A method, device, electronic device and storage medium for defending against malicious programs

Abstract

The embodiment of the present application provides a malicious program defense method, device, electronic device and storage medium, wherein the method includes: obtaining a malicious application; moving the malicious application to a security sandbox for operation, obtaining basic information of the malicious application; generating an attack chain based on the basic information; obtaining communication data of the malicious application; obtaining the attack intent corresponding to the malicious application based on the communication data and the attack chain; obtaining a defense plan based on the attack intent; and performing defense according to the defense plan. In the embodiment of the present application, by providing different defense plans for different attack intentions and performing defense according to the defense plan, it is possible to maximize the retention of the working capacity of the device while protecting the device.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a malicious program defense method, device, electronic device and computer-readable storage medium. Background Art

[0002] With the rapid development of information technology and the Internet, the boundaries of national security have transcended the limitations of geographic space and expanded to the Internet. Cybersecurity has become an important issue concerning national security. At present, non-traditional cybersecurity threats such as Trojan botnets and phishing websites are increasing, and new types of cyber attacks such as distributed denial of service (DDOS) and advanced persistent threats (APT) are becoming more and more severe. The scope and content of cybersecurity threats are constantly expanding and evolving, and the cybersecurity situation and challenges are becoming increasingly severe and complex.

[0003] The existing malware defense technology cannot further identify the attack intention of the malicious program and cannot further provide a defense solution. Summary of the invention

[0004] The purpose of the embodiments of the present application is to provide a malicious program defense method, device, electronic device and storage medium, which can identify malicious programs.

[0005] The present invention provides a method for defending against malicious programs, the method comprising:

[0006] Get malicious apps;

[0007] Moving the malicious application to a security sandbox for execution, and obtaining basic information of the malicious application;

[0008] Generate an attack chain according to the basic information;

[0009] Obtaining communication data of the malicious application;

[0010] Acquire the attack intention corresponding to the malicious application according to the communication data and the attack chain;

[0011] Obtaining a defense plan based on the attack intent;

[0012] Perform defense according to the defense plan.

[0013] In the above implementation process, the malicious program is first obtained. In order to ensure that the malicious program does not have other harmful effects on the computer, the malicious program is analyzed at the same time, and the malicious program is moved to the sandbox for operation. On this basis, the basic information of the malicious program can be obtained. At the same time, the communication data of the malicious program is further obtained. Based on the communication data and the basic information of the malicious program obtained above, the attack intention of the malicious program can be obtained. With the attack intention of the malicious program, the relevant defense plan can be obtained according to the attack intention, and the device can be defended according to the defense plan. In the prior art, different malicious programs are usually defended with the same defense plan. Although this defense method can protect the device, it almost limits all the working capabilities of the device and reduces the working ability of the device. The present application provides different defense plans for different attack intentions, and defense is carried out according to the defense plan. It can protect the device while maximizing the retention of the working ability of the device.

[0014] Furthermore, the step of moving the malicious application to a secure sandbox for execution includes:

[0015] Using a multi-mode matching algorithm to match the application with the Yara rule base to obtain a matching result;

[0016] If the matching result is yes, processing the malicious program;

[0017] If the matching result is no, the malicious application is moved to a secure sandbox for execution.

[0018] In the above implementation process, a multi-mode matching algorithm is used to match the malicious application with the Yara rule library to obtain a matching result, and the malicious application is disposed of according to the matching result. The Yara rule library includes multiple behaviors based on the collected malicious programs. Matching the malicious program with the Yara rule library can improve the accuracy of identifying the malicious program and identify whether the malicious application is a known malicious application. If it is not a known malicious application, the malicious application is moved to the sandbox to run to prevent harm to the device.

[0019] Furthermore, after the step of generating an attack chain according to the basic information, the method further includes:

[0020] Obtain key information corresponding to the attack chain;

[0021] Comparing the key information with key information of malicious applications in a known attack chain to obtain a comparison result;

[0022] If the comparison result is the same, the known attack chain is determined as the attack chain;

[0023] If the comparison result is different, the attack chain is stored.

[0024] In the above implementation process, the attack characteristics of the malicious program are more obviously reflected in the attack chain. Different malicious applications have different attack chains. In order to facilitate management and obtain defense solutions, the attack chain of the malicious application is compared with the attack chain of the known application to obtain a comparison result. If the comparison result is the same, it can be determined that the attack chain is the attack chain corresponding to the malicious application. If the comparison result is not the same, the attack chain is stored. Based on the above implementation, it is easy to manage malicious applications and to identify other malicious applications later.

[0025] Furthermore, after the step of generating an attack chain according to the basic information, the method further includes:

[0026] Obtaining multiple behaviors of the malicious application;

[0027] Matching the multiple behaviors of the malicious application with the multiple behaviors of the known attack chain in the known attack chain feature library to obtain the number of successful matches;

[0028] Obtaining a matching score according to the number of successful matches;

[0029] The attack chain is added to the known attack chain feature library according to the matching score.

[0030] In the above implementation process, different malicious applications have different behaviors. The known attack chain feature library stores multiple behaviors of multiple known attack chains. The multiple behaviors of the malicious program are matched with the multiple behaviors in the known attack chain in the known attack chain. The matching score is obtained according to the number of successful matches. According to the matching score, it can be determined whether the attack chain is a known attack chain in the known attack chain feature library. According to the matching score, the attack chain can also be added to the known attack chain feature library to expand the number of known attack chains in the known attack chain feature library, which is convenient for the subsequent identification of other malicious applications.

[0031] Further, after the step of obtaining the attack intention corresponding to the malicious application according to the communication data and the basic information, it also includes:

[0032] A portrait of the attacker is generated according to the attack intention and the attack chain.

[0033] In the above implementation process, the attacker portrait describes the attacker's behavioral characteristics, which can facilitate subsequent monitoring and analysis of the attacker based on the attack intention.

[0034] Furthermore, after the step of generating a portrait of the attacker according to the attack intention and the attack chain, the method further includes:

[0035] Matching the attacker's profile with the known attacker's profile in a known profile feature library to obtain a matching result;

[0036] According to the matching result, the attack

[0037] The portrait of the attacker is added to the portrait feature library.

[0038] In the above implementation process, the attacker's portrait is matched with the portraits of known attackers in the known portrait feature library, and the attacker's portrait is added to the portrait feature library according to the matching result, which is conducive to expanding the capacity of the attacker's portrait feature library and improving the subsequent malicious program identification efficiency.

[0039] Furthermore, the step of matching the attacker's portrait with the known attacker's portrait in the known portrait feature library to obtain a matching result includes:

[0040] Matching the attack chain corresponding to the malicious application with the attack chain corresponding to the portrait of the known attacker to obtain the number of successful matches;

[0041] Obtaining a matching score according to the number of successful matches;

[0042] The step of adding the attacker's portrait to the portrait feature library according to the matching result includes:

[0043] The attacker's portrait is added to the known portrait feature library according to the matching score.

[0044] In the above implementation process, the attack chains of the same attacker are similar. Therefore, in order to determine whether the attacker's portrait corresponding to the malicious program is the portrait of a known attacker in the portrait feature library, the attack chain corresponding to the malicious program and the attack chain corresponding to the portrait of the known attacker can be matched, and the matching score can be obtained according to the matching result. According to the number of matching roots, the attacker's portrait corresponding to the malicious program is added to the known portrait feature library.

[0045] In a second aspect, an embodiment of the present application provides a malicious program defense device, the device comprising:

[0046] A malicious application acquisition module, used to acquire malicious applications;

[0047] A basic information acquisition module, used to move the malicious application to a security sandbox for execution and obtain basic information of the application;

[0048] An attack chain generation module, used to generate an attack chain according to the basic information;

[0049] A communication data acquisition module, used to acquire the communication data of the application;

[0050] An attack intention acquisition module, used to acquire the attack intention corresponding to the malicious application according to the communication data and the attack chain;

[0051] The defense module is used to recommend a defense plan according to the attack intention; and to perform defense according to the defense plan.

[0052] In the above implementation process, the malicious application acquisition module first acquires the malicious program. In order to ensure that the malicious program does not have other harmful effects on the computer, the basic information acquisition module analyzes the malicious program at the same time and moves the malicious program to the sandbox for operation. On this basis, the basic information of the malicious program can be obtained. At the same time, the communication data acquisition module further acquires the communication data of the malicious program. Based on the communication data and the basic information of the malicious program obtained above, the attack intention acquisition module can obtain the attack intention of the malicious program. With the attack intention of the malicious program, the defense module can obtain the relevant defense plan according to the attack intention, and the device can be defended according to the defense plan. In the prior art, different malicious programs are usually defended by the same defense plan. Although this defense method can protect the device, it almost limits all the working capabilities of the device and reduces the working capabilities of the device. The present application provides different defense plans for different attack intentions, and defends according to the defense plan, which can maximize the working capabilities of the device while protecting the device.

[0053] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of the first aspects when executing the computer program.

[0054] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in any one of the first aspects.

[0055] In a fifth aspect, an embodiment of the present application provides a computer program product, which, when running on a computer, enables the computer to execute the method as described in any one of the first aspects.

[0056] Other features and advantages disclosed in the present application will be described in the following description, or some features and advantages can be inferred or determined without doubt from the description, or can be learned by implementing the above-mentioned technology disclosed in the present application.

[0057] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 A method for defending against malicious programs provided in an embodiment of the present application;

[0060] Figure 2 A schematic diagram of the composition of a malicious program defense device provided in an embodiment of the present application;

[0061] Figure 3 A schematic diagram of the composition of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0063] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0064] Example 1

[0065] See also Figure 1 The embodiment of the present application provides a method for defending against malicious programs, the method comprising:

[0066] S1: Get malicious applications;

[0067] S2: Move the malicious application to the security sandbox for execution and obtain basic information of the malicious application;

[0068] S3: Generate an attack chain based on basic information;

[0069] S4: Obtain communication data of malicious applications;

[0070] S5: Obtain the attack intention corresponding to the malicious application based on the communication data and attack chain;

[0071] S6: Obtain defense solutions based on attack intent;

[0072] S7: Defend according to the defense plan.

[0073] In the above embodiments, different defense schemes have different impacts on the working ability of the device.

[0074] The communication data includes the communication data of the malicious application and multiple software of the device. The attack intentions include: commercial data theft, national espionage, "jumpboard", and intranet roaming.

[0075] Basic information includes the type and hash of malicious programs. In addition, the security sandbox can also obtain behavioral information of malicious programs, including key system functions called by malicious programs, running processes, existing external behaviors, etc.

[0076] Different defense schemes have different interception strategies and detection strategies, and different defense strategies have different impacts on the working ability of the device. A scheme with a stronger defense strength has a greater impact on the working ability of the device, while a scheme with a weaker defense strength has a smaller impact on the working ability of the device. For attack intentions that will cause more serious consequences, a defense strategy with a stronger defense strength can be adopted. For attack intentions that will cause less serious consequences, a defense strategy with a weaker defense strength can be adopted to intercept the malicious program.

[0077] In the above embodiment, the malicious program is first obtained. In order to ensure that the malicious program does not have other harmful effects on the computer, the malicious program is analyzed at the same time, and the malicious program is moved to the sandbox for operation. On this basis, the basic information of the malicious program can be obtained. At the same time, the communication data of the malicious program is further obtained. Based on the communication data and the basic information of the malicious program obtained above, the attack intention of the malicious program can be obtained. With the attack intention of the malicious program, the relevant defense plan can be obtained according to the attack intention, and the device can be defended according to the defense plan. In the prior art, different malicious programs are usually defended with the same defense plan. Although this defense method can protect the device, it almost limits all the working capabilities of the device and reduces the working capability of the device. The present application provides different defense plans for different attack intentions, and defense is carried out according to the defense plan, which can maximize the working capability of the device while protecting the device.

[0078] In a possible implementation, the attack intention may also be obtained based on the basic information of the attacked party, including the area where the attacked party is located, the industry, whether there is commercial / political value, etc.

[0079] In a possible implementation, S2 includes the following sub-steps:

[0080] Use the multi-mode matching algorithm to match the application and the Yara rule base to obtain the matching result;

[0081] If the matching result is yes, the malicious program is processed;

[0082] If the matching result is negative, the malicious application is moved to a secure sandbox for execution.

[0083] In the above embodiment, a multi-mode matching algorithm is used to match the malicious application with the Yara rule library to obtain a matching result, and the malicious application is disposed of according to the matching result. The Yara rule library includes multiple behaviors based on the collected malicious programs. Matching the malicious program with the Yara rule library can improve the accuracy of identifying the malicious program and identify whether the malicious application is a known malicious application. If it is not a known malicious application, the malicious application is moved to the sandbox to run to prevent harm to the device.

[0084] The security sandbox will record the program's behavior and basic information (program type, hash and other basic features), including which key functions are called, which processes are running, and whether there are any external connections.

[0085] The basic information and detailed behavior information obtained through the security sandbox are combined with the behavior feature library (various functional units of the system, such as the command prompt, which indicates that the command prompt command is called and the command line operation is executed) for analysis to determine whether the program has attack features. If so, further data collection and analysis are performed to generate an attack chain and Yara rule feature library. If not, security identification is performed.

[0086] In a possible implementation, after S3, the method further includes the following steps:

[0087] Obtain key information corresponding to the attack chain;

[0088] Compare the key information with the key information of the malicious application in the known attack chain to obtain a comparison result;

[0089] If the comparison results are the same, the known attack chain is determined as the attack chain;

[0090] If the comparison result is different, the attack chain will be stored.

[0091] In the above embodiment, the key information includes: C2 server, customized framework, attacker's iconic icon / term / string, etc.

[0092] The attack characteristics of malicious applications are more clearly reflected in the attack chain. Different malicious applications have different attack chains. In order to facilitate management and obtain defense solutions, the attack chain of the malicious application is compared with the attack chain of the known application to obtain a comparison result. If the comparison result is the same, it can be determined that the known attack chain is the attack chain corresponding to the malicious application. If the comparison result is not the same, the attack chain is stored. Based on the above implementation, it is easy to manage malicious applications and to identify other malicious applications later.

[0093] In a possible implementation, after the step of generating an attack chain according to the basic information, the method further includes:

[0094] Get multiple behaviors of malicious applications;

[0095] Matching multiple behaviors of the malicious application with multiple behaviors of known attack chains in a known attack chain signature library to obtain the number of successful matches;

[0096] Get the matching score based on the number of successful matches;

[0097] The attack chain is added to the known attack chain feature library based on the matching score.

[0098] In the above implementation process, different malicious applications have different behaviors. The known attack chain feature library stores multiple behaviors of multiple known attack chains. The multiple behaviors of the malicious program are matched with the multiple behaviors in the known attack chain in the known attack chain. The matching score is obtained according to the number of successful matches. According to the matching score, it can be determined whether the attack chain is a known attack chain in the known attack chain feature library. According to the matching score, the attack chain can also be added to the known attack chain feature library to expand the number of known attack chains in the known attack chain feature library, which is convenient for the subsequent identification of other malicious applications.

[0099] In a possible implementation manner, after the step of obtaining the attack intention corresponding to the malicious application according to the communication data and the basic information, the method further includes:

[0100] Generate a portrait of the attacker based on the attack intention and attack chain.

[0101] In the above implementation process, the attacker portrait describes the attacker's behavioral characteristics, which can facilitate subsequent monitoring and analysis of the attacker based on the attack intention.

[0102] Exemplarily, by obtaining one or more attack chains, analyzing the C2 command and control program and communication data used by the attacker, combining the basic information of the attacked party (such as: region, industry, whether there is commercial / political value, etc.) and the attack intention, a portrait of the attacker is generated.

[0103] In a possible implementation, after the step of generating a portrait of the attacker according to the attack intention and the attack chain, the method further includes:

[0104] Match the attacker's profile with the known attacker's profile in the known profile feature library to obtain a matching result;

[0105] The attacker's portrait is added to the portrait feature library based on the matching results.

[0106] In the above implementation process, the attacker's portrait is matched with the portraits of known attackers in the known portrait feature library, and the attacker's portrait is added to the portrait feature library according to the matching result, which is conducive to expanding the capacity of the attacker's portrait feature library and improving the subsequent malicious program identification efficiency.

[0107] Furthermore, the step of matching the attacker's profile with the known attacker's profile in the known profile feature library to obtain a matching result includes:

[0108] Match the attack chain corresponding to the malicious application with the attack chain corresponding to the known attacker's profile to obtain the number of successful matches;

[0109] Get the matching score based on the number of successful matches;

[0110] The steps of adding the attacker's profile to the profile feature library according to the matching results include:

[0111] The attacker's profile is added to the known profile feature library based on the matching score.

[0112] In the above implementation process, the attack chains of the same attacker are similar. Therefore, in order to determine whether the attacker's portrait corresponding to the malicious program is the portrait of a known attacker in the portrait feature library, the attack chain corresponding to the malicious program and the attack chain corresponding to the portrait of the known attacker can be matched, and the matching score can be obtained according to the matching result. According to the number of matching roots, the attacker's portrait corresponding to the malicious program is added to the known portrait feature library.

[0113] In a possible implementation, the known attacker feature library and the attacker's portrait can also be matched in the following manner: Using the attacker's portrait key information as a reference: If the attacker's portrait uses the same key information as the known attacker's portrait (such as: C2 server, customized framework, attacker's iconic icon / term / string, etc.), then call the known information of the attacker's portrait. Based on the known attacker's portrait, the known attacker's portrait can be used for analysis to further determine the defense plan.

[0114] Example 2

[0115] See also Figure 2 , an embodiment of the present application provides a malicious program defense device, the device comprising:

[0116] Malicious application acquisition module 1, used to acquire malicious applications;

[0117] Basic information acquisition module 2, used to move the malicious application to the security sandbox for operation and obtain basic information of the application;

[0118] Attack chain generation module 3, used to generate an attack chain according to basic information;

[0119] Communication data acquisition module 4, used to acquire the communication data of the application;

[0120] Attack intention acquisition module 5, used to obtain the attack intention corresponding to the malicious application according to the communication data and the attack chain;

[0121] The defense module 6 is used to recommend a defense plan according to the attack intention and to perform defense according to the defense plan.

[0122] In the above implementation process, the malicious application acquisition module 1 first acquires the malicious program. In order to ensure that the malicious program does not have other harmful effects on the computer, the basic information acquisition module 2 analyzes the malicious program at the same time and moves the malicious program to the sandbox for operation. On this basis, the basic information of the malicious program can be obtained. At the same time, the communication data acquisition module 4 further acquires the communication data of the malicious program. Based on the communication data and the basic information of the malicious program obtained above, the attack intention acquisition module 5 can obtain the attack intention of the malicious program. With the attack intention of the malicious program, the defense module 6 can obtain the relevant defense plan according to the attack intention, and the device can be defended according to the defense plan. In the prior art, different malicious programs are usually defended by the same defense plan. Although this defense method can protect the device, it almost limits all the working capabilities of the device and reduces the working capabilities of the device. The present application provides different defense plans for different attack intentions, and defense is carried out according to the defense plan, which can maximize the working capabilities of the device while protecting the device.

[0123] In a possible implementation, the basic information acquisition module 2 is also used to match the application with the Yara rule library using a multi-mode matching algorithm to obtain a matching result; if the matching result is yes, the malicious program is processed; if the matching result is no, the malicious application is moved to a secure sandbox for execution.

[0124] In a possible implementation, the device also includes an attack chain storage module, which is used to obtain key information corresponding to the attack chain; compare the key information with the key information of the malicious application of the known attack chain to obtain a comparison result; if the comparison result is the same, determine the known attack chain as the attack chain; if the comparison result is not the same, store the attack chain.

[0125] In a possible implementation, the attack chain storage module is also used to obtain multiple behaviors of the malicious application;

[0126] Match multiple behaviors of the malicious application with multiple behaviors of a known attack chain in a known attack chain signature library to obtain the number of successful matches; obtain a matching score based on the number of successful matches; and add the attack chain to the known attack chain signature library based on the matching score.

[0127] In a possible implementation, the device further includes an attacker portrait generation module, which is used to generate an attacker portrait according to the attack intention and the attack chain.

[0128] In a possible implementation, the attacker portrait storage module is used to match the attacker's portrait with the known attacker portraits in a known portrait feature library to obtain a matching result; and add the attacker's portrait to the portrait feature library according to the matching result.

[0129] In a possible implementation, the attacker portrait storage module is also used to match the attack chain corresponding to the malicious application with the attack chain corresponding to the portrait of a known attacker to obtain the number of successful matches; obtain a matching score based on the number of successful matches; and add the attacker's portrait to the portrait feature library based on the matching result, comprising: adding the attacker's portrait to the known portrait feature library based on the matching score.

[0130] Example 3

[0131] This application also provides an electronic device, see Figure 3 , Figure 3 A block diagram of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 31, a communication interface 32, a memory 33, and at least one communication bus 34. The communication bus 34 is used to realize direct connection and communication between these components. The communication interface 520 of the electronic device in the embodiment of the present application is used to communicate signaling or data with other node devices. The processor 31 may be an integrated circuit chip with signal processing capabilities.

[0132] The processor 31 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor 31 can also be any conventional processor, etc.

[0133] The memory 33 may be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable read-only memory (EEPROM), etc. The memory 33 stores computer-readable instructions, and when the computer-readable instructions are executed by the processor 31, the electronic device may execute the various steps involved in the above method embodiment.

[0134] Optionally, the electronic device may further include a storage controller and an input / output unit.

[0135] The memory 33, storage controller, processor 31, peripheral interface, input and output unit components are directly or indirectly electrically connected to each other to achieve data transmission or interaction. For example, these components can be electrically connected to each other via one or more communication buses 34. The processor 31 is used to execute executable modules stored in the memory 33, such as software function modules or computer programs included in the electronic device.

[0136] The input and output unit is used to provide users with the task creation and to create an optional time period or preset execution time for the task to enable interaction between the user and the server. The input and output unit can be, but is not limited to, a mouse and a keyboard.

[0137] Understandably, Figure 3 The structure shown is for illustration only. The electronic device may also include Figure 3 More or fewer components as shown, or with Figure 3 Different configurations shown. Figure 3 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0138] The embodiment of the present application also provides a storage medium having instructions stored thereon. When the instructions are run on a computer, the method of the method embodiment is implemented when the computer program is executed by a processor. To avoid repetition, it will not be described again here.

[0139] The present application also provides a computer program product. When the computer program product is run on a computer, the computer executes the method of the method embodiment.

[0140] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and a part of the module, program segment or code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0141] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0142] If the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc., and other media that can store program codes.

[0143] The above are only embodiments of the present application and are not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

[0144] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0145] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

Claims

1. A method for defending against malicious programs, characterized in that: include: Get malicious apps; Moving the malicious application to a security sandbox for execution, and obtaining basic information of the malicious application; Generate an attack chain according to the basic information; Obtaining communication data of the malicious application; Acquire the attack intention corresponding to the malicious application according to the communication data and the attack chain; Obtaining a defense plan based on the attack intent; Conduct defense according to the defense plan; And, the step of moving the malicious application to a secure sandbox for execution includes: Using a multi-mode matching algorithm to match the application with the Yara rule base to obtain a matching result; If the matching result is yes, processing the malicious program; If the matching result is no, moving the malicious application to a secure sandbox for execution; And, after the step of generating an attack chain according to the basic information, the method further includes: Obtain key information corresponding to the attack chain; Comparing the key information with key information of malicious applications in a known attack chain to obtain a comparison result; If the comparison result is the same, the known attack chain is determined as the attack chain; If the comparison result is different, the attack chain is stored.

2. The method for defending against malicious programs according to claim 1, characterized in that: After the step of generating an attack chain according to the basic information, the method further includes: Obtaining multiple behaviors of the malicious application; Matching the multiple behaviors of the malicious application with the multiple behaviors of the known attack chain in the known attack chain feature library to obtain the number of successful matches; Obtaining a matching score according to the number of successful matches; The attack chain is added to the known attack chain feature library according to the matching score.

3. The malware defense method according to claim 1, characterized in that: After the step of obtaining the attack intention corresponding to the malicious application according to the communication data and the basic information, the method further includes: A portrait of the attacker is generated according to the attack intention and the attack chain.

4. The method for defending against malicious programs according to claim 3, characterized in that: After the step of generating a portrait of the attacker according to the attack intention and the attack chain, the method further includes: Matching the attacker's profile with the known attacker's profile in a known profile feature library to obtain a matching result; The attacker's portrait is added to the portrait feature library according to the matching result.

5. The method for defending against malicious programs according to claim 4, characterized in that: The step of matching the attacker's portrait with the known attacker's portrait in the known portrait feature library to obtain a matching result includes: Matching the attack chain corresponding to the malicious application with the attack chain corresponding to the portrait of the known attacker to obtain the number of successful matches; Obtaining a matching score according to the number of successful matches; The step of adding the attacker's portrait to the portrait feature library according to the matching result includes: The attacker's portrait is added to the known portrait feature library according to the matching score.

6. A malicious program defense device, characterized in that: include: A malicious application acquisition module, used to acquire malicious applications; A basic information acquisition module, used to move the malicious application to a security sandbox for execution and obtain basic information of the application; An attack chain generation module, used to generate an attack chain according to the basic information; A communication data acquisition module, used to acquire the communication data of the application; An attack intention acquisition module, used to acquire the attack intention corresponding to the malicious application according to the communication data and the attack chain; A defense module, used for recommending a defense plan according to the attack intention; Conduct defense according to the defense plan; And, the step of moving the malicious application to a secure sandbox for execution includes: Using a multi-mode matching algorithm to match the application with the Yara rule base to obtain a matching result; If the matching result is yes, processing the malicious program; If the matching result is no, moving the malicious application to a secure sandbox for execution; And, after the step of generating an attack chain according to the basic information, it is also used to: Obtain key information corresponding to the attack chain; Comparing the key information with key information of malicious applications in a known attack chain to obtain a comparison result; If the comparison result is the same, the known attack chain is determined as the attack chain; If the comparison result is different, the attack chain is stored.

7. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the malicious program defense method as described in any one of claims 1 to 5 when executing the computer program.

8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a computer, the computer is caused to execute the malicious program defense method according to any one of claims 1 to 5.

Images