Attack tracing method and device based on system call automaton

Abstract

The application discloses an attack tracing method and device based on a system call automaton, and the method comprises the following steps: generating a control flow graph of an application function by performing static analysis on a binary file of the application; constructing a directed graph of system calls according to the control flow graph; adopting an uncertain finite automaton as a state transition representation of application system calls for a node set and a directed edge set in the directed graph; constructing an application system call automaton; dividing an execution unit of a standard format log generated in advance by using the application system call automaton; constructing a system-level tracing graph; and forming an attack path and an attack influence respectively by summarizing nodes of a dependent symptom event in the system tracing graph. The attack tracing method based on the system call automaton can solve the problem that the existing technology is difficult to apply to a practical production environment for relieving a dependent explosion by using an execution unit divided in a manner based on program insertion and collected high-level semantic information of an application log.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to an attack tracing method and device based on system call automaton. BACKGROUND

[0002] With the development and innovation of computer technology and communication technology, network has been closely related to people's daily life. The comprehensive coverage of network infrastructure and the continuous innovation of emerging network applications make the Internet user scale show a sustained expansion trend. The huge network inevitably attracts the attention of hackers and causes network attacks. Advanced persistent threat (APT) has recently become one of the most critical cyber space threats faced by enterprises and institutions. APT attack is a hidden and long-running computer network intrusion, usually with a certain purpose.

[0003] The above-mentioned APT attack tracing method mostly uses audit logs to construct a tracing graph, and uses its powerful semantic expression ability and attack history association ability to model attacks, so as to construct a complete attack path and analyze attack impact. However, in the background of long-time running of servers and generation of a large number of logs, the attack tracing method based on the tracing graph attributes the attack events to the process level, and this coarse-grained assumption will cause the dependency explosion phenomenon when analyzing the attack path.

[0004] Due to the difficulty in quickly constructing a complete attack path in a large number of event associations, the usability of the attack tracing algorithm in the actual security scene is greatly reduced. In order to solve the problem of dependency explosion, the related technology proposes the concept of execution unit, which can limit the dependency between system objects to the execution unit level. Specifically, in the implementation process, the attack tracing method can divide the process into execution units by introducing high-level semantic information reflecting the structure of the application program. However, the form of obtaining high-level semantic information is generally program instrumentation and collecting application program logs. The program instrumentation method needs to modify the execution file of the program, and the modification permission of the executable file is not allowed in the real production environment, and the program instrumentation will bring great time and space overhead in the production environment, thus lacking universality. The method of using application program logs also needs the application program to provide a log function with a standard format, and the additional time and space overhead generated at runtime puts higher requirements on system performance. SUMMARY

[0005] The application provides an attack tracing method and device based on a system call automaton, which effectively divides an execution unit by using an automaton reflecting the system call of a program structure and providing high-level semantic information of an application program, thereby solving the problem that the execution unit divided by using the high-level semantic information obtained by the prior art based on program insertion and collection of application program logs is difficult to apply to a practical production environment for relieving dependence explosion.

[0006] In a first aspect, the application provides an attack tracing method based on a system call automaton, which comprises the following steps.

[0007] The binary file of the application program is statically analyzed to generate a control flow graph of the application program function, and a directed graph of the system call is constructed according to the control flow graph, wherein the calling relationship between the application program functions is recorded in the directed graph of the system call.

[0008] An uncertain finite automaton is used as the state transition representation of the system call of the application program for the node set and the directed edge set in the directed graph of the system call, and an application program system call automaton is constructed.

[0009] The application program system call automaton is used to divide the execution unit of the pre-generated standard format log, and a system-level tracing graph representing the causal relationship between system events is constructed according to the log of the divided execution unit, wherein the standard format log is obtained by field extraction on the log provided by an audit module.

[0010] Attack analysis is performed on a symptom event based on the system-level tracing graph, and nodes dependent on the symptom event are summarized in the system tracing graph to form an attack path and an attack impact, respectively.

[0011] Optionally, the static analysis of the binary file of the application program to generate the control flow graph of the application program function and the construction of the directed graph of the system call according to the control flow graph comprise the following steps.

[0012] The binary file of the application program is statically analyzed by using the export control flow graph function provided by the static decompilation software to generate a control flow graph describing the function call of the application program.

[0013] For each application program function, the node information and the directed edge information are extracted from the control flow graph describing the function call of the corresponding application program, the preset instructions in the nodes are retained, and the directed graph of the system call is constructed.

[0014] Optionally, after the static analysis of the binary file of the application program to generate the control flow graph of the application program function and the construction of the directed graph of the system call according to the control flow graph, the method further comprises the following steps.

[0015] recorded in the directed graph of the system call, and the node information of the system call, respectively, obtain the empty node, the unreachable node and the equivalent node in the directed graph of the system call;

[0016] By eliminating the empty node and the unreachable node in the directed graph of the system call, and merging the equivalent node, the graph structure of the system call directed graph is optimized.

[0017] Optionally, the method further comprises:

[0018] The entry node in the directed graph of the system call is adjusted by using the constructed pre-node, if the entry node is not empty, an edge with the source node being the pre-node and the destination node being the entry node is added, if the entry node is empty, the edge connected with the entry node is replaced, so as to uniformly take the pre-node as the entry node of the directed graph of the system call;

[0019] The exit node in the directed graph of the system call is adjusted by using the constructed post-node, for all nodes with out-degree of zero in the directed graph of the system call, an edge with the node as the source node and the post-node as the destination node is added.

[0020] Optionally, the uncertain finite automaton is used as the state transition representation of the application program system call for the node set and the directed edge set in the directed graph of the system call, and the application program system call automaton is constructed, comprising:

[0021] The function call automaton is constructed for the node set and the directed edge set in the directed graph of the system call;

[0022] The application program system call automaton is constructed by performing depth-first search on the application program entry function based on the function call automaton.

[0023] Optionally, the determined finite automaton comprises a finite state set, a symbol set and a transition function, the initial state and the termination state set are included in the finite state set, the function call automaton is constructed for the node set and the directed edge set in the directed graph of the system call, comprising:

[0024] An empty uncertain finite automaton is constructed, the node numbered as the initial value is taken as the initial state of the finite state set, and the node numbered as the termination value is added to the termination state set of the finite state set;

[0025] For each node in the node set, add its number to the finite state set and its node content to the input symbol set without repetition, and for each directed edge in the directed edge set, add its rule to the transition function, which represents that the source node state of the directed edge will transfer to the destination node state if the destination node content is received as the input symbol.

[0026] Optionally, the application program system call automaton is constructed based on the function call automaton by performing a depth-first search on the application program entry function, and includes:

[0027] The effective execution path of the application program throughout the life cycle is enumerated, and the effective execution path is searched in a depth-first manner starting from the entry function of the application program, and the state machines of the sub-functions in the function call automaton are connected through the preset instructions in the nodes;

[0028] When a preset sub-function is traversed, the preset sub-function is locally searched in a depth-first manner without leaving the address space of the preset sub-function, and after the local depth-first search is completed, the automaton of the current function is cached in the memory, and the local depth-first search expands the automaton of the lower function through the preset instructions in the nodes.

[0029] Optionally, the application program system call automaton is constructed based on the function call automaton by performing a depth-first search on the application program entry function, and includes:

[0030] The system calls in the pre-generated standard log are matched with the state transitions of the application program system call automaton, and in the matching process, a continuous matching mode is called to handle the case of multiple state transition matching items, and a forward-looking matching and backward-looking matching mode is called to handle the case of no state transition matching item, to identify logs belonging to the same execution unit and divide the execution unit;

[0031] According to the log of the divided execution unit, events are added to the trace graph, and unit-level events and system-level events are distinguished when adding events, to construct a system-level trace graph representing the causal relationship between system events, wherein the data outflower in the trace graph is the subject of the event, the data inflower is the object of the event, and the event is a directed edge pointing from the subject to the object.

[0032] Optionally, the system-level trace graph is used as a basis for performing attack analysis on a symptom event, and nodes dependent on the symptom event are summarized in the system trace graph to form an attack path and an attack impact, respectively.

[0033] performing backward attack analysis on the symptom event based on the system-level trace graph, starting from the symptom event, performing backtracking in a reverse data flow direction on the trace graph, if a node backtracked to directly or indirectly inputs data to a subject or object of the symptom event, then the node is summarized into an attack path;

[0034] performing forward attack analysis on the symptom event based on the system-level trace graph, starting from the symptom event, performing searching in a data flow direction on the trace graph, if a node searched to directly or indirectly receives data input from a subject or object of the symptom event, then the node is summarized into attack influence.

[0035] In a second aspect, an embodiment of the present application provides an attack trace method and device based on system call automaton, the device comprises:

[0036] a generating unit configured to generate a control flow graph of application functions by performing static analysis on a binary file of the application, and construct a directed graph of system calls according to the control flow graph, wherein the directed graph of system calls records calling relationships between the application functions;

[0037] a constructing unit configured to construct an application system call automaton by using an uncertain finite automaton as a state transition representation of application system calls for a node set and a directed edge set in the directed graph of system calls;

[0038] a dividing unit configured to divide a pre-generated standard format log into execution units using the application system call automaton, and construct a system-level trace graph representing causal relationships between system events according to logs of the execution units obtained by the division, wherein the standard format log is obtained by performing field extraction on logs provided by an audit module;

[0039] an analyzing unit configured to perform attack analysis on a symptom event based on the system-level trace graph, and summarize nodes dependent on the symptom event in the system trace graph to form an attack path and attack influence, respectively.

[0040] Optionally, the generating unit comprises:

[0041] a generating module configured to perform static analysis on a binary file of the application by using an export control flow graph function proposed by static decompilation software, and generate a control flow graph describing function calls of the application;

[0042] a constructing module configured to, for each application function, extract node information and directed edge information from the control flow graph describing function calls of the corresponding application function, retain preset instructions in the nodes, and construct a directed graph of system calls.

[0043] Optionally, the device further comprises:

[0044] The acquisition unit is configured to, after the control flow graph of the application function is generated by performing the static analysis on the binary file of the application program and the directed graph of the system call is constructed according to the control flow graph, acquire the empty node, the unreachable node and the equivalent node in the directed graph of the system call respectively by using the edge and node information recorded in the directed graph of the system call.

[0045] The optimization unit is configured to perform the elimination processing on the empty node and the unreachable node in the directed graph of the system call and perform the merging processing on the equivalent node, so as to perform the graph structure optimization on the directed graph of the system call.

[0046] Optionally, the apparatus further comprises:

[0047] The adjustment unit is configured to adjust the entry node in the directed graph of the system call by using the constructed pre-node, add an edge with a source node being the pre-node and a destination node being the entry node if the entry node is not empty, and replace the edge connected with the entry node if the entry node is empty, so as to uniformly take the pre-node as the entry node of the directed graph of the system call.

[0048] The adjustment unit is further configured to adjust the exit node in the directed graph of the system call by using the constructed post-node, and add an edge with the post-node as a destination node for all nodes with an out-degree of zero in the directed graph of the system call.

[0049] Optionally, the construction unit comprises:

[0050] The first construction module is configured to construct the function call automaton for the node set and the directed edge set in the directed graph of the system call.

[0051] The second construction module is configured to construct the application program system call automaton by performing the depth-first search on the application program entry function based on the function call automaton.

[0052] Optionally, the first construction module is specifically configured to construct an empty uncertain finite automaton, take a node numbered as an initial value as an initial state of a finite state set, and add a node numbered as a termination value to a termination state set of the finite state set.

[0053] The first construction module is specifically further configured to add the number of each node in the node set to the finite state set and add the node content of the node to an input symbol set without repetition, and add a rule of each directed edge in the directed edge set to a transition function, so as to construct the function call automaton, wherein the rule represents that the source node state of the directed edge will be transferred to the destination node state when the destination node content is received as the input symbol.

[0054] Optionally, the second construction module is specifically configured to enumerate valid execution paths of the application program in the whole life cycle, and perform a depth-first search on the valid execution paths starting from an entry function of the application program, and automatically link state machines of sub-functions in a function call through preset instructions in a node.

[0055] The second construction module is further configured to perform a local depth-first search on the preset sub-function without leaving an address space of the preset sub-function when the preset sub-function is traversed, and cache an automaton of the current function in the memory after the local depth-first search is completed, and the local depth-first search expands an automaton call of a lower function through preset instructions in a node.

[0056] Optionally, the division unit comprises:

[0057] The division module is configured to perform state transition matching between system calls in a pre-generated standard log and the application program system call automaton, and in the matching process, a continuous matching mode is called to process a case of multiple state transition matching items, and a forward-looking matching mode and a backward-looking matching mode are called to process a case of no state transition matching item, so as to identify logs belonging to one execution unit and divide the logs to obtain an execution unit.

[0058] The construction module is configured to add events to a traceability graph according to logs of the divided execution unit, and distinguish unit-level events and system-level events when the events are added, and construct a system-level traceability graph representing a causal relationship between system events, wherein a data outflower in the traceability graph is a subject of an event, a data inflower is an object of the event, and the event is a directed edge from the subject to the object.

[0059] Optionally, the analysis unit is specifically configured to perform backward attack analysis on a symptom event based on the system-level traceability graph, and perform backtracking in a reverse data flow direction from the symptom event on the traceability graph, and if a node that is backtracked directly or indirectly inputs data to a subject or an object of the symptom event, the node is summarized to an attack path.

[0060] The analysis unit is specifically configured to perform forward attack analysis on the symptom event based on the system-level traceability graph, and perform a search in a forward data flow direction from the symptom event on the traceability graph, and if a node that is searched directly or indirectly receives data input from the subject or the object of the symptom event, the node is summarized to an attack influence.

[0061] In a third aspect, an embodiment of the present application provides a storage medium having executable instructions stored thereon, and the instructions are executed by a processor to enable the processor to implement the method in the first aspect.

[0062] In a fourth aspect, an apparatus for attack tracing based on a system call automaton is provided, comprising:

[0063] one or more processors;

[0064] a memory device storing one or more programs,

[0065] wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method of the first aspect.

[0066] From the above, the attack tracing method and apparatus based on a system call automaton provided by the embodiments of the present application can generate a control flow graph of an application program function by performing static analysis on a binary file of the application program, construct a directed graph of system calls according to the control flow graph, record the calling relationship between the application program functions in the directed graph of system calls, and use an uncertain finite automaton as a state transition representation of the system calls of the application program for the node set and the directed edge set in the directed graph of system calls, to build an application program system call automaton. The application program system call automaton is used to divide the execution units of a standard format log generated in advance, and a system-level tracing graph representing the causal relationship between system events is constructed according to the log of the divided execution units. The standard format log is obtained by field extraction on a log provided by an audit module. Attack analysis is performed on a symptom event based on the system-level tracing graph, and an attack path is formed by summarizing the nodes dependent on the symptom event in the system tracing graph. Compared with the prior art, the execution units are divided based on the high-level semantic information obtained by program instrumentation and collection of application program logs. The embodiments of the present application provide the high-level semantic information of the application program for the subsequent execution unit division process by constructing the system call automaton reflecting the program structure, thereby solving the problem that the execution unit division based on the high-level semantic information obtained by program instrumentation and collection of application program logs is difficult to apply to the actual production environment to alleviate the dependency explosion problem.

[0067] In addition, the embodiments of the present application can also achieve the following technical effects:

[0068] (1) By processing the program control flow graph into a graph structure convenient for program calculation, the system calls and control flow are extracted, which provides support for subsequent construction of the application program system call automaton.

[0069] (2) The log after dividing the execution units eliminates the irrelevant dependencies of the long-running processes, limits the dependencies within the execution unit category, and thereby alleviates the dependency explosion problem.

[0070] (3) The attack trace algorithm can identify the cause and complete attack process of attack events in the audit log, and analyze the consequences caused by the attack to the system, which helps security personnel analyze the attack scene and solves the dependence explosion problem caused by attack analysis of a large number of audit logs.

[0071] Of course, implementing any product or method of the present application does not necessarily require achieving all the advantages described above at the same time. BRIEF DESCRIPTION OF DRAWINGS

[0072] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application. Those skilled in the art can obtain other drawings according to these drawings without any creative effort.

[0073] Figure 1 A flowchart of an attack trace method based on system call automaton provided by an embodiment of the present application;

[0074] Figure 2 A data structure schematic diagram of system call directed graph provided by an embodiment of the present application;

[0075] Figure 3a A schematic diagram of eliminating empty nodes in directed graph provided by an embodiment of the present application;

[0076] Figure 3b A schematic diagram of eliminating unreachable nodes in directed graph provided by an embodiment of the present application;

[0077] Figure 3c A schematic diagram of adjusting entry and exit nodes provided by an embodiment of the present application;

[0078] Figure 3d A schematic diagram of merging equivalent nodes in directed graph provided by an embodiment of the present application;

[0079] Figure 4 A flowchart of dividing execution units provided by an embodiment of the present application;

[0080] Figure 5 A system-level trace graph after dividing execution units provided by an embodiment of the present application;

[0081] Figure 6a A flowchart of performing backward analysis on the trace graph provided by an embodiment of the present application;

[0082] Figure 6b A flowchart of performing forward analysis on the trace graph provided by an embodiment of the present application;

[0083] Figure 7 A framework schematic diagram of an attack trace procedure provided for an embodiment of the present application is shown in FIG. 1.

[0084] Figure 8 A component block diagram of an attack trace method and device based on a system call automaton provided for an embodiment of the present application is shown in FIG. 2. DETAILED DESCRIPTION

[0085] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative effort fall within the scope of protection of the present application.

[0086] It should be noted that the terms “include” and “have” and any variations thereof in the embodiments of the present application and the accompanying drawings are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device including a series of steps or units is not limited to the listed steps or units, but can optionally further include steps or units not listed, or can optionally further include other steps or units inherent to the process, method, product or device.

[0087] The present application provides an attack trace method and device based on a system call automaton. By constructing an automaton reflecting the program structure of system calls, high-level semantic information of an application program is provided for the process of subsequent execution unit division, thereby solving the problem that the manner of dividing the execution unit based on the high-level semantic information obtained by program instrumentation and collection of application program logs is difficult to apply to the actual production environment for mitigating dependency explosion. In the process of attack trace, for a long-running process, a corresponding application program structure is generally introduced as additional semantic information to assist the process of execution unit division. The existing algorithm generally introduces additional semantic information representing the program structure in the form of application program instrumentation and application program logs. However, the method of program instrumentation requires modification of the executable file, and the method of using application programs also requires the application program to provide a format specification log function, and the additional time and space overhead generated during runtime also imposes more stringent requirements on system performance.

[0088] The embodiments of the present application will be described in detail below.

[0089] Figure 1 A flowchart of an attack trace method based on a system call automaton provided for an embodiment of the present application is shown in FIG. 3. The method can include the following steps:

[0090] S100: generating a control flow graph of application functions by static analysis on the binary file of the application program, and constructing a directed graph of system calls according to the control flow graph.

[0091] In the directed graph of system calls, the calling relationship between application functions is recorded. In the assembly form of the binary, each function has a corresponding control flow graph, which represents the structural information of the function and shows the possible code execution path in the function. Here, the control flow graph is composed of basic code blocks and directed edges connecting the basic code blocks. Each basic code block contains a number of sequentially executed assembly instructions, and each directed edge represents the transfer of execution flow from the source code block to the destination code block. After the first code block is executed, the control flow graph will select the second or third code block for execution according to the parameters, and return after execution is completed. The basic code block will contain a call instruction and a retn instruction after the function execution is completed.

[0092] It can be understood that in the static binary analysis stage, the algorithm will perform disassembly processing on the binary file before the binary file is executed. For each function of the application program, an assembly form control flow graph is generated. The information contained in the control flow graph is relatively redundant, in addition to the system call information, there are other assembly instructions, and these assembly instructions do not play a role in subsequent analysis. In order to further obtain the system call information, it is necessary to perform text extraction on the description file of the control flow graph to obtain the system call information. At the same time, a suitable data structure needs to be designed to represent the execution flow of the system call, that is, the directed graph of the system call, and the directed graph of the system call is used to store the possible execution path of the system call. Specifically, the export control flow graph function proposed by the static decompilation software can be used to perform static analysis on the binary file of the application program to generate a control flow graph describing the function calls of the application program. Further, for each application function, node information and directed edge information are extracted from the control flow graph describing the function calls of the corresponding application function, the preset instructions in the node are retained, and a directed graph of system calls is constructed.

[0093] In actual application scenarios, the process of obtaining the control flow graph description file of the application function can rely on the IDA Python plug-in provided by the decompilation software IDA Pro, and IDA Pro supports exporting the flow control graph of the function in the Geometric Description Language (GDL) file format. In the process of generating the control flow graph of the application function, the name and address list of all functions can be obtained according to the application name, and for each sub-function, the GDL file of the current function is generated by using the export control flow graph function provided by IDA Pro. The GDL file consists of three parts, namely the layout information of the control flow graph, the node information and the directed edge information. According to the node information and the directed edge information, the system call directed graph can be constructed. In the process of constructing the system call directed graph according to the control flow graph, the GDL file can be processed by text segmentation to obtain the node information set and the directed edge information set. Since there is redundant information in the description of the node information and the directed edge information in the file, further formatting extraction is needed. For each node information in the node information set, the name and the label attribute are extracted respectively, which represent the name of the basic code block and the assembly instructions contained in the code block.

[0094] In the assembly instructions, the object of the call instruction is a user function or a library function. If the instruction object is a library function and the object belongs to the key set of the mapping dictionary, the system call corresponding to the object is extracted. At the same time, in order to preserve the control flow information, the non-empty function called by the call instruction and the retn instruction are also extracted, where the non-empty function refers to the user function whose corresponding system call directed graph is not empty. Specifically, for the label attribute, the non-empty function or system call called by the call instruction and the retn instruction are further extracted, and then the constituent pair of the current code block name and the simplified assembly instruction (name, new label) is added to the node information set of the control flow graph. Similarly, for each directed edge information in the directed edge information set, the data source and the target attribute are further extracted respectively, which represent the source node and the destination node of the directed edge, and the constituent pair (source node, destination node) is added to the directed edge set of the control flow graph. At this time, the data structure describing the system call directed graph is obtained, and the system call directed graph of each function control flow graph can be obtained through the node set and the directed edge set in the system call directed graph.

[0095] An exemplary, Figure 2 A data structure of a system call directed graph is shown, which has 9 nodes and 11 edges in the directed graph. Among them, there are system calls in nodes 2, 4 and 5, respectively. There are 3 write system calls in node 2, and there is one write system call in nodes 4 and 5, respectively.

[0096] Further need to be explained, the system call directed graph is an important data structure representing application system structure information, which shows the system call control flow of the application program. However, there are some empty nodes, unreachable nodes and equivalent nodes in the directed graph extracted from the control flow graph. The empty nodes are caused by the fact that the program block may not contain call information, but the corresponding node of the program block is still retained in the process of building the graph. The unreachable node refers to the corresponding node of the program block which only has an outgoing edge but no incoming edge. The existence of empty nodes and unreachable nodes does not affect the control flow graph of system calls, but it expands the size of the directed graph of system calls, making the structure of the directed graph complex. In order to achieve faster execution unit division, these nodes can be processed by elimination and merging to further reduce the size of the directed graph of system calls. Specifically, after constructing the directed graph of system calls, the edge and node information recorded in the directed graph of system calls can be used to obtain the empty nodes, unreachable nodes and equivalent nodes in the directed graph of system calls, respectively. Then, by eliminating the empty nodes and unreachable nodes in the directed graph of system calls and merging the equivalent nodes, the graph structure of the directed graph of system calls can be optimized.

[0097] Further, in order to unify the entry and exit nodes in the directed graph, the entry node in the directed graph of system calls can be adjusted using the constructed pre-node after constructing the directed graph of system calls. If the entry node is not empty, a source node is added as the pre-node and the destination node is the entry node. If the entry node is empty, the edges connected to the entry node are replaced to unify the pre-node as the entry node of the directed graph of system calls. The exit node in the directed graph of system calls can be adjusted using the constructed post-node. For all nodes with out-degree zero in the directed graph of system calls, an edge is added from the node to the post-node.

[0098] In the directed graph of system calls, some nodes corresponding to the code block do not contain call instructions, or do not contain library functions belonging to the mapping dictionary key set, which become empty nodes in the directed graph. The label of the node is empty. The existence of empty nodes not only occupies storage resources, but also adds time overhead to the subsequent process of constructing automata. Therefore, by eliminating the empty nodes in the directed graph, the structure of the directed graph can be simplified. For example, Figure 3a The process of eliminating empty nodes is shown. The original directed graph of system calls has 9 nodes. After eliminating the empty nodes, the 0th node as the function entry, the 2nd, 4th and 5th nodes generating calls, and the 7th node generating retn instructions are retained. At the same time, the directed edges between the retained nodes are also adjusted under the premise of maintaining the control flow graph unchanged.

[0099] In the directed graph of a system call, there exist nodes that are not function entry points and only serve as source nodes for directed edges, but have no directed edges pointing back to them. Such nodes are unreachable in the actual control flow graph; therefore, eliminating unreachable nodes in the directed graph simplifies its structure. For example, Figure 3b The process of eliminating unreachable nodes is shown. The directed graph called by the system originally had 8 nodes. Node 4 is a non-entry node with an in-degree of 0, which is an unreachable node. Therefore, the directed edges from nodes 4 to 5 and 6 are eliminated, and the isolated nodes 4 and 5 are eliminated, thus completing the optimization of eliminating unreachable nodes.

[0100] The above embodiments need to be improved. Figure 3a and Figure 3b It should be further explained that during the process of eliminating null and unreachable nodes, considering the special nature of node 0 in the directed graph as the function entry point, this node was always kept unchanged. To unify the entry nodes of the directed graph, it is necessary to further adjust the node numbered 0 in the directed graph. Similarly, it is also necessary to uniformly add exit nodes to the directed graph. Specifically, in the process of adjusting the entry nodes of the directed graph, a predecessor node is first constructed and numbered -1. When the entry node 0 of the directed graph is not null, the source node is adjusted to the predecessor node -1, and the destination node is the directed edge of node 0. When node 0 is null, in order to uniformly use the predecessor node as the entry node of the directed graph, the edges connected to node 0 are replaced as follows: The source node set of the incoming edges of node 0 is constructed, and the corresponding incoming edges are replaced with directed edges from the source node set pointing to the predecessor node -1; the destination node set of the outgoing edges of node 0 is constructed, and the corresponding outgoing edges are replaced with directed edges from the destination node set pointing to the predecessor node -1. During the adjustment of the exit node of the directed graph, a successor node numbered -2 ​​is constructed. For all nodes in the directed graph with an out-degree of 0, a directed edge is added pointing from that node to the successor node -2. For example, Figure 3c The process of adjusting the entry and exit nodes in a directed graph is shown. After optimization, the directed graph called by the system has 5 nodes. Node 0 is the entry node, which is an empty node. Node 0 can be directly replaced by the preceding node -1. Node 7 is the exit node with an out-degree of 0. A directed edge is added from node 7 to the following node -2 to complete the adjustment of the entry and exit nodes in the directed graph.

[0101] In the directed graph of system calls, there exist two nodes whose node content, the source node of their incoming edges, and the destination node of their outgoing edges are exactly the same. These two nodes are equivalent nodes in the directed graph, and their structure can be simplified by merging these equivalent nodes. For example, Figure 3dThe process of merging equivalent nodes is shown. The directed graph of system calls has 7 nodes, and the 4th node and the 5th node contain the same write system call, and the source nodes of the incoming edges of the two nodes are both node-1, and the destination nodes of the outgoing edges are both node 3. It can be determined that the 4th node and the 5th node are equivalent nodes. The merging of equivalent nodes is completed by eliminating the edges connected to the 4th node or the 5th node and removing the 4th node or the 5th node.

[0102] S110: An uncertain finite automaton is used as a state transition representation of application system calls for the node set and the directed edge set in the directed graph of system calls to construct an application system call automaton.

[0103] It can be understood that in order to better perform the division unit, it is necessary to construct an application system call automaton. Here, the optimized directed graph of system calls can be used to construct the application system call automaton. The optimized directed graph of system calls effectively reduces the size of the graph and improves the division effect of the subsequent execution unit. Specifically, a function call automaton can be constructed for the node set and the directed edge set in the directed graph of system calls, and the function call automaton can be used as a basis to construct an application system call automaton by performing a depth-first search on the application entry function.

[0104] In the process of constructing the function call automaton, an empty uncertain finite automaton can be constructed, a node numbered as an initial value can be used as an initial state of the finite state set, a node numbered as a termination value can be added to the termination state set of the finite state set, and further, for each node in the node set, its number can be added to the finite state set, and its node content can be added to the input symbol set without duplication, and for each directed edge in the directed edge set, its rule can be added to the transition function, to construct the function call automaton. Here, the rule represents that the source node state of the directed edge will be transferred to the target node state when the target node content is received as the input symbol. In actual application scenarios, first, an empty uncertain finite automaton NFA is constructed, then a node numbered as-1 is used as the initial state S0, a node numbered as-2 is added to the termination state set F0, for each node in the directed graph, its number is added to the finite state machine set S, and its node content is added to the symbol set ∑ without duplication, for each directed edge e in the directed edge set, there is φ(e.source, e.target.label), and it is added to the transition function f. φ is a rule in the transition function, which represents that the source node state of e will be transferred to the target node state of e when the target node content of e is received as the input symbol.

[0105] After building the function system call automaton, the complete application system call automaton can be further built, which needs to enumerate the valid execution paths of the application in the entire life cycle. However, extracting all execution paths is not a process of directly performing a priority search on each function, and the following three situations need to be additionally considered:

[0106] (1) The same function can be called by different callers, and therefore has to be traversed multiple times.

[0107] (2) The call instruction of the called function should be matched with the corresponding return instruction retn.

[0108] (3) The application uses loop and recursive functions, which also need to be traversed multiple times.

[0109] For situation (1), the method of caching the function automaton can be used for processing. For situation (2), the initial state and the termination state set of the function automaton can be used for processing. For (3), the method of fixed point iteration can be used to solve the loop and recursive functions, that is, the function is continuously traversed until no new execution path is added to the traversal process, at which time it can be considered that the loop or recursive process is completed.

[0110] In the process of building the application system call automaton, the valid execution paths of the application in the entire life cycle can be enumerated, and the application entry function is taken as the starting point to perform a depth-first search on the valid execution paths. The state machines of the sub-functions of the function call automaton are connected through the preset instructions in the node. When a preset sub-function is reached, the preset sub-function is locally traversed without leaving the address space of the preset sub-function. After the local depth-first search traversal is completed, the automaton of the current function is cached in the memory. The automaton of the sub-function is called through the preset instructions in the node. In actual application scenarios, in order to build the system call automaton of the application, the entry function of the application is taken as the starting point, and the possible execution paths are searched in depth-first manner. The state machines of the sub-functions are connected through the call instructions and retn instructions. When the sub-function fun is reached, since its initial state and termination state set have been determined, it can be locally traversed without leaving the address space of the function fun. The local depth-first search traversal still expands the automaton of the lower function through the call instructions and retn instructions. After the local traversal is completed, in order to speed up the traversal process, the automaton of the current function is cached in the memory. Especially for situations (1) and (3), the overhead of loading the current function automaton again is saved.

[0111] S120: using the application system call automaton, dividing the pre-generated standard format log into execution units, and constructing a system-level provenance graph representing the causal relationship between system events according to the logs of the divided execution units.

[0112] The standard format log is obtained by field extraction of the log provided by the audit module. The system call field in the standard format log entry is matched with the state transition of the system call in the application system call automaton to divide the execution units. In order to construct the standard format log, further analysis of the log entries of different types of values is required to extract the values of some fields and construct a new log sequence. In the process of extracting the system call sequence, the audit log is traversed. For a group of log entries of different types, different key fields are extracted according to the type to generate a new standard format log entry.

[0113] It can be understood that the new log entry here simplifies the fields of the audit log while retaining the valid information of the audit log, and constructs a standard log format. The standard log format reduces the size of the log on the one hand, and provides the information required for subsequent log division and attack tracing on the other hand.

[0114] Specifically, the system call in the pre-generated standard log can be matched with the state transition of the application system call automaton, and the continuous matching mode can be called to handle the case of multiple state transition matching items in the matching process, and the forward-looking matching and backward-looking matching modes can be called to handle the case of no state transition matching item to identify logs belonging to the same execution unit, divide the execution units, and further add events to the provenance graph according to the logs of the divided execution units, and distinguish between unit-level events and system-level events when adding events to construct a system-level provenance graph representing the causal relationship between system events, wherein the data outflower in the provenance graph is the subject of the event, the data inflower is the object of the event, and the event is a directed edge from the subject to the object.

[0115] Exemplarily, Figure 4The flow of dividing the execution unit is shown. In the process of matching the system call sequence of the standard log with the system call automaton of the application program, for the candidate system call element in the sequence, the corresponding system call state in the automaton needs to be found, after completing the current system call state transition matching, the next system call in the sequence is taken as the candidate system call element, and the matching is performed with the neighbor state of the current state in the automaton. If the candidate system call element and the system call in a certain neighbor state meet the unique matching condition, the unit described in the current standard log record is marked, and the process continues until the matching process is completed. If the unique matching is not completed, multiple matching or no matching may occur, and the continuous matching, forward-looking matching and backward-looking matching are used for processing. If the elements of the system call sequence fail to complete the unique matching with the system call states in the automaton, one of the possible situations is that the current element can be matched with multiple states in the automaton, that is, multiple matching problem occurs. For this situation, the continuous matching method can be used to solve, that is, by reading in multiple continuous logs as the matching items, the multiple continuous states in the automaton are found and matched, that is, the path selection is specified through the continuous mode. It should be noted that the number of continuous logs in this process should not be too much, otherwise the number of paths to be searched will quickly increase, so the threshold of continuous matching needs to be set. Another situation that the elements of the system call sequence fail to complete the unique matching with the system call states in the automaton can be that due to the omission of the execution path when constructing the system call automaton of the application program, the current element cannot find a matching state in the automaton. For this situation, the forward-looking matching can be used for processing. Specifically, if the current system call element has no matching state in the automaton, the current state is allowed to enter the next state again to try to match the current element with the next state. If the unique matching is completed in the next state, the forward-looking matching process ends. If multiple matching occurs in the next state, the conflict resolution matching is turned to. If the matching state is still not found, the forward-looking matching process continues. It should be noted that the forward-looking matching process also cannot be carried out unlimitedly, and the threshold number of times of forward-looking can be set here, and the forward-looking matching process ends when the number of times of forward-looking reaches the threshold number of times.

[0116] It can be understood that the failure of the forward-looking matching process is because the current system call has already belonged to a new execution unit, so that the state transition matching in the previous execution unit cannot be completed. Here, the backward-looking matching is introduced to transfer the matching state to the entrance of the execution unit for matching. Similarly, the threshold number of times can also be set for the backward-looking matching, and when the threshold number of times is reached and the matching still fails, the target entry to which the system call belongs is divided into an execution unit alone, becoming an isolated execution unit. The matching of the next log entry still starts from the entrance of the execution unit, and finally the continuous isolated execution units can be combined.

[0117] The embodiment of the present application utilizes the standard log format to match the state transition with the application program calling system automaton, and solves the multiple matching and no matching problems in the matching process through continuous matching, forward looking matching and backward looking matching, divides the standard format log into several execution units, and eliminates the irrelevant dependence of the long running process after dividing the execution units, limits the dependence in the execution unit category, thereby relieving the dependence explosion problem, and the divided execution unit is also used for constructing the trace graph in the subsequent attack analysis stage.

[0118] After the division of the execution unit is completed, the system level trace graph representing the previous causal relationship of the system event can be constructed according to the definition of the trace graph, and specifically, for the system entities such as processes, threads, files and sockets, the data outgoer is taken as the subject of the event, and the data inflower is taken as the object of the event. However, for the trace graph after the division of the execution unit, a long running process will be regarded as different entities between different execution units. Therefore, when adding events to the trace graph, it is necessary to distinguish the unit level and the system level events, and the subject of the unit level event should be displayed by combining the process identifier and the unit identifier.

[0119] Among them, the edge direction of the trace graph represents the data flow direction. If an execution unit or a system entity u receives input from other system entity v, for example, u reads the data of v, a directed edge from v to u is added in the trace graph. Similarly, if the execution unit or the system entity u outputs data to other system entity v, for example, u writes or updates data to v, a directed edge from u to v is added in the trace graph. In addition, the time of the event will be marked as the information of the edge, so as to determine the time sequence information between events. In this way, the entity in the data output event only depends on the input event entity in the execution unit, and no longer depends on all previous input events in the whole process entity life cycle.

[0120] An exemplary, Figure 5 The system level trace graph after the division of the execution unit is shown. In the figure, the browser is taken as a long running application, and a large number of sockets and files are associated in the life cycle, so each file depends on all the sockets accessed before it. But the actual browser may only download a file from a single socket, that is, the file only depends on a specific socket. In the trace graph after the division of the execution unit, the browser is divided into several execution units, and the associated sockets and files in the life cycle also belong to different execution units accordingly, and each file only depends on the socket in the execution unit to which it belongs. Through the division of the execution unit, the dependence explosion problem caused by the browser can be relieved.

[0121] S130: Based on the system-level source graph, perform attack analysis on the symptom events, and summarize the nodes that depend on the symptom events in the system source graph to form attack paths and attack impacts respectively.

[0122] In this embodiment of the invention, the source graph's ability to abstractly represent system objects and events and its historical correlation capabilities are utilized to analyze attacks. When security devices such as terminal detection and response systems detect an attack event and issue a warning, the event that received the warning is defined as a symptom event.

[0123] After constructing the system-level source graph, attack analysis can be performed on symptom events. This attack analysis builds the system-level source graph based on logs after dividing execution units, and uses it for backward and forward analysis to generate an attack analysis report. The attack analysis includes a description of the attack path and its impact on the system. Specifically, backward attack analysis is performed on symptom events based on the system-level source graph. Starting from the symptom event, the backtracking proceeds in the reverse data flow direction on the source graph. If a node traced back directly or indirectly inputs data to the subject or object of the symptom event, that node is included in the attack path. Forward attack analysis is performed on symptom events based on the system-level source graph. Starting from the symptom event, the forward search proceeds in the forward data flow direction on the source graph. If a searched node is directly or indirectly affected by data input from the subject or object of the symptom event, that node is included in the attack impact.

[0124] For example, Figure 6a The diagram illustrates the backtracking process on the source map. When EDR issues an alert for the creation of a tab and the execution of a malicious script, backtracking begins with event 6 as the symptom event. All events that occurred before the symptom event and directly or indirectly output data to entities within the symptom event are added to the attack path. Specifically, when the browser performs attack analysis, only the browser execution unit accessing the malicious socket, i.e., browser 1, is added to the attack path; other browser units are not analyzed. Through backtracking of the symptom event, it was discovered that the attack entered the host through the malicious socket, and the complete path from the intrusion to the symptom event was uncovered. Figure 6bThe flowchart illustrates the forward analysis process on the source graph. When EDR issues an alert for an event involving the creation of a tab and the execution of a malicious script, forward analysis begins with event 6 as the symptom event. All events that occur after the symptom event and directly or indirectly receive entity data from it are included in the attack impact. Through forward analysis of the symptom events, it was discovered that the attack deleted important text and malicious scripts from the system, attempting to erase attack traces, thus clarifying the impact from the symptom event to the attack's occurrence. Here, a system-level source graph is constructed using the standard log format after dividing execution units. When EDR issues an alert, the alerted event is marked as a symptom event on the source graph. Based on the symptom events, attack analysis is conducted on the source graph. Starting with the symptom events, the attack analysis performs both reverse data flow analysis to construct the attack path and forward data flow analysis to analyze the attack impact.

[0125] This invention employs application control flow graphs as additional semantic information to assist in the partitioning of execution units. Compared to program instrumentation and application logs, control flow graphs are a more readily available form of information reflecting program structure, requiring no special application specifications, and without incurring additional time and space overhead during system runtime. The system call information contained in the application function control flow graphs also exists in the system audit logs. Therefore, system calls can be used as common elements to match the audit logs with the application control flow, thereby completing the partitioning of execution units.

[0126] In practical application scenarios, the framework for attack attribution tracing is as follows: Figure 7 As shown, Figure 7 The process mainly includes four stages: automaton construction, audit log analysis, execution unit partitioning, and attack analysis.

[0127] (1) In the automaton construction phase, the system call automaton of the current function needs to be constructed based on the graph information provided by the nodes and edges of the optimized directed graph. The function system call automaton represents the state transitions that occur from the entry point of the current function according to different system calls until leaving the address space of the current function. By analyzing the call and retn instructions, the system call automata of each function can be chained together to construct a complete application system call automaton. The application system call automaton describes all possible system call state transition paths in the program's lifecycle, providing important program structure information for the subsequent execution unit partitioning process.

[0128] (2) In the audit log analysis phase, it is necessary to generate standard format logs according to the logs provided by the audit module of the operating system. For each system event, several log records will be generated. However, for different events, the log types used for description are different, and thus the information provided by the logs is also different. In order to uniformly describe system events, it is necessary to design a unified log format, i.e., a standard log format. The design of the standard log format needs to meet the following points: containing a system call key field used for dividing an execution unit, containing a field of system entity information used for constructing a trace graph, adding a field used for representing execution unit information, and reducing the number of fields as much as possible to reduce the amount of logs.

[0129] (3) In the execution unit division phase, an application system call automaton needs to be introduced as an auxiliary tool. The division of the execution unit is mainly aimed at long-running application programs, which will generate a large number of related entries in the system audit log, bringing inconvenience to attack analysis work. Therefore, in this case, the system call in the standard format log is matched with the state transition of the application system call automaton. In the matching process, if there are multiple state matching items, the method of continuous matching is called for processing, and if there is no state transition matching item, the methods of looking ahead and looking back are called for processing. In this way, the same execution log unit is identified, and thus the division of the execution unit of the related log of the application program is completed.

[0130] It can be understood that the division of the execution unit of the long-time application program log reduces a large number of irrelevant dependencies, effectively alleviating the dependency explosion problem. Between the data outputs in an execution unit, only the data input events in the unit are dependent, and no longer dependent on the data input events in other units.

[0131] (4) In the attack analysis phase, first, the system standard format log after the division of the execution unit is used to construct a system-level trace graph. Whenever the symptom time comes, attack analysis will be based on the trace graph and mainly divided into two aspects: backward analysis and forward analysis. The backward analysis takes the symptom event as the starting point and expands the analysis process in the reverse data flow direction on the trace graph, and directly or indirectly adds the events dependent on the symptom event to the attack path until the entry point of the attack is reached, thereby completing the construction of the attack path. The forward analysis takes the symptom event as the starting point and expands the analysis process in the order data flow direction on the trace graph, and directly or indirectly adds the events dependent on the symptom event to the attack impact until the attack onset event or the termination event is reached, thereby completing the analysis of the attack impact.

[0132] The attack tracing method based on the system call automaton provided by the embodiment of the present application comprises the following steps: performing static analysis on a binary file of an application program to generate a control flow graph of functions of the application program, constructing a directed graph of system calls according to the control flow graph, recording a calling relationship between the functions of the application program in the directed graph of system calls, using an uncertain finite automaton as a state transition representation of system calls of the application program for a node set and a directed edge set in the directed graph of system calls to construct an application program system call automaton, dividing an execution unit by using the application program system call automaton on a standard format log generated in advance, and constructing a system-level tracing graph representing a causal relationship between system events according to a log of the execution unit obtained by the division, wherein the standard format log is obtained by performing field extraction on a log provided by an audit module.

[0133] Based on the above embodiment, another embodiment of the present application provides an attack tracing method and device based on a system call automaton, as shown in the following table: Figure 8 The device comprises:

[0134] The generating unit 20 can be used for performing static analysis on a binary file of an application program to generate a control flow graph of functions of the application program, and constructing a directed graph of system calls according to the control flow graph, wherein the directed graph of system calls records a calling relationship between the functions of the application program.

[0135] The constructing unit 22 can be used for using an uncertain finite automaton as a state transition representation of system calls of the application program for a node set and a directed edge set in the directed graph of system calls to construct an application program system call automaton.

[0136] The dividing unit 24 can be used for dividing an execution unit by using the application program system call automaton on a standard format log generated in advance, and constructing a system-level tracing graph representing a causal relationship between system events according to a log of the execution unit obtained by the division, wherein the standard format log is obtained by performing field extraction on a log provided by an audit module.

[0137] The analysis unit 26 can be configured to perform attack analysis on a symptom event based on the system-level traceability graph, and aggregate nodes dependent on the symptom event in the system traceability graph to form an attack path and an attack impact, respectively.

[0138] In a specific application scenario, the generation unit 20 includes:

[0139] The generation module can be configured to perform static analysis on the binary file of the application program by using an export control flow graph function proposed by static decompilation software, and generate a control flow graph describing function calls of the application program.

[0140] The construction module can be configured to, for each application program function, extract node information and directed edge information from the control flow graph describing the corresponding application program function call, retain preset instructions in the node, and construct a directed graph of system calls.

[0141] In a specific application scenario, the apparatus further includes:

[0142] The acquisition unit can be configured to, after generating the control flow graph of the application program function by performing static analysis on the binary file of the application program, and constructing the directed graph of system calls according to the control flow graph, acquire empty nodes, unreachable nodes, and equivalent nodes in the directed graph of system calls by using edge and node information recorded in the directed graph of system calls.

[0143] The optimization unit can be configured to perform elimination processing on the empty nodes and the unreachable nodes in the directed graph of system calls, and perform merging processing on the equivalent nodes, to perform graph structure optimization on the directed graph of system calls.

[0144] In a specific application scenario, the apparatus further includes:

[0145] The adjustment unit can be configured to adjust an entry node in the directed graph of system calls by using the constructed front node, add an edge with a source node being the front node and a destination node being the entry node if the entry node is not empty, and replace edges connected to the entry node if the entry node is empty, so as to uniformly take the front node as the entry node of the directed graph of system calls.

[0146] The adjustment unit can also be configured to adjust an exit node in the directed graph of system calls by using the constructed back node, and add an edge with the back node as a destination node for all nodes with an out-degree of zero in the directed graph of system calls.

[0147] In a specific application scenario, the construction unit 22 includes:

[0148] The first constructing module can be used to construct a function call automaton for the node set and the directed edge set in the directed graph of the system call;

[0149] The second constructing module can be used to construct an application system call automaton by performing a depth-first search on an application entry function based on the function call automaton.

[0150] In a specific application scenario, the first constructing module can be specifically used to construct an empty uncertain finite automaton, take a node numbered as an initial value as an initial state of a finite state set, and add a node numbered as a termination value to a termination state set of the finite state set.

[0151] The first constructing module can be specifically used to add the number of each node in the node set to the finite state set, add the node content of the node to an input symbol set without repetition, add a rule of each directed edge in the directed edge set to a transition function, construct a function call automaton, and the rule indicates that a source node state of the directed edge will be transferred to a destination node state when the destination node content is received as an input symbol.

[0152] In a specific application scenario, the second constructing module can be specifically used to enumerate valid execution paths of an application in an entire life cycle, perform a depth-first search on the valid execution paths starting from an entry function of the application, and link state machines of sub-functions in the function call automaton through preset instructions in a node.

[0153] The second constructing module can be specifically used to perform a local depth-first search on a preset sub-function without leaving an address space of the preset sub-function when the preset sub-function is traversed, cache an automaton of a current function in a memory after the local depth-first search is completed, and expand an automaton call of a lower function through preset instructions in a node.

[0154] In a specific application scenario, the dividing unit 24 includes:

[0155] The dividing module can be used to perform state transition matching on a system call in a pre-generated standard log and the application system call automaton, handle a case where multiple state transition matching items are matched by calling a continuous matching mode in the matching process, handle a case where no state transition matching item is matched by calling a forward-looking matching mode and a backward-looking matching mode, identify logs belonging to a same execution unit, and divide the logs to obtain an execution unit.

[0156] The construction module can be used to add events in a log trace graph of an execution unit according to the division, and distinguish unit-level events and system-level events when adding the events, and construct a system-level trace graph representing a causal relationship between system events, wherein a data outflower in the trace graph is a subject of an event, a data inflower is an object of the event, and the event is a directed edge from the subject to the object.

[0157] In a specific application scenario, the analysis unit 26 can be specifically used to perform backward attack analysis on a symptom event based on the system-level trace graph, and perform backtracking in a reverse data flow direction from the symptom event on the trace graph, and if a node to be backtracked directly or indirectly inputs data to a subject or an object of the symptom event, the node is summarized to an attack path.

[0158] The analysis unit 26 can be specifically used to perform forward attack analysis on a symptom event based on the system-level trace graph, and perform searching in a forward data flow direction from the symptom event on the trace graph, and if a node to be searched directly or indirectly receives data input from a subject or an object of the symptom event, the node is summarized to attack influence.

[0159] Based on the above method embodiments, another embodiment of the present application provides a storage medium having executable instructions stored thereon, which, when executed by a processor, cause the processor to implement the above method.

[0160] Based on the above embodiments, another embodiment of the present application provides an attack trace method based on a system call automaton, comprising:

[0161] One or more processors;

[0162] A storage device for storing one or more programs,

[0163] When the one or more programs are executed by the one or more processors, the one or more processors implement the above method.

[0164] The above device embodiments correspond to the method embodiments and have the same technical effects as the method embodiments. For specific descriptions, refer to the method embodiments. The device embodiments are based on the method embodiments, and specific descriptions can be referred to the method embodiment part, which will not be repeated here. Those skilled in the art can understand that the drawings are only schematic diagrams of an embodiment, and the modules or flows in the drawings are not necessarily necessary for implementing the present application.

[0165] Those skilled in the art can understand that the modules in the device in the embodiments can be distributed in the device in the embodiments according to the embodiment description, or can be changed and located in one or more devices different from the embodiments. The modules in the above embodiments can be combined into one module, or can be further split into multiple sub-modules.

[0166] Finally, it should be noted that the above examples are only used to illustrate the technical solutions of the present application, and are not intended to limit the same; although the present application has been described in detail with reference to the foregoing examples, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing examples, or make equivalent replacements for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for attack tracing based on system call automaton, characterized in that, The method comprises: generating a control flow graph of application functions by static analysis on a binary file of the application, and constructing a directed graph of system calls according to the control flow graph, wherein the calling relationship between the application functions is recorded in the directed graph of system calls; adopting an uncertain finite automaton as a state transition representation of application system calls for a node set and a directed edge set in the directed graph of system calls to build an application system call automaton; dividing a pre-generated standard format log into execution units using the application system call automaton, and constructing a system-level provenance graph representing the causal relationship between system events according to the log of the divided execution units, wherein the standard format log is obtained by field extraction on a log provided by an audit module; performing attack analysis on a symptom event based on the system-level provenance graph, and summarizing nodes dependent on the symptom event in the system-level provenance graph to form an attack path and an attack impact, respectively; wherein the dividing of the pre-generated standard format log into execution units using the application system call automaton, and the constructing of the system-level provenance graph representing the causal relationship between system events according to the log of the divided execution units, comprise: matching system calls in the pre-generated standard log with state transitions of the application system call automaton, and processing the case of multiple state transition matching items in the matching process by calling a continuous matching mode, and processing the case of no state transition matching item by calling a forward-looking matching mode and a backward-looking matching mode, to identify logs belonging to one execution unit, and to divide the execution units; adding events to the provenance graph according to the log of the divided execution units, and distinguishing unit-level events and system-level events when adding the events, to construct the system-level provenance graph representing the causal relationship between system events, wherein a data outflower in the provenance graph is taken as a subject of an event, a data inflower is taken as an object of the event, and the event is taken as a directed edge pointing from the subject to the object.

2. The method of claim 1, wherein, The generating of the control flow graph of application functions by static analysis on a binary file of the application, and the constructing of the directed graph of system calls according to the control flow graph, comprise: performing static analysis on the binary file of the application by using an exported control flow graph function of static decompilation software to generate a control flow graph describing the calling of application functions; for each application function, extracting node information and directed edge information from the control flow graph describing the calling of the corresponding application function, retaining preset instructions in the node, and constructing the directed graph of system calls.

3. The method of claim 1, wherein, After the generating of the control flow graph of application functions by static analysis on a binary file of the application, and the constructing of the directed graph of system calls according to the control flow graph, the method further comprises: acquiring empty nodes, unreachable nodes and equivalent nodes in the directed graph of system calls, respectively, by using edge and node information recorded in the directed graph of system calls; The empty node and the unreachable node in the directed graph of the system call are eliminated, and the equivalent nodes are merged to optimize the graph structure of the system call directed graph.

4. The method of claim 3, wherein, The method further comprises: The entry node in the directed graph of the system call is adjusted by using the constructed pre-node, if the entry node is not empty, a source node is added as the pre-node, a destination node is added as the entry node, if the entry node is empty, the edges connected to the entry node are replaced, so that the pre-node is uniformly used as the entry node of the directed graph of the system call; The exit node in the directed graph of the system call is adjusted by using the constructed post-node, and for all nodes with out-degree of zero in the directed graph of the system call, an edge from the node with out-degree of zero to the post-node is added.

5. The method of claim 1, wherein, The uncertain finite automaton is used as the state transition representation of the application system call for the node set and the directed edge set in the directed graph of the system call, and the application system call automaton is constructed, comprising: The function call automaton is constructed for the node set and the directed edge set in the directed graph of the system call; The application system call automaton is constructed by performing depth-first search on the application entry function based on the function call automaton.

6. The method of claim 5, wherein, The uncertain finite automaton comprises a finite state set, a symbol set and a transition function, the initial state and the termination state set are included in the finite state set, the function call automaton is constructed for the node set and the directed edge set in the directed graph of the system call, comprising: An empty uncertain finite automaton is constructed, a node numbered as an initial value is used as the initial state of the finite state set, and a node numbered as a termination value is added to the termination state set of the finite state set; For each node in the node set, the number of the node is added to the finite state set, and the node content is added to the input symbol set without repetition, and for each directed edge in the directed edge set, a rule is added to the transition function to construct the function call automaton, the rule represents that the source node state of the directed edge will be transferred to the destination node state when receiving the destination node content as the input symbol.

7. The method of claim 5, wherein, The application system call automaton is constructed by performing depth-first search on the application entry function based on the function call automaton, comprising: The effective execution path of the application in the entire life cycle is enumerated, the effective execution path is searched in depth-first manner starting from the entry function of the application, and the state machines of the sub-functions in the function call automaton are connected through the preset instructions in the nodes; When a preset sub-function is traversed, the preset sub-function is locally searched in depth-first manner without leaving the address space of the preset sub-function, and after the local depth-first search is completed, the automaton of the current function is cached in the memory. The preset instructions in the nodes are used to expand the automaton call of the lower layer function.

8. The method of any one of claims 1-7, wherein, The attack analysis on the symptom event is performed based on the system-level trace graph, and nodes depending on the symptom event are summarized in the system-level trace graph to form an attack path and an attack influence, respectively, including: The backward attack analysis on the symptom event is performed based on the system-level trace graph, and a backtracking in a reverse data flow direction is performed from the symptom event on the trace graph, if a node to be backtracked directly or indirectly inputs data to a subject or an object of the symptom event, the node is summarized to an attack path; The forward attack analysis on the symptom event is performed based on the system-level trace graph, and a search in a data flow direction is performed from the symptom event on the trace graph, if a node to be searched directly or indirectly receives data input of a subject or an object of the symptom event, the node is summarized to an attack influence.

9. A system call automaton based attack tracing method apparatus, characterized in that, The device comprises: A generation unit configured to generate a control flow graph of an application function by performing static analysis on a binary file of the application, and construct a directed graph of system calls according to the control flow graph, wherein the directed graph of system calls records a calling relationship between the application functions; A construction unit configured to construct an application system call automaton by adopting an uncertain finite automaton as a state transition representation of application system calls for a node set and a directed edge set in the directed graph of system calls; A division unit configured to divide a pre-generated standard format log into execution units by using the application system call automaton, and construct a system-level trace graph representing a causal relationship between system events according to logs of the execution units, wherein the standard format log is obtained by performing field extraction on a log provided by an audit module; wherein the division of the pre-generated standard format log into execution units by using the application system call automaton, and the construction of the system-level trace graph representing the causal relationship between the system events, include: matching system calls in the pre-generated standard log with state transitions of the application system call automaton, and processing a case where a plurality of state transition matching items exist in a matching process by calling a continuous matching mode, processing a case where no state transition matching item exists by calling a forward-looking matching mode and a backward-looking matching mode, to identify logs belonging to one execution unit, and divide the logs into the execution units; adding events to the trace graph according to the logs of the divided execution units, and distinguishing unit-level events and system-level events when adding the events, to construct the system-level trace graph representing the causal relationship between the system events, wherein a data outflower in the trace graph is a subject of an event, a data inflower is an object of the event, and the event is a directed edge pointing from the subject to the object; An analysis unit configured to perform attack analysis on a symptom event based on the system-level trace graph, and summarize nodes depending on the symptom event in the system-level trace graph to form an attack path and an attack influence, respectively.

Images