Advanced persistent threat attack detection method and device

Abstract

The embodiment of the present invention provides a method and device for detecting advanced persistent threat attacks. The method includes: detecting network assets to obtain information about the network assets; based on the protocol of C&C communication of advanced persistent threat attacks, determining suspicious addresses in the information about the network assets, and constructing a request message for C&C communication; sending the constructed request message to the suspicious address, and receiving a response message to the request message fed back by the suspicious address; based on the protocol of C&C communication of the advanced persistent threat attack, analyzing the response message, and determining the suspicious address as the active C&C server address of the advanced persistent threat attack. The embodiment of the present invention can adapt to changes in the network environment, has the ability to identify unknown attacks, has high timeliness and accuracy, is more concise, can accurately determine the attacker's information, and meets the requirements of advanced persistent threat attack detection and defense technology.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an advanced persistent threat attack detection method and device. Background Art

[0002] Advanced Persistent Threat (APT) attacks are a frequent security incident in recent years. How to accurately detect APT attack behaviors and effectively avoid the damage and losses caused by their attacks is the focus of APT attack detection and defense technology.

[0003] Currently, the mainstream methods for APT attack detection include detection methods based on Indicators of Compromise (IOC) and detection methods based on ATT&CK.

[0004] Among them, the IOC-based detection method is to deploy various forms of IOC on the detection device, match the collected events with the IOC on the device, and provide multi-dimensional information related to IOC so that users can classify the alarms generated by the hit IOC and guide the priority of disposal. Practical research shows that IOC is not enough to adapt to the changing network environment, and IOC is also difficult to ensure timeliness and accuracy. For example, for sample detection, we usually use a hash calculation-based method to determine whether the sample belongs to a certain organization, so that malicious samples can be accurately detected. However, with the continuous upgrading and deformation of samples, the same type of samples have a large number of different versions. At this time, how to track the version deformation to obtain a new hash value and how to ensure the validity of the hash value is a basic problem. In addition, domain names and IP addresses as IOC are also an important detection method to determine whether they are attacked. However, over time, the domain name and IP address of an organization will change due to expiration, change of service providers, and abandonment, resulting in reduced recognition accuracy. Although there are more and more IOCs used for detection and the database is constantly expanding, the actual detection effect is not ideal.

[0005] Based on the ATT&CK detection method, the ATT&CK model builds a set of more fine-grained and easier to share knowledge models and frameworks. It describes and classifies adversarial behaviors based on real observation data, and is mainly divided into 12 categories: initial access, execution, persistence, elevated privileges, defense bypass, credential access, discovery, lateral movement, collection, command and control, data penetration and influence. Simplify the entire attack process of APT, which mainly includes three stages: a. implanting malicious code; b. elevating privileges and lateral movement; c. command and control (C&C) communication. As a knowledge base of attack techniques and tactics, ATT&CK covers 12 tactics in the entire attack process. It is a comprehensive solution for describing a specific attack event and judging an attack event through a series of attack behaviors. The fundamental starting point of its event monitoring is various attack techniques, which can well solve the problem of being attacked, but it is difficult to answer the question of who is attacked. Summary of the invention

[0006] In view of the problems in the prior art, an embodiment of the present invention provides an advanced persistent threat attack detection method and device.

[0007] Specifically, the embodiment of the present invention provides the following technical solutions:

[0008] In a first aspect, an embodiment of the present invention provides an advanced persistent threat attack detection method, including:

[0009] Probe network assets to obtain information about them;

[0010] Based on the protocol of the advanced persistent threat attack C&C communication, determine the suspicious address in the information of the network asset and construct a request message for C&C communication;

[0011] Sending the constructed request message to the suspicious address, and receiving a response message to the request message fed back by the suspicious address;

[0012] Based on the protocol of the advanced persistent threat attack C&C communication, the response message is analyzed, and the suspicious address is determined to be the address of the C&C server where the advanced persistent threat attack is active.

[0013] Furthermore, the protocol based on the advanced persistent threat attack C&C communication determines the suspicious address in the information of the network asset and constructs a request message for C&C communication, including:

[0014] Parsing the protocol of the advanced persistent threat attack C&C communication to obtain the network fingerprint and message format of the advanced persistent threat attack C&C communication;

[0015] Based on the network fingerprint of the advanced persistent threat attack C&C communication, the information of the network assets is screened to obtain the suspicious address;

[0016] Based on the message format of the advanced persistent threat attack C&C communication, construct a request message for the C&C communication;

[0017] Based on the protocol of the C&C communication of the advanced persistent threat attack, analyzing the response message, and determining the suspicious address as the C&C server address of the active advanced persistent threat attack, including:

[0018] Based on the message format of the advanced persistent threat attack C&C communication, the response message is analyzed, and the suspicious address is determined to be the address of the C&C server where the advanced persistent threat attack is active.

[0019] Furthermore, the network fingerprint includes at least one of a server software version, a certificate, a port, and HTTP, HTTPS, and TCP communication characteristics.

[0020] Furthermore, the message format includes at least one of an encryption algorithm, a verification algorithm, a data compression algorithm and a data format.

[0021] Furthermore, the message format includes a request message format and a response message format;

[0022] Based on the message format of the advanced persistent threat attack C&C communication, constructing a request message of the C&C communication, including:

[0023] Based on the request message format of the advanced persistent threat attack C&C communication, construct a request message for the C&C communication;

[0024] Based on the message format of the C&C communication of the advanced persistent threat attack, analyzing the response message, and determining the suspicious address as the C&C server address of the active advanced persistent threat attack, including:

[0025] Based on the response message format of the advanced persistent threat attack C&C communication, the response message is analyzed, and the suspicious address is determined to be the C&C server address where the advanced persistent threat attack is active.

[0026] Further, based on the request message format of the advanced persistent threat attack C&C communication, constructing the request message of the C&C communication includes:

[0027] Based on the request message format of the C&C communication of the advanced persistent threat attack, respectively construct a correct request message and an incorrect request message of the C&C communication;

[0028] Sending the constructed request message to the suspicious address, and receiving a response message to the request message fed back by the suspicious address, includes:

[0029] Sending the constructed correct request message and the constructed error request message to the suspicious address respectively, and receiving a first response message to the correct request message and a second response message to the error request message fed back by the suspicious address respectively;

[0030] Based on the response message format of the advanced persistent threat attack C&C communication, analyzing the response message, and determining the suspicious address as the C&C server address of the active advanced persistent threat attack, including:

[0031] Determining whether the first response message conforms to the response message format of the advanced persistent threat attack C&C communication;

[0032] If the first response message conforms to the response message format of the advanced persistent threat attack C&C communication, determine whether the second response message is the same as the first response message;

[0033] If the second response message is different from the first response message, the suspicious address is determined to be the C&C server address where the advanced persistent threat attack is active.

[0034] Furthermore, detecting the network to obtain network assets includes:

[0035] The network address space is scanned based on a port scanning tool to obtain the network assets.

[0036] In a second aspect, an embodiment of the present invention further provides an advanced persistent threat attack detection device, including:

[0037] Asset scanning module, used to detect network assets and obtain information about them;

[0038] A protocol processing module, for determining suspicious addresses in the information of the network assets based on the protocol of the advanced persistent threat attack C&C communication, and constructing a request message for C&C communication;

[0039] A network communication module, used for sending the constructed request message to the suspicious address, and receiving a response message to the request message fed back by the suspicious address;

[0040] The address determination module is used to analyze the response message based on the protocol of the advanced persistent threat attack C&C communication, and determine the suspicious address as the C&C server address of the active advanced persistent threat attack.

[0041] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the advanced persistent threat attack detection method described in the first aspect are implemented.

[0042] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the advanced persistent threat attack detection method as described in the first aspect.

[0043] In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the advanced persistent threat attack detection method described in the first aspect.

[0044] The advanced persistent threat attack detection method and device provided by the embodiment of the present invention, by taking the advanced persistent threat attack C&C communication protocol as a basis, determines the suspicious address from the network assets, constructs the advanced persistent threat attack C&C communication request message, communicates with the suspicious address, and determines the suspicious address as the C&C server address of the active advanced persistent threat attack based on the response message fed back by the suspicious address, which belongs to the category of actively discovering advanced persistent threat attacks. Compared with the IOC-based detection method, it can adapt to changes in the network environment, has the ability to identify unknown attacks, and has high timeliness and accuracy. Compared with the ATT&CK-based detection method, it is more concise, and can accurately determine the attacker's information, which can meet the requirements of advanced persistent threat attack detection and defense technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0046] Figure 1 It is a flow chart of the advanced persistent threat attack detection method provided by the present invention;

[0047] Figure 2 It is a flow chart of determining a suspicious address and constructing a request message according to a C&C communication protocol provided by the present invention;

[0048] Figure 3It is a flow chart of detecting APT attacks by constructing a request message to communicate with a suspicious address provided by the present invention;

[0049] Figure 4 It is a flowchart of an application scenario of an advanced persistent threat attack detection method provided by the present invention;

[0050] Figure 5 yes Figure 4 Schematic diagram of the principle of medium and advanced persistent threat attack detection methods;

[0051] Figure 6 It is a structural schematic diagram of an advanced persistent threat attack detection device provided by the present invention;

[0052] Figure 7 A schematic diagram of the physical structure of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0054] Combine the following Figure 1-Figure 5 The advanced persistent threat attack detection method of the present invention is described.

[0055] See also Figure 1 , Figure 1 is a flow chart of the advanced persistent threat attack detection method provided by the present invention, Figure 1 The advanced persistent threat attack detection method shown can be executed by an advanced persistent threat attack detection device, which can be set on a server. For example, the server can be a physical server including an independent host, a virtual server carried by a host cluster, a cloud server, etc., which is not limited in the embodiment of the present invention. Figure 1 As shown, the advanced persistent threat attack detection method at least includes:

[0056] 101. Detect network assets to obtain information about the network assets.

[0057] In the embodiments of the present invention, network assets, also called Internet assets, refer to information assets mapped on the Internet, which may include IP addresses, domain names, network ports, etc. Information about network assets may be obtained by detecting network assets. Currently, commonly used methods for detecting network assets may include active scanning detection and passive traffic analysis detection, etc. The embodiments of the present invention do not limit the implementation method for detecting network assets. For example, the network address space may be scanned based on existing port scanning tools to obtain information about network assets.

[0058] 102. Based on the advanced persistent threat attack C&C communication protocol, determine the suspicious address in the information of the network asset, and construct a request message for C&C communication.

[0059] In the embodiment of the present invention, C&C is the main technology used by the APT attacker device to control the attacked device. After the network asset is detected to obtain the information of the network asset, the protocol of the APT attack C&C communication can be analyzed, and the suspicious address in the information of the network asset can be determined according to the network characteristics defined in the C&C communication protocol, and the request message of the APT attack C&C communication can be constructed according to the message characteristics defined in the C&C communication protocol. For example, the network characteristics may include common network characteristics such as the network protocol and port used, the suspicious address may be a suspicious IP address, and the message characteristics may include special message characteristics such as data format and verification algorithm.

[0060] Since there are differences in the protocols used for C&C communications of different APT attack organizations, when analyzing the protocols of APT attack C&C communications, the protocols of C&C communications of all known APT attack organizations can be analyzed to determine suspicious addresses in the information of network assets based on the network features defined in the protocols of C&C communications of all known APT attack organizations, and to construct request messages of C&C communications of all known APT attack organizations based on the message features defined in the protocols of C&C communications of all known APT attack organizations.

[0061] 103. Send the constructed request message to the suspicious address, and receive a response message to the request message fed back by the suspicious address.

[0062] In an embodiment of the present invention, after obtaining a suspicious address in the information of network assets and constructing a request message for APT attack C&C communication, the constructed request message for APT attack C&C communication can be sent to the obtained suspicious address, and a response message fed back by the suspicious address according to the received request message can be received. When the request message for C&C communication includes multiple request messages for C&C communication of APT attack organizations, the request messages for C&C communication of APT attack organizations can be sent to the obtained suspicious addresses one by one, wherein after sending a request message for C&C communication of APT attack organization to the suspicious address, after receiving a response message for the request message for C&C communication of APT attack organization from the suspicious address, or starting the timing from sending the request message for C&C communication of APT attack organization, when the time of the timer reaches a preset time threshold, the next request message for C&C communication of APT attack organization can be sent to the suspicious address, wherein the preset time threshold can be set according to the time of the response message feedback in the network communication.

[0063] 104. Based on the advanced persistent threat attack C&C communication protocol, the response message is analyzed and the suspicious address is determined to be the address of the C&C server where the advanced persistent threat attack is active.

[0064] In an embodiment of the present invention, after receiving a response message to a request message fed back by a suspicious address, the received response message can be analyzed by analyzing the protocol of the APT attack C&C communication, and according to the message features defined in the protocol of the C&C communication, the received response message can be analyzed, and according to the analysis result, it can be determined whether the suspicious address that sends the response message is the C&C server address of the APT attack active. For example, if the received response message meets the message features defined in the protocol of the C&C communication, it can be considered that the suspicious address that sends the response message is the address of the APT attack organization, and the suspicious address that sends the response message can be determined as the C&C server address of the APT attack active. If the received response message does not meet the message features defined in the protocol of the C&C communication, this operation is terminated. For a request message of the C&C communication of an APT attack organization, multiple response messages may be received. According to the message features defined in the protocol of the C&C communication of the APT attack organization, the received multiple response messages can be analyzed separately to determine whether the suspicious address that sends each response message is the C&C server address of the APT attack active.

[0065] The advanced persistent threat attack detection method provided by the embodiment of the present invention determines suspicious addresses from network assets by taking the advanced persistent threat attack C&C communication protocol as a basis, constructs a request message for the advanced persistent threat attack C&C communication, communicates with the suspicious address, and determines the suspicious address as an active C&C server address of the advanced persistent threat attack based on the response message fed back by the suspicious address, which belongs to the category of actively discovering advanced persistent threat attacks. Compared with the IOC-based detection method, it can adapt to changes in the network environment, has the ability to identify unknown attacks, and has high timeliness and accuracy. Compared with the ATT&CK-based detection method, it is more concise, and can accurately determine the attacker's information, which can meet the requirements of advanced persistent threat attack detection and defense technology.

[0066] See also Figure 2 , Figure 2 FIG. 1 is a flow chart of determining a suspicious address and constructing a request message according to a C&C communication protocol provided by the present invention, such as Figure 2 As shown, based on the protocol of C&C communication of advanced persistent threat attack, the suspicious address in the network asset is determined, and the request message of C&C communication is constructed, which at least includes:

[0067] 201, parse the protocol of the advanced persistent threat attack C&C communication to obtain the network fingerprint and message format of the advanced persistent threat attack C&C communication.

[0068] In the embodiment of the present invention, by parsing the protocol of the APT attack C&C communication, the network features defined in the protocol of the APT attack C&C communication can be extracted as the network fingerprint of the APT attack C&C communication, and the dedicated message features defined in the protocol of the APT attack C&C communication can be extracted as the message format of the APT attack C&C communication. The method for parsing the protocol of the APT attack C&C communication, and the types of the extracted network fingerprint and message format of the APT attack C&C communication are not limited in the embodiment of the present invention.

[0069] For example, the network fingerprint of the APT attack C&C communication extracted may include at least one of the common network features used by the communication protocols, such as the server software version, certificate, port, Hyper Text Transfer Protocol (HTTP), Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS), Transmission Control Protocol (TCP). For example, the message format of the APT attack C&C communication extracted may include at least one of the special message features used by the communication protocols, such as encryption algorithm, verification algorithm, data compression algorithm and data format.

[0070] 202. Based on the network fingerprint of the C&C communication of the advanced persistent threat attack, the information of the network assets is screened to obtain the suspicious addresses.

[0071] In an embodiment of the present invention, after obtaining the network fingerprint of the APT attack C&C communication by parsing the protocol of the APT attack C&C communication, the obtained information of the network assets can be preliminarily screened according to the network fingerprint of the APT attack C&C communication to obtain suspicious addresses in the information of the network assets. For example, a suspicious IP address library can be formed, and the obtained suspicious addresses can be used as detection targets for subsequent APT attacks, which can better ensure the pertinence and accuracy of APT attack detection.

[0072] 203. Based on the message format of the advanced persistent threat attack C&C communication, a request message for C&C communication is constructed.

[0073] In an embodiment of the present invention, after obtaining the message format of the APT attack C&C communication by parsing the protocol of the APT attack C&C communication, a request message of the APT attack C&C communication can be constructed according to the message format of the APT attack C&C communication. After sending the constructed request message of the APT attack C&C communication to the suspicious address and receiving the response message fed back by the suspicious address, the response message can also be analyzed according to the message format of the APT attack C&C communication, and it is determined whether the suspicious address that sends the response message is the C&C server address of the APT attack active according to the analysis result. For example, if the response message conforms to the message format of the APT attack C&C communication, the suspicious address that sends the response message can be determined as the C&C server address of the APT attack active.

[0074] In some optional examples, by parsing the protocol of the APT attack C&C communication, the obtained message format of the APT attack C&C communication may include a request message format and a response message format. At this time, the request message of the APT attack C&C communication can be constructed according to the request message format of the APT attack C&C communication, and the response message can be analyzed according to the response message format of the APT attack C&C communication, and it is determined according to the analysis result whether the suspicious address that sends the response message is the C&C server address of the APT attack. For example, if the response message conforms to the response message format of the APT attack C&C communication, the suspicious address that sends the response message can be determined as the C&C server address of the APT attack.

[0075] See also Figure 3 , Figure 3 FIG. 1 is a flow chart of detecting APT attacks by constructing a request message to communicate with a suspicious address provided by the present invention, such as Figure 3 As shown, detecting APT attacks by constructing request messages to communicate with suspicious addresses includes at least:

[0076] 301, based on the request message format of the advanced persistent threat attack C&C communication, construct a correct request message and an incorrect request message of the C&C communication respectively.

[0077] In an embodiment of the present invention, after obtaining the request message format and response message format of the APT attack C&C communication by parsing the protocol of the APT attack C&C communication, a correct request message that conforms to the standard of the request message format of the APT attack C&C communication and a special error request message that does not conform to the request message format of the APT attack C&C communication can be constructed according to the request message format of the APT attack C&C communication. The embodiment of the present invention does not limit the form of the constructed special error request message for the APT attack C&C communication.

[0078] 302, sending the constructed correct request message and the constructed error request message to the suspicious address respectively, and receiving the first response message to the correct request message and the second response message to the error request message fed back by the suspicious address respectively.

[0079] In an embodiment of the present invention, after constructing a correct request message and an error request message respectively according to the request message format of the APT attack C&C communication, the correct request message and the error request message constructed according to the same request message format of the APT attack C&C communication can be sent to the suspicious address one by one as two independent request messages, that is, first sending the constructed correct request message to the suspicious address, and receiving a first response message fed back by the suspicious address based on the received correct request message, and then sending the constructed error request message to the suspicious address, and receiving a second response message fed back by the suspicious address based on the received error request message.

[0080] 303 , determining whether the first response message complies with the response message format of the advanced persistent threat attack C&C communication.

[0081] If the first response message conforms to the response message format of the advanced persistent threat attack C&C communication, execute 304; otherwise, end this operation.

[0082] 304. Determine whether the second response message is the same as the first response message.

[0083] If the second response message is different from the first response message, execute 305; otherwise, end this operation.

[0084] 305, the suspicious address is determined to be the C&C server address where the advanced persistent threat attack is active.

[0085] In an embodiment of the present invention, after receiving a first response message to a correct request message fed back by a suspicious address, the first response message can be compared with the response message format of the APT attack C&C communication obtained by parsing the protocol of the APT attack C&C communication, and it can be determined whether the first response message conforms to the response message format of the APT attack C&C communication. If the first response message conforms to the response message format of the APT attack C&C communication, the next step of comparison and judgment can be performed. If the first response message does not conform to the response message format of the APT attack C&C communication, it can be considered as an error result, and the detection operation of the APT attack C&C communication is terminated. After the first response message fed back by the suspicious address conforms to the response message format of the APT attack C&C communication and the second response message to the erroneous request message fed back by the suspicious address is received, the second response message can be compared with the first response message, and it can be determined whether the second response message is the same as the first response message. If the second response message is the same as the first response message, it can be considered as an error result, and the detection operation of the APT attack C&C communication is terminated. If the second response message is different from the first response message, it can be considered that the suspicious address that sent the first response message and the second response message is the address of the APT attack organization, and the suspicious address that sent the first response message and the second response message can be determined as the C&C server address of the active APT attack.

[0086] The embodiment of the present invention constructs a correct request message and an error request message according to the response message format of the APT attack C&C communication to communicate with the suspicious address, and determines whether the suspicious address is an active C&C server address of the APT attack according to the results of the correct request message and the error request message response, thereby effectively ensuring the accuracy of APT attack detection.

[0087] See also Figure 4 and Figure 5 , Figure 4 is a flow chart of an application scenario of an advanced persistent threat attack detection method provided by the present invention, Figure 5 yes Figure 4 Schematic diagram of the principles of medium and advanced persistent threat attack detection methods.

[0088] like Figure 4As shown, in the first step, the network address space is scanned by an existing port scanning tool to obtain information about network assets, also known as asset mapping, to form a preliminary result; in the second step, the information about network assets is preliminarily screened according to the network fingerprint of the APT attack C&C communication to form a suspicious IP address library; in the third step, a standard correct request message is constructed according to the request message format of the APT attack C&C communication, and a correct request message is sent to the suspicious IP address, and a response to the correct request message from the suspicious IP address, i.e., a first response message, is received. According to the response message format of the APT attack C&C communication, the fingerprint of the response result, i.e., the first response message, can be judged whether it meets the response message format. In the fourth step, according to the request message format of the APT attack C&C communication, a special error request message is constructed, and a rough request message is sent to the suspicious IP address, and the response of the suspicious IP address to the error request message, that is, the second response message, is received. The response result of the correct request message, that is, the first response message, can be compared with the response result of the error request message, that is, the second response message. If they are the same, it can be considered as an error result. If they are different, the suspicious IP address can be determined to be the C&C server address of the APT attack.

[0089] like Figure 5 As shown, by analyzing the protocol of APT attack C&C communication, the server software version, certificate, port and HTTP, HTTPS, TCP communication features used in APT attack C&C communication, and other common network features can be extracted as the network fingerprint of APT attack C&C communication; and the encryption algorithm, verification algorithm, data compression algorithm and data format used in APT attack C&C communication can be extracted as the message format of APT attack C&C communication. Then, according to the network fingerprint of APT attack C&C communication, the information of network assets is screened to determine the suspicious IP address. After that, according to the message format of APT attack C&C communication, different request messages, namely correct request messages and wrong request messages, are constructed to communicate with the determined suspicious IP address, and according to the response results of the suspicious IP address to the correct request message and the wrong request message, it is determined whether the suspicious IP address is the C&C server address of APT attack activity.

[0090] The following example illustrates the network fingerprint of APT attack C&C communication:

[0091] 1) HTTP response fingerprint of C&C communication

[0092]

[0093] The HTTP response information above shows that the C&C server uses the nginx server to build a reverse proxy environment on the server side. The nginx server can be used as the HTTP response fingerprint for C&C communication.

[0094] 2) HTTPS request fingerprint of C&C communication

[0095] Through analysis, it can be seen that there is a fixed feature in the ClientHello message of a certain APT organization, including the TLS version, the use of a fixed cryptographic suite, and finally the encoding using a fixed signature algorithm list, forming a specific HTTPS ClientHello message request fingerprint as shown in Table 1.

[0096] Table 1

[0097]

[0098] 3) Port fingerprint of C&C communication

[0099] By analyzing the C&C communication samples of an APT organization, we found that the APT organization often uses ports 80, 443, 14146, 45406, etc. for communication. Therefore, these port features can be used as fingerprints of C&C communication to screen network assets.

[0100] 4) Certificate fingerprint used for C&C communication

[0101]

[0102] From the above information, we can see that the certificate version of the server response is TLS 1.0, using the Let'sEncypt certificate, and the negotiated encryption suite is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xC103). Therefore, the certificate features can be used as the fingerprint of C&C communication to screen network assets.

[0103] The formats of request and response messages of different APT organizations are different. Their fundamental purpose is to achieve data exchange through C&C communication. Therefore, different APT organizations use different encryption algorithms, data formats, etc. in the protocol. The following uses the request and response message formats of SideWinder organization to illustrate some special situations of APT organizations in C&C communication:

[0104] 1) Download files using a specific encryption algorithm

[0105] When downloading the file content, the download address is divided into two parts, namely the IP address and the URL address. Therefore, if the download content exists, the file content will be downloaded directly and decrypted to execute the relevant sample functions. The decryption process of the algorithm is also very simple. The first 32 bytes of the ciphertext are directly used as the key. The subsequent data can be decrypted to restore the encrypted data content. The decryption algorithm is shown in Formula 1.

[0106]

[0107] According to the decrypted result, it is a ".NET" type DLL file "UpdateServerUrI.dll", whose main function is to update the accessed URL address.

[0108] 2) Upload system configuration information format

[0109] The content of the Post request uploads different information according to the different commands. The main function is to upload system configuration information and file list information. The basic data structure of the system configuration information starts with 0x01, and is composed of multiple strings, integers and bytes such as configuration information path, output directory, URL absolute path, Get request time interval, Post upload time interval, etc., as shown in Table 2.

[0110] Table 2

[0111]

[0112] 3) Upload file list information

[0113] The file list information starts with the string "FL", followed by 1 byte 0x01, and then the number of system drive letters, drive letter information, followed by a directory information list, etc. The specific data structure is shown in Table 3.

[0114] Table 3

[0115]

[0116] The advanced persistent threat attack detection device provided by the present invention is described below. The advanced persistent threat attack detection device described below and the advanced persistent threat attack detection method described above can be referred to each other.

[0117] See also Figure 6 , Figure 6 is a schematic diagram of the structure of an advanced persistent threat attack detection device provided by the present invention, Figure 6 The advanced persistent threat attack detection device shown can be used to perform Figure 1 Advanced persistent threat attack detection methods such as Figure 6As shown, the advanced persistent threat attack detection device at least includes:

[0118] The asset scanning module 610 is used to detect network assets and obtain information about network assets.

[0119] The protocol processing module 620 is used to determine suspicious addresses in the information of network assets based on the protocol of advanced persistent threat attack C&C communication, and construct a request message for C&C communication.

[0120] The network communication module 630 is used to send the constructed request message to the suspicious address and receive a response message to the request message fed back by the suspicious address.

[0121] The address determination module 640 is used to analyze the response message based on the advanced persistent threat attack C&C communication protocol and determine the suspicious address as the C&C server address where the advanced persistent threat attack is active.

[0122] Optionally, the protocol processing module 620 includes:

[0123] The protocol parsing unit is used to parse the protocol of the advanced persistent threat attack C&C communication to obtain the network fingerprint and message format of the advanced persistent threat attack C&C communication.

[0124] The address screening unit is used to screen the information of network assets based on the network fingerprint of the advanced persistent threat attack C&C communication to obtain suspicious addresses.

[0125] The message construction unit is used to construct a request message for C&C communication based on the message format of the advanced persistent threat attack C&C communication.

[0126] The address determination module 640 is used to analyze the response message based on the message format of the advanced persistent threat attack C&C communication, and determine the suspicious address as the address of the C&C server where the advanced persistent threat attack is active.

[0127] Optionally, the network fingerprint includes at least one of a server software version, a certificate, a port, and HTTP, HTTPS, and TCP communication characteristics.

[0128] Optionally, the message format includes at least one of an encryption algorithm, a verification algorithm, a data compression algorithm and a data format.

[0129] Optionally, the message format includes a request message format and a response message format;

[0130] The message construction unit is used to construct a request message for C&C communication based on the request message format of the advanced persistent threat attack C&C communication.

[0131] The address determination module 640 is used to analyze the response message based on the response message format of the advanced persistent threat attack C&C communication, and determine the suspicious address as the address of the C&C server where the advanced persistent threat attack is active.

[0132] Optionally, the message construction unit is used to construct a correct request message and an incorrect request message of the C&C communication based on the request message format of the advanced persistent threat attack C&C communication.

[0133] The network communication module 630 is used to send the constructed correct request message and the wrong request message to the suspicious address respectively, and receive the first response message to the correct request message and the second response message to the wrong request message fed back by the suspicious address respectively.

[0134] Optionally, the address determination module 640 includes:

[0135] The first determination unit is used to determine whether the first response message conforms to the response message format of the advanced persistent threat attack C&C communication.

[0136] The second judgment unit is used to judge whether the second response message is the same as the first response message according to the judgment result of the first judgment unit if the first response message conforms to the response message format of the advanced persistent threat attack C&C communication.

[0137] The address determination unit is used to determine the suspicious address as the C&C server address where the advanced persistent threat attack is active, based on the judgment result of the second judgment unit, if the second response message is different from the first response message.

[0138] Optionally, the asset scanning module 610 is used to scan the network address space based on a port scanning tool to obtain network assets.

[0139] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730 and a communication bus 740, wherein the processor 710, the communication interface 720 and the memory 730 complete mutual communication through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute the following method: detect the network assets to obtain the information of the network assets; determine the suspicious address in the information of the network assets based on the protocol of the C&C communication of the advanced persistent threat attack, and construct a request message for the C&C communication; send the constructed request message to the suspicious address, and receive the response message to the request message fed back by the suspicious address; analyze the response message based on the protocol of the C&C communication of the advanced persistent threat attack, and determine the suspicious address as the C&C server address of the active advanced persistent threat attack.

[0140] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0141] On the other hand, an embodiment of the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the methods provided in the above embodiments, for example, including: detecting network assets to obtain information about network assets; based on the protocol of C&C communication of advanced persistent threat attacks, determining a suspicious address in the information of the network assets, and constructing a request message for C&C communication; sending the constructed request message to the suspicious address, and receiving a response message to the request message fed back by the suspicious address; based on the protocol of C&C communication of the advanced persistent threat attack, analyzing the response message, and determining the suspicious address as the active C&C server address of the advanced persistent threat attack.

[0142] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0143] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0144] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting advanced persistent threat attacks, characterized in that: include: Probe network assets to obtain information about them; Based on the protocol of C&C communication of the advanced persistent threat attack, a suspicious address in the information of the network asset is determined, and a request message of the C&C communication is constructed, wherein the protocol of the C&C communication of the advanced persistent threat attack includes defined network features and message features, and the suspicious address in the information of the network asset is determined according to the network features defined in the protocol of the C&C communication by analyzing the protocol of the APT attack C&C communication; Sending the constructed request message to the suspicious address, receiving a response message to the request message fed back by the suspicious address, and constructing a request message for APT attacking C&C communication according to the message features defined in the C&C communication protocol; Based on the protocol of the advanced persistent threat attack C&C communication, the response message is analyzed, and the suspicious address is determined to be the C&C server address where the advanced persistent threat attack is active; if the received response message meets the message characteristics defined in the C&C communication protocol, the suspicious address that sends the response message is considered to be the address of the APT attack organization, and the suspicious address that sends the response message is determined to be the C&C server address where the APT attack is active; if the received response message does not meet the message characteristics defined in the C&C communication protocol, this operation is terminated.

2. The advanced persistent threat attack detection method according to claim 1, characterized in that: The protocol based on the advanced persistent threat attack C&C communication determines the suspicious address in the information of the network asset and constructs a request message for C&C communication, including: Parsing the protocol of the advanced persistent threat attack C&C communication to obtain the network fingerprint and message format of the advanced persistent threat attack C&C communication; Based on the network fingerprint of the advanced persistent threat attack C&C communication, the information of the network assets is screened to obtain the suspicious address; Based on the message format of the advanced persistent threat attack C&C communication, construct a request message for the C&C communication; Based on the protocol of the C&C communication of the advanced persistent threat attack, analyzing the response message, and determining the suspicious address as the C&C server address of the active advanced persistent threat attack, including: Based on the message format of the advanced persistent threat attack C&C communication, the response message is analyzed, and the suspicious address is determined to be the address of the C&C server where the advanced persistent threat attack is active.

3. The advanced persistent threat attack detection method according to claim 2, characterized in that: The network fingerprint includes at least one of a server software version, a certificate, a port, and HTTP, HTTPS, and TCP communication characteristics.

4. The advanced persistent threat attack detection method according to claim 2, characterized in that: The message format includes at least one of an encryption algorithm, a verification algorithm, a data compression algorithm and a data format.

5. The advanced persistent threat attack detection method according to any one of claims 2 to 4, characterized in that: The message format includes a request message format and a response message format; Based on the message format of the advanced persistent threat attack C&C communication, constructing a request message of the C&C communication, including: Based on the request message format of the advanced persistent threat attack C&C communication, construct a request message for the C&C communication; Based on the message format of the C&C communication of the advanced persistent threat attack, analyzing the response message, and determining the suspicious address as the C&C server address of the active advanced persistent threat attack, including: Based on the response message format of the advanced persistent threat attack C&C communication, the response message is analyzed, and the suspicious address is determined to be the C&C server address where the advanced persistent threat attack is active.

6. The advanced persistent threat attack detection method according to claim 5, characterized in that: Based on the request message format of the advanced persistent threat attack C&C communication, constructing the request message of the C&C communication, including: Based on the request message format of the C&C communication of the advanced persistent threat attack, respectively construct a correct request message and an incorrect request message of the C&C communication; Sending the constructed request message to the suspicious address, and receiving a response message to the request message fed back by the suspicious address, includes: Sending the constructed correct request message and the constructed error request message to the suspicious address respectively, and receiving a first response message to the correct request message and a second response message to the error request message fed back by the suspicious address respectively; Based on the response message format of the advanced persistent threat attack C&C communication, analyzing the response message, and determining the suspicious address as the C&C server address of the active advanced persistent threat attack, including: Determining whether the first response message conforms to the response message format of the advanced persistent threat attack C&C communication; If the first response message conforms to the response message format of the advanced persistent threat attack C&C communication, determine whether the second response message is the same as the first response message; If the second response message is different from the first response message, the suspicious address is determined to be the C&C server address where the advanced persistent threat attack is active.

7. The advanced persistent threat attack detection method according to claim 6, characterized in that: The detecting of the network to obtain the network assets includes: The network address space is scanned based on a port scanning tool to obtain the network assets.

8. An advanced persistent threat attack detection device, characterized in that: include: Asset scanning module, used to detect network assets and obtain information about them; A protocol processing module, configured to determine suspicious addresses in the information of the network assets based on the protocol of the C&C communication of the advanced persistent threat attack, and construct a request message for the C&C communication, wherein the protocol of the C&C communication of the advanced persistent threat attack includes defined network features and message features, and to determine suspicious addresses in the information of the network assets based on the network features defined in the protocol of the C&C communication by analyzing the protocol of the APT attack C&C communication; A network communication module, used to send the constructed request message to the suspicious address, receive a response message to the request message fed back by the suspicious address, and construct a request message for APT attacking C&C communication according to the message features defined in the C&C communication protocol; The address determination module is used to analyze the response message based on the protocol of the advanced persistent threat attack C&C communication, determine the suspicious address as the C&C server address where the advanced persistent threat attack is active, if the received response message meets the message characteristics defined in the C&C communication protocol, then the suspicious address that sends the response message is considered to be the address of the APT attack organization, and the suspicious address that sends the response message is determined to be the C&C server address where the APT attack is active, if the received response message does not meet the message characteristics defined in the C&C communication protocol, then end this operation.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the advanced persistent threat attack detection method according to any one of claims 1 to 7 are implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the advanced persistent threat attack detection method as described in any one of claims 1 to 7 are implemented.

Images