Attack detection method and device, equipment and storage medium

Abstract

The invention belongs to the technical field of terminal security, and discloses an attack detection method and device, equipment and a storage medium. According to the method, the process behavior of the target process is matched with the initial detection condition of each preset attack behavior chain; if the initial detection condition is successfully matched with the initial detection condition of any preset attack behavior chain, taking the successfully matched preset attack behavior chain as a target behavior chain; constructing a detection condition list according to the target behavior chain; and if the subsequent process behavior of the target process meets each detection condition in the detection condition list, judging that the high-risk attack is detected. The process behaviors of the processes in the terminal are monitored and matched with the multiple attacks included in the preset attack behavior chains corresponding to the advanced threat programs, so that it is ensured that the terminal can find whether high-risk attacks exist or not in advance, misjudgment of single behavior detection is avoided, and the safety of the terminal is improved. Therefore, the terminal can automatically detect whether the attack exists or not, and the dependence on the server is reduced.

Description

Technical Field

[0001] The present invention relates to the field of terminal security technology, and in particular to an attack detection method, device, equipment and storage medium. Background Art

[0002] Currently, the alerting capabilities of Endpoint Threat Detection Response (EDR) rely on several aspects: 1. Threat intelligence 2. Signature engine 3. Big data analysis. Only threat intelligence and signature engine can be directly applied on the terminal. Both methods have a lag and cannot detect attack behavior in advance.

[0003] Based on this, another attack detection method currently available for terminals is a behavior-based rule engine. By matching rules with relevant information about a single behavior, the risk level of the behavior is determined. This method has a high detection rate, but because advanced threats usually try to keep the behavioral characteristics of ordinary programs as close as possible in a single behavior, this method has a high false alarm rate, resulting in unsatisfactory attack detection results on the terminal side. Summary of the Invention

[0004] The main purpose of the present invention is to provide an attack detection method, device, equipment and storage medium, aiming to solve the technical problem that the effect of attack detection on the terminal side in the prior art is not ideal.

[0005] To achieve the above object, the present invention provides an attack detection method, which is applied to a smart terminal;

[0006] The attack detection method comprises the following steps:

[0007] Match the target process's behavior with the preliminary detection conditions of each preset attack behavior chain;

[0008] If the initial detection condition of any preset attack behavior chain is successfully matched, the preset attack behavior chain that is successfully matched will be used as the target behavior chain;

[0009] Constructing a list of detection conditions based on the target behavior chain;

[0010] If the subsequent process behavior of the target process meets each detection condition in the detection condition list, it is determined that a high-risk attack is detected.

[0011] Optionally, the step of constructing a detection condition list according to the target behavior chain includes:

[0012] Extracting at least one detection condition included in the target behavior chain;

[0013] Obtain the attack behavior corresponding to each detection condition;

[0014] The at least one detection condition is sorted according to the order of the attack behavior in the target behavior chain to obtain a detection condition list.

[0015] Optionally, before the step of determining that a high-risk attack is detected if subsequent process behaviors of the target process meet each detection condition in the detection condition list, the step further includes:

[0016] The moment when the target behavior chain is determined is regarded as the starting moment;

[0017] Traversing the detection condition list and using the traversed detection condition as the current detection condition;

[0018] Monitoring the process behavior of the target process after the start time;

[0019] If the process behavior of the target process after the start time satisfies the current detection condition, detecting whether the current detection condition is the last detection condition in the detection condition list;

[0020] If it is the last detection condition, the traversal of the detection condition list is ended, and it is determined whether the subsequent process behavior of the target process meets each detection condition in the detection condition list.

[0021] Optionally, the step of monitoring the process behavior of the target process after the start time includes:

[0022] Monitoring process behaviors of the target process and associated processes corresponding to the target process after a start time, wherein the associated processes corresponding to the target process include child processes created by the target process and / or processes controlled by the target process;

[0023] If the process behavior of the target process after the start time satisfies the current detection condition, the step of detecting whether the current detection condition is the last detection condition in the detection condition list includes:

[0024] If the process behavior of the target process or the associated process corresponding to the target process after the start time satisfies the current detection condition, it is detected whether the current detection condition is the last detection condition in the detection condition list.

[0025] Optionally, after the step of detecting whether the current detection condition is the last detection condition in the detection condition list if the process behavior of the target process after the start time satisfies the current detection condition, the method further includes:

[0026] If it is not the last detection condition, get the current system time;

[0027] The current system time is used as a new starting time, and the step of traversing the detection condition list is returned to, and the traversed detection condition is used as the current detection condition.

[0028] Optionally, if subsequent process behaviors of the target process satisfy each detection condition in the detection condition list, the step of determining that a high-risk attack has been detected includes:

[0029] If the process behavior of the target process satisfies each detection condition in the detection condition list, obtaining the time at which each detection condition in the detection condition list is satisfied;

[0030] If the satisfied moment satisfies a preset determination condition, it is determined that a high-risk attack is detected.

[0031] Optionally, before the step of determining that a high-risk attack is detected if the satisfied moment satisfies a preset determination condition, the step further includes:

[0032] Obtaining the maximum and minimum moments among the satisfied moments;

[0033] Determine the condition-satisfaction interval length according to the maximum time and the minimum time;

[0034] If the condition is met and the interval duration is less than or equal to the preset interval threshold, it is determined that the preset determination condition is met.

[0035] Optionally, before the step of determining that a high-risk attack is detected if the satisfied moment satisfies a preset determination condition, the step further includes:

[0036] Determine, based on the satisfied moments, the satisfied interval durations between adjacent detection conditions in the detection condition list;

[0037] Extracting the maximum value among the satisfied interval durations to obtain the maximum interval duration;

[0038] If the maximum interval duration is less than or equal to the preset neighborhood determination threshold, it is determined that the preset determination condition is met.

[0039] Optionally, after the step of determining that a high-risk attack is detected if subsequent process behaviors of the target process meet each detection condition in the detection condition list, the step further includes:

[0040] terminating the operation of the target process;

[0041] When the termination is successful, obtaining the terminal application file corresponding to the target process;

[0042] The terminal application files are isolated.

[0043] Optionally, after the step of isolating the terminal application file, the method further includes:

[0044] The moment when the target behavior chain is determined is regarded as the first moment, and the moment when the high-risk attack is detected is regarded as the second moment;

[0045] Obtaining process behavior data of the target process between the first moment and the second moment;

[0046] Uploading the process behavior data to the cloud for attack detection;

[0047] If the attack detection result fed back by the cloud is that there is no attack behavior, the isolation of the terminal application file is lifted.

[0048] Optionally, after the step of uploading the process behavior data to the cloud for attack detection, the method further includes:

[0049] If the attack detection result fed back by the cloud indicates that an attack behavior exists, then obtain the attack repair script corresponding to the target attack chain;

[0050] Run the attack repair script to repair the terminal environment.

[0051] In addition, to achieve the above objectives, the present invention further provides an attack detection device, which includes the following modules:

[0052] A matching module is used to match the process behavior of the target process with the preliminary detection conditions of each preset attack behavior chain;

[0053] A selection module is used to select the preset attack behavior chain as the target behavior chain if the matching with the preliminary detection conditions of any preset attack behavior chain is successful;

[0054] A construction module, configured to construct a detection condition list according to the target behavior chain;

[0055] The detection module is configured to determine that a high-risk attack is detected if subsequent process behaviors of the target process satisfy each detection condition in the detection condition list.

[0056] Optionally, the construction module is further used to extract at least one detection condition contained in the target behavior chain; obtain the attack behavior corresponding to each detection condition; sort the at least one detection condition according to the order of the attack behavior in the target behavior chain to obtain a detection condition list.

[0057] Optionally, the detection module is also used to take the moment of determining the target behavior chain as the starting moment; traverse the detection condition list, and use the traversed detection condition as the current detection condition; monitor the process behavior of the target process after the starting moment; if the process behavior of the target process after the starting moment meets the current detection condition, then detect whether the current detection condition is the last detection condition in the detection condition list; if it is the last detection condition, then end the traversal of the detection condition list, and determine whether the subsequent process behavior of the target process meets each detection condition in the detection condition list.

[0058] Optionally, the detection module is further configured to monitor process behaviors of the target process and associated processes corresponding to the target process after a start time, wherein the associated processes corresponding to the target process include child processes created by the target process and / or processes controlled by the target process;

[0059] The detection module is further configured to detect whether the current detection condition is the last detection condition in the detection condition list if the process behavior of the target process or the associated process corresponding to the target process after the start time satisfies the current detection condition.

[0060] Optionally, the detection module is also used to obtain the current system time if it is not the last detection condition; use the current system time as the new starting time, and return to the step of traversing the detection condition list and using the traversed detection condition as the current detection condition.

[0061] Optionally, the detection module is also used to obtain the time when each detection condition in the detection condition list is satisfied if the process behavior of the target process satisfies each detection condition in the detection condition list; if the time when each detection condition is satisfied meets the preset judgment condition, it is determined that a high-risk attack is detected.

[0062] Optionally, the detection module is also used to obtain the maximum moment and the minimum moment among the satisfied moments; determine the condition satisfaction interval length based on the maximum moment and the minimum moment; if the condition satisfaction interval length is less than or equal to the preset interval threshold, it is determined that the preset determination condition is satisfied.

[0063] In addition, to achieve the above-mentioned purpose, the present invention also proposes an attack detection device, which includes: a processor, a memory, and an attack detection program stored in the memory and executable on the processor, and when the attack detection program is executed by the processor, the steps of the attack detection method described above are implemented.

[0064] In addition, to achieve the above-mentioned object, the present invention further proposes a computer-readable storage medium, on which an attack detection program is stored. When the attack detection program is executed, the steps of the above-mentioned attack detection method are implemented.

[0065] The present invention matches the process behavior of the target process with the preliminary detection conditions of each preset attack behavior chain; if the preliminary detection conditions of any preset attack behavior chain are successfully matched, the preset attack behavior chain that successfully matches is used as the target behavior chain; a detection condition list is constructed based on the target behavior chain; if the subsequent process behavior of the target process meets each detection condition in the detection condition list, it is determined that a high-risk attack has been detected. Since the process behavior of the process in the terminal is monitored and matched with multiple attacks included in the preset attack behavior chain corresponding to each advanced threat program, while ensuring that the terminal can detect whether a high-risk attack exists in advance, it also avoids misjudgment of a single behavior detection, allowing the terminal to detect whether an attack exists by itself, reducing dependence on the server, avoiding the need for continuous process restoration and rule matching of data from all terminals on the server, and improving the ability of a single terminal to detect advanced threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 It is a schematic diagram of the structure of an electronic device in the hardware operating environment involved in the embodiment of the present invention;

[0067] Figure 2 This is a flow chart of the first embodiment of the attack detection method of the present invention;

[0068] Figure 3 This is a schematic diagram of an advanced threat attack process according to an embodiment of the present invention;

[0069] Figure 4 This is a flow chart of a second embodiment of the attack detection method of the present invention;

[0070] Figure 5 This is a flow chart of a third embodiment of the attack detection method of the present invention;

[0071] Figure 6 This is a flow chart of a fourth embodiment of an attack detection method according to the present invention;

[0072] Figure 7 This is a structural block diagram of the first embodiment of the attack detection device of the present invention.

[0073] The purpose, features and advantages of the present invention will be further described with reference to the accompanying drawings and in conjunction with the embodiments. DETAILED DESCRIPTION

[0074] It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0075] Reference Figure 1 , Figure 1 This is a schematic diagram of the attack detection device structure in the hardware operating environment involved in the embodiment of the present invention.

[0076] like Figure 1 As shown, the electronic device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), an input unit such as a keyboard (Keyboard), and the user interface 1003 may optionally include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a wireless fidelity (Wireless-Fidelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) or a stable non-volatile memory (Non-Volatile Memory, NVM), such as a disk storage. The memory 1005 may optionally be a storage device independent of the aforementioned processor 1001.

[0077] Those skilled in the art will understand that Figure 1 The structure shown in the figure does not constitute a limitation to the electronic device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0078] like Figure 1 As shown, the memory 1005 as a storage medium may include an operating system, a network communication module, a user interface module, and an attack detection program.

[0079] exist Figure 1 In the electronic device shown, the network interface 1004 is mainly used for data communication with the network server; the user interface 1003 is mainly used for data interaction with the user; the processor 1001 and the memory 1005 in the electronic device of the present invention can be set in the attack detection device, and the electronic device calls the attack detection program stored in the memory 1005 through the processor 1001 and executes the attack detection method provided by the embodiment of the present invention.

[0080] The embodiment of the present invention provides an attack detection method, referring to Figure 2 , Figure 2 The figure is a flow chart of a first embodiment of an attack detection method of the present invention.

[0081] In this embodiment, the attack detection method is applied to a smart terminal;

[0082] The attack detection method comprises the following steps:

[0083] Step S10: Match the process behavior of the target process with the preliminary detection conditions of each preset attack behavior chain.

[0084] It should be noted that the execution subject of this embodiment can be the attack detection device, which can be the smart terminal (such as a smart phone, tablet computer, etc.) itself, or an electronic device that can monitor and control the operation of software programs (such as APP applications) in the smart terminal, or other devices that can achieve the same or similar functions. This embodiment is not limited to this. In this embodiment and the following embodiments, the attack detection method of the present invention is described using a smart terminal as an example.

[0085] It should be noted that the target process can be a process in the smart terminal that is designated as requiring attack detection. The target process can be pre-set by the smart terminal administrator (such as the developer of the smart terminal or the user of the smart terminal). Multiple target processes can be set, and the attack detection methods provided in this embodiment or the following embodiments can be executed separately for each set target process without affecting each other. Process behavior can be the behavior of a process interacting with the outside world or with other processes during operation, such as downloading files from the outside world, executing downloaded files, sending control instructions to other processes, etc.

[0086] In practical applications, a preset attack behavior chain can be a behavior chain based on the attack behaviors of a pre-determined advanced threat program. Different advanced threat programs can correspond to different preset attack behavior chains. A preset attack behavior chain can include multiple consecutive attack behaviors, and the initial detection condition for the preset attack behavior chain can be a detection condition set for the first attack behavior in the preset attack behavior chain.

[0087] For example, let's assume the attack process of an advanced threat program is as follows: 1. The user opens an external file received by IM software; 2. The external file downloads the latest attack module; 3. The external file executes the latest attack module; 4. The latest attack module is added to the system for resident.

[0088] At this time, the attack behavior chain corresponding to the advanced threat program is: "receiving external files - external files loading attack modules - external files executing attack modules - attack modules adding system residency", and the initial detection condition corresponding to this attack behavior chain is "process receiving external files".

[0089] It is understandable that since a single behavior is used for detection, it is actually quite easy to make false detections. At this time, a comprehensive judgment can be made based on the preset attack behavior chain corresponding to the advanced threat program to reduce false detections. Therefore, after determining the target process, the process behavior of the target process can be matched with the preliminary detection conditions corresponding to each preset attack behavior chain to determine whether the process behavior of the target process is consistent with the first attack behavior in the attack behavior chain of a certain advanced threat program, thereby determining whether subsequent detection is required.

[0090] Step S20: If the initial detection condition of any preset attack behavior chain is successfully matched, the preset attack behavior chain that is successfully matched is used as the target behavior chain.

[0091] It should be noted that if the preliminary detection conditions of any preset attack behavior chain are successfully matched, it means that the process behavior of the target process at this time is consistent with the first attack behavior in the attack behavior chain of a certain advanced threat program. At this time, the target process is suspected of attack and needs to be further monitored to determine whether it is an attack behavior to avoid misjudgment. Therefore, the preset attack behavior chain that is successfully matched can be used as the target behavior chain.

[0092] Step S30: Constructing a detection condition list according to the target behavior chain.

[0093] It should be noted that constructing a detection condition list based on a target behavior chain can be accomplished by obtaining detection conditions corresponding to multiple attack behaviors contained in the target behavior chain and combining the obtained detection conditions to generate a detection condition list. Since the preliminary detection conditions of the target behavior chain have already been met, when constructing the detection condition list, the preliminary detection conditions can be removed and the detection condition list can be constructed based on the remaining detection conditions.

[0094] In a specific implementation, to ensure the accuracy of subsequent detection, step S30 in this embodiment may include:

[0095] Extracting at least one detection condition included in the target behavior chain;

[0096] Obtain the attack behavior corresponding to each detection condition;

[0097] The at least one detection condition is sorted according to the order of the attack behavior in the target behavior chain to obtain a detection condition list.

[0098] It should be noted that since each attack behavior in the preset attack behavior chain corresponding to the advanced threat program may not be much different from normal behavior when viewed individually, multiple attack behaviors need to be executed in sequence to produce the attack effect. If the order is disrupted, the attack effect may not be produced. In order to minimize misjudgments, when constructing the detection condition list, the detection conditions corresponding to each attack behavior need to be sorted and combined according to the order of each attack behavior in the attack behavior chain to ensure that correct judgments can be made in subsequent detections.

[0099] Step S40: If the subsequent process behavior of the target process satisfies each detection condition in the detection condition list, it is determined that a high-risk attack is detected.

[0100] It should be noted that the subsequent process behavior of the target process may be the process behavior when the target process is executed after the target behavior chain is determined.

[0101] It can be understood that if the subsequent process behavior of the target process meets all the detection conditions in the detection condition list, it means that the process behavior of the target process at this time is actually consistent with the overall attack behavior flow of the advanced threat program corresponding to the target behavior chain. At this time, the target process is likely to be attacking, and therefore, it can be determined that a high-risk attack has been detected. Among them, a high-risk attack can be an attack by an advanced threat program.

[0102] For ease of understanding, now combined Figure 3 To illustrate, but not to limit, this solution. Figure 3 This is a flow chart of the advanced threat attack process in this embodiment. Figure 3 As shown, the attack process of the advanced threat program can be divided into four attack steps (i.e., attack behaviors), and the execution order is attack step 1, attack step 2, attack step 3, and attack step 4. Each attack step can correspond to a detection condition (detection condition 1, detection condition 2, detection condition 3, and detection condition 4, respectively). Then, the preset attack behavior chain corresponding to the advanced threat attack program is "attack step 1-attack step 2-attack step 3-attack step 4". At this time, detection condition 1 corresponding to attack step 1 is the preliminary detection condition of the preset attack behavior chain. After taking the preset attack behavior chain as the target behavior chain, the constructed detection condition list can be "detection condition 2-detection condition 3-detection condition 4".

[0103] This embodiment matches the process behavior of the target process with the preliminary detection conditions of each preset attack behavior chain; if the preliminary detection conditions of any preset attack behavior chain are successfully matched, the successfully matched preset attack behavior chain is used as the target behavior chain; a detection condition list is constructed based on the target behavior chain; if the subsequent process behavior of the target process meets each detection condition in the detection condition list, it is determined that a high-risk attack has been detected. Because the process behavior of the process in the terminal is monitored and matched with the multiple attacks included in the preset attack behavior chain corresponding to each advanced threat program, while ensuring that the terminal can detect whether there is a high-risk attack in advance, it also avoids the misjudgment of a single behavior detection, allowing the terminal to detect whether there is an attack on its own, reducing dependence on the server, avoiding the need for continuous process restoration and rule matching of all terminal data on the server, and improving the ability of a single terminal to detect advanced threats.

[0104] refer to Figure 4 , Figure 4 FIG. 4 is a flow chart of a second embodiment of an attack detection method according to the present invention.

[0105] Based on the first embodiment described above, the attack detection method of this embodiment further includes, before step S40:

[0106] Step S31: The moment when the target behavior chain is determined is used as the starting moment.

[0107] It should be noted that the moment of determining the target behavior chain is actually the moment when the process behavior of the target process is monitored to match the preliminary detection conditions of the target behavior chain, that is, the moment when the process behavior of the target process is detected to be consistent with the first attack behavior of the advanced threat program corresponding to the target behavior chain. At this time, in order to facilitate the detection of whether the subsequent behavior of the target process is consistent with the subsequent attack behavior of the advanced threat program, the moment of determining the target behavior chain can be used as the starting moment.

[0108] Step S32: traverse the detection condition list and use the traversed detection condition as the current detection condition.

[0109] It should be noted that the traversal of the detection condition list may be performed according to the sorting order of the detection conditions in the detection condition list.

[0110] Step S33: monitoring the process behavior of the target process after the start time.

[0111] It should be noted that, since the purpose is to detect whether the subsequent behavior of the target process is consistent with the subsequent attack behavior of the advanced threat program, the process behavior of the target process after the start time can be monitored.

[0112] Step S34: If the process behavior of the target process after the start time satisfies the current detection condition, then detect whether the current detection condition is the last detection condition in the detection condition list.

[0113] It should be noted that if the process behavior of the target process after the starting moment meets the current detection condition, it means that the process behavior of the target process at this time is consistent with the attack behavior corresponding to the current detection condition. At this time, it can be detected whether the current detection condition is the last detection condition in the detection condition list, so as to determine whether it is necessary to obtain the detection condition again.

[0114] Furthermore, to ensure the accuracy of the detection, step S33 in this embodiment may include:

[0115] Monitoring process behaviors of the target process and associated processes corresponding to the target process after a start time, wherein the associated processes corresponding to the target process include child processes created by the target process and / or processes controlled by the target process;

[0116] Accordingly, the step S34 may include:

[0117] If the process behavior of the target process or the associated process corresponding to the target process after the start time satisfies the current detection condition, it is detected whether the current detection condition is the last detection condition in the detection condition list.

[0118] It should be noted that when an advanced threat program is attacking, some of its behaviors may not be directly executed by its corresponding process, but by the corresponding associated process, that is, executed by the created child process, or executed by other controlled processes. Therefore, in order to ensure the accuracy of detection, when detecting whether the current detection conditions are met, it is possible to detect whether the process behavior of the target process and the associated process corresponding to the target process after the starting time meets the current detection conditions. If the process behavior of the target process or the associated process corresponding to the target process after the starting time meets the current detection conditions, it can be said that the target process has executed the current detection conditions on its own to perform the attack behavior, or has performed the attack behavior by controlling other processes. At this time, it can still be determined that the current detection condition is met. Afterwards, it can be detected whether the current detection condition is the last detection condition in the detection condition list, so as to determine whether the detection condition list needs to be traversed.

[0119] Step S35: If it is the last detection condition, then the traversal of the detection condition list is ended, and it is determined whether the subsequent process behavior of the target process meets each detection condition in the detection condition list.

[0120] It can be understood that if the current detection condition is the last detection condition, it means that after determining the target behavior chain, the subsequent process behavior sequence of the target process meets all the detection conditions in the detection condition list. At this time, it can be determined that there is a high probability of attack behavior in the target process. Therefore, it can be determined that the subsequent process behavior of the target process meets each detection condition in the detection condition list.

[0121] If the current detection condition is not the last detection condition in the detection condition list, it means that there are still unsatisfied detection conditions in the detection condition list, and the detection conditions need to be obtained again. Therefore, after step S34 in this embodiment, the following steps may be further included:

[0122] If it is not the last detection condition, get the current system time;

[0123] The current system time is used as a new starting time, and the step of traversing the detection condition list is returned to, and the traversed detection condition is used as the current detection condition.

[0124] It is understandable that if the current detection condition is met and the current detection condition is not the last detection condition, then it is necessary to obtain subsequent detection conditions for further judgment. The attack behavior corresponding to the subsequent detection condition should be generated after the attack behavior corresponding to the current detection condition. Therefore, the current system time is used as the new starting time, and then return to step S32 to re-acquire the detection condition.

[0125] This embodiment uses the moment of determining the target behavior chain as the starting moment; traverses the detection condition list and uses the traversed detection condition as the current detection condition; monitors the process behavior of the target process after the starting moment; if the process behavior of the target process after the starting moment meets the current detection condition, then detects whether the current detection condition is the last detection condition in the detection condition list; if it is the last detection condition, then ends the traversal of the detection condition list and determines whether the subsequent process behavior of the target process meets each detection condition in the detection condition list. Since the detection condition list is traversed sequentially and detection conditions are extracted therefrom for matching, it is ensured that the process behavior of the target process can be compared with the attack behavior in order during detection, thereby ensuring the effectiveness of the detection.

[0126] refer to Figure 5 , Figure 5 FIG. 4 is a flow chart of a third embodiment of an attack detection method according to the present invention.

[0127] Based on the first embodiment, step S40 of the attack detection method of this embodiment includes:

[0128] Step S401: If the process behavior of the target process satisfies each detection condition in the detection condition list, then the time when each detection condition in the detection condition list is satisfied is obtained.

[0129] It should be noted that if the intervals between the detection times corresponding to multiple process behaviors suspected of being attack behaviors are too long, it is actually difficult to use them as a basis for determining whether a high-risk attack exists. In order to judge whether this situation occurs, when determining that the process behavior of the target process meets each detection condition in the detection condition list, you can first obtain the time when each detection condition in the detection condition list is met.

[0130] The time when the detection condition is satisfied may be the time when it is determined that the detection condition is satisfied.

[0131] Step S402: If the satisfied moment satisfies a preset determination condition, it is determined that a high-risk attack is detected.

[0132] It is understandable that if the preset determination condition is met at the satisfied moment, it means that the interval is not too long at this time, and therefore, it can be determined that a high-risk attack is detected.

[0133] In a specific implementation, whether the preset determination condition is satisfied may be determined by the difference between the time when the first detection condition determined to be satisfied is satisfied and the time when the last detection condition determined to be satisfied is satisfied in the detection condition list. Before step S402 in this embodiment, the following may also be included:

[0134] Obtaining the maximum and minimum moments among the satisfied moments;

[0135] Determine the condition-satisfaction interval length according to the maximum time and the minimum time;

[0136] If the condition is met and the interval duration is less than or equal to the preset interval threshold, it is determined that the preset determination condition is met.

[0137] It should be noted that the maximum moment among the satisfied moments can be the moment with the largest corresponding timestamp value among the satisfied moments, that is, the moment when the last detection condition in the detection condition list is determined to be satisfied is satisfied, and the minimum moment among the satisfied moments can be the moment with the smallest corresponding timestamp value among the satisfied moments, that is, the moment when the first detection condition in the detection condition list is determined to be satisfied is satisfied.

[0138] In actual use, determining the condition satisfaction interval duration based on the maximum time and the minimum time may be performed by subtracting the minimum time from the maximum time, and using the obtained difference as the condition satisfaction interval duration.

[0139] It should be noted that if the difference between the time when the first detection condition in the detection condition list is determined to be satisfied and the time when the last detection condition is determined to be satisfied is too large, it means that the overall detection time is too long and can no longer be used as a basis for judgment. Therefore, if the interval time for satisfying the condition is greater than the preset interval threshold, it can be determined that the preset judgment condition is not met. At this time, you can return to step S10 and re-test.

[0140] If the condition satisfaction interval is less than or equal to the preset interval threshold, it means that the difference between the time when the first detection condition determined to be satisfied in the detection condition list is satisfied and the time when the last detection condition determined to be satisfied is satisfied is not too large. At this time, it can be used as a basis for judgment. Therefore, it can be determined that the preset judgment condition is met.

[0141] The preset interval threshold may be set in advance by the developer of the smart terminal, for example, the preset interval threshold may be set to 1 hour.

[0142] In a specific implementation, whether the preset determination condition is satisfied may also be determined by the difference between the times when adjacent detection conditions in the detection condition list are satisfied. In this case, before step S402 in this embodiment, the following may also be included:

[0143] Determine, based on the satisfied moments, the satisfied interval durations between adjacent detection conditions in the detection condition list;

[0144] Extracting the maximum value among the satisfied interval durations to obtain the maximum interval duration;

[0145] If the maximum interval duration is less than or equal to the preset neighborhood determination threshold, it is determined that the preset determination condition is met.

[0146] It should be noted that adjacent detection conditions in the detection condition list can be two detection conditions that are sorted adjacently in the detection condition list. For example, if the detection condition list sequentially stores four detection conditions A, B, C, and D, then A and B, B and C, and C and D are adjacent detection conditions.

[0147] In actual use, the duration of the satisfied interval between adjacent detection conditions can be the absolute value of the difference between the moments when the adjacent detection conditions are satisfied. For example: if detection conditions A and B are not adjacent, the corresponding satisfied moment of A is A1, and the corresponding satisfied moment of B is B1, then the duration of the satisfied interval between A and B is |A1-B1|.

[0148] In actual applications, if the interval between any set of adjacent detection conditions is too long, the entire system can no longer be used as a basis for judgment. To quickly determine whether any set of adjacent detection conditions is too long, the maximum value of the satisfied intervals can be obtained as the maximum interval, and then compared with a preset neighborhood judgment threshold. The preset neighborhood judgment threshold can be pre-set by the developer of the smart terminal, for example, the preset neighborhood judgment threshold can be set to 30 minutes.

[0149] It is understood that if the maximum interval duration is less than or equal to the preset neighborhood determination threshold, it means that at this time, the interval duration between any set of adjacent detection conditions is not too long, which can be used as a basis for determination. Therefore, it can be determined that the preset determination condition is met.

[0150] If the maximum interval duration is greater than the preset neighborhood determination threshold, it means that the interval duration between at least one set of adjacent detection conditions is too long and can no longer be used as a basis for determination. Therefore, you can directly return to the above step S10 and re-detect.

[0151] This embodiment determines that a high-risk attack has been detected if the target process's behavior satisfies each detection condition in the detection condition list. The time at which each detection condition in the detection condition list is satisfied is obtained. If the time at which each detection condition in the detection condition list is satisfied satisfies a preset determination condition, a high-risk attack is detected. This improves the reliability of the attack detection method of this embodiment by performing a timeliness check based on the time at which each detection condition in the detection condition list is satisfied, thereby determining the reliability of the detection result.

[0152] refer to Figure 6 , Figure 6 FIG. 4 is a flow chart of a fourth embodiment of an attack detection method according to the present invention.

[0153] Based on the first embodiment described above, the attack detection method of this embodiment further includes, after step S40:

[0154] Step S50: Terminate the operation of the target process.

[0155] It should be noted that if a high-risk attack is detected, it means that the target process is most likely the process corresponding to the advanced threat program. If it is allowed to continue running, it may pose a threat to the smart terminal. Therefore, the target process can be terminated.

[0156] Step S60: When the termination is successful, the terminal application file corresponding to the target process is obtained.

[0157] Step S70: Isolate the terminal application file.

[0158] It should be noted that some advanced threat programs also have the ability to self-start. If you only terminate the operation of the target process, the advanced threat program may start again and attempt to attack again, which may damage the smart terminal. To avoid this phenomenon, when it is determined that the termination is successful, you can also obtain the terminal application file corresponding to the target process and isolate the terminal application file.

[0159] Wherein, obtaining the terminal application file corresponding to the target process may be to find the corresponding application according to the target process, and to find the terminal application file according to the application installation directory.

[0160] Furthermore, due to the data volume and computing power limitations on the terminal side, the overall detection accuracy is lower than that on the cloud side. To avoid erroneous isolation and other treatments caused by misjudgment, relevant data can also be uploaded to the cloud for further analysis and processing. In this case, after step S70 described in this embodiment, the following steps may also be included:

[0161] The moment when the target behavior chain is determined is regarded as the first moment, and the moment when the high-risk attack is detected is regarded as the second moment;

[0162] Obtaining process behavior data of the target process between the first moment and the second moment;

[0163] Uploading the process behavior data to the cloud for attack detection;

[0164] If the attack detection result fed back by the cloud is that there is no attack behavior, the isolation of the terminal application file is lifted.

[0165] It should be noted that the moment of determining the target behavior chain may be the moment when the process behavior of the target process is detected to match the preliminary detection conditions of the target behavior chain, and the moment when a high-risk attack is determined to be detected may be the moment when the last detection condition in the detection condition list is determined to be satisfied.

[0166] In actual use, if high-risk behavior is determined to exist, the basis for the smart terminal to determine the existence of a high-risk attack is the process behavior data of the target process between the first moment and the second moment. At this time, the process behavior data of the target process between the first moment and the second moment can be uploaded to the cloud for further detection, and further analysis can be performed using the cloud's higher computing power and more comprehensive detection data.

[0167] It is understandable that if the attack detection result fed back by the cloud is that there is no attack behavior, it means that a misjudgment behavior has occurred at this time, and the isolation of the terminal application file can be lifted at this time.

[0168] If the attack detection result fed back by the cloud indicates that an attack behavior exists, it means that this is not a false positive. At this time, in order to ensure the operation of the smart terminal, after uploading the process behavior data to the cloud for attack detection in this embodiment, the following steps may be further performed:

[0169] If the attack detection result fed back by the cloud indicates that an attack behavior exists, then obtain the attack repair script corresponding to the target attack chain;

[0170] Run the attack repair script to repair the terminal environment.

[0171] It should be noted that when the target process attempts to attack, it may modify part of the environment of the smart terminal (such as files, system parameters, etc.). At this time, the system environment of the smart terminal may become abnormal. In order to avoid the impact of this phenomenon on the smart terminal, when the attack detection result fed back from the cloud indicates that there is an attack behavior, the attack repair script corresponding to the target attack chain can be obtained, and then the attack repair script can be run to restore the environment tampered with by the target process, thereby repairing the terminal environment.

[0172] In actual use, the smart terminal can be equipped with a local repair script library, which can store attack repair scripts corresponding to various advanced threat programs. In this case, obtaining the attack repair script corresponding to the target attack chain can be done by searching the repair script library for the corresponding advanced threat program. The smart terminal can periodically request data from the cloud to update the repair script library.

[0173] This embodiment terminates the target process; upon successful termination, obtains the terminal application file corresponding to the target process; and isolates the terminal application file. Since the target process is quickly terminated and its corresponding terminal application file is isolated upon determining a high-risk attack, this prevents the target process from continuing to run and posing a threat to the terminal, and also prevents the target process from restarting and resuming itself.

[0174] In addition, an embodiment of the present invention further provides a storage medium, on which an attack detection program is stored. When the attack detection program is executed by a processor, the steps of the attack detection method described above are implemented.

[0175] Reference Figure 7 , Figure 7 This is a structural block diagram of the first embodiment of the attack detection device of the present invention.

[0176] like Figure 7 As shown, the attack detection device proposed in the embodiment of the present invention includes:

[0177] A matching module 10 is used to match the process behavior of the target process with the preliminary detection conditions of each preset attack behavior chain;

[0178] A selection module 20 is configured to select a preset attack behavior chain as a target behavior chain if the matching condition with any preset attack behavior chain is successful;

[0179] A construction module 30 is used to construct a detection condition list according to the target behavior chain;

[0180] The detection module 40 is configured to determine that a high-risk attack is detected if the subsequent process behavior of the target process satisfies each detection condition in the detection condition list.

[0181] This embodiment matches the process behavior of the target process with the preliminary detection conditions of each preset attack behavior chain; if the preliminary detection conditions of any preset attack behavior chain are successfully matched, the successfully matched preset attack behavior chain is used as the target behavior chain; a detection condition list is constructed based on the target behavior chain; if the subsequent process behavior of the target process meets each detection condition in the detection condition list, it is determined that a high-risk attack has been detected. Because the process behavior of the process in the terminal is monitored and matched with the multiple attacks included in the preset attack behavior chain corresponding to each advanced threat program, while ensuring that the terminal can detect whether there is a high-risk attack in advance, it also avoids the misjudgment of a single behavior detection, allowing the terminal to detect whether there is an attack on its own, reducing dependence on the server, avoiding the need for continuous process restoration and rule matching of all terminal data on the server, and improving the ability of a single terminal to detect advanced threats.

[0182] Furthermore, the construction module 30 is also used to extract at least one detection condition contained in the target behavior chain; obtain the attack behavior corresponding to each detection condition; sort the at least one detection condition according to the order of the attack behavior in the target behavior chain to obtain a detection condition list.

[0183] Furthermore, the detection module 40 is also used to take the moment of determining the target behavior chain as the starting moment; traverse the detection condition list, and use the traversed detection condition as the current detection condition; monitor the process behavior of the target process after the starting moment; if the process behavior of the target process after the starting moment meets the current detection condition, then detect whether the current detection condition is the last detection condition in the detection condition list; if it is the last detection condition, then end the traversal of the detection condition list, and determine whether the subsequent process behavior of the target process meets each detection condition in the detection condition list.

[0184] Furthermore, the detection module 40 is further configured to monitor the process behavior of the target process and its associated processes after a start time, wherein the associated processes of the target process include child processes created by the target process and / or processes controlled by the target process.

[0185] The detection module 40 is further configured to detect whether the current detection condition is the last detection condition in the detection condition list if the process behavior of the target process or the associated process corresponding to the target process after the start time satisfies the current detection condition.

[0186] Furthermore, the detection module 40 is also used to obtain the current system time if it is not the last detection condition; use the current system time as the new starting time, and return to the step of traversing the detection condition list and using the traversed detection condition as the current detection condition.

[0187] Furthermore, the detection module 40 is also used to obtain the time when each detection condition in the detection condition list is satisfied if the process behavior of the target process satisfies each detection condition in the detection condition list; if the time when each detection condition is satisfied meets the preset judgment condition, it is determined that a high-risk attack is detected.

[0188] Furthermore, the detection module 40 is also used to obtain the maximum moment and the minimum moment among the satisfied moments; determine the condition satisfaction interval length based on the maximum moment and the minimum moment; if the condition satisfaction interval length is less than or equal to the preset interval threshold, it is determined that the preset determination condition is satisfied.

[0189] Furthermore, the detection module 40 is also used to determine the satisfied interval duration between adjacent detection conditions in the detection condition list based on the satisfied moment; extract the maximum value among the satisfied interval durations to obtain the maximum interval duration; if the maximum interval duration is less than or equal to the preset neighborhood judgment threshold, it is determined that the preset judgment condition is satisfied.

[0190] Furthermore, the detection module 40 is further configured to terminate the operation of the target process; when the termination is successful, obtain the terminal application file corresponding to the target process; and isolate the terminal application file.

[0191] Furthermore, the detection module 40 is also used to use the moment when the target behavior chain is determined as the first moment, and the moment when a high-risk attack is detected as the second moment; obtain the process behavior data of the target process between the first moment and the second moment; upload the process behavior data to the cloud for attack detection; if the attack detection result fed back from the cloud is that there is no attack behavior, then the isolation of the terminal application file is lifted.

[0192] Furthermore, the detection module 40 is further configured to obtain an attack repair script corresponding to the target attack chain if the attack detection result fed back from the cloud indicates that an attack behavior exists; and run the attack repair script to repair the terminal environment.

[0193] It should be understood that the above is only an example and does not constitute any limitation to the technical solution of the present invention. In specific applications, those skilled in the art can make settings as needed, and the present invention does not impose any limitation on this.

[0194] It should be noted that the workflow described above is merely illustrative and does not limit the scope of protection of the present invention. In practical applications, technicians in this field can select part or all of it according to actual needs to achieve the purpose of the embodiment scheme, and no limitation is made here.

[0195] In addition, for technical details not fully described in this embodiment, reference can be made to the attack detection method provided in any embodiment of the present invention, and will not be repeated here.

[0196] In addition, it should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0197] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0198] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, or of course by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium (such as a read-only memory (ROM) / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0199] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

[0200] This application discloses A1, an attack detection method, which is applied to a smart terminal;

[0201] The attack detection method comprises the following steps:

[0202] Match the target process's behavior with the preliminary detection conditions of each preset attack behavior chain;

[0203] If the initial detection condition of any preset attack behavior chain is successfully matched, the preset attack behavior chain that is successfully matched will be used as the target behavior chain;

[0204] Constructing a list of detection conditions based on the target behavior chain;

[0205] If the subsequent process behavior of the target process meets each detection condition in the detection condition list, it is determined that a high-risk attack is detected.

[0206] A2. In the attack detection method described in A1, the step of constructing a detection condition list based on the target behavior chain comprises:

[0207] Extracting at least one detection condition included in the target behavior chain;

[0208] Obtain the attack behavior corresponding to each detection condition;

[0209] The at least one detection condition is sorted according to the order of the attack behavior in the target behavior chain to obtain a detection condition list.

[0210] A3. The attack detection method according to A1, wherein before the step of determining that a high-risk attack has been detected if subsequent process behavior of the target process satisfies each detection condition in the detection condition list, the method further comprises:

[0211] The moment when the target behavior chain is determined is regarded as the starting moment;

[0212] Traversing the detection condition list and using the traversed detection condition as the current detection condition;

[0213] Monitoring the process behavior of the target process after the start time;

[0214] If the process behavior of the target process after the start time satisfies the current detection condition, detecting whether the current detection condition is the last detection condition in the detection condition list;

[0215] If it is the last detection condition, the traversal of the detection condition list is ended, and it is determined whether the subsequent process behavior of the target process meets each detection condition in the detection condition list.

[0216] A4. In the attack detection method described in A3, the step of monitoring the process behavior of the target process after the start time comprises:

[0217] Monitoring process behaviors of the target process and associated processes corresponding to the target process after a start time, wherein the associated processes corresponding to the target process include child processes created by the target process and / or processes controlled by the target process;

[0218] If the process behavior of the target process after the start time satisfies the current detection condition, the step of detecting whether the current detection condition is the last detection condition in the detection condition list includes:

[0219] If the process behavior of the target process or the associated process corresponding to the target process after the start time satisfies the current detection condition, it is detected whether the current detection condition is the last detection condition in the detection condition list.

[0220] A5. The attack detection method according to A3, further comprising: after the step of detecting whether the current detection condition is the last detection condition in the detection condition list if the process behavior of the target process after the start time satisfies the current detection condition;

[0221] If it is not the last detection condition, get the current system time;

[0222] The current system time is used as a new starting time, and the step of traversing the detection condition list is returned to, and the traversed detection condition is used as the current detection condition.

[0223] A6. The attack detection method according to A1, wherein if the subsequent process behavior of the target process satisfies each detection condition in the detection condition list, the step of determining that a high-risk attack has been detected comprises:

[0224] If the process behavior of the target process satisfies each detection condition in the detection condition list, obtaining the time at which each detection condition in the detection condition list is satisfied;

[0225] If the satisfied moment satisfies a preset determination condition, it is determined that a high-risk attack is detected.

[0226] A7. The attack detection method according to A6, further comprising: before the step of determining that a high-risk attack is detected if the satisfied moment satisfies a preset determination condition:

[0227] Obtaining the maximum and minimum moments among the satisfied moments;

[0228] Determine the condition-satisfaction interval length according to the maximum time and the minimum time;

[0229] If the condition is met and the interval duration is less than or equal to the preset interval threshold, it is determined that the preset determination condition is met.

[0230] A8. The attack detection method according to A6, further comprising: before the step of determining that a high-risk attack is detected if the satisfied moment satisfies a preset determination condition:

[0231] Determine, based on the satisfied moments, the satisfied interval durations between adjacent detection conditions in the detection condition list;

[0232] Extracting the maximum value among the satisfied interval durations to obtain the maximum interval duration;

[0233] If the maximum interval duration is less than or equal to the preset neighborhood determination threshold, it is determined that the preset determination condition is met.

[0234] A9. The attack detection method according to any one of A1 to A8, further comprising: after the step of determining that a high-risk attack has been detected if subsequent process behavior of the target process satisfies each detection condition in the detection condition list;

[0235] terminating the operation of the target process;

[0236] When the termination is successful, obtaining the terminal application file corresponding to the target process;

[0237] The terminal application files are isolated.

[0238] A10. The attack detection method according to A9, further comprising, after isolating the terminal application file:

[0239] The moment when the target behavior chain is determined is regarded as the first moment, and the moment when the high-risk attack is detected is regarded as the second moment;

[0240] Obtaining process behavior data of the target process between the first moment and the second moment;

[0241] Uploading the process behavior data to the cloud for attack detection;

[0242] If the attack detection result fed back by the cloud is that there is no attack behavior, the isolation of the terminal application file is lifted.

[0243] A11. The attack detection method according to A10, after uploading the process behavior data to the cloud for attack detection, further comprising:

[0244] If the attack detection result fed back by the cloud indicates that an attack behavior exists, then obtain the attack repair script corresponding to the target attack chain;

[0245] Run the attack repair script to repair the terminal environment.

[0246] This application also discloses B12, an attack detection device, which includes the following modules:

[0247] A matching module is used to match the process behavior of the target process with the preliminary detection conditions of each preset attack behavior chain;

[0248] A selection module is used to select the preset attack behavior chain as the target behavior chain if the matching with the preliminary detection conditions of any preset attack behavior chain is successful;

[0249] A construction module, configured to construct a detection condition list according to the target behavior chain;

[0250] The detection module is configured to determine that a high-risk attack is detected if subsequent process behaviors of the target process satisfy each detection condition in the detection condition list.

[0251] B13. In the attack detection device as described in B12, the construction module is further used to extract at least one detection condition contained in the target behavior chain; obtain the attack behavior corresponding to each detection condition; sort the at least one detection condition according to the order of the attack behavior in the target behavior chain to obtain a detection condition list.

[0252] B14. In the attack detection device as described in B12, the detection module is further used to use the moment of determining the target behavior chain as the starting moment; traverse the detection condition list, and use the traversed detection condition as the current detection condition; monitor the process behavior of the target process after the starting moment; if the process behavior of the target process after the starting moment meets the current detection condition, then detect whether the current detection condition is the last detection condition in the detection condition list; if it is the last detection condition, then end the traversal of the detection condition list, and determine whether the subsequent process behavior of the target process meets each detection condition in the detection condition list.

[0253] B15. The attack detection device as described in B14, wherein the detection module is further used to monitor the process behavior of the target process and its associated processes after the start time, wherein the associated processes corresponding to the target process include child processes created by the target process and / or processes controlled by the target process;

[0254] The detection module is further configured to detect whether the current detection condition is the last detection condition in the detection condition list if the process behavior of the target process or the associated process corresponding to the target process after the start time satisfies the current detection condition.

[0255] B16. In the attack detection device as described in B14, the detection module is further used to obtain the current system time if it is not the last detection condition; use the current system time as the new starting time, and return to the step of traversing the detection condition list and using the traversed detection condition as the current detection condition.

[0256] B17. In the attack detection device as described in B12, the detection module is further used to obtain the time when each detection condition in the detection condition list is satisfied if the process behavior of the target process satisfies each detection condition in the detection condition list; if the satisfied time satisfies the preset judgment condition, it is determined that a high-risk attack is detected.

[0257] B18. The attack detection device as described in B17, wherein the detection module is further used to obtain the maximum time and the minimum time among the satisfied times; determine the condition satisfaction interval length based on the maximum time and the minimum time; if the condition satisfaction interval length is less than or equal to a preset interval threshold, it is determined that the preset determination condition is satisfied.

[0258] The present application also discloses C19, an attack detection device, which includes: a processor, a memory, and an attack detection program stored in the memory and executable on the processor, wherein the attack detection program implements the steps of the attack detection method described above when executed by the processor.

[0259] The present application also discloses D20, a computer-readable storage medium, on which an attack detection program is stored. When the attack detection program is executed, the steps of the attack detection method described above are implemented.

Claims

1. An attack detection method, characterized in that: The attack detection method is applied to smart terminals; The attack detection method comprises the following steps: Match the target process's behavior with the preliminary detection conditions of each preset attack behavior chain; If the initial detection condition of any preset attack behavior chain is successfully matched, the preset attack behavior chain that is successfully matched will be used as the target behavior chain; Constructing a list of detection conditions based on the target behavior chain; If the subsequent process behavior of the target process meets each detection condition in the detection condition list, it is determined that a high-risk attack is detected.

2. The attack detection method according to claim 1, wherein: The step of constructing a detection condition list according to the target behavior chain includes: Extracting at least one detection condition included in the target behavior chain; Obtain the attack behavior corresponding to each detection condition; The at least one detection condition is sorted according to the order of the attack behavior in the target behavior chain to obtain a detection condition list.

3. The attack detection method according to claim 1, wherein: Before the step of determining that a high-risk attack is detected if subsequent process behaviors of the target process meet each detection condition in the detection condition list, the method further includes: The moment when the target behavior chain is determined is regarded as the starting moment; Traversing the detection condition list and using the traversed detection condition as the current detection condition; Monitoring the process behavior of the target process after the start time; If the process behavior of the target process after the start time satisfies the current detection condition, detecting whether the current detection condition is the last detection condition in the detection condition list; If it is the last detection condition, the traversal of the detection condition list is ended, and it is determined whether the subsequent process behavior of the target process meets each detection condition in the detection condition list.

4. The attack detection method according to claim 3, wherein: The step of monitoring the process behavior of the target process after the start time includes: Monitoring process behaviors of the target process and associated processes corresponding to the target process after a start time, wherein the associated processes corresponding to the target process include child processes created by the target process and / or processes controlled by the target process; If the process behavior of the target process after the start time satisfies the current detection condition, the step of detecting whether the current detection condition is the last detection condition in the detection condition list includes: If the process behavior of the target process or the associated process corresponding to the target process after the start time satisfies the current detection condition, it is detected whether the current detection condition is the last detection condition in the detection condition list.

5. The attack detection method according to claim 3, wherein: After the step of detecting whether the current detection condition is the last detection condition in the detection condition list if the process behavior of the target process after the start time satisfies the current detection condition, the method further includes: If it is not the last detection condition, get the current system time; The current system time is used as a new starting time, and the step of traversing the detection condition list is returned to, and the traversed detection condition is used as the current detection condition.

6. The attack detection method according to claim 1, wherein: The step of determining that a high-risk attack is detected if subsequent process behaviors of the target process meet each detection condition in the detection condition list includes: If the process behavior of the target process satisfies each detection condition in the detection condition list, obtaining the time at which each detection condition in the detection condition list is satisfied; If the satisfied moment satisfies a preset determination condition, it is determined that a high-risk attack is detected.

7. The attack detection method according to claim 6, wherein: Before the step of determining that a high-risk attack is detected if the satisfied moment satisfies a preset determination condition, the method further includes: Obtaining the maximum and minimum moments among the satisfied moments; Determine the condition-satisfaction interval length according to the maximum time and the minimum time; If the condition is met and the interval duration is less than or equal to the preset interval threshold, it is determined that the preset determination condition is met.

8. An attack detection device, characterized in that: The attack detection device includes the following modules: A matching module is used to match the process behavior of the target process with the preliminary detection conditions of each preset attack behavior chain; A selection module is used to select the preset attack behavior chain as the target behavior chain if the matching with the preliminary detection conditions of any preset attack behavior chain is successful; A construction module, configured to construct a detection condition list according to the target behavior chain; The detection module is configured to determine that a high-risk attack is detected if subsequent process behaviors of the target process satisfy each detection condition in the detection condition list.

9. An attack detection device, characterized in that: The attack detection device includes: a processor, a memory, and an attack detection program stored in the memory and executable on the processor. When the attack detection program is executed by the processor, the steps of the attack detection method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores an attack detection program, which, when executed, implements the steps of the attack detection method according to any one of claims 1 to 7.

Images