Threat analysis method, device, equipment and storage medium in confidential environment

Abstract

The present invention provides a threat analysis method, device, equipment and storage medium in a confidential environment, wherein the method comprises: pre-installing a trusted threat analysis tool in the confidential environment; using the trusted threat analysis tool to determine the file type of an unknown file to be analyzed; processing the unknown file according to a pre-set processing rule to obtain a source to be analyzed; and using the pre-generated threat analysis rule to perform threat analysis on the source to be analyzed to obtain a threat analysis result. This solution can automatically perform threat analysis on a confidential environment, and improve the analysis accuracy and efficiency.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of security detection technology, and in particular to a threat analysis method, device, equipment and storage medium in a confidential environment. Background Art

[0002] With the increasing risks of network security, the threat blocking of confidential environments can no longer be achieved through simple physical isolation. Current network attacks can achieve high-intensity and high-frequency penetration and utilization of confidential environments in isolated networks through a variety of attack methods, ultimately achieving the purpose of obtaining confidential information in confidential environments.

[0003] Faced with the increasing threats, it is often necessary to conduct threat analysis on confidential environments. However, due to the particularity of confidential environments, threat analysis and identification are generally performed manually. The manual method not only has low accuracy, but also low analysis efficiency. Summary of the invention

[0004] Based on the problem that the manual threat analysis method for confidential environments has low accuracy and analysis efficiency, the embodiments of the present invention provide a threat analysis method, apparatus, device and storage medium in a confidential environment, which can automatically perform threat analysis on confidential environments and improve analysis accuracy and analysis efficiency.

[0005] In a first aspect, an embodiment of the present invention provides a method for threat analysis in a confidential environment, comprising:

[0006] Pre-install trusted threat analysis tools in classified environments;

[0007] Determining the file type of the unknown file to be analyzed using the trusted threat analysis tool;

[0008] According to a preset processing rule, the unknown file is processed to obtain a source to be analyzed;

[0009] A threat analysis is performed on the source to be analyzed using pre-generated threat analysis rules to obtain a threat analysis result.

[0010] Preferably, the file type of the unknown file is an executable file;

[0011] The processing of the unknown file to obtain the source to be analyzed includes: converting the executable file into a disassembled code and a hexadecimal code and extracting a characteristic string from the executable file to obtain the disassembled code, the hexadecimal code and the characteristic string as the source to be analyzed;

[0012] The using of pre-generated threat analysis rules to perform threat analysis on the source to be analyzed includes: performing threat matching on the disassembled code, hexadecimal code and feature character string based on pre-generated yara rules to determine whether a threat behavior can be matched.

[0013] Preferably, before performing threat analysis on the source to be analyzed using the pre-generated threat analysis rules, the method further includes:

[0014] The disassembled code is converted into a pseudo code, and the pseudo code is determined as the source to be analyzed.

[0015] Preferably, the file type of the unknown file is a script file;

[0016] The processing of the unknown file to obtain a source to be analyzed includes: obtaining script content in the script file, and determining the script content as a source to be analyzed;

[0017] The threat analysis of the source to be analyzed using pre-generated threat analysis rules includes: performing algorithm matching on the algorithm contained in the script content based on the pre-generated algorithm detection rules; if an algorithm match exists, restoring the algorithm contained in the script content and determining whether there is an encrypted threat file, and determining the matched threat behavior based on the threat file.

[0018] Preferably, the file type of the unknown file is a process characteristic analysis software package file;

[0019] The processing of the unknown file to obtain the source to be analyzed includes: obtaining the flow in the process characteristic analysis software package file, and determining the flow as the source to be analyzed;

[0020] The threat analysis of the source to be analyzed by using the pre-generated threat analysis rules includes: restoring the traffic based on the pre-generated snort rules, and determining whether there is a threat behavior based on the restored traffic.

[0021] Preferably, after performing threat analysis on the source to be analyzed by using the pre-generated threat analysis rules, the method further includes:

[0022] When it is determined that the threat behavior is matched, the attack technology point corresponding to each matched threat behavior is determined, and the matched threat behavior and the corresponding attack technology point are determined as the threat analysis result.

[0023] Preferably,

[0024] Before performing threat analysis on the source to be analyzed using the pre-generated threat analysis rules, the method further includes: loading the source to be analyzed onto a display interface;

[0025] After performing threat analysis on the source to be analyzed using the pre-generated threat analysis rules, the method further includes: receiving threat behaviors manually determined and input based on the source to be analyzed loaded on the display interface, and updating the threat analysis rules according to the threat behaviors manually input and the threat behaviors matched by the threat analysis rules.

[0026] In a second aspect, an embodiment of the present invention further provides a threat analysis device in a confidential environment, comprising: a trusted threat analysis tool pre-installed in the confidential environment; wherein the trusted threat analysis tool comprises:

[0027] A file type determination unit, used to determine the file type of the unknown file to be analyzed;

[0028] A source determination unit to be analyzed, used to process the unknown file according to a preset processing rule to obtain a source to be analyzed;

[0029] The threat analysis unit is used to perform threat analysis on the source to be analyzed using pre-generated threat analysis rules to obtain a threat analysis result.

[0030] In a third aspect, an embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0031] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method described in any embodiment of this specification.

[0032] The embodiments of the present invention provide a threat analysis method, apparatus, device and storage medium in a confidential environment. After obtaining a trusted threat analysis tool, the trusted threat analysis tool is installed in the confidential environment, and threat analysis can be performed on unknown files in the confidential environment. During the threat analysis process, the file type of the unknown file can be identified, and different processing can be performed on unknown files of different file types. Threat analysis is performed on the source to be analyzed after processing using threat analysis rules, thereby realizing an automatic analysis process in the confidential environment. Compared with manual analysis, the analysis accuracy and efficiency are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0034] Figure 1 This is a flow chart of a threat analysis method in a confidential environment provided by an embodiment of the present invention;

[0035] Figure 2 is a hardware architecture diagram of a computing device provided by an embodiment of the present invention;

[0036] Figure 3 It is a structural diagram of a threat analysis device in a confidential environment provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0038] As mentioned above, due to the particularity of confidential environments, some existing analysis software, such as IDA (Interactive Disassembler) and OLLYDBG (Assembly Analysis Debugger), cannot be used in confidential environments. The main reasons include: 1. These analysis software can only analyze a single type of threat, but cannot achieve overall threat analysis; 2. These analysis software are not domestically produced trusted software, and using them in confidential environments will bring unknown threat factors to the confidential environment; 3. The operating system of confidential environments generally uses domestic operating systems, and there is no suitable trusted software for the time being. Based on the above reasons, threat analysis in confidential environments is currently performed manually. In order to improve detection efficiency and accuracy, it is possible to consider developing trusted threat analysis software for confidential environments to achieve overall threat analysis for confidential environments.

[0039] The specific implementation of the above concept is described below.

[0040] Please refer to Figure 1 The embodiment of the present invention provides a method for threat analysis in a confidential environment, the method comprising:

[0041] Step 100, pre-installing a trusted threat analysis tool in a confidential environment;

[0042] Step 102, using the trusted threat analysis tool to determine the file type of the unknown file to be analyzed;

[0043] Step 104, processing the unknown file according to a preset processing rule to obtain a source to be analyzed;

[0044] Step 106: Perform threat analysis on the source to be analyzed using pre-generated threat analysis rules to obtain threat analysis results.

[0045] In an embodiment of the present invention, after obtaining a trusted threat analysis tool, the trusted threat analysis tool is installed in a confidential environment, and threat analysis can be performed on unknown files in the confidential environment. During the threat analysis process, the file type of the unknown file can be identified, and different processing can be performed on unknown files of different file types. Threat analysis rules are used to perform threat analysis on the source to be analyzed after processing, thereby realizing an automatic analysis process in a confidential environment, and improving the analysis accuracy and efficiency compared to manual analysis.

[0046] Described below Figure 1 How the various steps are performed.

[0047] First, with respect to step 100, a trusted threat analysis tool is pre-installed in a confidential environment.

[0048] In the embodiment of the present invention, the type of operating system corresponding to the confidential environment can be a domestic operating system or a controllable operating system. Among them, the domestic operating system is developed based on the open source Linux system, such as Zhongbiao Kylin, Yinhe Kylin, etc.; the controllable operating system is an operating system that has been tested and has no malicious threats.

[0049] Since the existing analysis software is not domestically-produced trusted software, in the embodiment of the present invention, adaptation coding is performed for the type of operating system corresponding to the confidential environment to obtain a trusted threat analysis tool. Since the threat analysis tool is self-coded, the threat analysis tool is trusted and can be used in a confidential environment. The trusted threat analysis tool is installed in the confidential environment to perform threat analysis in the confidential environment.

[0050] Then, with respect to step 102, the trusted threat analysis tool is used to determine the file type of the unknown file to be analyzed.

[0051] Since the confidential environment is physically isolated, the unknown files are copied into the confidential environment through CDs and other means. Since the threat situation of the unknown files is unknown, it is necessary to use trusted threat analysis tools to perform threat analysis.

[0052] In an embodiment of the present invention, the trusted threat analysis tool may include a file identification module for identifying the file type of an unknown file. Specifically, in this step, the method of determining the file type of the unknown file to be analyzed may include at least two methods:

[0053] The first method is to identify directly based on the suffix of the unknown file.

[0054] The second method is to use the header features of unknown files for analysis and identification.

[0055] In the first method, different file types have different suffixes, for example, .exe is an executable file and .doc is a document file. However, considering that the file suffix can be changed, the identification result of the file type by the file suffix may be different from the actual file type. Therefore, it is preferred to use the second method for identification.

[0056] In the second method, files of different file types have different header features. By detecting the header features of the file, the real file type can be analyzed. Moreover, by identifying the file type through the header features of the file, not only the file type can be identified, but also the operating system to which the file can be applied. For example, it can be identified that the file type is an executable file, and whether the executable file is a PE file applied to Windows, an ELF file applied to Linux, or an APK file applied to the Android operating system.

[0057] In one embodiment of the present invention, in addition to the above-mentioned executable file types, at least the following file types can be identified: script files, process characteristic analysis software package files.

[0058] If the file type of an unknown file cannot be identified, it indicates that the unknown file poses a greater threat and the unknown file can be isolated to ensure the security of the confidential environment.

[0059] Finally, step 104 "processing the unknown file according to a preset processing rule to obtain a source to be analyzed" and step 106 "performing a threat analysis on the source to be analyzed using a pre-generated threat analysis rule to obtain a threat analysis result" are explained simultaneously.

[0060] According to step 102, the file types may include at least: executable files, script files and process characteristic analysis software package files. Since different file types require different processing methods, step 104 and step 106 are described below for the above three file types respectively.

[0061] The first file type is an executable file.

[0062] For an executable file, this step 104 may include: converting the executable file into a disassembled code and a hexadecimal code and extracting a characteristic string from the executable file to obtain the disassembled code, the hexadecimal code and the characteristic string as the source to be analyzed.

[0063] Then step 106 may include: performing threat matching on the disassembled code, hexadecimal code and feature string based on pre-generated Yara rules to determine whether a threat behavior can be matched.

[0064] Disassembly is the process of converting machine language into assembly language code. By converting the executable file into disassembly code, vulnerability analysis can be performed based on the disassembly code.

[0065] Among them, the feature string may include sensitive characters, sensitive paths, Chinese characters, etc. Based on these feature strings, string features can be formed in the Yara rule, and then the code in the executable file is matched based on the string features, and the string that matches the string features is determined as the feature string and extracted.

[0066] Since the disassembled code, hexadecimal code and feature string represent different information richness, when performing threat matching on the disassembled code, hexadecimal code and feature string in step 106, they can be combined with each other for threat matching. Specifically, when performing threat matching on any source to be analyzed among the disassembled code, hexadecimal code and feature string, if a suspicious threat behavior is matched, the position of the suspicious threat behavior in the current source to be analyzed is located, and based on the position in the current source to be analyzed, the corresponding positions of other sources to be analyzed are determined, and the relevant information at the corresponding positions of other sources to be analyzed is obtained, and threat matching is further performed based on the relevant information to determine whether the suspicious threat behavior is a real threat behavior. This method can more accurately analyze the real threat behavior of the executable file, and prevent the detection of the real threat behavior from being missed due to the failure of a single language code to express a complete threat feature, thereby affecting the accuracy of the threat analysis results.

[0067] For example, when performing threat matching on the disassembled code, if the matched threat feature cannot be directly determined as a real threat behavior, the matched behavior will be determined as a suspicious threat behavior. By locating the position of the suspicious threat behavior in the disassembled code, the corresponding position of the position in the hexadecimal code can be determined, and the relevant information at the corresponding position in the hexadecimal code (such as context information) is further threat matched on the relevant information. If the threat feature is matched, the suspicious threat behavior is determined to be a real threat behavior.

[0068] In one embodiment of the present invention, since the disassembled code is machine code, there may be a problem of insufficient understanding and learning of the machine code. Therefore, the disassembled code can be converted into pseudo code, and the pseudo code is determined as the source to be analyzed, and threat analysis is performed simultaneously with the disassembled code, hexadecimal code, and feature string to further improve the accuracy of threat analysis. The pseudo code can be one or more of Pascal, C, and Java languages.

[0069] The second file type is a script file.

[0070] For a script file, this step 104 may include: obtaining script content in the script file, and determining the script content as a source to be analyzed.

[0071] Then step 106 may include: performing algorithm matching on the algorithm contained in the script content based on a pre-generated algorithm detection rule, if there is an algorithm match, restoring the algorithm contained in the script content and determining whether there is an encrypted threat file, and determining the matched threat behavior based on the threat file.

[0072] A script is a programming language. The script content in the script file can be directly obtained, and the algorithm contained in the script content can be analyzed. Considering that in some malicious attack situations, the threat file will be encrypted and the encrypted threat file will be embedded in the script, therefore, the algorithm contained in the script content is matched with each preset algorithm contained in the algorithm detection rule. If there is an algorithm match, the matched algorithm can be restored, and it is determined whether there is a threat file encrypted according to the restored algorithm. If there is a threat file encrypted, the matched threat behavior is determined according to the threat file.

[0073] The third file type is the process characterization software package file.

[0074] For a process characteristic analysis software package file (PCAP), this step 104 may include: obtaining traffic in the process characteristic analysis software package file, and determining the traffic as a source to be analyzed.

[0075] Then step 106 may include: restoring the traffic based on the pre-generated snort rules, and determining whether there is a threat behavior based on the restored traffic.

[0076] After restoring the traffic included in the process characteristic analysis software package file, you can analyze common protocols, such as the http protocol, to determine whether it includes malicious instructions, file transfers to external servers, downloads of confidential files, and other threatening behaviors.

[0077] Regardless of which file type the unknown file is, when it is determined that the threat behavior is matched, the attack technology points corresponding to each matched threat behavior are determined, and the matched threat behavior and the corresponding attack technology points are determined as threat analysis results. Specifically, the ATT&CK attack framework can be used to determine the attack technology points of each threat behavior. By determining the matched threat behavior and the corresponding attack technology points as threat analysis results, more dimensional threat analysis results can be quickly output.

[0078] In addition, the above-mentioned threat analysis rules are formed based on the features extracted after manual threat behavior analysis in a confidential environment. In order to ensure the continuous detection of threat analysis rules, in one embodiment of the present invention, after obtaining the source to be analyzed, the source to be analyzed can be loaded onto a display interface, and the source to be analyzed loaded on the display interface can be manually analyzed. When it is manually determined that there is a threat behavior, the threat behavior is input on the display interface. Based on the source to be analyzed loaded on the display interface, the manually determined and input threat behavior is received, and the threat analysis rule is updated according to the manually input threat behavior and the threat behavior matched by the threat analysis rule.

[0079] Specifically, the threat behaviors other than the threat behaviors matched by the threat analysis procedure in the manually input threat behaviors may be used to further extract features of the threat behaviors, thereby updating the threat analysis rules using the extracted features.

[0080] Furthermore, in addition to the above threat analysis, the trusted threat analysis tool can also link other products, such as intelligence, dynamic sandbox, etc. to assist in analysis, and generate an analysis report together with the above threat analysis results according to the document template. Before generating the analysis report, a preview report can also be generated for the analyst to confirm.

[0081] like Figure 2 , Figure 3 As shown, an embodiment of the present invention provides a threat analysis device in a confidential environment. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 2 As shown, a hardware architecture diagram of a computing device in which a threat analysis device in a confidential environment is provided in an embodiment of the present invention is located. Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown in the figure, the computing device in which the device is located in the embodiment may also generally include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3As shown, as a device in a logical sense, the CPU of the computing device in which it is located reads the corresponding computer program in the non-volatile memory into the memory and runs it. This embodiment provides a threat analysis device in a confidential environment, including: a trusted threat analysis tool pre-installed in the confidential environment; wherein the trusted threat analysis tool includes:

[0082] A file type determination unit 301, used to determine the file type of the unknown file to be analyzed;

[0083] The source to be analyzed determining unit 302 is used to process the unknown file according to a preset processing rule to obtain a source to be analyzed;

[0084] The threat analysis unit 303 is used to perform threat analysis on the source to be analyzed by using pre-generated threat analysis rules to obtain a threat analysis result.

[0085] In one embodiment of the present invention, the file type of the unknown file is an executable file;

[0086] The source to be analyzed determining unit 302 is specifically used to convert the executable file into a disassembled code and a hexadecimal code and extract a characteristic string from the executable file to obtain the disassembled code, the hexadecimal code and the characteristic string as the source to be analyzed;

[0087] The threat analysis unit 303 is specifically used to perform threat matching on the disassembled code, hexadecimal code and feature string based on the pre-generated Yara rules to determine whether a threat behavior can be matched.

[0088] In one embodiment of the present invention, the source to be analyzed determining unit 302 is further configured to convert the disassembled code into a pseudo code, and determine the pseudo code as the source to be analyzed.

[0089] In one embodiment of the present invention, the file type of the unknown file is a script file;

[0090] The to-be-analyzed source determining unit 302 is specifically configured to obtain script content in the script file and determine the script content as the to-be-analyzed source;

[0091] The threat analysis unit 303 is specifically used to perform algorithm matching on the algorithm contained in the script content based on pre-generated algorithm detection rules. If there is an algorithm match, the algorithm contained in the script content is restored and it is determined whether there is an encrypted threat file, and the matched threat behavior is determined based on the threat file.

[0092] In one embodiment of the present invention, the file type of the unknown file is a process characteristic analysis software package file;

[0093] The to-be-analyzed source determination unit 302 is specifically configured to obtain the flow included in the process characteristic analysis software package file, and determine the flow as the to-be-analyzed source;

[0094] The threat analysis unit 303 is specifically configured to restore the traffic based on the pre-generated snort rules, and determine whether there is a threat behavior based on the restored traffic.

[0095] In one embodiment of the present invention, the threat analysis unit 303 is further configured to determine the attack technology points corresponding to the matched threat behaviors after determining that the threat behaviors are matched, and determine the matched threat behaviors and the corresponding attack technology points as the threat analysis results.

[0096] In one embodiment of the present invention, the threat analysis unit 303 is also used to load the source to be analyzed onto a display interface; and receive threat behaviors manually determined and input based on the source to be analyzed loaded on the display interface, and update the threat analysis rules according to the manually input threat behaviors and the threat behaviors matched by the threat analysis rules.

[0097] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on a threat analysis device in a confidential environment. In other embodiments of the present invention, a threat analysis device in a confidential environment may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0098] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0099] An embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a threat analysis method in a confidential environment in any embodiment of the present invention is implemented.

[0100] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes a threat analysis method in a confidential environment in any embodiment of the present invention.

[0101] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0102] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0103] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0104] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0105] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0106] Each embodiment of the present invention has at least the following beneficial effects:

[0107] 1. In one embodiment of the present invention, after obtaining a trusted threat analysis tool, the trusted threat analysis tool is installed in a confidential environment, and threat analysis can be performed on unknown files in the confidential environment. During the threat analysis process, the file type of the unknown file can be identified, and different processing can be performed on unknown files of different file types. Threat analysis is performed on the processed source to be analyzed using threat analysis rules, thereby realizing an automatic analysis process in a confidential environment, and improving the analysis accuracy and efficiency compared to manual analysis.

[0108] 2. In one embodiment of the present invention, by combining the disassembled code, hexadecimal code and feature character string for threat matching, the real threat behavior of the executable file can be analyzed more accurately, preventing the detection of the real threat behavior from being missed due to the failure of a single language code to express the complete threat characteristics, thereby affecting the accuracy of the threat analysis results.

[0109] 3. In one embodiment of the present invention, by converting the disassembled code into pseudo code and determining the pseudo code as the source to be analyzed, threat analysis is performed simultaneously with the disassembled code, hexadecimal code, and feature string to further improve the accuracy of threat analysis.

[0110] 4. In one embodiment of the present invention, the attack technology points of each threat behavior are determined by using the ATT&CK attack framework, and the matched threat behavior and the corresponding attack technology points are determined as threat analysis results, so that threat analysis results of more dimensions can be quickly output.

[0111] 5. In one embodiment of the present invention, by loading the source to be analyzed onto the display interface, manually analyzing the source to be analyzed loaded onto the display interface, and using the threat behavior analyzed manually to update the threat analysis rules, the continuous detection of the threat analysis rules can be ensured.

[0112] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0113] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0114] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A threat analysis method in a confidential environment, characterized in that: include: Pre-install trusted threat analysis tools in classified environments; Determining the file type of the unknown file to be analyzed using the trusted threat analysis tool; According to a preset processing rule, the unknown file is processed to obtain a source to be analyzed; Performing threat analysis on the source to be analyzed using pre-generated threat analysis rules to obtain threat analysis results; Before performing threat analysis on the source to be analyzed using the pre-generated threat analysis rules, the method further includes: loading the source to be analyzed onto a display interface; After performing threat analysis on the source to be analyzed using the pre-generated threat analysis rules, the method further includes: receiving threat behaviors manually determined and input based on the source to be analyzed loaded on the display interface, and updating the threat analysis rules according to the threat behaviors manually input and the threat behaviors matched by the threat analysis rules.

2. The method according to claim 1, characterized in that The file type of the unknown file is an executable file; The processing of the unknown file to obtain the source to be analyzed includes: converting the executable file into a disassembled code and a hexadecimal code and extracting a characteristic string from the executable file to obtain the disassembled code, the hexadecimal code and the characteristic string as the source to be analyzed; The using of pre-generated threat analysis rules to perform threat analysis on the source to be analyzed includes: performing threat matching on the disassembled code, hexadecimal code and feature character string based on pre-generated yara rules to determine whether a threat behavior can be matched.

3. The method according to claim 2, characterized in that Before performing threat analysis on the source to be analyzed by using the pre-generated threat analysis rules, the method further includes: The disassembled code is converted into a pseudo code, and the pseudo code is determined as the source to be analyzed.

4. The method according to claim 1, characterized in that: The file type of the unknown file is a script file; The processing of the unknown file to obtain a source to be analyzed includes: obtaining script content in the script file, and determining the script content as a source to be analyzed; The threat analysis of the source to be analyzed using pre-generated threat analysis rules includes: performing algorithm matching on the algorithm contained in the script content based on the pre-generated algorithm detection rules; if an algorithm match exists, restoring the algorithm contained in the script content and determining whether there is an encrypted threat file, and determining the matched threat behavior based on the threat file.

5. The method according to claim 1, characterized in that The file type of the unknown file is a process characteristic analysis software package file; The processing of the unknown file to obtain the source to be analyzed includes: obtaining the flow in the process characteristic analysis software package file, and determining the flow as the source to be analyzed; The threat analysis of the source to be analyzed by using the pre-generated threat analysis rules includes: restoring the traffic based on the pre-generated snort rules, and determining whether there is a threat behavior based on the restored traffic.

6. The method according to any one of claims 1 to 5, characterized in that: After performing threat analysis on the source to be analyzed by using the pre-generated threat analysis rules, the method further includes: When it is determined that the threat behavior is matched, the attack technology point corresponding to each matched threat behavior is determined, and the matched threat behavior and the corresponding attack technology point are determined as the threat analysis result.

7. A threat analysis device in a confidential environment, characterized in that: include: A trusted threat analysis tool pre-installed in a confidential environment; wherein the trusted threat analysis tool includes: A file type determination unit, used to determine the file type of the unknown file to be analyzed; A source determination unit to be analyzed, used to process the unknown file according to a preset processing rule to obtain a source to be analyzed; A threat analysis unit, configured to perform a threat analysis on the source to be analyzed using a pre-generated threat analysis rule to obtain a threat analysis result; The threat analysis unit is also used to load the source to be analyzed onto a display interface; and receive threat behaviors manually determined and input based on the source to be analyzed loaded on the display interface, and update the threat analysis rules according to the threat behaviors manually input and the threat behaviors matched by the threat analysis rules.

8. The device according to claim 7, characterized in that The file type of the unknown file is an executable file; The source to be analyzed determining unit is specifically used to convert the executable file into a disassembled code and a hexadecimal code and extract a characteristic string in the executable file to obtain the disassembled code, the hexadecimal code and the characteristic string as the source to be analyzed; The threat analysis unit is specifically used to perform threat matching on the disassembled code, hexadecimal code and feature character string based on pre-generated Yara rules to determine whether a threat behavior can be matched.

9. The device according to claim 8, characterized in that The source to be analyzed determining unit is further configured to convert the disassembled code into a pseudo code, and determine the pseudo code as the source to be analyzed.

10. The device according to claim 7, characterized in that The file type of the unknown file is a script file; The to-be-analyzed source determination unit is specifically configured to obtain script content in the script file and determine the script content as the to-be-analyzed source; The threat analysis unit is specifically used to perform algorithm matching on the algorithm contained in the script content based on pre-generated algorithm detection rules. If an algorithm match exists, the algorithm contained in the script content is restored and it is determined whether there is an encrypted threat file, and the matched threat behavior is determined based on the threat file.

11. The device according to claim 7, characterized in that The file type of the unknown file is a process characteristic analysis software package file; The to-be-analyzed source determination unit is specifically configured to obtain the flow included in the process characteristic analysis software package file, and determine the flow as the to-be-analyzed source; The threat analysis unit is specifically used to restore the traffic based on the pre-generated snort rules, and determine whether there is a threat behavior based on the restored traffic.

12. The device according to any one of claims 7 to 11, characterized in that: The threat analysis unit is further configured to determine the attack technology points corresponding to the matched threat behaviors after determining that the threat behaviors are matched, and determine the matched threat behaviors and the corresponding attack technology points as the threat analysis results.

13. A computing device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.

14. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 6.

Images