A process event processing method and device

Abstract

The present invention discloses a process event processing method, the method comprising: parsing each process event being run locally to obtain the process information of each process event; judging whether any target process event in each process event exists in a listening port list or a process information list, if so, completing the process information list according to the process information of the target process event; performing a behavior analysis on the target process event based on the completed process information list to judge whether the target process event is a malicious event, if so, establishing a process command tree of the target process event. The technical solution provided by the present application can timely discover malicious attack events.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to a process event processing method and device. Background Art

[0002] With the rapid development of the Internet, malicious attacks on the network are increasing day by day. In order to improve the security of the network, people pay more and more attention to the analysis of malicious attack events. Existing analysis technology mainly relies on event auditing, such as detecting intrusion behavior by detecting file tampering records, or relying on kernel hook functions to detect process events.

[0003] However, detecting intrusions by detecting file tampering records is a post-event detection, which not only fails to detect malicious attacks in time, but also fails to obtain tampering entries, which makes it impossible to fully analyze malicious attacks. Detecting process events through kernel hook functions requires recompiling kernel modules, which is not only inconvenient to use, but also has high performance overhead and poor stability.

[0004] In view of this, it is necessary to provide a new process event processing method and device to solve the above-mentioned shortcomings. Summary of the invention

[0005] The purpose of this application is to provide a new process event processing method and device, which can detect malicious attack events in a timely manner.

[0006] To achieve the above-mentioned purpose, the present application provides a process event processing method on the one hand, the method comprising: parsing each process event running locally to obtain process information of each process event; judging whether any target process event among the each process event exists in a listening port list or a process information list, and if so, completing the process information list according to the process information of the target process event; performing a behavioral analysis on the target process event based on the completed process information list to judge whether the target process event is a malicious event, and if so, establishing a process command tree of the target process event.

[0007] To achieve the above-mentioned purpose, the present application also provides a process event processing device on the other hand, which includes: a process parsing module, which is used to parse various process events running locally to obtain process information of each process event; a process screening module, which is used to determine whether any target process event among the various process events exists in the listening port list or the process information list, and if so, to improve the process information list according to the process information of the target process event; a behavior analysis module, which is used to perform behavior analysis on the target process event based on the improved process information list to determine whether the target process event is a malicious event, and if so, to establish a process command tree of the target process event.

[0008] To achieve the above-mentioned purpose, the present application further provides a process event processing device on the other hand, which includes a memory and a processor, wherein the memory is used to store a computer program, and when the computer program is executed by the processor, the above-mentioned process event processing method is implemented.

[0009] It can be seen that the technical solution provided by the present application, on the one hand, monitors various process events running locally in real time, and parses the above process events, and then obtains the process information corresponding to each process event. On the other hand, the process events running on the listening port are used as the process of interest, and the monitored process events are screened, so that malicious behaviors can be discovered in time and the interference of invalid process events can be reduced. After completing the screening of process events, the present application can also perform behavioral analysis on the screened process events based on the process information of the process events to determine whether the process event is a malicious event, so as to discover malicious attack behaviors in time. For process events that are judged to be malicious attack behaviors, the present application can also generate a process command tree of the process event, so that the operation and maintenance personnel can analyze the entire attack process of the process event by analyzing the above process command tree, which is convenient for the operation and maintenance personnel to conduct local investigation and traceability analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0011] Figure 1 is a flowchart of a process event processing method in implementation mode 1 of the present application;

[0012] Figure 2 This is a flowchart of process event screening in implementation mode 1 of the present application;

[0013] Figure 3 This is a flow chart of the process event behavior analysis in the first implementation mode of the present application;

[0014] Figure 4 is a flowchart of a process event processing method in implementation mode 2 of the present application;

[0015] Figure 5 is a schematic diagram of functional modules of a process event processing device in an embodiment of the present invention;

[0016] Figure 6 It is a schematic diagram of the structure of a process event processing device in an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0018] With the rapid development of the Internet, malicious attacks on the network are increasing. In order to improve the security of the network, people pay more and more attention to the analysis of malicious attack events. In actual applications, operation and maintenance personnel usually detect the tampering records of files to discover intrusions, but this detection is a post-detection. When the intrusion is discovered, the illegal intruder has completed the intrusion process, and people cannot find the tampering entrance by detecting the tampering records of the files. This makes it impossible for operation and maintenance personnel to trace the source of malicious attacks and cannot fully analyze the entire attack process of illegal intruders. In another scenario, kernel hook functions can also be used to detect process events, but this detection method requires recompiling the kernel module, which is highly invasive to the system. In addition, as the number of hook functions increases, the performance overhead of the system also increases, which will affect the normal operation of the business.

[0019] Therefore, how to monitor and analyze intrusion behaviors in real time and detect malicious attacks in a timely manner has become an issue that needs to be urgently addressed in this field.

[0020] The technical solution provided in this application can solve the above-mentioned shortcomings.

[0021] To facilitate understanding of the process content involved in this application, a brief introduction is given below.

[0022] A process is a dynamic execution process of a program with certain independent functions on a data set. It is an independent unit for resource allocation and scheduling of the operating system and a carrier for the operation of the application. A process generally consists of three parts: program, data set and process control block (PCB). The process control block is a structure type, which mainly contains information such as process identification (PID), process status, current working directory, file descriptor, user id and group id.

[0023] The proc directory is a file system that allows users to view information about system hardware and currently running processes. The proc directory contains multiple subdirectories named with numbers. These numbers represent the process identifiers of the processes currently running in the system. Each subdirectory contains the process information file of the corresponding process.

[0024] Please also read Figure 1 , Figure 2 and Figure 3 , Figure 1 This is a flowchart of a process event processing method in the first implementation mode of the present application. Figure 2 is a flowchart of process event screening in implementation mode 1 of the present application, Figure 3 This is a flowchart of process event behavior analysis in implementation mode 1 of the present application.

[0025] S101: Parse each process event running locally to obtain process information of each process event.

[0026] In this embodiment, a process event connector can be used to establish a netlink connection between the user layer and the kernel module, and a netlink control message event can be constructed to notify the kernel module to turn on the process event connector report switch. When the kernel module turns on the process event connector report switch, the kernel module can obtain all local running process events. After the kernel module obtains the local running process events, the kernel module can parse the above process events to obtain the process information of each process event. Specifically, the kernel module can parse the process control block of each process event to obtain the process information contained therein, such as the process PID, user ID, and group ID.

[0027] After the kernel module obtains the process information of each process event, the kernel module can encapsulate the obtained process information into a netlink message. The above netlink message includes a netlink message header, a connector message header, a process event or a control operation instruction, and the process event includes a response to a control instruction, a fork event, an exec event, a Uid event, an exit event, a Gid event, etc.

[0028] In this embodiment, after the kernel module generates a netlink message, the netlink message can be sent to the user layer. After receiving the netlink message, the user layer can parse the received netlink message, and read the / proc / pid subdirectory corresponding to each process event according to the parsing result, and finally obtain the process information of each process. In this way, there is no need to modify the kernel module. The user layer can obtain the local running process events through the process event connector, and finally parse the process information of the above process events.

[0029] In actual applications, for fork events, the user layer can output the ID of the parent process and thread and the ID of the child process and thread; for exec events, the user layer can output the ID of the process and thread that executes the exec call; for Uid events, the user layer can output the ID of the process and thread that created the event, the old user ID, and the new user ID; for Gid events, the user layer can output the ID of the process and thread that created the event, the old group ID, and the new group ID; for exit events, the user layer can output the ID of the process and thread that ended the running and the exit code.

[0030] At the same time, by parsing the subdirectories corresponding to each process event, the user layer can also obtain the cmdline (process startup parameters), exe (process name), sessionID (process session ID), PID (process identifier), cwd (process working directory), startup timestamp, fd (file descriptor) and other process information corresponding to each process event.

[0031] In one embodiment, before parsing each process event running locally, the process of interest may be set in advance to reduce the interference of invalid process events. Setting the process of interest may be achieved in the following manner:

[0032] First, query the local listening port to obtain the process events running on the listening port;

[0033] Then, a listening port list and a process information list are established according to the process identifier and the process name of the process event.

[0034] In actual applications, most malicious attacks are carried out through illegal intrusions through listening ports, so the process events running on the listening ports can be set as concerned processes. Specifically, all the listening ports opened locally can be queried through network status tools such as Netstat or ss, and then the process events running on each listening port can be obtained, and then the obtained process events can be parsed to obtain the process identifier and process name of the above process events. Furthermore, a listening port list and a process information list can be established based on the above process identifier and process name, so that the above process identifier and process name are stored in the listening port list and the process information list.

[0035] It should be noted that the listening port list is only used to store the process events running on each listening port, and the process information list is used to store both the process events running on each listening port and other process events associated with the process events running on the listening port. For example, the subprocess of a process event running on the listening port can be stored in the process information list. In the initial stage, the content of the process events stored in the listening port list and the process information list is the same. As the user layer continues to parse each process event, when the user layer finds that a process event is associated with the process event running on the listening port, for example, a process event is a subprocess of the process event running on the listening port, but the process event is not in the listening port list, then the user layer can generate an entry corresponding to the process event in the process information list, and store the process identifier and process name of the process event under the above entry. As time goes by, a large number of process events associated with the process events running on the listening port will be stored in the process information list, and the process events stored in the process information list will be more than the process events stored in the listening port list.

[0036] S102: Determine whether any target process event among the process events exists in the listening port list or the process information list; if so, complete the process information list according to the process information of the target process event.

[0037] In this embodiment, after the user layer obtains the process information of each process event running locally, for any one of the above process events (i.e., the target process event), the user layer can compare the process identifier of the target process event obtained by parsing with the information stored in the listening port list or the process information list, thereby determining whether the process identifier of the target process event exists in the listening port list or the process information list.

[0038] If the process identifier of the target process event exists in the listening port list or the process information list, it means that the target process event exists in the listening port list or the process information list, and the target process event may have a risk of malicious attack. Therefore, the user layer can add the process information of the target process event parsed from the / proc / pid file to the entry corresponding to the target process event in the process information list, thereby improving the process information list to facilitate subsequent behavior analysis of the target process event. Furthermore, the user layer can also establish a threat analysis queue and put the target process event into the above threat analysis queue to wait for the user layer to perform behavior analysis on it.

[0039] If the process identifier of the target process event does not exist in the listening port list or the process information list, it means that the target process event does not exist in the listening port list or the process information list, and the target process event does not pose a risk of malicious attack. Therefore, the user layer can discard the above target process event and process the next process event.

[0040] It should be pointed out that when the user layer determines whether the process identifier of the target process event exists in the listening port list or the process information list, it can first perform a first screening according to the listening port list, and then perform a second screening according to the process information list. Since the occurrence of process events is continuous, it may be missed if the process information of a certain process event needs to be added to the process information list only through the listening port list. For example, assuming that process event A exists in the listening port list, and process event B is the child process of process event A, then process event B will be added to the process information list. If an exec event occurs in process event B, thereby generating process event C, since process event B does not exist in the listening port list, the user layer will determine that process event C is not associated with process event A, and process event C does not need to be added to the process information list, which causes the user layer to miss process event C.

[0041] To avoid missing selections, after the user layer performs the first screening based on the listening port list, it also needs to perform a second screening in conjunction with the process information list. Taking the previous example as an example, since there is process event B in the process information list, and process event C is the exec process of process event B, when the user layer performs the second screening in conjunction with the process information list, it will determine that process event C is associated with process event B, and process event C needs to be added to the process information list, so that the user layer can keep tracking process event A and obtain the complete workflow of process event A.

[0042] It should be noted that the order of each process event in the process information list is based on the time when the user layer receives the netlink message corresponding to each process event. For example, assuming that the user layer receives the netlink message corresponding to process event A at 15:21:02, and receives the netlink message corresponding to process event B at 15:21:04, then process event A will be arranged before process event B in the process information list. This application defines process event A as the previous process event of process event B, and process event B as the subsequent process event of process event A.

[0043] In one embodiment, in order to avoid the process information list from occupying too much memory due to being too large, the capacity of the process information list can be limited in actual applications. Specifically, an upper capacity limit can be set for the process information list, for example, the upper capacity limit of the process information list is set to 4000 items. Assuming that the number of process events stored in the process information list has reached 4000, the user layer determines that process event C also needs to be added to the process information list. Then the user layer can delete the process event ranked first in the process information list, and then add process event C to the last position in the process information list. For subsequent process events that need to be added to the process information list, the user layer can repeat the above operation, so that the volume of the process information list can be controlled at an appropriate level, and the process information list always stores the latest process events.

[0044] S103: Performing behavior analysis on the target process event based on the improved process information list to determine whether the target process event is a malicious event; if so, establishing a process command tree for the target process event.

[0045] In this embodiment, after the user layer adds the process information of the target process event to the entry corresponding to the target process event in the process information list, the user layer can perform behavioral analysis on the target process event according to the improved process information list. Specifically, the user layer can take the target process event out of the threat analysis queue, and perform webshell analysis, rebound shell analysis, and remote command execution analysis on the target process event in sequence according to the process tree information, file descriptor information, network information of the target process event, and the process information of the previous process event of the target process event and the process information of the subsequent process event of the target process event in the process information list.

[0046] In actual applications, the user layer can query the parent-child process relationship in the process information list to obtain the process relationship (i.e., process tree information) corresponding to the target process event. When performing webshell analysis on the target process event, the user layer can combine the web work path of the locally running web process, the behavior of the previous process event and the subsequent process event of the target process event, and other information for comprehensive analysis and feature extraction, so as to determine whether the characteristics of the target process event conform to the webshell behavior; when performing rebound shell analysis on the target process event, the user layer can combine the behavior of the previous process event and the subsequent process event of the target process event, the fd network connection of the target process event, and other information for comprehensive analysis and feature extraction, so as to determine whether the characteristics of the target process event conform to the set rebound shell behavior; when performing remote command execution (RCE, remote code execution) analysis on the target process event, the user layer can combine the parent-child process changes of the target process event, the fd network connection information of the target process event, and the previous process event and the subsequent process event of the target process event for comprehensive analysis and feature extraction, so as to determine whether the characteristics of the target process event conform to the remote command execution behavior.

[0047] If the target process event meets the threat behavior characteristics, it means that the target process event is a malicious event, and the user layer can establish a process command tree with the process identifier of the target process event as the root node; if the target process event does not meet the threat behavior characteristics, it means that the target process event is not a malicious event, and the user layer can discard the target process event. Furthermore, when the user layer determines that the target process event is a malicious event, the user layer can also establish a queue to be alerted, and put the target process event into the queue to be alerted, waiting for the user layer to determine whether to send an alert message for the target process event.

[0048] It should be pointed out that the logic for judging the threat characteristics of malicious event processes can be obtained through process analysis of malicious events that have occurred in the past.

[0049] See also Figure 4 , which is a flowchart of the process event processing method in the second implementation mode of the present application.

[0050] In actual applications, after the user layer puts the target process event into the alarm queue, the user layer can track the subsequent process events of the target process event, splice the process command tree of the target process event, and then obtain the complete workflow of the target process event.

[0051] In one embodiment, the user layer can take the target process event out of the alarm queue, and obtain each process event occurring after the target process event through the process event connector, and then analyze any one of the obtained process events (i.e., the object process event) to determine whether the above object process event is a sub-process of the target process event. If the above object process event is a sub-process of the target process event, the user layer can add the process identifier of the object process event to the process command tree of the target process event to splice the process command tree; if the above object process event is not a sub-process of the target process event, the user layer can discard the above object process event and process the next process event.

[0052] In one embodiment, if the object process event is a subprocess of the target process event, in order to obtain the complete workflow of the target process event, the user layer can further determine whether the object process event has a subprocess. Specifically, the user layer can parse the above object process event and determine whether the process event occurring after the above object process event is a subprocess of the object process event (i.e., a fork event) or an exec event. If the object process event has a subprocess, the user layer can splice the subprocess of the object process event into the above process command tree. If the user layer finds that all process events associated with the target process event have ended, such as finding an exit event, the user layer can stop splicing the above process command tree and use the final spliced ​​process command tree (i.e., the target process command tree) as the complete workflow of the target process event.

[0053] In one embodiment, in order to avoid the process command tree from being too large, the user layer can limit the splicing process of the process command tree. Specifically, the user layer can set a splicing threshold, which includes but is not limited to the splicing duration and the splicing level. When splicing the process command tree, the user layer can determine whether the splicing of the process command tree reaches the splicing threshold. If the splicing of the process command tree has reached the splicing threshold, the user layer can stop the splicing of the process command tree to generate the target process command tree. For example, the user layer can set the splicing duration to 2s and the splicing level to 20 levels, then the user layer will only analyze the process events that occur within 2s after the target process event to determine whether each process event that occurs within the above 2s is a sub-process of the target process event, or whether each process event that occurs within the above 2s has a sub-process. If the level of the process command tree reaches 20 levels, the user layer can also stop the splicing process.

[0054] It should be pointed out that for the target process event, its subsequent process events are process events that have not yet occurred. Therefore, when splicing the process command tree, it is necessary to wait for the subsequent process events to occur. In some cases, for example, if a process event has not ended for a long time and its splicing process has not reached the splicing threshold, then the splicing process of the process command tree will wait indefinitely. In another case, if a process event has many sub-process events in a very short period of time, the information will be too long when the alarm is reported, and it will be uncontrollable. To avoid the above situation, when setting the splicing threshold, the user layer needs to set the splicing duration and splicing level at the same time. The user layer uses the threshold that is reached first as the standard to determine whether to stop the splicing of the process command tree.

[0055] In one embodiment, when the user layer processes each process event that occurs after the target process event, it can process each process event in sequence according to the time when the user layer receives the netlink message corresponding to each process event. When the user layer adds the process identifier of each process event to the process command tree, the relationship between the process identifiers of each process event in the process command tree should conform to the process tree information of each process event. For example, assuming that the target process event is an exec event, the process identifier of the target process event is 216, and the subsequent process event B is a fork event, and the parent process of process event B is the target process event, and the process identifier of process event B is 235, then 235 can be spliced ​​after 216, and then process event C occurs as an exec event, and the process identifier of process event C is 242, then 242 needs to be spliced ​​after 216, and process event D continues to occur, and the parent process of process event D is process event B, and the process identifier of process event D is 246, then 246 needs to be spliced ​​after 235. By matching each process event that occurs after the target process event one by one and repeating the above splicing operation, the user layer can eventually obtain a tree structure (i.e., the target process command tree) with the target process event as the root node and each process event associated with the target process event as a child node.

[0056] In one embodiment, in order to avoid misjudgment when the user layer determines whether the target process event is a malicious event according to the threat feature logic, the user layer can also filter the target process event according to the process whitelist. Specifically, after the user layer generates the target process command tree, the user layer can compare the target process command tree with the locally stored process whitelist to determine whether the target process command tree exists in the process whitelist. If the target process command tree exists in the process whitelist, it means that the target process event is not a malicious event. The user layer can discard the above target process command tree and not issue an early warning for the target process event; if the target process command tree does not exist in the process whitelist, it means that the target process event is a malicious event. The user layer can save the above target process command tree locally and generate target alarm information based on the above target process command tree. The target alarm information is bound to the target process command tree. Through the target alarm information, the operation and maintenance personnel can query the target process event and the target process command tree to analyze the complete workflow of the target process event. It should be pointed out that the process whitelist can be obtained by analyzing the misjudgments that have occurred in history.

[0057] In one embodiment, after the user layer generates target alarm information, in order to avoid repeated sending of the same alarm information, the user layer can put the target alarm information into a cache queue and determine whether the number of times the above target alarm information is sent is less than the specified value. If the number of times the target alarm information is sent is less than the above specified value, the user layer can send the target alarm information to the operation and maintenance personnel by email, text message, etc., so that the operation and maintenance personnel can deal with malicious incidents in a timely manner; if the number of times the target alarm information is sent is greater than or equal to the above specified value, it means that the user layer has sent the above target alarm information to the operation and maintenance personnel. In order to avoid repeated sending of the target alarm information, the user layer may not send the target alarm information generated this time to the operation and maintenance personnel, but discard the above target alarm information.

[0058] It should be pointed out that in order to ensure the efficiency of obtaining and consuming process information, the processing of the above process events can adopt a dual-queue asynchronous processing method, and the used memory resources can be reused and recycled, and the system does not need to repeatedly allocate memory variables. Taking the user layer obtaining the locally running process events as an example, the system can establish queues A and queues B. The user layer can first obtain the allocated memory variables from queue B, and then use the netlink method to obtain the process events from the kernel connector and store them in the above-mentioned allocated memory variables. After that, the user layer can put the obtained process event variables into queue A to process the process events. When the process event parsing is completed, the memory variables can be put back into queue B for recycling, thereby realizing the reuse of memory resources.

[0059] It should be pointed out that for container processes in actual applications, since the path through which the container process receives the request is generally through the host's docker-proxy process, which then forwards the request to the real container process, what is obtained through the network status tool is the listening port of the docker-proxy process, and the system cannot directly obtain the real container process. Therefore, by mapping the proxy port, a mapping relationship can be established between the docker-proxy process and the real container process to obtain the real container process, thereby achieving intrusion detection on the real container process.

[0060] See also Figure 5 The present application also provides a process event processing device, the device comprising:

[0061] A process parsing module, used to parse each process event running locally to obtain process information of each process event;

[0062] A process screening module, used to determine whether any target process event among the various process events exists in the listening port list or the process information list, and if so, to complete the process information list according to the process information of the target process event;

[0063] The behavior analysis module is used to perform behavior analysis on the target process event based on the improved process information list to determine whether the target process event is a malicious event. If so, a process command tree of the target process event is established.

[0064] In one embodiment, the device further comprises:

[0065] The process acquisition module is concerned with querying the local listening port to obtain the process event running on the listening port, and establishing the listening port list and the process information list according to the process identifier and process name of the process event.

[0066] In one embodiment, performing behavior analysis on the target process event based on the improved process information list includes:

[0067] According to the process tree information, file descriptor information, network information, previous process events and subsequent process events of the target process event, webshell analysis, rebound shell analysis and remote command execution analysis are performed on the target process event.

[0068] In one embodiment, the device further comprises:

[0069] A command tree splicing module is used to obtain various process events that occur after the target process event, and to determine whether any object process event among the various process events is a sub-process of the target process event. If the object process event is a sub-process of the target process event, the object process event is spliced ​​into the process command tree.

[0070] In one embodiment, the command tree splicing module is also used to parse the object process event to determine whether the object process event has a sub-process. If the object process event has a sub-process, the sub-process of the object process event is spliced ​​into the process command tree.

[0071] In one embodiment, the command tree splicing module is further used to determine whether the splicing of the process command tree reaches a splicing threshold. If the splicing threshold is reached, the splicing of the process command tree is stopped to generate a target process command tree.

[0072] In one embodiment, the device further comprises:

[0073] The alarm module is used to determine whether the target process command tree exists in the process whitelist. If not, the target process command tree is saved, and target alarm information is generated based on the target process command tree, and whether the number of times the target alarm information is sent is less than a specified value. If it is less than the specified value, the target alarm information is sent.

[0074] See also Figure 6 The present application also provides a process event processing device, the process event processing device includes a memory and a processor, the memory is used to store a computer program, when the computer program is executed by the processor, the process event processing method as described above can be implemented. Specifically, at the hardware level, the process event processing device may include a processor, an internal bus and a memory. The memory may include a memory and a non-volatile memory. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it. It can be understood by those skilled in the art that Figure 6 The structure shown is only for illustration and does not limit the structure of the above process event processing device. Figure 6 More or fewer components shown in the figure may also include other processing hardware, such as a GPU (Graphics Processing Unit), or an external communication port, etc. Of course, in addition to the software implementation, this application does not exclude other implementations, such as logic devices or a combination of software and hardware, etc.

[0075] In this embodiment, the processor may include a central processing unit (CPU) or a graphics processing unit (GPU), and of course may also include other single-chip microcomputers, logic gate circuits, integrated circuits, etc. with logic processing capabilities, or appropriate combinations thereof. The memory described in this embodiment may be a memory device for storing information. In a digital system, a device that can store binary data may be a memory; in an integrated circuit, a circuit with a storage function without a physical form may also be a memory, such as a RAM, a FIFO, etc.; in a system, a storage device with a physical form may also be called a memory, etc. When implemented, the memory may also be implemented in the form of a cloud storage, and the specific implementation method is not limited in this specification.

[0076] It should be noted that the specific implementation of the process event processing device in this specification can refer to the description of the method implementation method, and will not be described in detail here.

[0077] It can be seen that the technical solution provided by the present application, on the one hand, monitors various process events running locally in real time, and parses the above process events, and then obtains the process information corresponding to each process event. On the other hand, the process events running on the listening port are used as the process of interest, and the monitored process events are screened, so that malicious behaviors can be discovered in time and the interference of invalid process events can be reduced. After completing the screening of process events, the present application can also perform behavioral analysis on the screened process events based on the process information of the process events to determine whether the process event is a malicious event, so as to discover malicious attack behaviors in time. For process events that are judged to be malicious attack behaviors, the present application can also generate a process command tree of the process event, so that the operation and maintenance personnel can analyze the entire attack process of the process event by analyzing the above process command tree, which is convenient for the operation and maintenance personnel to conduct local investigation and traceability analysis.

[0078] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0079] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A process event processing method, characterized in that: The method comprises: Parsing each process event running locally to obtain process information of each process event; Determine whether any target process event among the process events exists in the listening port list or the process information list, and if so, complete the process information list according to the process information of the target process event; Based on the improved process information list, a behavior analysis is performed on the target process event to determine whether the target process event is a malicious event, and if so, a process command tree of the target process event is established; Track the subsequent process events of the target process event, splice the process command tree, and based on the set splicing threshold, determine whether the splicing of the process command tree reaches the splicing threshold; if the splicing threshold is reached, stop the splicing of the process command tree to generate a target process command tree.

2. The method according to claim 1, characterized in that Before parsing each process event running locally, the method further includes: Query the local listening port to obtain the process events running on the listening port; The listening port list and the process information list are established according to the process identifier and the process name of the process event.

3. The method according to claim 1, characterized in that Performing behavior analysis on the target process event based on the improved process information list includes: According to the process tree information, file descriptor information, network information, previous process events and subsequent process events of the target process event, webshell analysis, rebound shell analysis and remote command execution analysis are performed on the target process event.

4. The method according to claim 1, characterized in that: After establishing the process command tree of the target process event, the method further includes: Obtain each process event that occurs after the target process event; It is determined whether any one of the object process events is a subprocess of the target process event. If the object process event is a subprocess of the target process event, the object process event is spliced ​​into the process command tree.

5. The method according to claim 4, characterized in that After splicing the object process event into the process command tree, the method further includes: The object process event is parsed to determine whether the object process event has a child process. If the object process event has a child process, the child process of the object process event is spliced ​​into the process command tree.

6. The method according to claim 1, characterized in that After generating the target process command tree, the method further includes: Determine whether the target process command tree exists in the process whitelist, and if so, discard the target process command tree; If it does not exist, the target process command tree is saved, and target alarm information is generated based on the target process command tree.

7. The method according to claim 6, characterized in that After generating the target warning information, the method further includes: Determine whether the number of times the target warning information is sent is less than a specified value, and if so, send the target warning information; If it is greater than or equal to the specified value, the target alarm information is discarded.

8. A process event processing device, characterized in that: The device comprises: A process parsing module, used to parse each process event running locally to obtain process information of each process event; A process screening module, used to determine whether any target process event among the process events exists in the listening port list or the process information list, and if so, to complete the process information list according to the process information of the target process event; A behavior analysis module, used for performing behavior analysis on the target process event based on the improved process information list to determine whether the target process event is a malicious event, and if so, establishing a process command tree of the target process event; The command tree splicing module is used to track the subsequent process events of the target process event, splice the process command tree, and determine whether the splicing of the process command tree reaches the splicing threshold based on the set splicing threshold. If the splicing threshold is reached, the splicing of the process command tree is stopped to generate the target process command tree.

9. The device according to claim 8, characterized in that The command tree splicing module is also used to obtain various process events that occur after the target process event, and determine whether any object process event among the various process events is a sub-process of the target process event. If the object process event is a sub-process of the target process event, the object process event is spliced ​​into the process command tree.

10. The device according to claim 9, characterized in that The command tree splicing module is also used to parse the object process event to determine whether the object process event has a sub-process. If the object process event has a sub-process, the sub-process of the object process event is spliced ​​into the process command tree.

11. A process event processing device, characterized in that: The process event processing device comprises a memory and a processor, wherein the memory is used to store a computer program, and when the computer program is executed by the processor, the method according to any one of claims 1 to 7 is implemented.

Images