Host loss detection method, device, electronic device and storage medium

Abstract

The embodiment of the present invention discloses a host compromise detection method, device and electronic device, which relate to the field of network security technology. The method comprises: obtaining asset operation data generated on a first host; the asset operation data carries a data type identification feature; performing a war technology labeling process on the asset operation data according to the data type identification feature and a preset war technology public knowledge base rule to obtain a corresponding war technology matrix diagram; and determining whether the first host is a compromised host based on the war technology matrix diagram analysis. The present invention can improve the reliability of host compromise detection to a certain extent, and is suitable for scenarios of safe monitoring of the operating status of electronic equipment such as computers and mobile phones.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a host compromise detection method, device, electronic device and storage medium. Background Art

[0002] With the development of cyberspace confrontation, the background, form and internal mechanism of cyberspace threats have undergone profound changes. Traditional methods of recognizing and analyzing threats to host assets can no longer effectively deal with threats.

[0003] For example, the current threat detection method for assets is mainly to use compromised beacons (Indicator of compromise, referred to as IOC) for detection, and then use intelligence analysis to tell defenders which beacons may be potential network threats after they appear based on compromised cases. However, compromised beacons, such as sample hashes, IP addresses, and domain names, are easy to change, and attackers can change them without much cost. Once the compromised beacons are changed, it may be difficult to reliably detect whether the host is under threat. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a host failure detection method, device and electronic device, which can improve the reliability of host failure detection to a certain extent.

[0005] In order to achieve the above-mentioned invention object, the following technical scheme is adopted:

[0006] In a first aspect, an embodiment of the present invention provides a host compromise detection method, the method comprising the steps of: acquiring asset operation data generated on a first host; the asset operation data carries a data type identification feature; performing combat technology labeling on the asset operation data according to the data type identification feature and a preset combat technology public knowledge base rule to obtain a corresponding combat technology matrix diagram; and determining whether the first host is a compromised host based on analysis of the combat technology matrix diagram.

[0007] In combination with the first aspect, in a first implementation of the first aspect,

[0008] The preset war technology public knowledge base is the ATT&CK knowledge base;

[0009] The performing war technology labeling processing on the asset operation data according to the data type identification feature and the preset war technology public knowledge base rules to obtain the corresponding war technology matrix diagram includes: matching the data type identification feature with the ATT&CK knowledge base to determine whether the operation data is security event data;

[0010] If it is determined to be security incident data, the security incident is described in a strategic and technical labeling matrix using the rules of the ATT&CK knowledge base, and it is determined that the security incident corresponds to the strategic and technical identity code in the ATT&CK knowledge base.

[0011] In combination with the first aspect and the first implementation manner of the first aspect, in the second implementation manner of the first aspect,

[0012] The step of performing war technology labeling on the asset operation data according to the data type identification feature and the preset war technology public knowledge base rules to obtain the corresponding war technology matrix diagram further includes: after performing war technology labeling matrix description on the security incident using the rules of the ATT&CK knowledge base, determining the corresponding war technology label weight using the rules of the ATT&CK knowledge base according to the obtained application environment information of the first host and the result of performing war technology labeling matrix description on the security incident;

[0013] According to the obtained label matrix description result of the security event and the corresponding combat technology label weight, the label distribution is analyzed to obtain the corresponding combat technology matrix diagram of the first host.

[0014] In combination with the first aspect, the first and second implementations of the first aspect, in a third implementation of the first aspect,

[0015] Determining the corresponding war technology label weight using the rules of the ATT&CK knowledge base includes: determining the war technology label of the security event as the corresponding alarm level according to the confidence of the security event and war technology mapping relationship included in the ATT&CK knowledge base and the degree of detail of the preset security event detection rules;

[0016] Determine the weight of the corresponding combat technology tag according to the application environment information of the first host and the alarm level;

[0017] The determining whether the first host is a compromised host based on the analysis of the combat technology matrix diagram includes:

[0018] Counting the weight, quantity and / or type of the combat technology label corresponding to the first host based on the combat technology matrix diagram;

[0019] If the combat technology tag corresponding to the first host has multiple tags of the first weight, the first host is determined to be a suspected compromised host; or,

[0020] If the number of the combat technology tags corresponding to the first host exceeds the preset tag number threshold, the first host is determined to be a suspected compromised host; or,

[0021] If the type of the combat technology tag corresponding to the first host exceeds a preset tag category threshold, the first host is determined to be a suspected compromised host.

[0022] In combination with the first aspect, the first, second and third implementation modes of the first aspect, in a fourth implementation mode of the first aspect, the asset operation data includes: process behavior data, file access data, system operation data and network traffic data.

[0023] In combination with the first aspect, the first, second, third and fourth implementation manners of the first aspect, in a fifth implementation manner of the first aspect, the asset operation data includes first process behavior data;

[0024] After obtaining the corresponding battle technology matrix diagram, the method further includes: if the first process behavior data triggers an alarm, tracing back to the process tree corresponding to the first process behavior data;

[0025] According to the combat technology matrix diagram, obtain the combat technology tags attached to all processes on the corresponding process tree;

[0026] According to the combat technology tags attached to all processes on the process tree, it is analyzed whether the process tree is a compromised attack chain.

[0027] In combination with the first aspect, the first, second, third, fourth and fifth implementation modes of the first aspect, in a sixth implementation mode of the first aspect, the method further comprises: acquiring asset operation data generated on a second host; the second host and the first host are in the same local area network, and the asset operation data is process behavior data;

[0028] After determining that the first host is a compromised host, determining whether the first host has a process accessing a second host according to process behavior data of the first host;

[0029] If yes, determine the weight, quantity and / or type of the combat technology tag corresponding to the second host according to the detected combat technology information and summary of the second host;

[0030] Determining whether the second host is a compromised host according to the weight, quantity and / or type of the combat technology tag corresponding to the second host;

[0031] According to the determination result of whether the second host is a compromised host, it is determined whether the attack on the first host is a lateral movement attack.

[0032] In combination with the first aspect, any one of the first to sixth implementation modes of the first aspect, in a seventh implementation mode of the first aspect, after obtaining the corresponding combat technology matrix diagram or the process tree with attached technical and tactical labels, the method further includes: obtaining a detection index of a hit combat technology rule as an input parameter; the input parameter includes: asset operation data type, event occurrence time information, attack weapon, attack implementation object and attack result;

[0033] The input parameters are input into a preset combat technology scenario description model to obtain a scenario description statement of the attack event identified by each type of combat technology label.

[0034] In a second aspect, an embodiment of the present invention further provides a host compromise detection device, the device comprising: a first acquisition program module, used to acquire asset operation data generated on a first host; the asset operation data carries a data type identification feature; a detection program module, used to perform combat technology labeling on the asset operation data according to the data type identification feature and preset combat technology public knowledge base rules to obtain a corresponding combat technology matrix diagram; an analysis program module, used to determine whether the first host is a compromised host based on the combat technology matrix diagram analysis.

[0035] In a third aspect, an embodiment of the present invention provides an electronic device, comprising: one or more processors; a memory; one or more executable programs are stored in the memory, and the one or more processors read the executable program code stored in the memory to run the program corresponding to the executable program code, so as to execute any of the methods described in the first aspect.

[0036] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement any method described in the first aspect.

[0037] The host compromise detection method, device, electronic device and storage medium provided by the embodiment of the present invention obtains the asset operation data generated on the first host; the asset operation data carries a data type identification feature; the asset operation data is subjected to a TTP (Tactical Technology Perception Score) labeling process according to the data type identification feature and the preset TTP public knowledge base rules to obtain a corresponding TTP matrix diagram; based on the TTP matrix diagram, it is possible to reliably analyze and determine whether the first host is a compromised host. Since the asset operation data is subjected to TTP labeling process according to the data type identification feature of the asset operation data and the preset TTP public knowledge base rules, the attacker's TTPs matrix diagram can be obtained, and once the attacker's TTPs are identified and defended accordingly, it is very difficult for the attacker to change it, thereby improving the reliability of host compromise detection to a certain extent.

[0038] Furthermore, since the attacker's TTPs are discovered, it increases the difficulty for them to change their attack tactics, techniques, and attack processes, which in turn provides a time window for defenders to defend, which is beneficial to ensuring the security of the host operating environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 It is a flowchart of an embodiment of a host loss detection method of the present invention;

[0041] Figure 2 It is a flowchart of another embodiment of the host loss detection method of the present invention;

[0042] Figure 3 It is a flowchart of another embodiment of the host loss detection method of the present invention;

[0043] Figure 4 A process tree for applying the host compromise detection method of the present invention to detect multiple hosts in a local area network;

[0044] Figure 5 This is a schematic block diagram of the architecture of an embodiment of a host loss detection device of the present invention;

[0045] Figure 6 It is a schematic block diagram of another embodiment of the host loss detection device of the present invention;

[0046] Figure 7It is a schematic block diagram of another embodiment of the host loss detection device of the present invention;

[0047] Figure 8 The figure is a schematic diagram of the structure of an embodiment of the electronic device of the present invention. DETAILED DESCRIPTION

[0048] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0049] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0050] Figure 1 FIG. 1 is a flow chart of an embodiment of a host failure detection method of the present invention; Figure 1 As shown, the host compromise detection method provided by the embodiment of the present invention can be applied to the security monitoring scenario of the operating status of electronic devices such as computers and mobile phones, and is used to detect whether there is a threat to the host; it should be noted that the method can be solidified in a certain manufactured product in the form of software, and when the user uses the product, the method flow of the present application can be reproduced.

[0051] For example, the host compromise detection method provided in this embodiment is installed in the form of application software on computers, mobile phones and other electronic devices. When the user triggers the operation of the product on the computer or mobile phone, the asset operation data generated on the computer and other electronic devices is obtained to detect whether the current electronic device has potential threats. The method previously solidified in the electronic product is mechanically reproduced, and the asset operation data is processed and analyzed according to the steps of the method to determine whether the current host has a security threat, that is, whether it has been compromised, so as to take defensive measures.

[0052] The method of this embodiment can be applied to the security analysis and judgment scenario of the assets of a specific organization, enterprise, network, etc., so as to maintain the security of the assets of the specific organization, enterprise, network, etc. The method may include:

[0053] Step 110: Acquire asset operation data generated on the first host; the asset operation data carries a data type identification feature.

[0054] The asset operation data can be obtained through various asset operation logs; the data type identification feature is used to identify the asset operation data type, and the asset operation data type is, for example, process behavior data, network traffic data or file access data, etc. Furthermore, the data type identification feature is also used to identify the event content of the corresponding asset recorded in the asset operation data; for example, for process behavior data type asset operation data, the data type identification features it carries may include: process identifier (PID), event content created by the process, etc.; for network traffic data type asset operation data, the data type identification features it carries may include: source IP address, current host IP address, domain name, URL, hash value (also called hash value), network event content, etc.

[0055] 120. Perform combat technology labeling on the asset operation data according to the data type identification characteristics and preset combat technology public knowledge base rules to obtain a corresponding combat technology matrix diagram.

[0056] In this embodiment, the preset combat technology public knowledge base is a shared knowledge base that provides a large number of various types of TTPs (Tactics, Techniques, and Procedures), and can also be considered as a structured framework for describing confrontation tactics, techniques and procedures.

[0057] Specifically, step 120 is: determining the type of asset operation data and event content according to the data type identification feature; converting the event content into a tactical technology structured list using preset tactical technology public knowledge base rules; wherein the structured list is a matrix, the rows of the matrix are tactical elements, which are used to represent the tactical objectives that the attacker wants to achieve, and the columns are technical elements, which are used to represent the technical means used by the attacker to achieve the tactical objectives in the rows.

[0058] In this embodiment, by mining and refining meso-level tactical and technical data from the acquired micro-level data, the TTPs used by the attacker can be identified to a large extent. Since the attacker's TTPs are difficult to change, this is the greatest blow to the attacker, thereby improving the reliability of threat detection.

[0059] In order to facilitate the description of the event content in the acquired asset operation data, in some embodiments, a corresponding identity code (ID) can be established for each TTPS to uniquely identify the corresponding tactics, technology and process. In this way, the asset operation data can be labeled with tactics and technology, and after the asset operation data is abstracted and refined, it can be assigned a tactical technology identity code label. Since a mapping relationship is established between the tactical technology identity code label and the tactical technology, when the corresponding tactical intention and technology need to be obtained, it can be traced back from the preset tactical technology public knowledge base.

[0060] For example, for the monitored first process behavior data (Process Date), labeling is to add an identity code corresponding to a TTPS combat technique, such as adding the identity code 4688 to the first process behavior data. In this way, by using a preset combat technology public knowledge base, such as the ATT&CK knowledge base, to add combat technology labels to asset operation data, a common language for describing threat alerts is formed, such as using technical and tactical identity codes (generally numbers) to uniformly describe alerts, avoiding language barriers caused by different names for combat technologies among different personnel, enterprises or organizations, and affecting the collaborative ability of analysts, thereby facilitating collaborative analysis of threat events.

[0061] In some embodiments, the preset common technical knowledge base is the ATT&CK knowledge base (also known as the ATT&CK framework).

[0062] Before using the TTPs in the ATT&CK knowledge base to describe the threats found in the first host, it is necessary to obtain the relevant asset operation data of the first host as the underlying support; and the obtained asset operation data should be able to be identified as TTPs by the ATT&CK knowledge base. According to the data source ranking list of identifiable TTPs provided by ATT&CK, data such as process creation, process commands, and file monitoring account for a large proportion. Therefore, as an optional embodiment, the asset operation data includes: process behavior data, file access data, system operation data, and network traffic data.

[0063] The specific method of obtaining the asset operation data of the first host can utilize the SIEM (Security Information and Event Management) platform. For example, Sysmon, a lightweight system monitoring tool provided by Microsoft, can record various asset operation data such as process creation, file access, and network information through system services and drivers, and write and display the relevant information in the Windows log event.

[0064] It is understandable that since the SIEM (Security Information and Event Management) platform has a large amount of data and contains a lot of data that has no analytical value, the platform needs to extract security events that are of priority. Of course, these events are not necessarily malicious attacks, and there are also operations and maintenance managers such as Powershell and CMD who need to pay attention.

[0065] In order to filter out data that is valuable for analyzing host compromise or potential threats, the asset operation data is subjected to strategic labeling according to the data type identification features and preset strategic technology public knowledge base rules to obtain a corresponding strategic technology matrix diagram (step 120), including: matching the data type identification features with the ATT&CK knowledge base to determine whether the operation data is a security incident; if it is determined to be a security incident, the security incident is described in a strategic technology labeling matrix using the rules of the ATT&CK knowledge base, and determining that the security incident corresponds to the strategic technology identity identification code in the ATT&CK knowledge base.

[0066] Among them, the ATT&CK knowledge base can be used to add a layer of labels to the data. The generation of labels comes from the rules of the ATT&CK knowledge base. The rules of the ATT&CK knowledge base are the basis for the application of the ATT&CK knowledge base (framework). The rules of the ATT&CK knowledge base can be initially implemented and optimized based on the open source projects on github, such as sentinel-attack, sigma, sysmon-config, etc.; the SIEM platform can analyze the labeled data and then describe the analysis results.

[0067] In this embodiment, by combining rich data probes, taking advantage of the collected data, and then based on the ATT&CK knowledge base, the ability to discover unknown threats can be effectively improved.

[0068] In this embodiment, in order to distinguish the importance of an event, a label is needed to describe the meaning of the event. The purpose of the scheme in this embodiment is to identify potential threats or compromised hosts. Therefore, the TTPs identity code becomes the best label. Moreover, the tactics, techniques and processes used by the attacker can be obtained based on the label, which facilitates intuitive description and analysis of whether the first host has potential threats.

[0069] Step 130: Determine whether the first host is a compromised host based on the analysis of the combat technology matrix diagram.

[0070] In this embodiment, based on the asset operation data of the first host, the ATT&CK knowledge base is used to perform labeling processing to obtain the corresponding strategy and technology matrix diagram. According to the strategy and technology labels in the obtained strategy and technology matrix diagram, the current asset operation status of the first host can be traced and analyzed, that is, whether there is a potential threat and the degree of the threat, and then it can be determined whether the current first host is a compromised host.

[0071] In this embodiment, since the asset operation data is subjected to strategic technology labeling according to the data type identification characteristics of the asset operation data and the preset strategic technology public knowledge base rules, the attacker's TTPs matrix can be obtained. Once the attacker's TTPs are identified and defended accordingly, it is very difficult for the attacker to change them, thereby improving the reliability of host compromise detection to a certain extent.

[0072] Furthermore, since the attacker's TTPs are discovered, it increases the difficulty for them to change their attack tactics, techniques, and attack processes, which in turn provides a time window for defenders to defend, which is beneficial to ensuring the security of the host operating environment.

[0073] It is understandable that, depending on the application environment of the host, such as a server environment or a terminal environment, of course, the application environment may also include: the type of business provided by the host, such as banking business, personal business, etc. Correspondingly, there are generally two situations when analyzing tags and analyzing data. Some asset operation data is only for analysis reference, and some asset operation data means that attacks may be occurring within the enterprise.

[0074] Therefore, after adding the strategic technology label, the label can also be weighted and scored. In some embodiments, the strategic technology labeling processing of the asset operation data according to the data type identification characteristics and the preset strategic technology public knowledge base rules to obtain the corresponding strategic technology matrix diagram (step 120) also includes: after the security incident is described in the strategic technology labeling matrix using the rules of the ATT&CK knowledge base, the corresponding strategic technology label weight is determined using the rules of the ATT&CK knowledge base according to the application environment information of the first host obtained and the result of the strategic technology labeling matrix description of the security incident; according to the obtained labeling matrix description result of the security incident and the corresponding strategic technology label weight, the label distribution is analyzed to obtain the corresponding strategic technology matrix diagram of the first host.

[0075] In this embodiment, by combining the application environment information of the first host and then using the rules of the ATT&CK knowledge base to determine the corresponding combat technology label weight, the accuracy of the analysis results can be improved to a certain extent.

[0076] Specifically, the use of the rules of the ATT&CK knowledge base to determine the corresponding strategic technology label weight includes: determining the strategic technology label of the security event as the corresponding alarm level based on the confidence of the security event and strategic technology mapping relationship included in the ATT&CK knowledge base and the detailed level of the preset security event detection rules; determining the weight of the strategic technology label based on the application environment information of the first host and the corresponding alarm level.

[0077] The determining whether the first host is a compromised host based on the analysis of the combat technology matrix diagram includes:

[0078] Counting the weight, quantity and / or type of the combat technology label corresponding to the first host based on the combat technology matrix diagram;

[0079] If the combat technology tag corresponding to the first host has multiple tags with the first weight, the first host is determined to be a suspected compromised host.

[0080] Alternatively, if the number of the combat technology tags corresponding to the first host exceeds a preset tag number threshold, the first host is determined to be a suspected compromised host.

[0081] Alternatively, if the type of the combat technology tag corresponding to the first host exceeds a preset tag category threshold, the first host is determined to be a suspected compromised host.

[0082] The alarm levels can be divided into three categories: loss alarm, reference alarm, and audit information.

[0083] Among them, the loss alarm: an alarm with a very low false alarm rate and a high-risk behavior. Reference alarm: an alarm with a high-risk behavior with a false alarm, and a medium-risk alarm with a low false alarm rate. Audit information: an action that may be exploited by an attacker or may be operated by the user himself. Different alarm levels have different weights, with the loss alarm having the highest weight and the weights decreasing in order.

[0084] For example, Powershell is currently frequently used by attackers and is also one of the data sources that the host must audit in the terminal application environment; if the corresponding rule in the ATT&CK knowledge base is defined as follows: Image contains'powershell.exe', then the corresponding security event's war technology label is an audit information. The detection level of this detection rule is relatively rough, the warning level is relatively low, and the weight can be set smaller accordingly.

[0085] If the detection rule has more detailed features, it can be set as a reference alarm or even a failure alarm level, that is, the weight is higher.

[0086] For example, Image contains'powershell.exe'and CommandLine contains('-whidden'or'–Exec Bypass'or'-c'or'-Enc'or'–Nop'or'DownloadFile'). If the content of this rule is more detailed, the corresponding technical label of the security event can be a reference warning or even a compromise warning level, and the weight can be set larger accordingly.

[0087] In this embodiment, by determining the weight of the combat technology tag corresponding to the first host, for example, judging that the first host has multiple tags with high weights (a weight threshold can be set for comparison and determination), or the number of combat technology tags reaches a certain number, or the tag category covers multiple tactical intentions, a variety of judgment bases are provided for judging whether the first host is suspected of being compromised, and cross-judgment can also be performed, thereby improving the accuracy of the compromised host judgment.

[0088] It is understandable that for the first host's compromise detection, different application environments will also affect the weight of the combat technology label. In this embodiment, the accuracy of the host compromise detection can be improved by comprehensively determining the weight of the combat technology label based on the application environment information of the first host and the alarm level.

[0089] In addition, in this embodiment, by setting detection rules with different detection granularities and utilizing audit rules with a wide detection granularity, the detection coverage can be improved to prevent omissions in rule definitions that may cause some threat events to be bypassed, thereby potentially causing security threats.

[0090] In this embodiment, by determining weight scores for combat technology tags, the machine can automatically perform preliminary screening of combat technology tags and directly lock in existing events with high-risk alarm levels.

[0091] Furthermore, since early cyber threats were single-point, the threat recognition methods adopted for them were also single-point and discrete. With the iteration and upgrade of mesh threats, threat warning events may serve different stages and purposes in the same organization's attack operations, and have an inherent connection of front-and-back correlation and coordination and collaboration, that is, threats begin to show multi-point and continuous characteristics, such as Advanced Persistent Threat. If we still view and deal with each threat event in an isolated way, we will fall into a dilemma of having no clue and no way to start, and it will be difficult to effectively analyze the causes and consequences of the threat, see the opponent clearly, and understand the real harm, which will bring immeasurable damage to cyber security. Therefore, some traditional threat recognition methods and analysis means can no longer effectively deal with threats.

[0092] In order to solve the above problems and deal with the multi-point and continuous attack characteristics of threat events, see Figure 2 As shown, in some embodiments, the asset operation data includes first process behavior data; after obtaining the corresponding combat technology matrix diagram, the method further includes: 130a, if the first process behavior data triggers an alarm, tracing the process tree corresponding to the first process behavior data; 140a, obtaining the combat technology tags attached to all processes on the corresponding process tree according to the combat technology matrix diagram; 150a, analyzing whether the process tree is a compromised attack chain according to the combat technology tags attached to all processes on the process tree.

[0093] In this embodiment, when the first process behavior data triggers an alarm, the process tree of the alarm process can be traced. At this time, the TTP tags attached to all processes on the process tree can be used as data to analyze whether the process tree is a compromised attack chain. In this way, threats with different stages and different purposes on the attack chain in the attack operation, which have internal connections with previous and subsequent correlations and cooperation, can be discovered to effectively analyze the causes and consequences of the threats and implement targeted defense measures against them.

[0094] An example of analyzing whether a process tree is an attack chain can be: a. Whether there are multiple TTP tags with high weights on the process tree. If so, it can be determined that the process tree is a compromised attack chain. Or, b. Whether there are more than a preset threshold {Num} different TTP tags on the process tree. If so, it can also be determined that the process tree is a compromised attack chain. Of course, according to the process tree, many processes without combat technology tags will be found. These may be the detection points missed by the rules. By analyzing the nodes of these process trees, it can be determined whether the rules of the ATT&CK knowledge base need to be updated.

[0095] Specifically, determining whether the first host is a compromised host based on the analysis of the combat technology matrix (step 130) can be as follows: maintaining a combat technology matrix for each host, using the TTPs label on the host as data, and analyzing whether the host is a compromised host.

[0096] For example: according to the analysis of the combat technology matrix: a. whether there are multiple TTPs tags with higher weights on the host; b. whether there are more than the preset threshold {Num} different TTPs tags on the host; c. whether there are more than ${Num} different tactical intention tags on the host, etc.

[0097] See also Figure 3 As shown, in another optional embodiment, the method further includes: step 310, acquiring asset operation data generated on a second host; the second host and the first host are in the same local area network, and the asset operation data is process behavior data;

[0098] After determining that the first host is a compromised host, executing step 320, determining whether the first host has a process accessing a second host according to the process behavior data of the first host;

[0099] 330. If yes, determine the weight, quantity and / or type of the combat technology tag corresponding to the second host according to the detected combat technology information and summary of the second host.

[0100] Among them, the combat technology information and summary of the second host can also be obtained according to the method steps of determining the combat technology label corresponding to the first host, and the combat technology information and summary can be obtained from the combat technology matrix diagram of the second host, and then the weight and / or type of the combat technology label corresponding to the second host can be determined. For the sake of brevity, the method steps for obtaining the combat technology matrix diagram of the second host will not be repeated, and the method steps for obtaining the combat technology matrix diagram of the first host can be referred to.

[0101] 335. Determine whether the second host is a compromised host according to the weight, quantity and / or type of the combat technology tag corresponding to the second host;

[0102] 340. Determine whether the attack on the first host is a lateral movement attack based on the result of determining whether the second host is a compromised host.

[0103] Specifically, if there is a match, for example, pointing to the same attack war, technical label, it can be determined whether the attack on the first host is a lateral movement attack.

[0104] In this embodiment, after detecting that the first host is a compromised host, it is determined whether the first host has a process accessing other machines in the intranet, such as the second host, and the TTPs information and summary detected on the second host are displayed. Based on this information, it can be determined whether the current attack is a lateral movement attack.

[0105] For example, winrs is a means of lateral movement. It is found that the compromised host 10.50.10.100 is connected to the intranet host 10.50.10.105 through winrs. It is also found that the host 10.50.10.105 also has high-weighted tags T1003-Credential Dumping, T1060-Registry Run Keys / Startup Folder, and T1191-CMSTP. The current attack is judged to be a lateral movement attack, and the result of the lateral movement attack is successful.

[0106] In some other embodiments, after obtaining the corresponding combat technology matrix diagram or the process tree with attached technical and tactical tags, the method further includes: obtaining the detection index of the hit combat technology rule as an input parameter; the input parameter includes: asset operation data type, event occurrence time information, attack weapon, attack implementation object and attack result;

[0107] The input parameters are input into a preset combat technology scenario description model to obtain a scenario description statement of the attack event identified by each type of combat technology label.

[0108] See also Figure 4 As shown, for example, taking the process tree as an example, after tactically classifying the operations in each layer of the tree, the attack behavior of the process asset running data is described in a scenario-based manner in the form of a timeline as follows:

[0109] 2019 / 11 / 07 16:31:05 The process IJIurngei.exe uses the vulnerability CVE-2018-8120 to elevate privileges and run uziYaoqomsfT.exe. The process user is elevated from User to System, achieving the purpose of privilege escalation.

[0110] 2019 / 11 / 07 16:31:07 The process uziYaoqomsfT.exe connected to the remote domain name download.microUpdate.com, which was suspected to achieve the purpose of remote control;

[0111] 2019 / 11 / 07 16:31:15 The process uziYaoqomsfT.exe releases the file svchost.exe to achieve the purpose of camouflage;

[0112] 2019 / 11 / 07 16:31:18 The process svchost.exe connected to the remote domain name ginni.go0gle.com, which was suspected to achieve the purpose of remote control;

[0113] 2019 / 11 / 07 16:31:23 The process uziYaoqomsfT.exe runs the program cmd.exe to achieve the execution purpose;

[0114] 2019 / 11 / 07 16:31:24 The cmd.exe process runs the programs tasklist.exe, systeminfo.exe, net.exe, net1.exe, whoami.exe to achieve the purpose of discovery;

[0115] 2019 / 11 / 07 16:31:32 The cmd.exe process runs the mimi.exe program to access the lsass.exe process to obtain credentials;

[0116] 2019 / 11 / 07 16:32:03 The process cmd.exe runs the program winrs.exe to connect to the remote host 10.50.10.105. There are three high-weight tags T1060-Registry Run Keys / StartupFolder, T1003-Credential Dumping, and T1191-CMSTP on the target machine, which is suspected to have achieved the purpose of lateral movement.

[0117] In this embodiment, by adding more detailed and popular descriptions to each TTP tag as basic sentences for scenario description, and then combining them into a complete description of a scenario, a foundation for understanding is laid for security analysts to collaborate and form internal security intelligence for sharing.

[0118] According to the above public description, the technical solution provided in this embodiment processes the TTPs labels of the source data obtained based on the public knowledge base of attack and tactics such as the ATT&CK knowledge base to obtain an attack and tactics matrix diagram, which can effectively focus on data with analysis value; on this basis, analysis and tracing applications based on the ATT&CK knowledge base, including process tree analysis, label distribution analysis, intranet tracing, contextual scenario description and other solutions, can be carried out independently of each other, and can work together with each other to form a more innovative new solution for threat detection, discovery and analysis based on multi-source data, so as to achieve the purpose of discovering unknown threats and suspicious behaviors, seeing the internal correlation of threat events, and identifying the technical and tactical behaviors of attackers.

[0119] Embodiment 2

[0120] Figure 5 FIG. 1 is a schematic block diagram of an embodiment of a host failure detection device according to the present invention; Figure 5 As shown, the host loss detection device includes:

[0121] The first acquisition program module 210 is used to acquire asset operation data generated on the first host; the asset operation data carries a data type identification feature;

[0122] The detection program module 220 is used to perform combat technology labeling processing on the asset operation data according to the data type identification characteristics and the preset combat technology public knowledge base rules to obtain a corresponding combat technology matrix diagram;

[0123] The analysis program module 230 is used to determine whether the first host is a compromised host based on the analysis of the combat technology matrix diagram.

[0124] The device of this embodiment can be used to perform Figure 1The technical solution of the method embodiment shown and the device of this embodiment have similar implementation principles and technical effects, which will not be described in detail here, and can be referenced to each other.

[0125] In this embodiment, as an optional embodiment, the device provided is similar to the device described in the above embodiment, except that: the preset war technology public knowledge base is the ATT&CK knowledge base;

[0126] The detection program module 220 includes: a screening program unit, which is used to match the data type identification feature with the ATT&CK knowledge base to determine whether the operation data is security event data;

[0127] The labeling program unit is used to describe the security event in a war-technical labeling matrix using the rules of the ATT&CK knowledge base if it is determined that the security event is security event data, and to determine that the security event corresponds to the war-technical identity code in the ATT&CK knowledge base.

[0128] In this embodiment, as another optional embodiment, the detection program module 220 further includes: a weight determination program unit, which is used to determine the corresponding war technology label weight according to the obtained application environment information of the first host and the result of the war technology label matrix description of the security event using the rules of the ATT&CK knowledge base after the war technology label matrix description of the security event is performed using the rules of the ATT&CK knowledge base;

[0129] The label analysis program unit is used to analyze the label distribution according to the label matrix description result of the security event and the corresponding combat technology label weight, so as to obtain the corresponding combat technology matrix diagram of the first host.

[0130] As another optional embodiment, the weight determination program unit is specifically used to: determine the war technology label of the security event as the corresponding alarm level according to the confidence of the security event and war technology mapping relationship included in the ATT&CK knowledge base and the degree of detail of the preset security event detection rules;

[0131] Determine the weight of the corresponding combat technology tag according to the application environment information of the first host and the alarm level;

[0132] The analysis program module is specifically used for:

[0133] Counting the weight, quantity and / or type of the combat technology label corresponding to the first host based on the combat technology matrix diagram;

[0134] If the combat technology tag corresponding to the first host has multiple tags of the first weight, the first host is determined to be a suspected compromised host; or,

[0135] If the number of the combat technology tags corresponding to the first host exceeds the preset tag number threshold, the first host is determined to be a suspected compromised host; or,

[0136] If the type of the combat technology tag corresponding to the first host exceeds a preset tag category threshold, the first host is determined to be a suspected compromised host.

[0137] The asset operation data includes: process behavior data, file access data, system operation data and network traffic data.

[0138] See also Figure 6 As shown, as another optional embodiment, the asset operation data includes first process behavior data; the device also includes: a tracing program module 230a, which is used to:

[0139] After obtaining the corresponding combat technology matrix diagram, if the first process behavior data triggers an alarm, trace the process tree corresponding to the first process behavior data; obtain the combat technology tags attached to all processes on the corresponding process tree according to the combat technology matrix diagram; and analyze whether the process tree is a compromised attack chain based on the combat technology tags attached to all processes on the process tree.

[0140] In this embodiment, as another optional embodiment, the device further includes: a second acquisition program module, used to acquire asset operation data generated on a second host; the second host and the first host are in the same local area network, and the asset operation data is process behavior data;

[0141] a process tracking program module, for determining, after determining that the first host is a compromised host, whether the first host has a process accessing a second host according to process behavior data of the first host;

[0142] a determination program module for determining, if any, the weight, quantity and / or type of the combat technology tag corresponding to the second host based on the detected combat technology information and summary of the second host;

[0143] A determination program module, used to determine whether the second host is a compromised host according to the weight and / or type of the combat technology tag corresponding to the second host;

[0144] The judgment program module is used to judge whether the attack on the first host is a lateral movement attack according to the judgment result of whether the second host is a compromised host.

[0145] See also Figure 7As shown, in this embodiment, as another optional embodiment, the device further includes: a scenario description program module 230b, which is used to obtain the detection index of the hit combat technology rule as an input parameter after obtaining the corresponding combat technology matrix diagram or the process tree with attached technical and tactical tags; the input parameters include: asset operation data type, event occurrence time information, attack weapon, attack implementation object and attack result;

[0146] The input parameters are input into a preset combat technology scenario description model to obtain a scenario description statement of the attack event identified by each type of combat technology label.

[0147] The host loss detection device provided in the embodiment of the present invention can improve the reliability of host loss detection to a certain extent based on the same specific technical features as the first embodiment.

[0148] Furthermore, since the attacker's TTPs are discovered, it increases the difficulty for them to change their attack tactics, techniques, and attack processes, which in turn provides a time window for defenders to defend, which is beneficial to ensuring the security of the host operating environment.

[0149] As for the various embodiments of the threat detection device provided by the present invention, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the method embodiments.

[0150] The present invention also provides an electronic device according to an embodiment, comprising one or more processors; a memory; the memory stores one or more executable programs, and the one or more processors read the executable program code stored in the memory to run the program corresponding to the executable program code, so as to execute any method described in embodiment one.

[0151] Figure 8 FIG. 1 is a schematic diagram of the structure of an embodiment of an electronic device of the present invention, which can implement any method described in Embodiment 1 of the present invention, such as Figure 8 As shown, as an optional embodiment, the above-mentioned electronic device may include: a shell 41, a processor 42, a memory 43, a circuit board 44 and a power supply circuit 45, wherein the circuit board 44 is arranged inside the space enclosed by the shell 41, and the processor 42 and the memory 43 are arranged on the circuit board 44; the power supply circuit 45 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 43 is used to store executable program codes; the processor 42 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 43, so as to execute the host loss detection method described in any of the aforementioned embodiments one.

[0152] The specific execution process of the processor 42 for the above steps and the steps further executed by the processor 42 by running the executable program code can be found in the description of the host loss detection method embodiment 1 of the present invention, which will not be repeated here.

[0153] The electronic device exists in various forms, including but not limited to: (1) Mobile communication devices: This type of device is characterized by having mobile communication functions and its main goal is to provide voice and data communications. Such terminals include: smart phones (such as iPhone), multimedia phones, functional phones, and low-end mobile phones. (2) Ultra-mobile personal computer devices: This type of device belongs to the category of personal computers, has computing and processing functions, and generally also has mobile Internet access features. Such terminals include: PDA, MID and UMPC devices, such as iPad. (3) Portable entertainment devices: This type of device can display and play multimedia content. Such devices include: audio and video playback modules (such as iPod), handheld game consoles, e-books, as well as smart toys and portable car navigation devices. (4) Servers: Devices that provide computing services. The server's composition includes processors, hard disks, memory, system buses, etc. The server is similar to the general computer architecture, but because it needs to provide highly reliable services, it has higher requirements in terms of processing power, stability, reliability, security, scalability, manageability, etc. (5) Other electronic devices with data interaction functions.

[0154] An embodiment of the present invention also provides a computer-readable storage medium, which stores one or more programs. The one or more programs can be executed by one or more processors to implement the host failure detection method described in any of the above-mentioned embodiments.

[0155] In summary, according to the description of the above embodiments, the host compromise detection method and device disclosed in this embodiment use a public knowledge base of attack techniques such as the ATT&CK knowledge base to label the acquired source data, identify the attacker's attack techniques TTPs, and provide a time window for the defender's defense, which is beneficial to ensuring the security of the host operating environment and can improve the reliability of host compromise detection to a certain extent.

[0156] Furthermore, since the attacker's warfare techniques TTPs can be identified, a time window is provided for the defender to defend, which is beneficial to ensuring the security of the host operating environment.

[0157] In addition, labeling security incidents with ATT&CK's technical and tactical IDs facilitates the formation of a common language for describing threat alerts in the industry. That is, security incidents are uniformly described through the ATT&CK framework's technical and sub-technical IDs and names, providing convenience for collaborative analysis.

[0158] Furthermore, the present invention can discover threats with inherent connections of context, coordination and collaboration at different stages and for different purposes in the attack chain during an attack operation, so as to effectively analyze the causes and consequences of the threats and implement targeted defense measures.

[0159] Furthermore, by adding more detailed and popular descriptions to each TTP tag as the basic statements for scenario description, and then combining them into a complete description of a scenario, a foundation of understanding is laid for security analysts to collaborate and form internal security intelligence for sharing, facilitating collaborative analysis among individuals, enterprises and organizations.

[0160] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0161] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

[0162] For the convenience of description, the above device is described by dividing the functions into various units / modules. Of course, when implementing the present invention, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0163] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can also be a disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM).

[0164] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A host loss detection method, characterized in that: The method comprises the steps of: Acquire asset operation data generated on the first host; the asset operation data carries a data type identification feature; According to the data type identification features and the preset combat technology public knowledge base rules, the asset operation data is subjected to combat technology labeling processing to obtain a corresponding combat technology matrix diagram; Determine whether the first host is a compromised host based on the analysis of the combat technology matrix diagram; The preset war technology public knowledge base is the ATT&CK knowledge base; The performing of war technology labeling processing on the asset operation data according to the data type identification feature and the preset war technology public knowledge base rules to obtain the corresponding war technology matrix diagram includes: matching the data type identification feature with the ATT&CK knowledge base to determine whether the operation data is security event data; If it is determined to be security incident data, the security incident is described in a war-technical labeling matrix using the rules of the ATT&CK knowledge base, and the security incident is determined to correspond to the war-technical identity code in the ATT&CK knowledge base; The step of performing war technology labeling on the asset operation data according to the data type identification feature and the preset war technology public knowledge base rules to obtain the corresponding war technology matrix diagram further includes: after performing war technology labeling matrix description on the security incident using the rules of the ATT&CK knowledge base, determining the corresponding war technology label weight using the rules of the ATT&CK knowledge base according to the obtained application environment information of the first host and the result of performing war technology labeling matrix description on the security incident; According to the obtained label matrix description result of the security event and the corresponding combat technology label weight, the label distribution is analyzed to obtain the corresponding combat technology matrix diagram of the first host; Determining the corresponding war technology label weight using the rules of the ATT&CK knowledge base includes: determining the war technology label of the security event as the corresponding alarm level according to the confidence of the mapping relationship between security events and war technologies included in the ATT&CK knowledge base and the level of detail of the preset security event detection rules; Determine the weight of the corresponding combat technology tag according to the application environment information of the first host and the alarm level; The determining whether the first host is a compromised host based on the analysis of the combat technology matrix diagram includes: Counting the weight, quantity and / or type of the combat technology label corresponding to the first host based on the combat technology matrix diagram; If the combat technology tag corresponding to the first host has multiple tags of the first weight, the first host is determined to be a suspected compromised host; or, If the number of the combat technology tags corresponding to the first host exceeds the preset tag number threshold, the first host is determined to be a suspected compromised host; or, If the type of the combat technology tag corresponding to the first host exceeds a preset tag category threshold, the first host is determined to be a suspected compromised host; The method further includes: acquiring asset operation data generated on a second host; the second host and the first host are in the same local area network, and the asset operation data is process behavior data; After determining that the first host is a compromised host, determining whether the first host has a process accessing a second host according to process behavior data of the first host; If yes, determine the weight and / or type of the combat technology tag corresponding to the second host according to the detected combat technology information and summary of the second host; Determining whether the second host is a compromised host according to the weight, quantity and / or type of the combat technology tag corresponding to the second host; According to the determination result of whether the second host is a compromised host, it is determined whether the attack on the first host is a lateral movement attack.

2. The method according to claim 1, characterized in that: The asset operation data includes: process behavior data, file access data, system operation data and network traffic data.

3. The method according to claim 1, characterized in that The asset operation data includes first process behavior data; After obtaining the corresponding battle technology matrix diagram, the method further includes: if the first process behavior data triggers an alarm, tracing back to the process tree corresponding to the first process behavior data; According to the combat technology matrix diagram, obtain the combat technology tags attached to all processes on the corresponding process tree; According to the combat technology tags attached to all processes on the process tree, it is analyzed whether the process tree is a compromised attack chain.

4. The method according to claim 3, characterized in that After obtaining the corresponding combat technology matrix diagram or the process tree with attached technical and tactical tags, the method further includes: obtaining the detection index of the hit combat technology rule as an input parameter; the input parameter includes: asset operation data type, event occurrence time information, attack weapon, attack implementation object and attack result; The input parameters are input into a preset combat technology scenario description model to obtain a scenario description statement of the attack event identified by each type of combat technology label.

5. A host failure detection device, characterized in that: The device comprises: A first acquisition program module is used to acquire asset operation data generated on the first host; the asset operation data carries a data type identification feature; A detection program module, used to perform combat technology labeling processing on the asset operation data according to the data type identification characteristics and the preset combat technology public knowledge base rules to obtain a corresponding combat technology matrix diagram; an analysis program module, configured to determine whether the first host is a compromised host based on the analysis of the combat technology matrix diagram; The preset war technology public knowledge base is the ATT&CK knowledge base; The detection program module includes: a screening program unit, which is used to match the data type identification feature with the ATT&CK knowledge base to determine whether the operation data is security event data; A labeling program unit, for, if it is determined to be security event data, using the rules of the ATT&CK knowledge base to describe the security event in a war-technical labeling matrix, and determining that the security event corresponds to a war-technical identity code in the ATT&CK knowledge base; The detection program module further includes: a weight determination program unit, which is used to determine the corresponding war technology label weight according to the rules of the ATT&CK knowledge base, after describing the security incident in a war technology label matrix according to the rules of the ATT&CK knowledge base, based on the application environment information of the first host obtained and the result of describing the security incident in a war technology label matrix according to the ATT&CK knowledge base; A label analysis program unit is used to analyze the label distribution according to the label matrix description result of the security event and the corresponding combat technology label weight, and obtain the corresponding combat technology matrix diagram of the first host; The weight determination program unit is specifically used to: determine the strategic technology label of the security event as the corresponding alarm level according to the confidence of the mapping relationship between security events and strategic technologies included in the ATT&CK knowledge base and the degree of detail of the preset security event detection rules; Determine the weight of the corresponding combat technology tag according to the application environment information of the first host and the alarm level; The analysis program module is specifically used for: Counting the weight, quantity and / or type of the combat technology label corresponding to the first host based on the combat technology matrix diagram; If the combat technology tag corresponding to the first host has multiple tags of the first weight, the first host is determined to be a suspected compromised host; or, If the number of the combat technology tags corresponding to the first host exceeds the preset tag number threshold, the first host is determined to be a suspected compromised host; or, If the type of the combat technology tag corresponding to the first host exceeds a preset tag category threshold, the first host is determined to be a suspected compromised host; The device further comprises: a second acquisition program module, used to acquire asset operation data generated on a second host; the second host and the first host are in the same local area network, and the asset operation data is process behavior data; a process tracking program module, for determining, after determining that the first host is a compromised host, whether the first host has a process accessing a second host according to process behavior data of the first host; a determination program module for determining, if any, the weight, quantity and / or type of the combat technology tag corresponding to the second host based on the detected combat technology information and summary of the second host; A determination program module, used to determine whether the second host is a compromised host according to the weight and / or type of the combat technology tag corresponding to the second host The judgment program module is used to judge whether the attack on the first host is a lateral movement attack according to the judgment result of whether the second host is a compromised host.

6. The device according to claim 5, characterized in that The asset operation data includes: process behavior data, file access data, system operation data and network traffic data.

7. The device according to claim 5, characterized in that The asset operation data includes first process behavior data; The device also includes: a traceability program module, which is used to: After obtaining the corresponding battle technology matrix diagram, if the first process behavior data triggers an alarm, tracing back to the process tree corresponding to the first process behavior data; According to the combat technology matrix diagram, obtain the combat technology tags attached to all processes on the corresponding process tree; According to the combat technology tags attached to all processes on the process tree, it is analyzed whether the process tree is a compromised attack chain.

8. The device according to claim 5, characterized in that The device also includes: The scenario description program module is used to obtain the detection index of the hit combat technology rule as an input parameter after obtaining the corresponding combat technology matrix diagram or the process tree with attached technical and tactical tags; the input parameters include: asset operation data type, event occurrence time information, attack weapon, attack implementation object and attack result; The input parameters are input into a preset combat technology scenario description model to obtain a scenario description statement of the attack event identified by each type of combat technology label.

9. An electronic device, characterized in that: include: One or more processors; Memory; The memory stores one or more executable programs, and the one or more processors read the executable program code stored in the memory to run the program corresponding to the executable program code, so as to execute the method described in any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores one or more programs, and the one or more programs can be executed by one or more processors to implement the method of any one of claims 1 to 4.

Images