File-free attack detection method and device and related equipment

Abstract

The invention provides a file-free attack detection method and device and related equipment, and relates to the technical field of communication. The method comprises the following steps: counting the occurrence probability of each byte value of a target process in a memory window at the current moment; determining an actual entropy value of the target process based on the occurrence probability of each byte value; based on the occurrence probability of each byte value in the memory window of the target process at a plurality of moments before the current moment, utilizing a time sequence prediction model to determine a prediction entropy value of the target process; based on the actual entropy value and the predicted entropy value of the target process, determining an entropy increase abnormal score of the target process; and determining whether the target process has no file attack based on the entropy increase anomaly score. Through the above technical means, the problem of low detection accuracy of no file attack in related technologies is solved.

Description

Technical Field

[0001] This disclosure relates to the field of communication technology, and in particular to a method, apparatus and related equipment for detecting fileless attacks. Background Technology

[0002] In recent years, fileless attacks have become a significant threat in the field of cybersecurity. They do not rely on writing malware directly to files on the hard drive, but instead utilize legitimate tools and processes already present in the operating system to execute malicious code. Currently, methods that use fixed thresholds to identify high-entropy regions are often used to detect fileless attacks. However, because legitimate operations such as data decompression, encrypted communication, or program compilation can also cause a temporary increase in process entropy, this method has low detection accuracy. Summary of the Invention

[0003] This disclosure provides a method, apparatus, and related equipment for detecting fileless attacks, thereby improving the accuracy of fileless attack detection.

[0004] According to one aspect of this disclosure, a method for detecting fileless attacks is provided, comprising: statistically analyzing the probability of each byte value appearing in the memory window of a target process at the current moment; determining the actual entropy value of the target process based on the probability of each byte value appearing; determining the predicted entropy value of the target process using a time series prediction model based on the probability of each byte value appearing in the memory window of the target process at multiple moments prior to the current moment; determining an entropy increase anomaly score of the target process based on the actual entropy value and the predicted entropy value; and determining whether a fileless attack exists in the target process based on the entropy increase anomaly score.

[0005] In one embodiment of this disclosure, determining the entropy increase anomaly score of the target process based on the actual entropy value and the predicted entropy value of the target process includes: determining the residual between the actual entropy value and the predicted entropy value of the target process; obtaining the standard deviation and mean of the residual of the normal process corresponding to the target process; and determining the entropy increase anomaly score based on the standard deviation and mean of the residual of the target process and the residual of the normal process.

[0006] In one embodiment of this disclosure, determining whether a target process is subject to a fileless attack based on an entropy increase anomaly score includes: determining the protocol fingerprint deviation score corresponding to the target process; and determining whether the target process is subject to a fileless attack based on the entropy increase anomaly score and the protocol fingerprint deviation score.

[0007] In one embodiment of this disclosure, determining the protocol fingerprint deviation score corresponding to the target process includes: determining the divergence value between the target process and the first legitimate protocol fingerprint; determining the distribution difference value between the target process and the second legitimate protocol fingerprint; and determining the protocol fingerprint deviation score based on the divergence value and the distribution difference value.

[0008] In one embodiment of this disclosure, determining the divergence value between a target process and a first protocol valid fingerprint includes: determining the protocol distribution of real-time traffic corresponding to the target process; obtaining the protocol distribution of the first protocol valid fingerprint; and determining the divergence value based on the protocol distribution of real-time traffic and the protocol distribution of the first protocol valid fingerprint.

[0009] In one embodiment of this disclosure, determining the distribution difference value between the target process and the second protocol legal fingerprint includes: determining the cumulative distribution function of the real-time traffic corresponding to the target process; obtaining the cumulative distribution function of the second protocol legal fingerprint; and determining the distribution difference value based on the cumulative distribution function of the real-time traffic and the cumulative distribution function of the second protocol legal fingerprint.

[0010] In one embodiment of this disclosure, the real-time traffic corresponding to the target process includes: the real-time traffic generated by the target process, the real-time traffic generated by the parent process to which the target process belongs, and the real-time traffic generated by the child processes under the target process.

[0011] In one embodiment of this disclosure, the protocol fingerprint deviation score corresponding to the target process includes: the protocol fingerprint deviation score of the target process, the protocol fingerprint deviation score of the parent process to which the target process belongs, and the protocol fingerprint deviation score of the child processes under the target process.

[0012] In one embodiment of this disclosure, determining whether a target process is subject to a fileless attack based on an entropy increase anomaly score and a protocol fingerprint deviation score includes: weighting and summing the entropy increase anomaly score and the protocol fingerprint deviation score according to a first weight and a second weight, respectively, to obtain a first confidence level that a fileless attack exists, wherein the first weight is greater than the second weight; when the first confidence level is greater than a preset confidence level, it is determined that the target process is subject to a fileless attack.

[0013] In one embodiment of this disclosure, after determining the entropy increase anomaly score of the target process based on the actual entropy value and the predicted entropy value of the target process, the method further includes: determining whether the target process is subjected to a fileless attack and a second confidence level of the existence of a fileless attack based on the entropy increase anomaly score; determining the protocol fingerprint deviation score corresponding to the target process within a preset time period; and updating the second confidence level based on the protocol fingerprint deviation score.

[0014] In one embodiment of this disclosure, before obtaining the protocol distribution of the first protocol's legitimate fingerprint, the method further includes: extracting features of the first protocol and establishing a first protocol's legitimate fingerprint based on the features of the first protocol; and determining the protocol distribution of the first protocol's legitimate fingerprint based on the historical traffic corresponding to the first protocol.

[0015] In one embodiment of this disclosure, before obtaining the cumulative distribution function of the second protocol's legitimate fingerprint, the method further includes: extracting features of the second protocol and establishing a second protocol's legitimate fingerprint based on the features of the second protocol; and determining the cumulative distribution function of the second protocol's legitimate fingerprint based on the historical traffic corresponding to the second protocol.

[0016] According to another aspect of this disclosure, a fileless attack detection device is provided, comprising: a statistics unit configured to count the probability of each byte value appearing in the memory window of a target process at the current time; a first determination unit configured to determine the actual entropy value of the target process based on the probability of each byte value appearing; a second determination unit configured to determine the predicted entropy value of the target process using a time series prediction model based on the probability of each byte value appearing in the memory window of the target process at multiple times prior to the current time; a third determination unit configured to determine an entropy increase anomaly score of the target process based on the actual entropy value and the predicted entropy value; and a fourth determination unit configured to determine whether a fileless attack exists in the target process based on the entropy increase anomaly score.

[0017] According to another aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform any of the methods described above by executing the executable instructions.

[0018] According to another aspect of this disclosure, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements any of the methods described above.

[0019] According to another aspect of this disclosure, a computer program product is provided, including computer instructions stored in a computer-readable storage medium, which, when executed by a processor, implement operation instructions for any of the methods described above.

[0020] In the embodiments of this disclosure, the predicted entropy value of the target process is determined by using a time series prediction model based on the probability of each byte value appearing in the memory window of the target process at multiple times before the current time. Based on the actual entropy value and the predicted entropy value of the target process, it is determined whether the target process is subject to a fileless attack, thereby enhancing the understanding of the target process context and solving the problem of low accuracy in fileless attack detection in related technologies, thus improving the accuracy of fileless attack detection.

[0021] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0022] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0023] Figure 1 This diagram illustrates a fileless attack detection system according to an embodiment of the present disclosure.

[0024] Figure 2 A flowchart of a fileless attack detection method according to an embodiment of this disclosure is shown.

[0025] Figure 3 A flowchart of another fileless attack detection method is shown in an embodiment of this disclosure.

[0026] Figure 4 A flowchart illustrating a protocol fingerprint deviation score calculation method in an embodiment of this disclosure is shown.

[0027] Figure 5 A flowchart illustrating a divergence value calculation method according to an embodiment of this disclosure is shown.

[0028] Figure 6 A flowchart illustrating a method for calculating distribution difference values ​​in an embodiment of this disclosure is shown.

[0029] Figure 7 A flowchart of a confidence calculation method according to an embodiment of this disclosure is shown.

[0030] Figure 8 A flowchart of another fileless attack detection method is shown in an embodiment of this disclosure.

[0031] Figure 9 A flowchart of yet another fileless attack detection method is shown in this disclosure embodiment.

[0032] Figure 10 A flowchart of yet another fileless attack detection method is shown in this disclosure embodiment.

[0033] Figure 11 This diagram illustrates a fileless attack detection device according to an embodiment of the present disclosure.

[0034] Figure 12 A schematic diagram of an electronic device provided in an embodiment of this disclosure is shown. Detailed Implementation

[0035] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0036] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0037] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0038] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0039] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0040] It should be noted that, unless otherwise specified, the embodiments of this disclosure and the technical features thereof can be combined with each other.

[0041] To facilitate understanding, the following is an explanation of several terms used in this disclosure:

[0042] UE (User Equipment) refers to the terminal device used by the user, such as a smartphone, laptop, or drone. It is the physical medium through which the user interacts with the network.

[0043] LSTM (Long Short-Term Memory) neural networks are a special type of recurrent neural network architecture designed to address the vanishing or exploding gradient problems that traditional RNNs often encounter when processing long sequences. By introducing mechanisms such as input gates, forget gates, and output gates, it can selectively remember or forget key information in a sequence, effectively capturing dependencies over long time spans. It is widely used in tasks such as time series forecasting, behavioral modeling, and anomaly detection.

[0044] DNS (Domain Name System) is a distributed database system that translates human-readable domain names (such as www.example.com) into machine-readable IP addresses (such as 192.0.2.1). As the "phone book" of the internet, it supports the addressing process for the vast majority of online services, allowing users to access websites and services without having to remember complex numerical addresses. It is an indispensable basic component of network communication.

[0045] HTTPS (Hypertext Transfer Protocol Secure) is a secure communication protocol built on top of the HTTP protocol with SSL / TLS encryption layers. It encrypts and authenticates data between the client and server, preventing data from being eavesdropped on, tampered with, or impersonated during transmission. It is widely used in scenarios such as web login, payment transactions, and the transmission of sensitive information, ensuring the confidentiality and integrity of user communications.

[0046] The TTL (Time To Live) value is a field in network protocols used to limit the lifespan of data packets, typically expressed as hop count or seconds. Each time a data packet passes through a router, the TTL value is decremented by one. When it reaches zero, the packet is discarded and a timeout message is returned. This mechanism prevents data packets from looping indefinitely through the network, improving network efficiency and can be used in network diagnostic tools such as traceroute.

[0047] Kullback-Leibler divergence (relative entropy) is an asymmetric metric in information theory that measures the difference between two probability distributions, representing the amount of information lost when approximating one distribution to another. A larger value indicates a more significant difference between the two distributions. In security detection, it is often used to compare the deviation of the current traffic characteristic distribution from normal behavioral fingerprints to identify potential abnormal communication behavior.

[0048] The Kolmogorov-Smirnov test (KS test) is a nonparametric statistical method used to determine whether two samples come from the same probability distribution, or whether a sample conforms to a theoretical distribution (such as a normal distribution). It is based on the maximum vertical distance between two cumulative distribution functions, independent of the specific distribution of the data. It is suitable for small samples and non-normal data, and is often used in anomaly detection to assess the distributional consistency of behavioral characteristics.

[0049] Fileless attacks are an advanced persistent threat (APS) attack method where attackers do not rely on traditional malicious executable files. Instead, they utilize legitimate built-in system tools (such as PowerShell and WMI), scripting languages, or memory injection techniques to execute malicious code directly in the target system's memory. Because they do not write to disk or only use legitimate processes, these attacks are difficult to detect by traditional file-signature-based antivirus software, exhibiting high stealth and persistence. Fileless attacks include code decryption and shellcode injection.

[0050] Code decryption refers to an attacker dynamically decrypting and executing encrypted malicious payloads in memory to evade static detection.

[0051] Shellcode injection refers to writing a small, executable piece of machine code (shellcode) into the memory space of a target process and then modifying the execution flow (such as thread hijacking) to make it run, thereby gaining control of the system.

[0052] Figure 1 This diagram illustrates a fileless attack detection system according to an embodiment of the present disclosure. The fileless attack detection system includes:

[0053] Device 101 and cloud 102.

[0054] Device 101 can be a mobile device such as a mobile phone, game console, tablet computer, e-book reader, smart glasses, MP4 (Moving Picture Experts Group Audio Layer IV) player, smart home device, AR (Augmented Reality) device, VR (Virtual Reality) device, or a personal computer (PC), such as a laptop computer or desktop computer.

[0055] The cloud 102 can be equipped with an application that performs the following actions: ...

[0056] The target process can be initiated by device 101.

[0057] Those skilled in the art will understand that the number of the aforementioned devices 101 can be more or less. For example, there may be only one device, or there may be dozens or hundreds of devices, or even more. This application does not limit the number or type of devices.

[0058] Device 101 is connected to the cloud 102 via a communication network. Optionally, the communication network can be a wired network or a wireless network.

[0059] Optionally, the aforementioned wireless or wired networks use standard communication technologies and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to Local Area Networks (LANs), Metropolitan Area Networks (MANs), Wide Area Networks (WANs), mobile, wired or wireless networks, private networks, or any combination of virtual private networks. In some embodiments, technologies and / or formats including Hyper Text Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), and Internet Protocol Security (IPsec) can be used to encrypt all or some links. In other embodiments, custom and / or dedicated data communication technologies can be used to replace or supplement the aforementioned data communication technologies.

[0060] Figure 2This diagram illustrates a flowchart of a fileless attack detection method according to an embodiment of the present disclosure. This method can be executed by a server or in the cloud, such as... Figure 2 As shown, it includes the following steps:

[0061] S201, Calculate the probability of each byte value appearing in the memory window of the target process at the current moment.

[0062] As an example, the target process is a running program that needs to be detected for fileless attacks.

[0063] As an example, the memory window is a sliding window, the size of a memory page (typically 4KB), used to analyze the byte sequence of the target process in memory.

[0064] S202, determine the actual entropy value of the target process based on the probability of each byte value occurring.

[0065] As an example, the actual entropy value is the information entropy calculated based on the probability of each byte value appearing in the memory window of the target process at the current moment, reflecting the degree of randomness of the data in memory at that moment.

[0066] In an exemplary embodiment, the actual entropy value H(X) is calculated using the following formula:

[0067]

[0068] Where i is the sequence number of the byte value, n is the number of bytes, and x i For the value of the i-th byte, P(x) i ) represents the byte value x i Probability of occurrence. The entropy value of a normal process is relatively stable, while a process subjected to a fileless attack may experience sudden entropy increases. Therefore, suspicious processes can be identified by detecting abnormal entropy fluctuations.

[0069] In one exemplary embodiment, the actual entropy value of the target process is obtained by weighted summation of the probabilities of each byte value. The weights corresponding to each byte value can be set as needed.

[0070] S203, based on the probability of each byte value appearing in the memory window of the target process at multiple times before the current time, the predicted entropy value of the target process is determined using a time series prediction model.

[0071] An exemplary time series prediction model is a trained LSTM neural network that can predict the prediction entropy of a target process based on the probability of each byte value appearing in a memory window at multiple time points.

[0072] As an example, the predicted entropy value, like the actual entropy value, reflects the randomness of the data in memory at that moment. The difference is that the predicted entropy value is the information entropy predicted by the time series prediction model.

[0073] In one exemplary embodiment, training data is acquired, which includes the probability of each byte value appearing in multiple memory windows of a normal process corresponding to the target process. The normal process and the target process belong to the same program, and the normal process is not subject to fileless attacks. The training data is input into an LSTM neural network, which outputs the predicted entropy value of the training data. The loss between the predicted entropy value of the training data and the label is calculated using a cross-entropy loss function. Based on the loss, the model parameters of the LSTM neural network are optimized to obtain a time series prediction model.

[0074] The labels of the training data are pre-labeled entropy values.

[0075] S204, Based on the actual entropy value and the predicted entropy value of the target process, determine the entropy increase anomaly score of the target process.

[0076] In one embodiment of this disclosure, determining the entropy increase anomaly score of the target process based on the actual entropy value and the predicted entropy value of the target process includes: determining the residual between the actual entropy value and the predicted entropy value of the target process; obtaining the standard deviation and mean of the residual of the normal process corresponding to the target process; and determining the entropy increase anomaly score based on the standard deviation and mean of the residual of the target process and the residual of the normal process.

[0077] As an example, the entropy increase anomaly score is calculated by the residual between the actual entropy value and the predicted entropy value and its deviation from the statistical distribution of normal processes. It can be used as an indicator to quantify the degree to which the memory entropy value of a target process deviates from the normal range.

[0078] In an optional embodiment, before obtaining the standard deviation and mean of the residuals of the normal process corresponding to the target process, the method further includes: determining the residuals between the actual entropy values ​​and the predicted entropy values ​​of the normal process at multiple times, obtaining multiple residuals, and calculating the standard deviation and mean of the multiple residuals.

[0079] In one exemplary embodiment, the entropy increase anomaly score E is calculated using the following formula:

[0080] ΔH=|H real -H pred | (2)

[0081]

[0082] Among them, H real and H predLet represent the actual entropy value and the predicted entropy value of the target process, respectively. Let ΔH represent the residual ΔH between the actual entropy value and the predicted entropy value of the target process. Let μ and σ be the mean and standard deviation of the residual of the normal process, respectively.

[0083] S205, based on entropy increase anomaly scoring, determines whether the target process is subject to a fileless attack.

[0084] In one exemplary embodiment, when the entropy increase anomaly score is greater than a first preset score, it is determined that the target process is subject to a fileless attack.

[0085] As an example, the first preset score is 3σ.

[0086] In this embodiment, the Shannon entropy of memory data is calculated using a sliding window, and a time series prediction model is introduced to predict the normal trend of the entropy sequence. The residual analysis between the actual value and the predicted value is used to judge anomalies, thereby achieving accurate detection of fileless attack behavior. Thus, the problem of low accuracy in fileless attack detection is solved by the above-mentioned technical means, thereby improving the accuracy of fileless attack detection.

[0087] Figure 3 A flowchart of another fileless attack detection method in an embodiment of this disclosure is shown, such as... Figure 3 As shown, it includes the following steps:

[0088] S301, Determine the protocol fingerprint deviation score corresponding to the target process;

[0089] S302, based on entropy increase anomaly scoring and protocol fingerprint deviation scoring, determines whether the target process is subject to a fileless attack.

[0090] As an example, protocol fingerprint deviation scoring is a quantitative indicator for assessing the degree of abnormal behavior at the network protocol level. It is used to measure the extent to which the network activity of a target process deviates from the normal pattern. Network protocols include DNS and HTTPS, among others.

[0091] In this embodiment, a comprehensive judgment is made by combining abnormal memory behavior and abnormal network communication, which reduces false alarms caused by single-dimensional detection and thus improves the accuracy of fileless attack identification.

[0092] In one embodiment of this disclosure, determining whether a target process is subject to a fileless attack based on an entropy increase anomaly score and a protocol fingerprint deviation score includes: weighting and summing the entropy increase anomaly score and the protocol fingerprint deviation score according to a first weight and a second weight, respectively, to obtain a first confidence level that a fileless attack exists, wherein the first weight is greater than the second weight; when the first confidence level is greater than a preset confidence level, it is determined that the target process is subject to a fileless attack.

[0093] As an example, the first weight reflects the importance of abnormal memory behavior in detecting fileless attacks, while the second weight reflects the importance of abnormal network communication behavior in detecting fileless attacks. Generally, abnormal memory behavior is more accurate in detecting fileless attacks, so the first weight is usually set to be greater than the second weight.

[0094] In this embodiment, the entropy increase anomaly score and the protocol fingerprint deviation score are weighted and summed according to a first weight and a second weight to obtain a first confidence level. If the first confidence level is greater than a preset confidence level, it is determined that the target process is subject to a fileless attack; otherwise, it is determined that the target process is not subject to a fileless attack. By using the above technical means, the entropy increase detection result and the protocol fingerprint deviation result are weighted and fused to improve the overall judgment accuracy in complex attack scenarios.

[0095] Figure 4 A flowchart illustrating a protocol fingerprint deviation scoring method according to an embodiment of this disclosure is shown, as follows: Figure 4 As shown, it includes the following steps:

[0096] S401, Determine the divergence value between the target process and the first protocol's valid fingerprint;

[0097] S402, determine the distribution difference value between the target process and the legitimate fingerprint of the second protocol;

[0098] S403, determine the protocol fingerprint bias score based on divergence value and distribution difference value.

[0099] As an example, the first protocol's legitimate fingerprint is the characteristic of the first protocol under normal communication behavior. For example, if the first protocol is the DNS protocol, then the first protocol's legitimate fingerprint includes the DNS protocol's subdomain length, query frequency, and TTL value characteristics.

[0100] As an example, the subdomain length in the DNS protocol is the number of characters in the subdomain portion of a DNS query initiated by the target process.

[0101] As an example, the DNS query frequency is the number of DNS queries initiated by a target process per unit of time.

[0102] As an example, the TTL value of the DNS protocol is the effective time for a DNS record to be cached in the network. A value that is too low may indicate that an attacker is frequently changing domain names to evade detection.

[0103] As an example, the legitimate fingerprint of the second protocol is the characteristic of the second protocol under normal communication behavior. For example, if the second protocol is HTTPS, then the legitimate fingerprint of the second protocol includes the User-Agent, Referer, and packet length characteristics of the HTTPS protocol.

[0104] As an example, the User-Agent in the HTTPS protocol is a client identification field carried by the target process when initiating an HTTPS request. This field describes the application type and version information from which the request originates.

[0105] As an example, the Referer field in the HTTPS protocol is the source page identifier field carried by the target process when initiating an HTTPS request. This field indicates the context path and redirection relationship of the request.

[0106] As an example, the packet length of the HTTPS protocol is the size of the HTTPS communication packets sent or received by the target process in bytes.

[0107] As an example, the divergence value can be the KL divergence between the target process and the first protocol's legitimate fingerprint.

[0108] As an example, the distribution difference value can be obtained by performing a KS test on the legitimate fingerprint of the target process and the second protocol.

[0109] In one embodiment of this disclosure, determining the protocol fingerprint deviation score based on the divergence value and the distribution difference value includes: weighting and summing the divergence value and the distribution difference value according to the third weight and the fourth weight respectively to obtain the protocol fingerprint deviation score.

[0110] The third and fourth weights can be set independently based on the importance of the divergence value and distribution difference value for the detection of fileless attacks.

[0111] In this embodiment, the divergence value between the target process and the first legitimate protocol fingerprint is calculated to measure the deviation between the target process and the first legitimate protocol fingerprint; the distribution difference value between the target process and the second legitimate protocol fingerprint is calculated to measure the deviation between the target process and the second legitimate protocol fingerprint. The protocol fingerprint deviation score is determined by combining the divergence value and the distribution difference value, thereby fusing behavioral deviation information from multiple protocol levels to improve the ability to identify spoofed communication and covert channels.

[0112] In one optional embodiment, determining the protocol fingerprint deviation score corresponding to the target process includes: determining the divergence value and distribution difference value between the target process and the first legitimate protocol fingerprint; determining the divergence value and distribution difference value between the target process and the second legitimate protocol fingerprint; and determining the protocol fingerprint deviation score based on the divergence value and distribution difference value between the target process and the first legitimate protocol fingerprint, as well as the divergence value and distribution difference value between the target process and the second legitimate protocol fingerprint.

[0113] Figure 5 A flowchart illustrating a divergence value calculation method according to an embodiment of this disclosure is shown, as follows: Figure 5 As shown, it includes the following steps:

[0114] S501, determine the protocol distribution of real-time traffic corresponding to the target process;

[0115] S502, Obtain the protocol distribution of the first protocol's valid fingerprint;

[0116] S503 determines the divergence value based on the protocol distribution of real-time traffic and the protocol distribution of the first protocol's valid fingerprint.

[0117] As an example, the real-time traffic corresponding to the target process is the stream of network data packets sent or received by the target process at the current moment.

[0118] The exemplary, real-time traffic protocol distribution is a joint probability distribution of the first protocol-related features of the target process during the current communication process, which is calculated based on actual network behavior data within the memory window at the current moment.

[0119] As an example, the protocol distribution of the first protocol's legitimate fingerprint is a baseline joint probability distribution of the first protocol's relevant features under normal communication behavior. This distribution is derived from historical traffic statistics of the first protocol under normal communication behavior (without fileless attacks) and is used to characterize normal behavior patterns.

[0120] In this embodiment, the protocol distribution of real-time traffic corresponding to the target process is extracted, and the divergence value between the protocol distribution of real-time traffic and the protocol distribution of the first protocol's legitimate fingerprint is calculated. Through the above technical means, the difference between the target process's current communication behavior and known normal patterns is quantified at the first protocol level, thereby identifying potential fileless attacks.

[0121] In one optional embodiment, real-time traffic is acquired; the frequency of occurrence of subdomain length, query frequency, and TTL value features in the real-time traffic is statistically analyzed to obtain the protocol distribution of the real-time traffic; the KL divergence between the protocol distribution of the real-time traffic and the protocol distribution of the first protocol legal fingerprint is calculated to obtain the divergence value.

[0122] In one embodiment of this disclosure, before obtaining the protocol distribution of the first protocol's legitimate fingerprint, the method further includes: extracting features of the first protocol and establishing a first protocol's legitimate fingerprint based on the features of the first protocol; and determining the protocol distribution of the first protocol's legitimate fingerprint based on the historical traffic corresponding to the first protocol.

[0123] In this embodiment, the features of the first protocol include subdomain length, query frequency, and TTL value characteristics, that is, the legitimate fingerprint of the first protocol includes subdomain length, query frequency, and TTL value characteristics. The protocol distribution of the legitimate fingerprint of the first protocol is obtained by statistically analyzing the historical traffic of the first protocol under normal communication behavior. Through the above technical means, the protocol distribution of the legitimate fingerprint of the first protocol is established, preparing for the calculation of the divergence value.

[0124] In one exemplary embodiment, the divergence value D is calculated using the following formula. KL (P||Q):

[0125]

[0126] Where i is the feature index, n is the number of features, and x i For the i-th feature, P(x) i ) represents feature x in real-time traffic. i The probability of occurrence, Q(x) i ) indicates that x is a valid fingerprint in the first protocol. i The probability of occurrence.

[0127] For example, if 10% of the requests in real-time DNS traffic have the characteristic of a subdomain length of 10, then P(subdomain length = 10) = 0.1.

[0128] For example, under normal circumstances, if requests with a subdomain length of 10 account for 8%, then Q(subdomain length = 10) = 0.08.

[0129] Figure 6 A flowchart illustrating a method for calculating distribution difference values ​​according to an embodiment of this disclosure is shown, as follows: Figure 6 As shown, it includes the following steps:

[0130] S601, Determine the cumulative distribution function of real-time traffic corresponding to the target process;

[0131] S602, Obtain the cumulative distribution function of the second protocol's valid fingerprint;

[0132] S603 determines the distribution difference value based on the cumulative distribution function corresponding to real-time traffic and the cumulative distribution function of the legal fingerprint of the second protocol.

[0133] As an example, the cumulative distribution function of real-time traffic is the cumulative probability distribution of the second protocol-related features of the target process during the current communication process. The cumulative distribution function describes the probability that the feature value is less than or equal to a certain threshold.

[0134] As an example, the cumulative distribution function of the legitimate fingerprint of the second protocol is a baseline cumulative probability distribution of the relevant features of the second protocol under normal communication behavior. This function and distribution are derived from the historical traffic statistics of the second protocol under normal communication behavior (without fileless attacks) and are used to reflect the feature distribution pattern under normal communication.

[0135] In this embodiment, the cumulative distribution function of real-time traffic is extracted, and the distribution difference between the cumulative distribution function corresponding to the real-time traffic and the cumulative distribution function of the legitimate fingerprint of the second protocol is calculated. Through the above technical means, the deviation of the target process's behavioral distribution on the second protocol from the normal pattern can be measured, thereby identifying potential abnormal communication behaviors.

[0136] In one optional embodiment, real-time traffic is acquired; the probability that User-Agent, Referer, and packet length features in the real-time traffic are less than or equal to a certain threshold is calculated to obtain the cumulative distribution function corresponding to the real-time traffic; the KS test statistic between the cumulative distribution function corresponding to the real-time traffic and the cumulative distribution function of the legal fingerprint of the second protocol is calculated to obtain the distribution difference value.

[0137] In one embodiment of this disclosure, before obtaining the cumulative distribution function of the second protocol's legitimate fingerprint, the method further includes: extracting features of the second protocol and establishing a second protocol's legitimate fingerprint based on the features of the second protocol; and determining the cumulative distribution function of the second protocol's legitimate fingerprint based on the historical traffic corresponding to the second protocol.

[0138] In this embodiment, the features of the second protocol include User-Agent, Referer, and data packet length characteristics. In other words, the legitimate fingerprint of the second protocol includes User-Agent, Referer, and data packet length characteristics. By statistically analyzing the historical traffic of the second protocol under normal communication behavior, the cumulative distribution function of the legitimate fingerprint of the second protocol is obtained. Through the above technical means, the cumulative distribution function of the legitimate fingerprint of the second protocol is established, preparing for the calculation of the distribution difference value.

[0139] In one exemplary embodiment, the distribution difference value D is calculated using the following formula. KS :

[0140]

[0141] Where x is a threshold, F real (x) is the cumulative distribution function of real-time traffic, F real (x) represents the probability that a feature in the real-time traffic is greater than x, F legit (x) is the cumulative distribution function of the legitimate fingerprints of the second protocol, F legit (x) represents the probability that a feature in the historical flow is greater than x, and sup takes the supremum (i.e., the maximum value) of all possible x, that is, finds the |F| corresponding to all x. real (x)-F legit The maximum value in (x)|.

[0142] As an example, in the analysis of the HTTPS protocol, F real(x) can be represented as the probability that a certain characteristic value (such as the length of the User-Agent string, the length of the Referer string, the length of the data packet, etc.) is less than or equal to x in real-time traffic. If F real (500) = 0.7, which means that in real-time traffic, 70% of the data packets are less than or equal to 500 bytes in length.

[0143] Exemplary, F legit (x) represents the probability that a certain characteristic value is less than or equal to x during normal communication. For example, F legit If (500) = 0.6, then in the second protocol's valid fingerprint, 60% of the data packets have a length less than or equal to 500 bytes.

[0144] In an exemplary embodiment, the first confidence level C is calculated using the following formula:

[0145] C=αE+βP (6)

[0146] Where E is the entropy increase anomaly score, P is the protocol fingerprint deviation score, and α and β are the first weight and the second weight, respectively.

[0147] In one embodiment of this disclosure, the real-time traffic corresponding to the target process includes: the real-time traffic generated by the target process, the real-time traffic generated by the parent process to which the target process belongs, and the real-time traffic generated by the child processes under the target process.

[0148] In this embodiment, the real-time traffic corresponding to the target process can be the real-time traffic generated by the target process, its parent process, and its child processes. Therefore, to detect whether the target process is subject to a fileless attack, it is also necessary to detect the parent process and child processes of the target process to improve the accuracy of the detection.

[0149] In one embodiment of this disclosure, the protocol fingerprint deviation score corresponding to the target process includes: the protocol fingerprint deviation score of the target process, the protocol fingerprint deviation score of the parent process to which the target process belongs, and the protocol fingerprint deviation score of the child processes under the target process.

[0150] In one optional embodiment, a first divergence value is calculated between the protocol distribution of the real-time traffic of the target process and the protocol distribution of the first protocol valid fingerprint; a second divergence value is calculated between the protocol distribution of the real-time traffic of the parent process to which the target process belongs and the protocol distribution of the first protocol valid fingerprint; a third divergence value is calculated between the protocol distribution of the real-time traffic of the child processes under the target process and the protocol distribution of the first protocol valid fingerprint; the first divergence value, the second divergence value, and the third divergence value are weighted and summed to obtain the divergence value between the target process and the first protocol valid fingerprint.

[0151] In one optional embodiment, a first distribution difference value is calculated between the cumulative distribution function of the real-time traffic of the target process and the cumulative distribution function of the first protocol legal fingerprint; a second distribution difference value is calculated between the cumulative distribution function of the real-time traffic of the parent process to which the target process belongs and the cumulative distribution function of the first protocol legal fingerprint; a third distribution difference value is calculated between the cumulative distribution function of the real-time traffic of the child processes under the target process and the cumulative distribution function of the first protocol legal fingerprint; the first distribution difference value, the second distribution difference value, and the third distribution difference value are weighted and summed to obtain the distribution difference value between the target process and the second protocol legal fingerprint.

[0152] Figure 7 A flowchart of a confidence calculation method according to an embodiment of this disclosure is shown, such as... Figure 7 As shown, it includes the following steps:

[0153] S701, based on entropy increase anomaly scoring, determines whether the target process is subject to a fileless attack and the second confidence level of the existence of a fileless attack;

[0154] S702, determine the protocol fingerprint deviation score corresponding to the target process within a preset time;

[0155] S703 updates the second confidence level based on protocol fingerprint deviation score.

[0156] As an example, the second confidence level is the probability of a fileless attack, initially calculated based on the entropy increase anomaly score.

[0157] As an example, if the entropy increase anomaly score is greater than the first preset score, it is determined whether the target process is subject to a fileless attack; a second confidence level for the fileless attack is determined based on the entropy increase anomaly score (the entropy increase anomaly score or a multiple of the entropy increase anomaly score is used as the second confidence level).

[0158] In this embodiment, the presence of a fileless attack on the target process is determined based on the entropy increase anomaly score. A protocol fingerprint deviation score corresponding to the target process within a preset time period is then determined, and this deviation score is used to update the second confidence level. The updated second confidence level can be obtained by weighted summing the protocol fingerprint deviation score and the original second confidence level. Through these techniques, the confidence level of the attack determination can be dynamically adjusted by combining the correlation between memory anomalies and subsequent network behavior, thereby improving the accuracy of the detection results.

[0159] In one optional embodiment, the real-time traffic of the target process within a preset time after the occurrence of an entropy increase anomaly (entropy increase anomaly score is greater than the first preset score) is obtained, and a protocol fingerprint deviation score is calculated based on the real-time traffic within the preset time. The protocol fingerprint deviation score is used as a feedback signal to perform weighted fusion on the second confidence score to obtain the updated confidence score.

[0160] In one optional embodiment, network communication data of the target process within 5 seconds after the entropy increase anomaly occurs is acquired, including traffic generated by the process itself, its parent process, and its child processes; the subdomain length, query frequency, and TTL value features of the DNS protocol are extracted, and the KL divergence between their joint distribution and the protocol distribution corresponding to the first legitimate protocol fingerprint is calculated; the User-Agent, Referer, and packet length features of the HTTPS protocol are extracted, and the KS test statistic between their cumulative distribution and the cumulative distribution corresponding to the second legitimate protocol fingerprint is calculated; the KL divergence and KS test statistic are weighted and fused to obtain the protocol fingerprint bias score; the protocol fingerprint bias score is used as a regulating factor to weight and update the second confidence level to obtain the corrected comprehensive confidence level. Through the above technical means, cross-dimensional evidence fusion based on time correlation can be achieved, thereby enhancing the ability to judge the integrity of the attack chain.

[0161] Figure 8 A flowchart of another fileless attack detection method in an embodiment of this disclosure is shown, such as... Figure 8 As shown, it includes the following steps:

[0162] S801: Obtain the probability of each byte value appearing in each memory window of the target process and the real-time traffic;

[0163] S802: Calculate the entropy increase anomaly score based on the probability of each byte value appearing in each memory window;

[0164] S803: Calculates protocol fingerprint deviation scores based on real-time traffic;

[0165] S804: The first confidence level is obtained by weighted summation of the entropy increase anomaly score and the protocol fingerprint deviation score;

[0166] S805: Determine whether the first confidence level is greater than the preset confidence level;

[0167] S806: If greater than 6, a fileless attack is detected, triggering an alarm or further analysis, and the process ends.

[0168] S807: Otherwise, it is determined to be normal communication, and the process ends.

[0169] Figure 9 A flowchart of yet another fileless attack detection method in this disclosure is shown, such as... Figure 9 As shown, it includes the following steps:

[0170] S901, determine the actual entropy value of the target process based on the probability of each byte value occurring;

[0171] S902, Based on the probability of each byte value appearing in the memory window of the target process at multiple times before the current time, the predicted entropy value of the target process is determined using a time series prediction model;

[0172] S903, determine the residual between the actual entropy value and the predicted entropy value of the target process;

[0173] S904, based on the standard deviation and mean of the residuals of the target process and the residuals of the normal process, determine the entropy increase anomaly score;

[0174] S905, determine whether the entropy increase anomaly score is greater than the preset score;

[0175] If S906 is greater than this, it is considered an abnormal entropy increase behavior.

[0176] S907, otherwise, the behavior is considered normal;

[0177] S908 outputs the entropy increase anomaly score.

[0178] Figure 10 A flowchart of yet another fileless attack detection method in this disclosure is shown, such as... Figure 10 As shown, it includes the following steps:

[0179] S1001, Extract the features of the DNS protocol and establish the first protocol's legitimate fingerprint;

[0180] S1002, Calculate the KL divergence between the target process and the first protocol's legitimate fingerprint;

[0181] S1003, determine whether the KL divergence is greater than the first threshold;

[0182] If S1004 is greater than this, then DNS behavior is considered abnormal.

[0183] If S1005 is not greater than this value, then the DNS behavior is considered normal.

[0184] S1006, Extract the features of the HTTPS protocol and establish a second legitimate protocol fingerprint;

[0185] S1007, Perform KS verification on the target process and the legitimate fingerprint of the second protocol;

[0186] S1008, Determine whether the KS test result is greater than the second threshold;

[0187] S1009, if greater than, then the HTTPS behavior is confirmed to be normal;

[0188] If S1010 is not greater than this value, then the HTTPS behavior is determined to be abnormal.

[0189] S1011 calculates the protocol fingerprint bias score based on divergence value and distribution difference value.

[0190] This disclosure, through the aforementioned technical means, can dynamically capture memory entropy anomalies caused by fileless attacks such as encryption and obfuscation, adapting to various attack forms such as self-decoding and packing, thereby improving the detection rate and generalization ability of fileless attacks; it can achieve highly sensitive identification of abnormal communication traffic based on protocol data modeling and deviation calculation, breaking through the blind spots of rule-based detection, reducing the false alarm rate, and effectively identifying covert channel behaviors such as DNS or HTTPS tunnels disguised as normal protocols; it can enhance the fault tolerance of the detection process through a multi-dimensional scoring fusion mechanism, cope with mixed attack methods in complex scenarios, thereby improving the credibility of detection results and providing accurate and efficient threat early warning support for security operations.

[0191] Based on the same inventive concept, this disclosure also provides a fileless attack detection device, as shown in the following embodiments. Since the principle by which the fileless attack detection device solves the problem is similar to that of the above method embodiments, the implementation of the fileless attack detection device can refer to the implementation of the above method embodiments, and repeated details will not be elaborated further.

[0192] Figure 11 This disclosure illustrates a fileless attack detection device in an embodiment, such as... Figure 11 As shown, the fileless attack detection device may include:

[0193] The statistics unit 1101 is configured to count the probability of each byte value appearing in the memory window of the target process at the current moment;

[0194] The first determining unit 1102 is configured to determine the actual entropy value of the target process based on the probability of occurrence of each byte value.

[0195] The second determining unit 1103 is configured to determine the predicted entropy value of the target process using a time series prediction model based on the probability of occurrence of each byte value in the memory window of the target process at multiple times before the current time.

[0196] The third determining unit 1104 is configured to determine the entropy increase anomaly score of the target process based on the actual entropy value and the predicted entropy value of the target process.

[0197] The fourth determination unit 1105 is configured to determine whether the target process is subject to a fileless attack based on an entropy increase anomaly score.

[0198] In some embodiments, the fourth determining unit 1105 is further configured to determine the residual between the actual entropy value and the predicted entropy value of the target process; obtain the standard deviation and mean of the residual of the normal process corresponding to the target process; and determine the entropy increase anomaly score based on the standard deviation and mean of the residual of the target process and the residual of the normal process.

[0199] In some embodiments, the fourth determining unit 1105 is further configured to determine the protocol fingerprint deviation score corresponding to the target process; and to determine whether the target process is subject to a fileless attack based on the entropy increase anomaly score and the protocol fingerprint deviation score.

[0200] In some embodiments, the fourth determining unit 1105 is further configured to determine the divergence value between the target process and the first legitimate protocol fingerprint; determine the distribution difference value between the target process and the second legitimate protocol fingerprint; and determine the protocol fingerprint deviation score based on the divergence value and the distribution difference value.

[0201] In some embodiments, the fourth determining unit 1105 is further configured to determine the protocol distribution of real-time traffic corresponding to the target process; obtain the protocol distribution of the first protocol valid fingerprint; and determine the divergence value based on the protocol distribution of real-time traffic and the protocol distribution of the first protocol valid fingerprint.

[0202] In some embodiments, the fourth determining unit 1105 is further configured to determine the cumulative distribution function of the real-time traffic corresponding to the target process; obtain the cumulative distribution function of the second protocol legal fingerprint; and determine the distribution difference value based on the cumulative distribution function of the real-time traffic and the cumulative distribution function of the second protocol legal fingerprint.

[0203] In some embodiments, the fourth determining unit 1105 is further configured with real-time traffic generated by the target process, real-time traffic generated by the parent process to which the target process belongs, and real-time traffic generated by the child processes under the target process.

[0204] In some embodiments, the fourth determining unit 1105 is further configured with the protocol fingerprint deviation score of the target process, the protocol fingerprint deviation score of the parent process to which the target process belongs, and the protocol fingerprint deviation score of the child processes under the target process.

[0205] In some embodiments, the fourth determining unit 1105 is further configured to perform a weighted summation of the entropy increase anomaly score and the protocol fingerprint deviation score according to the first weight and the second weight, respectively, to obtain a first confidence level that a fileless attack exists, wherein the first weight is greater than the second weight; when the first confidence level is greater than the preset confidence level, it is determined that the target process has a fileless attack.

[0206] In some embodiments, the fourth determining unit 1105 is further configured to determine whether the target process is subject to a fileless attack and a second confidence level of the existence of a fileless attack based on the entropy increase anomaly score; determine the protocol fingerprint deviation score corresponding to the target process within a preset time period; and update the second confidence level based on the protocol fingerprint deviation score.

[0207] In some embodiments, the fourth determining unit 1105 is further configured to extract features of the first protocol and establish a legitimate fingerprint of the first protocol based on the features of the first protocol; and determine the protocol distribution of the legitimate fingerprint of the first protocol based on the historical traffic corresponding to the first protocol.

[0208] In some embodiments, the fourth determining unit 1105 is further configured to extract features of the second protocol and establish a legitimate fingerprint of the second protocol based on the features of the second protocol; and determine the cumulative distribution function of the legitimate fingerprint of the second protocol based on the historical traffic corresponding to the second protocol.

[0209] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0210] The following reference Figure 12 To describe an electronic device 1200 according to such an embodiment of the present disclosure. Figure 12 The electronic device 1200 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0211] like Figure 12 As shown, the electronic device 1200 is presented in the form of a general-purpose computing device. The components of the electronic device 1200 may include, but are not limited to: at least one processor 1210, at least one memory 1220, and a bus 1230 connecting different system components (including memory 1220 and processor 1210).

[0212] The memory stores program code that can be executed by the processor 1210, causing the processor 1210 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processor 1210 can perform the following steps of the above method embodiments: statistically analyzing the probability of each byte value appearing in the memory window of the target process at the current moment; determining the actual entropy value of the target process based on the probability of each byte value appearing; determining the predicted entropy value of the target process using a time series prediction model based on the probability of each byte value appearing in the memory windows of the target process at multiple moments prior to the current moment; determining the entropy increase anomaly score of the target process based on the actual entropy value and the predicted entropy value; and determining whether the target process is subject to a fileless attack based on the entropy increase anomaly score.

[0213] The memory 1220 may include a readable medium in the form of volatile memory, such as random access memory (RAM) 12201 and / or cache memory 12202, and may further include read-only memory (ROM) 12203.

[0214] The memory 1220 may also include a program / utility 12204 having a set (at least one) of program modules 12205, including but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0215] Bus 1230 can represent one or more of several types of bus structures, including a memory bus or memory controller, peripheral bus, graphics acceleration port, processor, or a local bus using any of the various bus structures.

[0216] Electronic device 1200 can also communicate with one or more external devices 1240 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more first fileless attack detection devices that enable user interaction with electronic device 1200, and / or with any device that enables electronic device 1200 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1250. Furthermore, electronic device 1200 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1260. As shown, network adapter 1260 communicates with other modules of electronic device 1200 via bus 1230. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1200, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0217] In the disclosed exemplary embodiments, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium.

[0218] In some possible implementations, various aspects of this disclosure may also be implemented as a program product comprising program code that, when run on a terminal device, causes the terminal device to perform the steps described in the foregoing “Detailed Description” section of this specification according to various exemplary embodiments of this disclosure.

[0219] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0220] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0221] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0222] In practice, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on a terminal device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0223] This disclosure provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform a fileless attack detection method provided in various alternative embodiments of this disclosure.

[0224] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0225] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0226] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0227] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope of this disclosure is indicated by the appended claims.

Claims

1. A method for detecting fileless attacks, characterized in that, include: Calculate the probability of each byte value appearing in the memory window of the target process at the current moment; The actual entropy value of the target process is determined based on the probability of occurrence of each byte value. Based on the probability of each byte value appearing in the memory window of the target process at multiple times before the current time, the predicted entropy value of the target process is determined using a time series prediction model. Based on the actual entropy value and the predicted entropy value of the target process, an entropy increase anomaly score of the target process is determined; Based on the entropy increase anomaly score, it is determined whether the target process is subject to a fileless attack.

2. The method according to claim 1, characterized in that, The determination of the entropy increase anomaly score of the target process based on the actual entropy value and the predicted entropy value of the target process includes: Determine the residual between the actual entropy value and the predicted entropy value of the target process; Obtain the standard deviation and mean of the residuals of the normal processes corresponding to the target process; The entropy increase anomaly score is determined based on the standard deviation and mean of the residuals of the target process and the residuals of the normal process.

3. The method according to claim 1, characterized in that, The determination of whether the target process is subject to a fileless attack based on the entropy increase anomaly score includes: Determine the protocol fingerprint deviation score corresponding to the target process; Based on the entropy increase anomaly score and the protocol fingerprint deviation score, it is determined whether the target process is subject to the fileless attack.

4. The method according to claim 3, characterized in that, The determination of the protocol fingerprint deviation score corresponding to the target process includes: Determine the divergence value between the target process and the first protocol's valid fingerprint; Determine the distribution difference value between the target process and the legitimate fingerprint of the second protocol; The protocol fingerprint bias score is determined based on the divergence value and the distribution difference value.

5. The method according to claim 4, characterized in that, Determining the divergence value between the target process and the first protocol's legitimate fingerprint includes: Determine the protocol distribution of the real-time traffic corresponding to the target process; Obtain the protocol distribution of the first protocol's valid fingerprint; The divergence value is determined based on the protocol distribution of the real-time traffic and the protocol distribution of the first protocol valid fingerprint.

6. The method according to claim 4, characterized in that, Determining the distribution difference value between the target process and the second protocol's legitimate fingerprint includes: Determine the cumulative distribution function of the real-time traffic corresponding to the target process; Obtain the cumulative distribution function of the valid fingerprint of the second protocol; The distribution difference value is determined based on the cumulative distribution function corresponding to the real-time traffic and the cumulative distribution function of the second protocol legal fingerprint.

7. The method according to claim 5 or 6, characterized in that, The real-time traffic corresponding to the target process includes: the real-time traffic generated by the target process, the real-time traffic generated by the parent process to which the target process belongs, and the real-time traffic generated by the child processes under the target process.

8. The method according to claim 3, characterized in that, The protocol fingerprint deviation score corresponding to the target process includes: the protocol fingerprint deviation score of the target process, the protocol fingerprint deviation score of the parent process to which the target process belongs, and the protocol fingerprint deviation score of the child processes under the target process.

9. The method according to claim 3, characterized in that, The determination of whether the target process is subject to the fileless attack based on the entropy increase anomaly score and the protocol fingerprint deviation score includes: The entropy increase anomaly score and the protocol fingerprint deviation score are weighted and summed according to the first weight and the second weight respectively to obtain the first confidence level of the existence of the fileless attack, wherein the first weight is greater than the second weight; When the first confidence level is greater than the preset confidence level, it is determined that the target process is subject to the fileless attack.

10. The method according to claim 1, characterized in that, After determining the entropy increase anomaly score of the target process based on its actual and predicted entropy values, the method further includes: Based on the entropy increase anomaly score, determine whether the target process is subject to a fileless attack and the second confidence level of the existence of the fileless attack. Determine the protocol fingerprint deviation score corresponding to the target process within a preset time period; The second confidence level is updated based on the protocol fingerprint deviation score.

11. The method according to claim 5, characterized in that, Before obtaining the protocol distribution of the first protocol's valid fingerprint, the method further includes: Extract the features of the first protocol, and establish a legitimate fingerprint of the first protocol based on the features of the first protocol; Based on the historical traffic corresponding to the first protocol, the protocol distribution of the legitimate fingerprint of the first protocol is determined.

12. The method according to claim 6, characterized in that, Before obtaining the cumulative distribution function of the second protocol's valid fingerprint, the method further includes: Extract the features of the second protocol, and establish a legitimate fingerprint of the second protocol based on the features of the second protocol; Based on the historical traffic corresponding to the second protocol, the cumulative distribution function of the legitimate fingerprint of the second protocol is determined.

13. A fileless attack detection device, characterized in that, include: The statistics unit is configured to count the probability of each byte value appearing in the memory window of the target process at the current moment; The first determining unit is configured to determine the actual entropy value of the target process based on the probability of occurrence of each byte value; The second determining unit is configured to determine the predicted entropy value of the target process using a time series prediction model based on the probability of occurrence of each byte value of the target process in the memory window at multiple times before the current time. The third determining unit is configured to determine the entropy increase anomaly score of the target process based on the actual entropy value and the predicted entropy value of the target process. The fourth determining unit is configured to determine whether the target process is subject to a fileless attack based on the entropy increase anomaly score.

14. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the method of any one of claims 1-12 by executing the executable instructions.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1-12.

16. A computer program product comprising computer instructions stored in a computer-readable storage medium, wherein the computer instructions, when executed by a processor, implement the operation instructions of the method according to any one of claims 1-12.

Images