[0037] Digital forensics timeline analysis: Timeline analysis is an important part of digital forensics. Its main function is to reconstruct the time sequence of events or cyber attack activities by correlating digital evidence at different time points to facilitate the investigation of cyber attack incidents. Its key steps include: evidence collection, time extraction, time standardization, time correlation, timeline construction, and detailed timeline analysis.

[0038] The attack event in the embodiment of the present application includes a series of attack behaviors launched by the attacker against the attacked host.

[0039] For example, an attack behavior can be an APT attack behavior. APT attacks specifically refer to targeted attacks that are intended to steal / destroy high-value data or assets. Such attacks may come from attack organizations with national backgrounds or from cybercrime gangs. The following uses a comparison of several specific scenarios to illustrate the differences between APT attacks and other attacks.

[0040] 1. The difference between "targeted ransomware" (belongs to APT) and "common ransomware" (not APT):

[0041] Common ransomware: It is automated and immediately encrypted after execution. It has no incubation period and lacks directionality, so it is not APT.

[0042] Targeted ransomware: After lurking for a long time, fully roaming the intranet, and finding high-value data in a targeted manner, encrypted ransomware is launched. This is considered to have strong APT-like characteristics.

[0043] 2. The difference between APT attacks and targeted attack drills:

[0044] Targeted attack drills are directional, but are often short-lived (e.g., a few weeks). Because of the nature of the drills, they cannot use highly concealed or persistent attack techniques, so they are not considered APTs.

[0045] APT is not only targeted, lasts longer, and places more emphasis on hiding, but also has clear motives, with data theft, espionage, or covert sabotage as its main motivation.

[0046] 3. Differences between APT and common malware families (such as mining):

[0047] Common malware families (like thieves or robbers) often have malware, such as mining, whose motivation is mainly economic: abusing computing resources to obtain CRN; and they often run quickly after being dropped onto the disk, automatically completing the attack and killing a target, which is easy to detect based on features.

[0048] APT (like espionage or targeted kidnapping): The motivation is usually intelligence theft, data theft, and sabotage (such as Stuxnet); the techniques focus on concealment (legitimate credentials + off-land technology) and persistence, deliberately hiding in normal business actions or traffic, and are good at bypassing various defenses. They are highly confrontational and difficult to detect based on traditional terminal antivirus, network intrusion detection, low-interaction honeypot technology, etc.; they often involve the use of malware free tools, translation techniques for legitimate credentials, anti-killing code execution, a variety of privilege escalation methods, highly hidden C2 channels, etc.

[0049] The attack event in the embodiment of the present application may be an APT attack event or other types of non-APT attack events.

[0050] Based on the above APT technology background, current digital forensics tools often have a relatively common forensics tool set for different forensics scenarios, including:

[0051] 1. On-machine forensic analysis scenario; the main purpose is to check whether the host for forensic analysis has relatively significant attack traces. Tools for the Windows platform include tools such as Everything, Autoruns, ProcessExplorer, BrowsingHistoryView, TcpView, and command-line tools related to accounts, processes, networks, and firewall configurations provided by the operating system; forensic analysis on the Linux platform is based on command-line tools such as ps, ss / netstat, top, lsof, systemctl, find, grep, awk, sed, etc., and mainly checks configuration files such as / etc / passwd, / etc / shadow / , / etc / cron.*, / etc / profile.d / , and various log files such as bash_history, / var / log / *, and various environment variables such as $PATH, $LD_LIBRARY_PATH, $LD_PRELOAD, etc.

[0052] 2. Single-machine detailed forensics scenario; the main purpose is to conduct comprehensive or partial collection of key evidence information on suspected compromised hosts or servers. Tools on the Windows platform include EnCase, FTK, Kape, DumpIt, etc. The main goal is to collect important disk data such as RegistryHive, Prefetch, EventLogs, ScheduledTasks, MFT, VolumeShadow, and memory images; Linux platforms mainly include command-line tools such as dd and tar for disk image forensics and compression, as well as memory image forensics tools such as avml and LiME;

[0053] 3. Detailed evidence analysis scenario: Based on the above-mentioned forensic data, a detailed analysis is conducted on system processes, networks, local or remote terminal logins, scheduled tasks, drivers, service programs, user files and web browsing cache records, program running caches, system shadow backup files, file deletion traces and other evidence to extract potential malicious code or malicious operation traces and form an attack timeline analysis result. A large number of third-party open source or commercial tools are often used for analysis.

[0054] The tools involved in the above forensic process are relatively scattered, and the operation professionalism and analysis threshold of each tool are high. The uniformity of the generated data is also poor. In the forensic investigation scenario with multiple hosts compromised, it is difficult to quickly complete the traceability investigation.

[0055] In order to overcome the defects existing in the evidence collection of the above APT attack incidents, the technical solution of the embodiment of the present application is proposed. The method for determining the evidence collection rules provided by the embodiment of the present application is described in detail as follows:

[0056] Figure 1 The process diagram of the method for determining the evidence collection rules provided in the embodiment of this application is as follows: Figure 1 ,like Figure 1 As shown, the method comprises the following steps:

[0057] S101: Acquire attack behavior data of at least one attack scenario;

[0058] S102: Processing the attack behavior data using a forensic analysis model to generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

[0059] The method for determining the evidence collection rules in the embodiment of the present application is executed by a computer device, which may be an attacked host or another server, for example, a cloud server.

[0060] In some implementations, the forensic analysis model is a model obtained by training an initial large language model using a knowledge base in the field of computer forensics.

[0061] In the embodiment of the present application, for each attack scenario in at least one attack scenario, the attack behavior data of the attack scenario can reflect the attack characteristics of the attack scenario.

[0062] The technical solution of the embodiment of the present application can automatically select a suitable set of evidence collection rules for different attack scenarios using natural language interaction.

[0063] Below, examples of the evidence rule sets corresponding to different attack scenarios generated by the embodiments of the present application are introduced as follows. It should be noted that the evidence rule sets corresponding to the different attack scenarios listed below are only used as examples. The embodiments of the present application do not specifically limit the evidence rule sets corresponding to different attack scenarios, and they are determined based on the actual attack behavior data corresponding to each attack scenario.

[0064] 1. Collection of forensic rules for common network attack scenarios:

[0065] Netstat - check network connections;

[0066] NetSessions-Get network session information;

[0067] PacketFilter - Packet capture;

[0068] DumpDNSCache - DNS cache dump.

[0069] 2. Collection of forensic rules for data leakage scenarios:

[0070] Dump process memory-memory dump;

[0071] ThreatHunting-Detect suspicious processes;

[0072] Chrome - collects Chrome data;

[0073] FileCollector - collects file information;

[0074] YaraScan-Automatically integrates Yara rule scanning module.

[0075] 3. Collection of evidence collection rules for targeted extortion scenarios:

[0076] ProcessDump-process dump;

[0077] DumpEventLog-export event log;

[0078] WMIQuery-WMI information collection;

[0079] VSS - Get Volume Shadow Copy.

[0080] 4. Forensic rules set for Linux host scenario:

[0081] Dump process namespaces-export namespace;

[0082] PackageManager-exports package information;

[0083] ListSSHTrustedKeys - lists SSH trusted login keys;

[0084] ListENVs - Lists key environment variables.

[0085] The technical solution of the embodiment of the present application can be combined with generative artificial intelligence to determine the set of evidence collection rules corresponding to different attack scenarios. Subsequently, the evidence collection rule sets corresponding to the attack scenarios can be used to collect evidence for different attack scenarios corresponding to different attack events. This can improve the efficiency of batch evidence collection and batch analysis of attack event evidence collection operations, and further improve the efficiency of tracing attack events.

[0086] Figure 2 The process diagram of the method for determining the evidence collection rules provided in the embodiment of this application is as follows: Figure 2 ,like Figure 2 As shown, the method comprises the following steps:

[0087] S201: Obtaining search elements of each attack scenario in at least one attack scenario described by a user;

[0088] S202: Analyze the search elements of each attack scenario using the forensic analysis model to determine the forensic plug-in and keyword information of the forensic rules of each attack scenario;

[0089] S203: Generate a set of evidence collection rules corresponding to each attack scenario according to the evidence collection plug-in of each attack scenario and the keyword information of the evidence collection rule.

[0090] In an embodiment of the present application, the search elements described by the user are key data used to retrieve attack events, for example, they can be associated Procmon and network packet capture (PCAP) data, with process ID as the primary key, intelligent tracking and only focusing on important events related to the process, etc.

[0091] The forensic analysis model of the embodiment of the present application can realize the automated writing of forensic rule sets for different attack scenarios based on the detection elements of different scenarios described by the user.

[0092] In the embodiment of the present application, after analyzing the retrieval elements of each attack scenario, the forensic analysis model selects an appropriate predefined plug-in (ie, a forensic plug-in) and a forensic rule keyword to complete the writing of the forensic rules.

[0093] The predefined plug-in in the embodiment of the present application is a forensic plug-in written in accordance with a forensic retrieval language (also referred to as a forensic query language), and an offline forensic toolkit can be generated by compiling multiple forensic plug-ins.

[0094] The forensic plug-ins (also referred to as key atomic forensic plug-ins or predefined artifacts) that can be used in the embodiments of the present application include but are not limited to the following: FileCollector-collects file and directory information; Netstat-collects network connection information; PSList-collects process information; DumpProcessMemory-process memory dump; Netstat-collects network connection information; DumpDNSCache-DNS cache dump DumpEventLog-exports event log; NetSessions-lists network sessions; DumpRegistry-exports registry contents; WMIQuery-uses WMI to query information; Chrome-collects Chrome browser data; DumpInterfaceAddresses-interface and address information.

[0095] Keywords for data operations based on predefined plug-ins include but are not limited to the following: SELECT - select / query data from a data source; FROM - specify a data source, which can be an artifact, a table, or a view; WHERE - specify filter conditions; GROUP BY - group result sets; JOIN - connect multiple data sources; COUNT - return the number of matching records; SUM - sum operation; MAX / MIN - maximum / minimum value; EXECUTE - execute artifacts to collect data; LOG - record log information; QUERY - execute nested queries; LET - define variables; IF / THEN / ELSE - conditional judgment; Emit - output results; LIMIT - limit the number of returned rows; COLLECT - collect query results; UNIQUE - remove duplicates.

[0096] For example, for a data leakage scenario, the user describes the function of the forensic rule as follows:

[0097] Detect whether svchost.exe has network communication requests with other hosts in the intranet, and that the parent process of the process is cmd.exe;

[0098] The corresponding search elements are:

[0099] 1. Use process ID as the primary key (such as svchost.exe), intelligently track and only focus on important events related to the process (such as: parent-child process creation [parent process is cmd.exe]);

[0100] 2. Network activity tracking module: tracks the network communication of the process;

[0101] 3. Associate procmon data

[0102] According to the search elements described by the user above, the corresponding forensic plug-ins can be determined as: Netstat - collects network connection information, PSList - collects process information; the keyword of the forensic rule is: SELECT.

[0103] According to the determined forensic plug-in and forensic rule keywords, the forensic rule set corresponding to the data leakage scenario is generated as follows:

[0104] Dump process memory-memory dump;

[0105] ThreatHunting-Detect suspicious processes;

[0106] Chrome - collects Chrome data;

[0107] FileCollector - collects file information;

[0108] YaraScan-Automatically integrates Yara rule scanning module.

[0109] The technical solution of the embodiment of the present application can be combined with generative artificial intelligence to automatically write evidence collection rules for different attack scenarios, determine the evidence collection rule sets corresponding to different attack scenarios, and subsequently use the evidence collection rule sets corresponding to the attack scenarios to collect evidence for different attack scenarios corresponding to different attack events. This can improve the efficiency of batch evidence collection and batch analysis of attack event evidence collection operations, and further improve the efficiency of tracing attack events.

[0110] Figure 3 The process diagram of the method for determining the evidence collection rules provided in the embodiment of this application is as follows: Figure 3 ,like Figure 3 As shown, the method comprises the following steps:

[0111] S301: Obtain key attack behavior data of at least one attack scenario;

[0112] S302: Analyze key attack behavior data of the at least one attack scenario using a forensic analysis model to obtain a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

[0113] In the embodiment of the present application, the key attack behavior data is obtained by using the attack scenario simulation module. The functions supported by the attack scenario simulation module include:

[0114] 1. Correlate Procmon (a system process monitoring software) and network packet capture (PCAP) data;

[0115] 2. Use process ID as the primary key to intelligently track and focus only on important events related to the process;

[0116] 3. Thread injection behavior detection and tracking module;

[0117] 4. Network activity tracking module;

[0118] 5. Multi-level parent-child relationship tracking module, supports tracking of direct child processes and processes invoked by remote process scheduling (including wmi, etc.);

[0119] 6. Provide multiple filtering modes to filter out irrelevant noise information;

[0120] 7. Customized graphical content display, which can display the process behavior within a specific time window in a timeline manner;

[0121] 8. The logs filtered by the parent process ID are arranged in timeline and can be exported again in the form of comma-separated values ​​(CSV).

[0122] The embodiment of the present application can obtain a set of forensic rules for at least one attack scenario by using key attack behavior data of at least one attack scenario as input to a forensic analysis model.

[0123] In some implementations, the above step S301 includes: obtaining data after the attack scenario simulation module filters and standardizes key attack behavior data of at least one attack scenario;

[0124] The above step S302 includes: using the forensic analysis model to filter the key attack behavior data of the at least one attack scenario and analyze the standardized data to obtain a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

[0125] For example, for a data leakage scenario, the attack scenario simulation module can be used to obtain the following data of the data leakage scenario:

[0126] 1. Use process ID as the primary key (such as svchost.exe), intelligently track and only focus on important events related to the process (such as: parent-child process creation [parent process is cmd.exe]);

[0127] 2. Network activity tracking module: tracks the network communication of the process;

[0128] 3. Correlate procmon data.

[0129] Based on the above data of the data leakage scenario, as the input of the forensic analysis model, the forensic rule set of the data leakage scenario can be obtained as follows:

[0130] Dump process memory-memory dump;

[0131] ThreatHunting-Detect suspicious processes;

[0132] Chrome - collects Chrome data;

[0133] FileCollector - collects file information;

[0134] YaraScan-Automatically integrates Yara rule scanning module.

[0135] Based on the above functions of the attack scenario simulation module, the key dynamic behaviors of the attack scenarios when known malicious codes or attack tools are running, that is, the key attack behavior data, can be filtered and standardized, and the filtered and standardized data can be used as the input of the forensic analysis model to obtain a set of forensic rules for at least one attack scenario.

[0136] Exemplarily, in an embodiment of the present application, the standardized data associating Procmon and network packet capture (PCAP) data refers to process behavior data exported by procmon, or pcap network data.

[0137] The solution of the embodiment of the present application can automatically complete the analysis of the standardized logs output by the above-mentioned attack simulation module based on the forensic analysis model trained by the large language model, and automatically extract key process information, network information, registry, file and other behavioral information, and automatically write a set of forensic rules for different attack scenarios.

[0138] The technical solution of the embodiment of the present application can be combined with the automatic writing of evidence rules by generative artificial intelligence (using attack scenario simulation module + attack log analysis and automatic writing module of evidence rules). Subsequently, according to the specific attack scenario, the generative artificial intelligence method can be further used to automatically package the evidence rule set for the appropriate scenario. Subsequently, for different attack scenarios corresponding to different attack events, the evidence rule set corresponding to the attack scenario can be used to collect evidence, which can improve the efficiency of batch evidence collection and batch analysis of attack event evidence collection operations, and further improve the efficiency of tracing the attack events.

[0139] Figure 4 The process diagram of the method for determining the evidence collection rules provided in the embodiment of this application is as follows: Figure 4 ,like Figure 4 As shown, the method comprises the following steps:

[0140] S401: Determine a target attack scenario corresponding to an attack event, and select a target forensic rule set corresponding to the target attack scenario from the forensic rule set;

[0141] S402: Customizing a forensic tool for the attack event using the target forensic rule set;

[0142] S403: extracting forensic data of the attack event from the log data of the attack event using the forensic tool;

[0143] S404: Obtaining a tracing path of the attack event according to the forensic data.

[0144] In an embodiment of the present application, after determining the target attack scenario corresponding to the attack event, the target evidence rule set of the attack event can be determined according to the target attack scenario, and then the target evidence rule set and the evidence plug-in corresponding to each evidence rule in the target evidence rule set are used to generate a forensic tool for the attack scenario.

[0145] In one implementation, a customized forensic tool compilation platform based on forensic rules compiles target forensic rules and forensic plug-ins corresponding to the target forensic rules to obtain a customized forensic tool for attack events.

[0146] The evidence collection tool collects the evidence information of user's concern on the target host, reduces the storage pressure of the host, and can automatically complete the preliminary analysis task in the evidence collection stage. The embodiment of the present application can obtain the evidence data of the attack event contained in the log data by using the customized evidence collection tool to extract the log data of the target host. Then, the evidence collection tool of the attack event is generated based on the evidence collection data.

[0147] In some embodiments, the forensic data of the attack event can be obtained by using a digital forensics timeline analysis method based on context records related to the attack traces of the attack event and timestamp information corresponding to the record data; when obtaining the forensic data, the attack scenario of the attack event can be determined, and the forensic data in the log data of the attack event can be obtained using a set of forensic rules corresponding to the attack scenario.

[0148] Specifically, digital evidence at different time points in the log data can be associated to reconstruct the time series of network attack events to facilitate the investigation of network attack events. The key steps of digital forensic timeline analysis include: evidence collection, time extraction, time standardization, time association, timeline construction, and detailed timeline analysis.

[0149] In the embodiment of the present application, due to the deficiencies in the telemetry technology, protocol analysis technology, etc. of the attacked host, or due to the insufficient storage or processing performance of the attacked host, the log data of the attacked host may not be able to fully record the data related to the attack, and therefore, the forensic data of the attack event obtained based on the log data may not be complete. In the case of determining that the forensic data of the attack event obtained using the log data is incomplete, the suggestion information generated by the large language model to supplement the forensic data of the attack event can be used to provide the user with forensic scheme suggestions for supplementing the forensic data. For example, the suggestion information generated by the large language model can specifically include which data needs to be supplemented, the path of the data that needs to be supplemented, etc., so that the user provides more complete forensic data of the attack event according to the generated suggestion information, which is conducive to the subsequent use of the supplementary data provided by the user according to the suggestion information to supplement the forensic data to trace the attack chain of the attack event, and obtain a more accurate and complete tracing path of the attack event.

[0150] In an embodiment of the present application, by utilizing a forensic analysis model to generate a set of forensic rules corresponding to each attack scenario in at least one attack scenario, different sets of forensic rules can be adopted for different attack scenarios; then, a target attack scenario of the attack event is determined, and a target forensic rule set corresponding to the target attack scenario is selected from the forensic rule set; the forensic rules corresponding to the attack scenario corresponding to the attack event can be adopted, and when the forensic tool for the attack event is subsequently customized using the target forensic rule set, the forensic tool is also customized according to the attack scenario of the attack event, which can improve the efficiency of batch forensics and batch analysis of forensic operations of attack events, and further improve the efficiency of tracing the attack events.

[0151] Figure 5 A flow chart of the model training method provided in the embodiment of the present application is as follows: Figure 5 As shown, the model training method includes the following steps:

[0152] S501: Acquire a knowledge base in the field of computer forensics;

[0153] S502: Using the knowledge base to train an initial forensic analysis model to obtain a forensic analysis model.

[0154] In an embodiment of the present application, the forensic analysis model is used to process attack behavior data of at least one attack scenario and generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

[0155] In order to automatically write forensic rules for attack events, it is necessary to train the large language model for professional knowledge in the field of computer forensics (i.e., the knowledge base in the field of computer forensics). The key processes for training the large language model include:

[0156] a1. Collect papers, books, and documents in the field of digital forensics as training texts. These teaching materials can cover the basic concepts, principles, processes, tools, and other professional knowledge of digital forensics.

[0157] a2. Collect actual digital forensic analysis reports as cases and application examples to allow the model to learn analytical ideas.

[0158] a3. Build a Q&A dataset on forensics topics, covering the use of forensics tools, evidence extraction and processing, timeline analysis, etc. Use this dataset to refine the Q&A.

[0159] a4. Create situational dialogue data around specific evidence collection scenarios, allowing the model to learn case analysis and response processes through dialogue.

[0160] a5. Use retrieval chat to supplement knowledge and conduct reinforcement learning on model knowledge gaps during interaction.

[0161] a6. Apply reinforcement learning to allow the model to continuously learn through forensic problem solving exercises.

[0162] a7. Introduce case analysis tests in the later stages of training to evaluate the model’s ability to conduct digital forensic analysis and provide additional knowledge where deficiencies exist.

[0163] For example, when training a large language model, a typical input sample of the question-answering dataset for the forensics topic of a3 is as follows, where Q represents the question and A represents the answer.

[0164] Q1: What is the main goal of file system forensics? A1: The main goal of file system forensics is to obtain data or metadata related to files and directories from computer storage devices as evidence.

[0165] Q2: What are the common methods for creating forensic images? A2: Common methods for creating forensic images include physical images, logical images, and storage snapshots.

[0166] Q3: What are the main methods for collecting volatile data? A3: The main methods for collecting volatile data include memory dump, network data capture, running process listing, etc.

[0167] Q4: What is the role of timeline analysis in digital forensics? A4: Timeline analysis can determine the chronological order of events in electronic evidence and help reconstruct the timeline of activities in the case.

[0168] Q5: What are the basic steps for deleted file forensics? A5: The basic steps for deleted file forensics include retrieving the original data block, determining the file type, extracting file metadata, and restoring file content.

[0169] Q6: What are the special considerations for mobile device forensics? A6: Mobile device forensics requires attention to the steps of obtaining the corresponding system backup, unlocking the phone, and data connection.

[0170] For another example, when training a large language model, examples of creating situational dialogue data for a4 around specific digital forensics scenarios include:

[0171] 1. For network attack evidence collection scenarios:

[0172] 1. Provide a high-level description of the attack method (such as SQL injection, remote control Trojan, etc.) and the attack traces;

[0173] 2. The model needs to propose response measures, such as analyzing network logs, obtaining RAM dumps, etc.

[0174] 3. Provide detailed technical evidence based on the model’s response, such as network traffic capture, reverse connections, etc.

[0175] 4. Model learning proposes further ideas for network forensic analysis.

[0176] 2. For data leakage evidence collection scenarios:

[0177] 1. Describe known suspicious signs, such as the sale of company data on the Dark Web;

[0178] 2. The model needs to determine the intrusion path and propose a way to find evidence;

[0179] 3. Provide more details, such as Trojans implanted in some employees’ computers;

[0180] 4. The model learns to associate various pieces of evidence and locate the cause of the leak.

[0181] 3. For mobile APP forensics scenarios:

[0182] 1. Explain the suspicious behavior of the app, such as frequently reading contact information;

[0183] 2. Evidence required for model judgment, such as APP network traffic, code logic, etc.;

[0184] 3. Provide relevant technical details; if any suspicious encryption functions are found to be called;

[0185] 4. The model proposes technical suggestions for APP reverse analysis.

[0186] The forensic analysis model obtained through training in the embodiment of the present application can process the attack behavior data of at least one attack scenario and generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

[0187] The embodiment of the present application utilizes a trained forensic analysis model to process the attack behavior data of at least one attack scenario, thereby being able to generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario, thereby being able to collect evidence for different attack scenarios corresponding to different attack events using the forensic rule sets corresponding to the attack scenarios, thereby improving the efficiency of batch collection and batch analysis of attack event forensic operations, and further improving the efficiency of tracing attack events.

[0188] Figure 6 A schematic diagram of the structure of the device for determining evidence collection rules provided in an embodiment of the present application is shown in FIG. Figure 6 As shown, the device comprises:

[0189] A first acquisition unit 601 is used to acquire attack behavior data of at least one attack scenario;

[0190] The processing unit 602 is used to process the attack behavior data using a forensic analysis model to generate a forensic rule set corresponding to each attack scenario in the at least one attack scenario.

[0191] In one embodiment, the attack behavior data of the at least one attack scenario includes retrieval elements of each attack scenario in at least one attack scenario described by a user; the processing unit is used to analyze the retrieval elements of each attack scenario using the forensic analysis model, determine the forensic plug-in of each attack scenario and the keyword information of the forensic rules, and generate a set of forensic rules corresponding to each attack scenario based on the forensic plug-in of each attack scenario and the keyword information of the forensic rules.

[0192] In one embodiment, the attack behavior data of the at least one attack scenario includes key attack behavior data of the at least one attack scenario; the processing unit is used to analyze the key attack behavior data of the at least one attack scenario using a forensic analysis model to obtain a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

[0193] In one embodiment, the device further comprises:

[0194] A selection unit, configured to determine a target attack scenario corresponding to an attack event, and select a target forensic rule set corresponding to the target attack scenario from the forensic rule set;

[0195] A customization unit is used to customize the forensic tool of the attack event by using the target forensic rule set.

[0196] In one embodiment, the customization unit is used to generate a forensic tool for the attack scenario using the target forensic rule set and a forensic plug-in corresponding to each forensic rule in the target forensic rule set.

[0197] Those skilled in the art should understand that Figure 6 The implementation functions of each unit in the device for determining evidence rules shown can be understood by referring to the relevant description of the method for determining evidence rules mentioned above. Figure 6 The functions of each unit in the device for determining evidence collection rules shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0198] Figure 7 A schematic diagram of the structure of the model training device provided in the embodiment of the present application is shown in FIG. Figure 7 As shown, the model training device includes:

[0199] The second acquisition unit 701 is used to acquire a knowledge base in the field of computer forensics;

[0200] The training unit 702 is used to train the initial forensic analysis model using the database to obtain a forensic analysis model; the forensic analysis model is used to process the attack behavior data of at least one attack scenario to generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

[0201] Those skilled in the art should understand that Figure 7 The implementation functions of each unit in the model training device shown can be understood by referring to the relevant description of the aforementioned model training method. Figure 7 The functions of each unit in the model training device shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0202] An embodiment of the present application also provides an electronic device. Figure 8 Schematic diagram of the hardware structure of the electronic device of the embodiment of the present application, such as Figure 8 As shown, the electronic device includes: a communication component 803 for data transmission, at least one processor 801 and a memory 802 for storing a computer program that can be run on the processor 801. The various components in the terminal are coupled together through a bus system 804. It can be understood that the bus system 804 is used to achieve connection and communication between these components. In addition to the data bus, the bus system 804 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 8 Various buses are labeled as bus system 804 .

[0203] When the processor 801 executes the computer program, at least Figures 1 to 5 The steps of the method shown in any one of the embodiments.

[0204] It can be understood that the memory 802 can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disk, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), and direct RAM bus random access memory (DRRAM, Direct Rambus Random Access Memory).The memory 802 described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memories.

[0205] The method disclosed in the above-mentioned embodiment of the present application can be applied to the processor 801, or implemented by the processor 801. The processor 801 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above-mentioned method can be completed by the hardware integrated logic circuit in the processor 801 or the instruction in the form of software. The above-mentioned processor 801 may be a general-purpose processor, a DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The processor 801 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the memory 802. The processor 801 reads the information in the memory 802 and completes the above-mentioned in combination with its hardware. Figures 1 to 5 The steps of any method.

[0206] In an exemplary embodiment, the electronic device may be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), FPGAs, general purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0207] The present application also provides a computer-readable storage medium having a computer program stored thereon, wherein the program is at least used to execute when executed by a processor Figures 1 to 5 The computer readable storage medium may be a memory. The memory may be Figure 8 Memory 802 is shown.

[0208] The technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

[0209] In the several embodiments provided in the present application, it should be understood that the disclosed methods and intelligent devices can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0210] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0211] In addition, all functional units in the embodiments of the present application may be integrated into a second processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0212] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be covered by the protection scope of the present application.

Claims

1. A method for determining evidence collection rules, characterized in that: The method comprises: Acquire attack behavior data of at least one attack scenario; The attack behavior data is processed using a forensic analysis model to generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

2. The method according to claim 1, characterized in that The attack behavior data of the at least one attack scenario includes search elements of each attack scenario in the at least one attack scenario described by the user; the forensic analysis model is used to process the attack behavior data to generate a forensic rule set corresponding to each attack scenario in the at least one attack scenario, including: The forensic analysis model is used to analyze the retrieval elements of each attack scenario, determine the forensic plug-in of each attack scenario and the keyword information of the forensic rules, and generate a set of forensic rules corresponding to each attack scenario based on the forensic plug-in of each attack scenario and the keyword information of the forensic rules.

3. The method according to claim 1, characterized in that The attack behavior data of the at least one attack scenario includes key attack behavior data of the at least one attack scenario; the processing of the attack behavior data using the forensic analysis model to generate a forensic rule set corresponding to each attack scenario in the at least one attack scenario includes: The key attack behavior data of the at least one attack scenario is analyzed using a forensic analysis model to obtain a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Determine a target attack scenario corresponding to the attack event, and select a target forensic rule set corresponding to the target attack scenario from the forensic rule set; The target forensic rule set is used to customize a forensic tool for the attack event.

5. The method according to claim 4, characterized in that The forensic tool for customizing the attack event by using the target forensic rule set includes: The target forensic rule set and the forensic plug-in corresponding to each forensic rule in the target forensic rule set are used to generate a forensic tool for the attack scenario.

6. A model training method, characterized in that: The method comprises: Access the knowledge base in the field of computer forensics; The knowledge base is used to train an initial forensic analysis model to obtain a forensic analysis model; the forensic analysis model is used to process attack behavior data of at least one attack scenario to generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

7. A device for determining evidence collection rules, characterized in that: The device comprises: A first acquisition unit, configured to acquire attack behavior data of at least one attack scenario; The processing unit is used to process the attack behavior data using a forensic analysis model to generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

8. A model training device, characterized in that: The device comprises: A second acquisition unit is used to acquire a knowledge base in the field of computer forensics; A training unit is used to train an initial forensic analysis model using the database to obtain a forensic analysis model; the forensic analysis model is used to process attack behavior data of at least one attack scenario to generate a set of forensic rules corresponding to each attack scenario in the at least one attack scenario.

9. An electronic device, characterized in that: The electronic device comprises: a memory and a processor, wherein the memory stores computer executable instructions, and the processor can implement any one of claims 1 to 5 or claim 6 when executing the computer executable instructions on the memory.

10. A computer storage medium, characterized in that: The storage medium stores executable instructions, which, when executed by a processor, implement the method of any one of claims 1 to 5 or claim 6.

Images