Multi-stage trusted parent process chain simulation test and defense enhancement method

Abstract

The invention relates to the technical field of network security, and discloses a multi-stage trusted parent process chain simulation test and defense enhancement method, which comprises the following steps of: embedding a simulated malicious behavior into a child process of a legal interpreter process in simulation operation to generate a multi-stage process chain, the legal interpreter process comprises a parent process and a child process of each process; performing context behavior simulation and analysis on the multi-stage process chain to generate a cross-level behavior graph; identifying an abnormal process chain and a legal process chain of the multi-stage process chain based on the cross-level behavior map; and modifying the defense rule based on the behavior characteristics of the abnormal process chain, and modifying the defense white list based on the behavior characteristics of the legal process chain. According to the method, cross-level hidden attacks can be effectively identified, and the network security is ensured.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a multi-stage trusted parent process chain simulation test and defense enhancement method. Background Technology

[0002] Endpoint security detection technology is a protection system used for real-time monitoring, detection, and response to security threats on endpoint devices. Its core is to proactively identify advanced threats through deep behavioral analysis, machine learning, and big data technologies, compensating for the shortcomings of traditional antivirus software. Existing endpoint security detection technologies include EDR (Endpoint Detection and Response) and WAF (Web Application Firewall).

[0003] Existing endpoint security detection technologies typically rely on process tree trustworthiness analysis. For example, a single-level parent process hijacking where a malicious process is launched directly by explorer.exe is easily detected due to its abnormal behavior. However, attackers are increasingly employing multi-stage process chain techniques, using multiple levels of trusted parent processes to ensure that each layer conforms to a legitimate behavior pattern. This makes it difficult for traditional detection models to connect the entire chain, effectively identify cross-level covert attacks, and ultimately fail to guarantee network security. Summary of the Invention

[0004] In view of this, the present invention provides a multi-stage trusted parent process chain simulation test and defense enhancement method to effectively identify cross-level covert attacks and ensure network security.

[0005] In a first aspect, the present invention provides a multi-stage trusted parent process chain simulation testing and defense enhancement method, which includes: embedding simulated malicious behavior into the child processes of a simulated legitimate interpreter process to generate a multi-stage process chain, wherein the legitimate interpreter process includes the parent process and child processes of each process; performing contextual behavior simulation and analysis on the multi-stage process chain to generate a cross-level behavior graph; identifying abnormal process chains and legitimate process chains of the multi-stage process chain based on the cross-level behavior graph; modifying defense rules based on the behavioral characteristics of abnormal process chains; and modifying the defense whitelist based on the behavioral characteristics of legitimate process chains.

[0006] In this implementation, by constructing a simulated environment of multi-level legitimate process chains, an adaptive defense strategy based on behavioral context is designed to solve the problem of blind spots in the detection of multi-stage trusted parent process chains by traditional defense technologies, improve the efficiency of identifying and blocking hidden potential threat chains, and further enhance security protection capabilities.

[0007] In one alternative implementation, simulated malicious behavior is embedded in a child process of a simulated legitimate interpreter process to generate a multi-stage process chain, including: starting the legitimate interpreter process by modifying registry entries based on a COM hijacking method; injecting simulated code into the legitimate interpreter and starting a trusted child process by a process cloning method; and embedding the execution logic of simulated malicious behavior into the normal business process of the trusted child process to generate a multi-stage process chain.

[0008] In this implementation, a potential threat chain is simulated based on COM hijacking technology, providing a high-fidelity test scenario for terminal security detection, accelerating the iteration of defense rules, and simulating the process chain to fully reuse the digital signature and operation logic of legitimate applications, ensuring that the test environment closely resembles a real attack.

[0009] In one alternative implementation, contextual behavior simulation and analysis are performed on the multi-stage process chain to generate a cross-level behavior graph, including: identifying the process startup sequence, resource loading path and API call sequence of each process in the multi-stage process chain, and generating a cross-level behavior graph.

[0010] In this implementation, a context behavior graph of cross-level process chains is constructed, which breaks through the traditional single-layer detection logic and improves the ability to identify hidden potential threat chains.

[0011] In one optional implementation, identifying abnormal and legitimate process chains in a multi-stage process chain based on cross-level behavioral graphs includes: determining whether the startup interval between the parent and child processes of the target process is greater than a preset time interval based on the process startup sequence; if the startup interval is greater than the preset time interval, the target process is determined to be an abnormal process chain, otherwise it is a legitimate process chain; and / or determining whether the target process in the multi-stage process chain is in a defense whitelist based on the resource loading path; if the target process is not in the defense whitelist, the target process is determined to be an abnormal process chain, otherwise it is a legitimate process chain; and / or using a neural network model to model the API call sequence of the target process and calculate the API deviation; if the API deviation is greater than a preset deviation, the target process is determined to be an abnormal process chain, otherwise it is a legitimate process chain.

[0012] In one optional implementation, the defense rules are modified based on the behavioral characteristics of the abnormal process chain, and the defense whitelist is modified based on the behavioral characteristics of the legitimate process chain. This includes: if the resource loading path of the abnormal process chain is not in the defense whitelist, then a startup restriction rule for the abnormal process chain is generated and added to the defense rules; and the legitimate context features of the legitimate process chain are obtained and added to the defense whitelist.

[0013] In one optional implementation, the multi-stage trusted parent process chain simulation test and defense enhancement method further includes: performing defense tests using modified defense rules and modified defense whitelists; reducing the preset deviation when the abnormal process chain is not intercepted; increasing the preset deviation when the legitimate process chain is intercepted; and adjusting the model parameters of the neural network model when the legitimate process chain is intercepted multiple times or the abnormal process chain is not intercepted multiple times.

[0014] In this implementation, machine learning and behavioral whitelists are combined to achieve adaptive adjustment of detection rules, balancing security and false alarm rate.

[0015] Secondly, the present invention provides a multi-stage trusted parent process chain simulation testing and defense enhancement device, which includes: a simulation module for embedding simulated malicious behavior into the child processes of a simulated legitimate interpreter process to generate a multi-stage process chain, wherein the legitimate interpreter process includes the parent process and child processes of each process; a generation module for performing contextual behavior simulation and analysis on the multi-stage process chain to generate a cross-level behavior graph; an identification module for identifying abnormal process chains and legitimate process chains of the multi-stage process chain based on the cross-level behavior graph; and an adjustment module for modifying defense rules based on the behavioral characteristics of abnormal process chains and modifying the defense whitelist based on the behavioral characteristics of legitimate process chains.

[0016] Thirdly, the present invention provides a computer device, including: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the computer instructions to perform the multi-stage trusted parent process chain simulation testing and defense enhancement method described in the first aspect or any corresponding embodiment.

[0017] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the multi-stage trusted parent process chain simulation testing and defense enhancement method described in the first aspect or any of its corresponding embodiments.

[0018] Fifthly, the present invention provides a computer program product, including computer instructions, which are used to cause a computer to execute the multi-stage trusted parent process chain simulation testing and defense enhancement method described in the first aspect or any of its corresponding embodiments. Attached Figure Description

[0019] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a flowchart of a multi-stage trusted parent process chain simulation test and defense enhancement method according to an embodiment of the present invention;

[0021] Figure 2 This is a flowchart of another multi-stage trusted parent process chain simulation test and defense enhancement method according to an embodiment of the present invention;

[0022] Figure 3 This is a flowchart of another multi-stage trusted parent process chain simulation test and defense enhancement method according to an embodiment of the present invention;

[0023] Figure 4 This is a structural block diagram of a multi-stage trusted parent process chain simulation test and defense enhancement device according to an embodiment of the present invention;

[0024] Figure 5 This is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] Existing endpoint security detection technologies typically rely on process tree trustworthiness analysis, focusing only on the behavior of a single-level parent process and neglecting the correlation analysis of multi-stage process chains. Due to the lack of dynamic analysis capabilities for multi-stage process chains, they cannot effectively identify covert attacks across levels. If a child process is a legitimate application, its malicious behavior can easily be misjudged as normal operation, failing to guarantee network security. Therefore, this application proposes a multi-stage trusted parent process chain simulation testing and defense enhancement method. By simulating a multi-stage threat chain, it designs an adaptive defense strategy based on behavioral context, addressing the blind spot in traditional defense technologies for multi-stage trusted parent process chains, improving the efficiency of identifying and blocking covert potential threat chains, and further enhancing security protection capabilities.

[0027] According to an embodiment of the present invention, a method for multi-stage trusted parent process chain simulation testing and defense enhancement is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0028] This embodiment provides a multi-stage trusted parent process chain simulation test and defense enhancement method. Figure 1 This is a flowchart of a multi-stage trusted parent process chain simulation test and defense enhancement method according to an embodiment of the present invention. It should be noted that if substantially the same result is obtained, this embodiment does not necessarily reflect that result. Figure 1 The illustrated process sequence is limited. For example... Figure 1 As shown, the process includes the following steps:

[0029] Step S101: Embed simulated malicious behavior in a child process of a simulated legitimate interpreter process to generate a multi-stage process chain.

[0030] The valid interpreter process includes the parent process and child processes of each process.

[0031] Specifically, the process simulates the execution of a legitimate interpreter process, generating a process tree that conforms to normal operation. This process tree includes multi-level parent and child processes. Malicious behavior is then embedded into the child processes to generate a multi-stage process chain. The simulated malicious behavior includes actions such as reading sensitive files.

[0032] Understandably, this application uses malicious behavior in a multi-stage process chain to simulate defense testing.

[0033] Step S102: Perform contextual behavior simulation and analysis on the multi-stage process chain to generate a cross-level behavior graph.

[0034] Contextual text simulation analysis is performed on the parent and child processes of each process in a multi-stage process chain to determine the behavioral logic of the parent and child processes and generate a cross-level hierarchical map to reveal the hidden threat chain across processes.

[0035] In one implementation, the process startup sequence of each process in a multi-stage process chain is analyzed. Specifically, the startup time of the parent process and the startup time of the child process of each process are analyzed, and the startup interval is recorded.

[0036] One implementation analyzes the resource loading path of each process in the multi-stage process chain. Specifically, it analyzes the DLL (Dynamic Link Library) loading path of each process.

[0037] One implementation analyzes the API (Application Programming Interface) call sequence for each process in a multi-stage process chain. Specifically, the API call sequence refers to the process of executing a series of API requests in a specific order, describing how multiple API calls occur sequentially (or sometimes in parallel) when completing a complex task, and the dependencies between them.

[0038] Step S103: Identify abnormal and legitimate process chains in multi-stage process chains based on cross-level behavior graphs.

[0039] Based on cross-level behavioral graph analysis, it is determined whether there are anomalies in the multi-stage process chain. Specifically, it is determined whether the process startup sequence, resource loading path and API call sequence of each process in the multi-stage process chain are abnormal. When there is at least one behavioral anomaly, the process is determined to be an abnormal process chain; otherwise, the process is a legitimate process chain.

[0040] Step S104: Modify the defense rules based on the behavioral characteristics of the abnormal process chain, and modify the defense whitelist based on the behavioral characteristics of the legitimate process chain.

[0041] Specifically, the behavioral characteristics of the abnormal process chain are obtained, and corresponding abnormal process defense rules are set according to the abnormal behavioral characteristics. For example, if the abnormal process chain starts abnormally, a restriction rule is set for starting one of them.

[0042] Obtain the behavioral characteristics of legitimate process chains and set corresponding whitelist rules based on these characteristics, such as adding the behavioral characteristics of legitimate process chains to the whitelist database.

[0043] Furthermore, the modified defense rules and defense whitelist were used to conduct defense tests on the process chain.

[0044] The multi-stage trusted parent process chain simulation testing and defense enhancement method provided in this embodiment simulates a multi-stage threat chain and designs an adaptive defense strategy based on behavioral context. This solves the problem of blind spots in the detection of multi-stage trusted parent process chains by traditional defense technologies, improves the efficiency of identifying and blocking hidden potential threat chains, and further enhances security protection capabilities.

[0045] This embodiment provides a multi-stage trusted parent process chain simulation test and defense enhancement method. Figure 2 This is a flowchart of another multi-stage trusted parent process chain simulation test and defense enhancement method according to an embodiment of the present invention. It should be noted that if substantially the same result is obtained, this embodiment does not necessarily reflect that result. Figure 2 The illustrated process sequence is limited. For example... Figure 2 As shown, the process includes the following steps:

[0046] Step S201: Embed simulated malicious behavior in a child process of a simulated legitimate interpreter process to generate a multi-stage process chain.

[0047] The valid interpreter process includes the parent process and child processes of each process.

[0048] Specifically, step S201 includes:

[0049] Step S2011: Based on the COM hijacking method, a legitimate interpreter process is started by modifying registry entries.

[0050] Specifically, based on the COM hijacking method (ATT&CK T1546.015), explorer.exe is simulated to hijack the registry and start a legitimate interpreter process, generating a process tree that conforms to normal behavior, including a parent process and child processes.

[0051] For example, the legitimate interpreter process is python.exe.

[0052] Step S2012: Using the process cloning method, simulated code is injected into the legitimate interpreter to start a trusted subprocess.

[0053] Specifically, by using the process cloning method (ATT&CK T1055.003), simulated code is injected into the legitimate interpreter process to trigger the start of a trusted subprocess, in which the command-line parameters of the trusted subprocess are consistent with those of the legitimate operation.

[0054] For example, the trusted subprocess is the Teams updater.

[0055] Furthermore, the legitimate digital signatures and resource access patterns of trusted subprocesses are preserved.

[0056] Step S2013: Embed execution logic simulating malicious behavior into the normal business process of the trusted subprocess to generate a multi-stage process chain.

[0057] The simulated malicious behavior is embedded in a trusted subprocess, and the triggering conditions of the simulated malicious behavior are integrated with the legitimate operation logic of the trusted subprocess.

[0058] Specifically, the triggering condition for simulating malicious behavior is the pre-set abnormal behavior execution logic in the subprocess, while the legitimate operation logic of the trusted subprocess is the original normal business process of the subprocess. The execution logic of malicious behavior is embedded into the normal business process of the trusted subprocess.

[0059] For example, the simulated malicious behavior is reading sensitive files. The trigger condition for the simulated malicious behavior is reading sensitive files when temporary file cleanup is completed. The legitimate operation logic of the trusted subprocess is that the Teams updater automatically performs temporary file cleanup after completing the update.

[0060] The code implementation process for embedding malicious behavior into the trigger node of a legitimate operation is as follows:

[0061]

[0062] In this implementation, malicious behavior is "wrapped" in legitimate operation logic, circumventing single-layer behavior detection, improving stealth, and forcing the defense system to analyze contextual relationships, such as why user documents are read when cleaning up temporary files, rather than just checking isolated actions.

[0063] Step S202: Perform contextual behavior simulation and analysis on the multi-stage process chain to generate a cross-level behavior graph.

[0064] Specifically, the process startup sequence, resource loading path, and API call sequence of each process in a multi-stage process chain are identified to generate a cross-level behavior graph.

[0065] Furthermore, the cross-level behavioral graph is converted into a quantized feature vector form.

[0066] For example, the feature vector is represented as: [parent process name, child process permissions, DLL path confidence, API deviation].

[0067] In a specific example, the feature vector is represented as feature_vector = ["python.exe", "HIGH", 0.2, 0.35]. This example indicates that python.exe launches a high-privilege process (such as cmd.exe), with a DLL path confidence of 0.2 and an API deviation of 0.35.

[0068] Step S203: Identify abnormal and legitimate process chains in multi-stage process chains based on cross-level behavior graphs.

[0069] Specifically, step S203 includes:

[0070] Step S2031: Based on the process startup sequence, determine whether the startup interval between the parent process and child process of the target process is greater than a preset time interval. If the startup interval is greater than the preset time interval, the target process is determined to be an abnormal process chain; otherwise, it is a legal process chain.

[0071] Specifically, the correlation analysis method based on process startup timing analyzes the startup time of the target process's parent process and the startup time of its child processes, and records the startup interval.

[0072] For example, the preset time interval is 10 seconds. If the startup interval is greater than 10 seconds, the target process is determined to be abnormal and is an abnormal process chain; otherwise, it is a legal process chain.

[0073] Step S2032: Determine whether the target process in the multi-stage process chain is in the defense whitelist based on the resource loading path. If the target process is not in the defense whitelist, the target process is determined to be an abnormal process chain; otherwise, it is a legitimate process chain.

[0074] For example, the defense whitelist is C:\Windows\System32.

[0075] Specifically, the DLL path loaded by each process is analyzed to determine whether the DLL path is in the defense whitelist C:\Windows\System32. If the target process is not in the defense whitelist, the target process is judged to be suspicious and the target process is determined to be an abnormal process chain; otherwise, it is a legitimate process chain.

[0076] Step S2033: Use a neural network model to model the API call sequence of the target process and calculate the API deviation. If the API deviation is greater than the preset deviation, the target process is determined to be an abnormal process chain; otherwise, it is a legal process chain.

[0077] Specifically, the deviation of the API call sequence of the target process from the baseline pattern is analyzed based on LSTM neural network.

[0078] The baseline pattern refers to the standard behavior of the same process in a legal scenario.

[0079] In one implementation, the baseline pattern includes a normal API call sequence. For example, the normal API call sequence is that the Teams updater should first call WinHTTP to connect to the network, rather than directly reading and writing files. The deviation of the API call sequence from the baseline pattern is calculated.

[0080] For example, the preset deviation is 30%. When the API deviation is greater than 30%, the target process is determined to be abnormal and is an abnormal process chain; otherwise, it is a legal process chain.

[0081] In another implementation, the baseline mode includes a normal resource consumption range and a typical dependency library whitelist. For example, the normal resource consumption range is memory usage not exceeding 100MB, and the typical dependency library whitelist only loads DLLs located in C:\Windows\System32\.

[0082] For example, the resource consumption deviation is 150% of the baseline. If the resource consumption of the target process is greater than 150% of the baseline, the target process is determined to be abnormal and is an abnormal process chain; otherwise, it is a legal process chain.

[0083] In another implementation, the resource consumption and deviation of the API call sequence of the target process are analyzed based on the LSTM neural network to compare with the baseline pattern. When the API deviation is greater than 30% and the resource consumption of the target process is greater than 150% of the baseline, the target process is judged to be abnormal and is an abnormal process chain; otherwise, it is a legal process chain.

[0084] Step S204: Modify the defense rules based on the behavioral characteristics of the abnormal process chain, and modify the defense whitelist based on the behavioral characteristics of the legitimate process chain.

[0085] Specifically, step S204 includes:

[0086] Step S2041: If the resource loading path of the abnormal process chain is not in the defense whitelist, then generate the startup restriction rule for the abnormal process chain and add the startup restriction rule to the defense rules.

[0087] Based on the simulation test results, detection rules for multi-stage process chains are automatically generated.

[0088] Specifically, if it is detected that the parent process of an abnormal process chain starts a child process, and the resource loading path of the child process is not in the defense whitelist, then a restriction rule for the parent process to start a child process will be generated.

[0089] For example, if a simulation test detects that process A (e.g., python.exe) starts process B (e.g., Teams updater) and process B loads a non-whitelisted DLL, then a rule is generated to "restrict python.exe from starting high-privilege child processes".

[0090] Step S2042: Obtain the legitimate context features of the legitimate process chain and add the legitimate context features to the defense whitelist.

[0091] Specifically, the legitimate context features of legitimate process chains are included in the whitelist to reduce the false positive rate.

[0092] For example, the legitimate context feature is the standard command-line argument of the Teams updater. The standard command-line argument of the Teams updater, "--update--silent", is included in the whitelist database, and a confidence threshold is set; for example, a confidence level ≥ 95% is considered a legitimate process chain.

[0093] Furthermore, the modified defense rules and defense whitelist were used to conduct defense tests on the process chain. By repeatedly simulating multi-stage process chain attacks, the effectiveness of the defense rules was verified, and the detection threshold was dynamically adjusted.

[0094] In one implementation, defense testing is performed using modified defense rules and a modified defense whitelist. If an abnormal process chain is not intercepted, the preset deviation is reduced, for example, the preset deviation is adjusted from 30% to 25%. If a legitimate process chain is intercepted, the preset deviation is increased.

[0095] In another implementation, the modified defense rules and the modified defense whitelist are used for defense testing. If a legitimate process chain is intercepted multiple times or an abnormal process chain is not intercepted multiple times, the model parameters of the neural network model are adjusted.

[0096] This implementation constructs a potential threat chain test scenario and improves the identification capability of concealed potential threat chains by building a contextual behavior graph of cross-level process chains, breaking through the traditional single-layer detection logic. Based on ATT&CK technologies (T1546.015, T1055.003), it simulates potential threat chains, providing a high-fidelity test scenario for EDR / WAF, accelerating the iteration of defense rules, and optimizing defense rules based on contextual behavior analysis methods such as process startup sequence and resource access patterns. This achieves adaptive adjustment of detection rules, balancing security and false positive rate.

[0097] This embodiment provides a multi-stage trusted parent process chain simulation test and defense enhancement method. Figure 3 This is a flowchart of another multi-stage trusted parent process chain simulation testing and defense enhancement method according to an embodiment of the present invention. It should be noted that if substantially the same result is obtained, this embodiment does not necessarily reflect that. Figure 3 The illustrated process sequence is limited. For example... Figure 3 As shown, this multi-stage trusted parent process chain simulation testing and defense enhancement method mainly includes four steps: multi-stage process chain simulation, dynamic behavior analysis engine, defense strategy optimization, and closed-loop verification and iteration.

[0098] First, simulation of multi-stage process chains.

[0099] Multi-stage process chain simulation simulates the launch of a legitimate interpreter process (explorer.exe) through registry hijacking; it then injects code into the interpreter process to trigger a trusted child process; finally, it embeds simulated abnormal behavior integrated with legitimate operation logic into the child process. Specifically, multi-stage process chain simulation includes the following steps:

[0100] Step a1, COM hijacking simulation (T1546.015, registry key modification).

[0101] By simulating explorer.exe to hijack the registry and launch a legitimate interpreter (python.exe), a process tree that conforms to normal behavior is generated.

[0102] Step a2, process cloning simulation test (T1055.003, code injection).

[0103] Injecting mock code into python.exe triggers a trusted subprocess (Teams updater), preserving the legitimate digital signature and resource access mode.

[0104] Step a3, context behavior simulation.

[0105] The child process executes simulated malicious behavior, and the triggering conditions for the behavior are integrated with the logic of legitimate operations.

[0106] For example, the simulated malicious behavior of "reading sensitive files" is combined with the legitimate operation logic of "automatically cleaning up temporary files after updates".

[0107] Step a4: Record the raw data for the context behavior simulation.

[0108] Record raw data such as process startup sequence, resource loading path, and API call sequence.

[0109] Step a5: Generate the process tree.

[0110] Generate the process tree for the explorer→python→Teams updater.

[0111] Second, the dynamic behavior analysis engine.

[0112] The dynamic behavior analysis engine constructs a cross-level behavior graph based on process startup timing, resource path tracing, and API call sequence analysis; it uses an LSTM neural network to detect API sequence deviations and combines this with a whitelist path library to mark abnormal nodes. Specifically, the dynamic behavior analysis engine includes the following steps:

[0113] Step b1: Data collection is performed using a dynamic behavior analysis engine.

[0114] In one implementation, data such as process startup time stamp, data signature verification, and command line parameter tracking are collected.

[0115] In another implementation, the process startup sequence, child process dependencies, resource access paths, etc., are recorded.

[0116] In another implementation, process resource consumption and API sequence deviation are recorded.

[0117] Step b2, anomaly pattern identification.

[0118] The process resource consumption is compared with the baseline. If the memory usage is greater than 150% of the baseline, a cross-level behavior graph is constructed based on the process startup sequence, child process dependencies, resource access paths, etc., to represent the dependencies between cross-level processes.

[0119] Furthermore, the cross-level behavioral graph is converted into feature vector data for subsequent rule optimization.

[0120] The LSTM model is used to analyze whether the deviation of the API sequence is greater than 25%. If the deviation is greater than 25%, abnormal nodes are marked, such as Teams loading non-whitelisted DLLs.

[0121] Furthermore, a behavior analysis report is generated, and if the anomaly score is greater than 0.7, an anomaly alarm is triggered.

[0122] Third, optimize defense strategies.

[0123] Defense strategy optimization generates detection rules based on simulation test results, such as restricting the startup permissions of specific processes; and employs a whitelist reinforcement mechanism based on confidence thresholds. Specifically, defense strategy optimization includes the following steps:

[0124] Step c1, adaptive rule generation.

[0125] Based on the simulation test results, detection rules for multi-stage process chains are automatically generated, such as restricting python.exe from launching high-privilege child processes.

[0126] Step c2, behavior whitelist reinforcement.

[0127] Incorporating the contextual characteristics of legitimate process chains into a whitelist reduces false positives. For example, the standard command-line parameters for the Teams updater are: `--update --silent`.

[0128] Fourth, closed-loop verification and iteration.

[0129] The closed-loop validation and iteration process involves real-time adjustment of the detection threshold and model parameters using a closed-loop iterative logic. Specifically, the closed-loop validation and iteration process includes the following steps:

[0130] Step d1: Threshold dynamically adjusted.

[0131] The effectiveness of the defense rules was verified by repeatedly simulating multi-stage process chain attacks, and the detection threshold was dynamically adjusted.

[0132] When the false positive rate exceeds 5%, the rules are rolled back, the defense rule base is updated, and the version number is incremented. The updated rules are fed back to step a1 to achieve closed-loop verification of the simulation test. Simultaneously, iterative testing is triggered, which is only used for EDR defense verification.

[0133] Step d2: Optimize the detection threshold.

[0134] In one implementation, defense testing is performed using modified defense rules and a modified defense whitelist. If an abnormal process chain is not intercepted, the preset deviation is reduced, for example, the preset deviation is adjusted from 25% to 20%. If a legitimate process chain is intercepted, the preset deviation is increased.

[0135] In another implementation, false positives and false negatives are recorded. Defense tests are conducted using the modified defense rules and whitelist. If a legitimate process chain is repeatedly blocked or an abnormal process chain is repeatedly not blocked, the model parameters of the neural network model are adjusted.

[0136] The optimized detection threshold is fed back to step b2 to adjust the detection sensitivity and ensure that the false alarm rate is ≤5%.

[0137] This application proposes a multi-stage trusted parent process chain simulation testing and defense enhancement method. Compared with existing single-layer process monitoring technologies, it proposes a multi-stage process chain context association analysis method, which has a higher detection dimension. Compared with existing static rule bases, it proposes a simulation-driven dynamic adaptive strategy, which has a better defense optimization effect. Compared with existing technologies that rely on known attack samples, it proposes a high-fidelity legitimate process chain simulation, which has stronger behavior concealment protection. Compared with existing technologies based on blacklists and whitelists for defense, it proposes a defense method that integrates machine learning and behavior whitelists, which has a lower false positive rate.

[0138] This embodiment also provides a multi-stage trusted parent process chain simulation testing and defense enhancement device, which is used to implement the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0139] This embodiment provides a multi-stage trusted parent process chain simulation testing and defense enhancement device, such as... Figure 4 As shown, it includes:

[0140] The simulation module 401 is used to embed simulated malicious behavior into the child processes of a simulated legitimate interpreter process, generating a multi-stage process chain. The legitimate interpreter process includes the parent process and child processes of each process.

[0141] The generation module 402 is used to simulate and analyze the contextual behavior of multi-stage process chains and generate cross-level behavior graphs.

[0142] The identification module 403 is used to identify abnormal and legitimate process chains in multi-stage process chains based on cross-level behavior graphs.

[0143] Adjustment module 404 is used to modify defense rules based on the behavioral characteristics of abnormal process chains and to modify the defense whitelist based on the behavioral characteristics of legitimate process chains.

[0144] In some alternative implementations, simulation module 401 includes:

[0145] The first simulation unit is used to launch a legitimate interpreter process by modifying registry entries based on the COM hijacking method.

[0146] The second simulation unit is used to inject simulation code into a legitimate interpreter and start a trusted subprocess by means of process cloning.

[0147] The third simulation unit is used to embed execution logic that simulates malicious behavior into the normal business process of a trusted subprocess, generating a multi-stage process chain.

[0148] In some alternative implementations, the generation module 402 includes:

[0149] The generation unit is used to identify the process startup sequence, resource loading path and API call sequence of each process in a multi-stage process chain, and generate a cross-level behavior graph.

[0150] In some alternative implementations, the identification module 403 includes:

[0151] The first identification unit is used to determine whether the startup interval between the parent process and child process of the target process is greater than a preset time interval based on the process startup timing. If the startup interval is greater than the preset time interval, the target process is determined to be an abnormal process chain; otherwise, it is a legal process chain.

[0152] The second identification unit is used to determine whether the target process in the multi-stage process chain is in the defense whitelist based on the resource loading path. If the target process is not in the defense whitelist, the target process is determined to be an abnormal process chain; otherwise, it is a legitimate process chain.

[0153] The third identification unit is used to model the API call sequence of the target process using a neural network model and calculate the API deviation. If the API deviation is greater than the preset deviation, the target process is determined to be an abnormal process chain; otherwise, it is a legitimate process chain.

[0154] In some alternative implementations, the adjustment module 404 includes:

[0155] The first adjustment unit is used to generate startup restriction rules for the abnormal process chain when the resource loading path of the abnormal process chain is not in the defense whitelist, and to add the startup restriction rules to the defense rules.

[0156] The second adjustment unit is used to obtain the legitimate context features of the legitimate process chain and add the legitimate context features to the defense whitelist.

[0157] In some optional implementations, the multi-stage trusted parent process chain simulation testing and defense enhancement device further includes an optimization module 405, which includes:

[0158] The test unit is used to perform defense tests using the modified defense rules and the modified defense whitelist.

[0159] The first optimization unit is used to reduce the preset deviation when the abnormal process chain is not intercepted, and to increase the preset deviation when the legitimate process chain is intercepted.

[0160] The second optimization unit is used to adjust the model parameters of the neural network model when a legitimate process chain is intercepted multiple times or an abnormal process chain is not intercepted multiple times.

[0161] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0162] In this embodiment, the multi-stage trusted parent process chain simulation test and defense enhancement device is presented in the form of functional units. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0163] This invention also provides a computer device having the above-described features. Figure 4 The multi-stage trusted parent process chain simulation test and defense enhancement device shown is illustrated.

[0164] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 5As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 5 Take a processor 10 as an example.

[0165] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GPA), or any combination thereof.

[0166] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0167] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the computer device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0168] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0169] The computer device also includes an input device 30 and an output device 40. The processor 10, memory 20, input device 30, and output device 40 can be connected via a bus or other means. Figure 5 Taking the example of a connection between China and Israel via a bus.

[0170] Input device 30 can receive input numerical or character information, and generate key signal inputs related to user settings and function control of the computer device, such as a touchscreen, keypad, mouse, trackpad, touchpad, joystick, one or more mouse buttons, trackball, joystick, etc. Output device 40 may include display devices, auxiliary lighting devices (e.g., LEDs), and haptic feedback devices (e.g., vibration motors). The aforementioned display devices include, but are not limited to, liquid crystal displays, light-emitting diodes, displays, and plasma displays. In some alternative embodiments, the display device may be a touchscreen.

[0171] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0172] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0173] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for simulating and enhancing defenses using a multi-stage trusted parent process chain, characterized in that, The method includes: Simulated malicious behavior is embedded in the child processes of a simulated legitimate interpreter process to generate a multi-stage process chain, wherein the legitimate interpreter process includes the parent process and the child processes of each process. Contextual behavior simulation and analysis are performed on the multi-stage process chain to generate a cross-level behavior graph; Based on the cross-level behavior graph, abnormal and legitimate process chains of the multi-stage process chain are identified. The defense rules are modified based on the behavioral characteristics of the abnormal process chain, and the defense whitelist is modified based on the behavioral characteristics of the legitimate process chain.

2. The multi-stage trusted parent process chain simulation testing and defense enhancement method according to claim 1, characterized in that, The process of embedding simulated malicious behavior into a child process of a simulated legitimate interpreter process to generate a multi-stage process chain includes: Based on COM hijacking methods, a legitimate interpreter process is launched by modifying registry entries; By using a process cloning method, simulated code is injected into the legitimate interpreter to start a trusted subprocess; The execution logic simulating malicious behavior is embedded in the normal business process of the trusted subprocess to generate the multi-stage process chain.

3. The multi-stage trusted parent process chain simulation testing and defense enhancement method according to claim 1, characterized in that, The step of performing contextual behavior simulation and analysis on the multi-stage process chain to generate a cross-level behavior graph includes: Identify the process startup sequence, resource loading path, and API call sequence of each process in the multi-stage process chain to generate the cross-level behavior graph.

4. The multi-stage trusted parent process chain simulation testing and defense enhancement method according to claim 3, characterized in that, The process of identifying abnormal and legitimate process chains in the multi-stage process chain based on the cross-level behavior graph includes: Based on the process startup sequence, determine whether the startup interval between the parent process and the child process of the target process is greater than a preset time interval. If the startup interval is greater than the preset time interval, then the target process is determined to be the abnormal process chain; otherwise, it is the legal process chain; and / or Based on the resource loading path, it is determined whether the target process in the multi-stage process chain is in the defense whitelist. If the target process is not in the defense whitelist, the target process is determined to be part of the abnormal process chain; otherwise, it is part of the legitimate process chain. The target process's API call sequence is modeled using a neural network model, and the API deviation is calculated. If the API deviation is greater than a preset deviation, the target process is determined to be the abnormal process chain; otherwise, it is the legitimate process chain.

5. The multi-stage trusted parent process chain simulation testing and defense enhancement method according to claim 4, characterized in that, The modification of defense rules based on the behavioral characteristics of the abnormal process chain and the modification of the defense whitelist based on the behavioral characteristics of the legitimate process chain include: If the resource loading path of the abnormal process chain is not in the defense whitelist, then a startup restriction rule for the abnormal process chain is generated and the startup restriction rule is added to the defense rule. Obtain the legitimate context features of the legitimate process chain and add the legitimate context features to the defense whitelist.

6. The multi-stage trusted parent process chain simulation testing and defense enhancement method according to claim 5, characterized in that, The method further includes: The modified defense rules and the modified defense whitelist were used to conduct defense tests. If the abnormal process chain is not intercepted, the preset deviation is reduced; if the legitimate process chain is intercepted, the preset deviation is increased. If the legitimate process chain is intercepted multiple times or the abnormal process chain is not intercepted multiple times, the model parameters of the neural network model are adjusted.

7. A multi-stage trusted parent process chain simulation testing and defense enhancement device, characterized in that, The device includes: The simulation module is used to embed simulated malicious behavior into the child processes of a simulated legitimate interpreter process, generating a multi-stage process chain, wherein the legitimate interpreter process includes the parent process and the child processes of each process. The generation module is used to perform contextual behavior simulation and analysis on the multi-stage process chain and generate a cross-level behavior graph. The identification module is used to identify abnormal process chains and legitimate process chains of the multi-stage process chain based on the cross-level behavior graph; The adjustment module is used to modify the defense rules based on the behavioral characteristics of the abnormal process chain and to modify the defense whitelist based on the behavioral characteristics of the legitimate process chain.

8. A computer device, characterized in that, include: A memory and a processor are interconnected, the memory stores computer instructions, and the processor executes the computer instructions to perform the multi-stage trusted parent process chain simulation testing and defense enhancement method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the multi-stage trusted parent process chain simulation test and defense enhancement method according to any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes computer instructions for causing a computer to execute the multi-stage trusted parent process chain simulation testing and defense enhancement method as described in any one of claims 1 to 6.

Images