Security defense method, device, electronic device and storage medium based on ATT&CK model

Abstract

The embodiments of this specification relate to the field of network security technology, and in particular to a security defense method, device, electronic device and storage medium based on the ATT&CK model. Among them, the security defense method based on the ATT&CK model includes: monitoring the startup of the process on the terminal device, and determining the rule base currently used by the terminal device for security defense; in response to monitoring the startup of the process on the terminal device, determining the hardware resource consumption on the terminal device after the process starts, and the matching of the process with the rules in the rule base; based on the hardware resource consumption and the matching, updating the rule base so that the terminal device uses the updated target rule base for security defense, and returning to the step of determining the rule base currently used by the terminal device for security defense. The technical solution provided in this specification solves the problem that the ATT&CK model cannot adapt to different terminal devices.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of network security technology, and in particular to a security defense method, device, electronic device, and storage medium based on the ATT&CK model. Background Art

[0002] As a fine-grained attack and defense framework, the ATT&CK model provides defense rule information for processes that can be illegally exploited and their corresponding startup parameters.

[0003] Although the rules of the ATT&CK model cover a wide range, different terminal devices have their own usage scenarios, so the rules of the ATT&CK model cannot be adapted to different terminal devices (for example, not all suspected attack behaviors are illegal and need to be intercepted). Summary of the invention

[0004] In order to solve the problem that the ATT&CK model cannot adapt to different terminal devices, the embodiments of this specification provide a security defense method, device, electronic device and storage medium based on the ATT&CK model.

[0005] In a first aspect, an embodiment of this specification provides a security defense method based on an ATT&CK model, which is applied to a terminal device, wherein an initial rule base is pre-installed on the terminal device, and the rule base is obtained by extracting the rules of the existing ATT&CK model in a preset manner. The method includes:

[0006] Monitor the process startup status on the terminal device to determine the rule base currently used by the terminal device for security defense;

[0007] In response to monitoring the start of a process on the terminal device, determining the consumption of hardware resources on the terminal device after the process starts to start, and the matching of the process with the rules in the rule base;

[0008] Based on the hardware resource consumption and the matching situation, the rule base is updated so that the terminal device uses the updated target rule base for security defense, and the process returns to the step of determining the rule base currently used by the terminal device for security defense.

[0009] In a possible design, the rules in the rule base are stored in an XML file encrypted according to a specified algorithm;

[0010] The rule at least includes: a process name, startup parameters and a default operation of the current rule, and the default operation includes interception and release.

[0011] In one possible design, the rule also includes a parent process and custom parameters, and the custom parameters include a verification result of a digital signature, and / or a verification result of a Microsoft CAT signature, and / or manufacturer information.

[0012] In a possible design, in response to monitoring the startup of a process on the terminal device, determining the consumption of hardware resources on the terminal device after the process starts to start, and the matching of the process with the rules in the rule base includes:

[0013] In response to monitoring the start of a process on the terminal device, monitoring a total CPU occupancy rate and a total memory occupancy rate on the terminal device after the process starts to start, and using the total CPU occupancy rate and the total memory occupancy rate as hardware resource consumption on the terminal device;

[0014] and / or,

[0015] In response to monitoring the start of a process on the terminal device, monitoring a CPU occupancy rate and a memory occupancy rate corresponding to the process after the process starts to start, and using the CPU occupancy rate and the memory occupancy rate corresponding to the process as hardware resource consumption status on the terminal device;

[0016] The process name and startup parameters of the process are matched with the rules in the rule base to obtain the matching status of the process and the rules in the rule base.

[0017] In a possible design, updating the rule base based on the hardware resource consumption and the matching condition includes:

[0018] In the case where the total CPU usage is higher than a first preset threshold and / or the total memory usage is higher than a second preset threshold within a first specified time;

[0019] Alternatively, within the first specified time, the total CPU occupancy is not higher than the first preset threshold and the total memory occupancy is not higher than the second preset threshold, but within the second specified time after the process is fully started, the CPU occupancy corresponding to the process is higher than the third preset threshold and / or the memory occupancy corresponding to the process is higher than the fourth preset threshold;

[0020] If the process name and the startup parameters corresponding to the process are not matched in the rule base, the process name and the startup parameters corresponding to the process are stored in the XML file; wherein the default operation of the process is set to intercept;

[0021] If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is modified to intercept.

[0022] In a possible design, updating the rule base based on the hardware resource consumption and the matching condition includes:

[0023] When the process is not fully started, the CPU occupancy rate corresponding to the process is higher than a fifth preset threshold and / or the memory occupancy rate corresponding to the process is higher than a sixth preset threshold;

[0024] and / or, when the process is not fully started, the rate at which the CPU occupancy rate corresponding to the process increases is higher than a seventh preset threshold and / or the rate at which the memory occupancy rate corresponding to the process increases is higher than an eighth preset threshold;

[0025] If the process name and the startup parameters corresponding to the process are not matched in the rule base, the process name and the startup parameters corresponding to the process are stored in the XML file; wherein the default operation of the process is set to intercept;

[0026] If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is modified to intercept.

[0027] In a possible design, the rule base has an external call interface, and the external call interface is used to add, delete and / or modify rules;

[0028] The method further comprises:

[0029] In response to detecting that the external call interface of the rule base is called, matching the process targeted by the external call interface with the rules in the rule base;

[0030] The matching result of the process returned by the external call interface is obtained, and in response to a modification instruction sent by a user based on the matching result, the rule base is updated according to the modification instruction.

[0031] In a second aspect, an embodiment of this specification further provides a security defense device based on the ATT&CK model, which is applied to a terminal device, and an initial rule base is pre-installed on the terminal device. The rule base is extracted from the rules of the existing ATT&CK model in a preset manner. The device includes:

[0032] A first determination module is used to monitor the process startup status on the terminal device and determine the rule base currently used by the terminal device for security defense;

[0033] A second determination module is used to determine, in response to monitoring the startup of a process on the terminal device, the consumption of hardware resources on the terminal device after the process starts, and the matching of the process with the rules in the rule base;

[0034] An update module is used to update the rule base based on the hardware resource consumption and the matching situation so that the terminal device uses the updated target rule base for security defense, and returns to the step of determining the rule base currently used by the terminal device for security defense.

[0035] In a third aspect, an embodiment of this specification further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0036] In a fourth aspect, an embodiment of the present specification further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in any embodiment of the present specification.

[0037] The embodiments of this specification provide a security defense method, device, electronic device, and storage medium based on the ATT&CK model. First, the process startup on the terminal device is monitored to determine the rule base currently used by the terminal device for security defense; then, in response to monitoring the startup of the process on the terminal device, the hardware resource consumption on the terminal device after the process starts, and the matching between the process and the rules in the rule base are determined; finally, based on the hardware resource consumption and matching, the rule base is updated so that the terminal device uses the updated target rule base for security defense, and the step of determining the rule base currently used by the terminal device for security defense is returned. Therefore, the above technical solution can solve the problem of ATT&CK model localization in different usage scenarios, that is, it can make the ATT&CK model adapt to the usage requirements of different terminal devices, thereby preventing the ATT&CK model from misreporting rules; and considering the hardware resource consumption, it can prevent the system performance of the terminal device from being reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1This is a flow chart of a security defense method based on the ATT&CK model provided in an embodiment of this specification;

[0040] Figure 2 It is a hardware architecture diagram of an electronic device provided in an embodiment of this specification;

[0041] Figure 3 This is a structural diagram of a security defense device based on the ATT&CK model provided in an embodiment of this specification. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the embodiments of this specification clearer, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this specification.

[0043] As mentioned earlier, although the rules of the ATT&CK model cover a wide range, different terminal devices have their own usage scenarios, so the rules of the ATT&CK model cannot be adapted to different terminal devices (for example, not all suspected attack behaviors are illegal and need to be intercepted).

[0044] Therefore, we cannot adopt a one-size-fits-all approach to different user needs and usage scenarios of the ATT&CK model. We need to make the ATT&CK model adaptive and localized.

[0045] During the research and development process, the inventor discovered that the rules of the ATT&CK model can be summarized to form an initial rule base, and then after the process of the terminal device to be defended is started, the current hardware resource consumption of the terminal device and the matching of the process and the rule base can be monitored. Finally, based on the hardware resource consumption and matching conditions, the rule base can be updated to use the updated target rule base to perform security defense on the terminal device. This can prevent false alarms of the ATT&CK model rules and prevent the degradation of the system performance of the terminal device.

[0046] The inventive concept of the present illustrative embodiment is described below.

[0047] Please refer to Figure 1 , the embodiment of this specification provides a security defense method based on the ATT&CK model, the method comprising:

[0048] Step 100: Monitor the process startup status on the terminal device to determine the rule base currently used by the terminal device for security defense;

[0049] Step 102: In response to monitoring the start of a process on the terminal device, determining the hardware resource consumption on the terminal device after the process starts, and the matching status of the process with the rules in the rule base;

[0050] Step 104: Based on the hardware resource consumption and matching conditions, the rule base is updated so that the terminal device uses the updated target rule base for security defense, and the process returns to the step of determining the rule base currently used by the terminal device for security defense.

[0051] In the embodiments of this specification, the process startup on the terminal device is first monitored to determine the rule base currently used by the terminal device for security defense; then, in response to monitoring the startup of the process on the terminal device, the hardware resource consumption on the terminal device after the process starts, as well as the matching between the process and the rules in the rule base, are determined; finally, based on the hardware resource consumption and matching conditions, the rule base is updated so that the terminal device uses the updated target rule base for security defense, and the step of determining the rule base currently used by the terminal device for security defense is returned. Therefore, the above technical solution can solve the problem of ATT&CK model localization in different usage scenarios, that is, it can make the ATT&CK model adapt to the usage requirements of different terminal devices, thereby preventing the ATT&CK model from misreporting rules; and considering the hardware resource consumption, it can prevent the system performance of the terminal device from being reduced.

[0052] Described below Figure 1 How the various steps are performed.

[0053] For step 100:

[0054] It can be known that the ATT&CK model mainly integrates historical hacker organizations and attack incidents, and uses attack strategies as clues to link the attack technologies and software corresponding to different attack strategies. It provides an executable medium-level abstract model for information security practitioners.

[0055] In one embodiment of this specification, for the security of the terminal device, an initial rule base is pre-installed on the terminal device, and the initial rule base is obtained by extracting the rules of the existing ATT&CK model in a preset manner. Based on the installation of the initial rule base on the terminal device, the rule base currently used by the terminal device for security defense in this embodiment can be the initial rule base or the updated rule base.

[0056] In one embodiment of this specification, the rules in the rule base are stored in an XML file encrypted according to a specified algorithm;

[0057] The rules at least include: process name, startup parameters and the default action of the current rule. The default action includes interception and release.

[0058] In this embodiment, the initial rule base is formed by extracting the rules of the existing ATT&CK model, which is conducive to the matching of subsequent processes and thus helps to meet the usage scenario requirements of different users. In addition, by landing the extracted information in the form of an encrypted XML file, it is convenient to prevent tampering and match subsequent processes. Among them, the encryption method can be an algorithm such as MD5 or SHA.

[0059] Of course, the extracted information can also be stored in an encrypted database to obtain an initial rule base. Here, the specific storage method of the extracted information is not limited.

[0060] Generally speaking, the rules of the existing ATT&CK model include at least the process name, startup parameters, and the default action corresponding to the current rule, but there are also some other rules, such as parent process and custom parameters.

[0061] In one embodiment of the present specification, the rule also includes a parent process and custom parameters, and the custom parameters include a verification result of a digital signature, and / or a verification result of a Microsoft CAT signature, and / or manufacturer information.

[0062] In this embodiment, by configuring rules that also include parent processes and custom parameters, the rules of the existing ATT&CK model can be completely summarized, which is conducive to ensuring the integrity and comprehensiveness of the initial rule base.

[0063] Regarding step 102:

[0064] In one embodiment of this specification, step 102 may specifically include:

[0065] In response to monitoring the start of a process on the terminal device, monitoring the total CPU occupancy and the total memory occupancy on the terminal device after the process starts to start, and using the total CPU occupancy and the total memory occupancy as the hardware resource consumption status on the terminal device;

[0066] and / or,

[0067] In response to monitoring the start of a process on the terminal device, monitoring the CPU occupancy rate and memory occupancy rate corresponding to the process after the process starts to start, and using the CPU occupancy rate and memory occupancy rate corresponding to the process as the hardware resource consumption status on the terminal device;

[0068] The process name and startup parameters of the process are matched with the rules in the rule base to obtain the matching status of the process and the rules in the rule base.

[0069] In this embodiment, by considering the total CPU occupancy and total memory occupancy on the terminal device after the process starts and the matching situation of the process with the initial rule base, and / or the CPU occupancy and memory occupancy corresponding to the process after the process starts and the matching situation of the process with the initial rule base, it is possible to prevent false alarms of the ATT&CK model rules and prevent the system performance of the terminal device from being degraded.

[0070] It should be noted that the hardware resource consumption includes not only CPU occupancy and memory occupancy, but also consumption of external devices such as DMA terminal devices and hard disks, and the hardware resource consumption is not limited here.

[0071] Regarding step 104:

[0072] In one embodiment of this specification, step 104 may specifically include:

[0073] When the total CPU usage is higher than a first preset threshold and / or the total memory usage is higher than a second preset threshold within a first specified time;

[0074] Alternatively, the total CPU usage is not higher than the first preset threshold and the total memory usage is not higher than the second preset threshold within the first specified time, but within the second specified time after the process is fully started, the CPU usage corresponding to the process is higher than the third preset threshold and / or the memory usage corresponding to the process is higher than the fourth preset threshold;

[0075] If the process name and startup parameters corresponding to the process are not matched in the rule base, the process name and startup parameters corresponding to the process are stored in an XML file; wherein the default operation of the process is set to intercept;

[0076] If the process name and startup parameters corresponding to the process are matched in the rule base, the default action of the rule matching the process in the XML file is modified to intercept.

[0077] In this embodiment, when the total CPU occupancy rate is higher than the first preset threshold and / or the total memory occupancy rate is higher than the second preset threshold value within the first specified time; or, when the total CPU occupancy rate is not higher than the first preset threshold and the total memory occupancy rate is not higher than the second preset threshold value within the first specified time, but within the second specified time after the process is fully started, the CPU occupancy rate corresponding to the process is higher than the third preset threshold and / or the memory occupancy rate corresponding to the process is higher than the fourth preset threshold, it can be considered that the current startup method of the process is "unfriendly" to the terminal device. In this way, when the process name and startup parameters corresponding to the process are not matched in the initial rule base, the process name and startup parameters corresponding to the process can be stored in the XML file to obtain the target rule base corresponding to the terminal device, and the default operation of the process is set to intercept.

[0078] It can be known that in addition to monitoring the total CPU of the system, this embodiment also monitors the CPU occupancy rate of each process after a period of time has passed since the start of the process, so as to reduce the CPU occupancy caused by the start of process B while process A is starting, which may cause a surge in the total CPU and affect the judgment of whether the rule is friendly, thereby further improving the accuracy of judging whether the process is friendly.

[0079] It should be noted that the specific interception operation requires the caller to implement it through the driver layer or directly call the system API, and the specific implementation method of the interception operation is not limited here. In addition, the embodiments of this specification do not limit the specific values ​​of the first preset threshold, the second preset threshold, the third preset threshold and the fourth preset threshold.

[0080] In one embodiment of this specification, step 104 may specifically include:

[0081] When the process is not fully started, the CPU usage corresponding to the process is higher than the fifth preset threshold and / or the memory usage corresponding to the process is higher than the sixth preset threshold;

[0082] and / or, when the process is not fully started, the rate at which the CPU occupancy rate corresponding to the process increases is higher than a seventh preset threshold and / or the rate at which the memory occupancy rate corresponding to the process increases is higher than an eighth preset threshold;

[0083] If the process name and startup parameters corresponding to the process are not matched in the rule base, the process name and startup parameters corresponding to the process are stored in an XML file; wherein the default operation of the process is set to intercept;

[0084] If the process name and startup parameters corresponding to the process are matched in the rule base, the default action of the rule matching the process in the XML file is modified to intercept.

[0085] In this embodiment, from the above analysis, it can be seen that when the process is not fully started, the CPU occupancy rate corresponding to the process is higher than the fifth preset threshold and / or the memory occupancy rate corresponding to the process is higher than the sixth preset threshold; and / or when the process is not fully started, the rate of increase of the CPU occupancy rate corresponding to the process is higher than the seventh preset threshold and / or the rate of increase of the memory occupancy rate corresponding to the process is higher than the eighth preset threshold, it can be considered that the current startup method of the process is "unfriendly" to the terminal device. In this way, if the default operation corresponding to the process in the XML file is release, it will directly be detrimental to other processes of the terminal device. Therefore, the default operation corresponding to the process in the XML file needs to be modified to intercept.

[0086] It can be known that in addition to monitoring the total CPU of the system, this embodiment also monitors the CPU occupancy rate of each process after a period of time has passed since the start of the process, so as to reduce the CPU occupancy caused by the start of process B while process A is starting, which may cause a surge in the total CPU and affect the judgment of whether the rule is friendly, thereby further improving the accuracy of judging whether the process is friendly.

[0087] It can be understood that the above solution is for automatic update of the initial rule base, and the following describes a solution for manual update of the initial rule base.

[0088] In one embodiment of the present specification, the rule base has an external call interface, and the external call interface is used to add, delete and / or modify rules;

[0089] The method also includes:

[0090] In response to detecting that an external call interface of the rule base is called, matching the process targeted by the external call interface with the rules in the rule base;

[0091] The matching result of the process returned by the external call interface is obtained, and in response to the modification instruction sent by the user based on the matching result, the rule base is updated according to the modification instruction.

[0092] In this embodiment, by configuring the external call interface for the initial rule base, the initial rule base can be actively or adaptively modified by the caller, thereby further increasing the adaptability of the rule base on the terminal device.

[0093] Specifically, when a process is started, after the rule caller calls the rule matching interface, the interface will return the judgment result: whether this rule exists and whether the process is allowed to start or blocked.

[0094] If this rule does not exist in the initial rule base:

[0095] At this time, the default is to allow the process to start. However, if the caller wants to prohibit the start of this process, the interface to prevent the process from starting is called. In this case, the corresponding process and startup parameters will be saved to the rule base by default, and the interception or release option in the rule will be changed to interception;

[0096] If this rule exists in the rule base:

[0097] 1) If the interface returns that the process is allowed to start, the caller does not need to perform any operation at this time. However, if the caller does not want to allow the start of this process, the caller calls another interface: block the start of the process. At this time, the rules of the corresponding XML file will be modified to intercept. The next time the process is started with the same parameters, it will be directly intercepted.

[0098] 2) If the interface returns to block the process from starting, the process will be killed by default if the caller agrees. However, if the caller wants to allow the process to start, the caller calls another interface: allow the process to start. At this time, the rules of the corresponding XML file will be modified to allow the process to start. The next time the process is started with the same parameters, it will be allowed directly.

[0099] According to the above policy flow, ATT&CK's adaptive mechanism for different terminals is completed: a certain process (or some processes) can be started with certain parameters (or some parameters), and it is not allowed to start with certain parameters (or some parameters).

[0100] like Figure 2 , Figure 3 As shown, the embodiments of this specification provide a security defense device based on the ATT&CK model. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 2 As shown in the figure, it is a hardware architecture diagram of an electronic device where a security defense device based on the ATT&CK model is provided in an embodiment of this specification. Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, the CPU of the electronic device in which it is located reads the corresponding computer program in the non-volatile memory into the internal memory and runs it.

[0101] like Figure 3 As shown, a security defense device based on the ATT&CK model provided in this embodiment is applied to a terminal device, on which an initial rule base is pre-installed. The rule base is obtained by extracting the rules of the existing ATT&CK model in a preset manner. The device includes:

[0102] The first determination module 300 is used to monitor the process startup status on the terminal device and determine the rule base currently used by the terminal device for security defense;

[0103] A second determination module 302 is used to determine, in response to monitoring the startup of a process on the terminal device, the consumption of hardware resources on the terminal device after the process starts, and the matching of the process with the rules in the rule base;

[0104] The update module 304 is used to update the rule base based on the hardware resource consumption and the matching situation so that the terminal device uses the updated target rule base for security defense, and returns to the step of determining the rule base currently used by the terminal device for security defense.

[0105] In the embodiment of this specification, the first determination module 300 can be used to execute step 100 in the above method embodiment, the second determination module 302 can be used to execute step 102 in the above method embodiment, and the update module 304 can be used to execute step 104 in the above method embodiment.

[0106] In one embodiment of the present specification, the rules in the rule base are stored in an XML file encrypted according to a specified algorithm;

[0107] The rule at least includes: a process name, startup parameters and a default operation of the current rule, and the default operation includes interception and release.

[0108] In one embodiment of the present specification, the rule further includes a parent process and custom parameters, and the custom parameters include a verification result of a digital signature, and / or a verification result of a Microsoft CAT signature, and / or manufacturer information.

[0109] In one embodiment of the present specification, the second determining module 302 is configured to perform the following operations:

[0110] In response to monitoring the start of a process on the terminal device, monitoring a total CPU occupancy rate and a total memory occupancy rate on the terminal device after the process starts to start, and using the total CPU occupancy rate and the total memory occupancy rate as hardware resource consumption on the terminal device;

[0111] and / or,

[0112] In response to monitoring the start of a process on the terminal device, monitoring a CPU occupancy rate and a memory occupancy rate corresponding to the process after the process starts to start, and using the CPU occupancy rate and the memory occupancy rate corresponding to the process as hardware resource consumption status on the terminal device;

[0113] The process name and startup parameters of the process are matched with the rules in the rule base to obtain the matching status of the process and the rules in the rule base.

[0114] In one embodiment of the present specification, the update module 304 is used to perform the following operations:

[0115] In the case where the total CPU usage is higher than a first preset threshold and / or the total memory usage is higher than a second preset threshold within a first specified time;

[0116] Alternatively, within the first specified time, the total CPU occupancy is not higher than the first preset threshold and the total memory occupancy is not higher than the second preset threshold, but within the second specified time after the process is fully started, the CPU occupancy corresponding to the process is higher than the third preset threshold and / or the memory occupancy corresponding to the process is higher than the fourth preset threshold;

[0117] If the process name and the startup parameters corresponding to the process are not matched in the rule base, the process name and the startup parameters corresponding to the process are stored in the XML file; wherein the default operation of the process is set to intercept;

[0118] If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is modified to intercept.

[0119] In one embodiment of the present specification, the update module 304 is used to perform the following operations:

[0120] When the process is not fully started, the CPU occupancy rate corresponding to the process is higher than a fifth preset threshold and / or the memory occupancy rate corresponding to the process is higher than a sixth preset threshold;

[0121] and / or, when the process is not fully started, the rate at which the CPU occupancy rate corresponding to the process increases is higher than a seventh preset threshold and / or the rate at which the memory occupancy rate corresponding to the process increases is higher than an eighth preset threshold;

[0122] If the process name and the startup parameters corresponding to the process are not matched in the rule base, the process name and the startup parameters corresponding to the process are stored in the XML file; wherein the default operation of the process is set to intercept;

[0123] If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is modified to intercept.

[0124] In one embodiment of the present specification, the rule base has an external call interface, and the external call interface is used to add, delete and / or modify rules;

[0125] The device also includes:

[0126] A calling module, configured to, in response to detecting that an external calling interface of the rule base is called, match the process targeted by the external calling interface with the rules in the rule base;

[0127] The acquisition module is used to acquire the matching result of the process returned by the external call interface, and in response to the modification instruction sent by the user based on the matching result, update the rule base according to the modification instruction.

[0128] It is understood that the structure illustrated in the embodiments of this specification does not constitute a specific limitation on a security defense device based on the ATT&CK model. In other embodiments of this specification, a security defense device based on the ATT&CK model may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0129] Since the information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the method embodiments of this specification, the specific contents can be found in the description of the method embodiments of this specification and will not be repeated here.

[0130] An embodiment of this specification also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a security defense method based on the ATT&CK model in any embodiment of this specification is implemented.

[0131] An embodiment of this specification also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes a security defense method based on the ATT&CK model in any embodiment of this specification.

[0132] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0133] In this case, the program code itself read from the storage medium can realize the function of any one of the above embodiments, and thus the program code and the storage medium storing the program code constitute part of this specification.

[0134] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0135] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0136] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0137] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0138] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0139] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this specification, rather than to limit them. Although this specification has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of this specification.

Claims

1. A security defense method based on the ATT&CK model, characterized in that: Applied to a terminal device, the terminal device is pre-installed with an initial rule base, the rule base is obtained by extracting the rules of the existing ATT&CK model in a preset manner, the ATT&CK model integrates historical hacker organizations and attack events, and uses attack strategies as clues to link attack technologies and software corresponding to different attack strategies, the method includes: Monitor the process startup status on the terminal device to determine the rule base currently used by the terminal device for security defense; In response to monitoring the start of a process on the terminal device, determining the consumption of hardware resources on the terminal device after the process starts to start, and the matching of the process with the rules in the rule base; Based on the hardware resource consumption and the matching situation, the rule base is updated so that the terminal device uses the updated target rule base for security defense, and returns to the step of determining the rule base currently used by the terminal device for security defense; The rules in the rule base are stored in an XML file encrypted according to a specified algorithm; The rule at least includes: a process name, startup parameters and a default operation of the current rule, wherein the default operation includes interception and release; The rule also includes a parent process and custom parameters, wherein the custom parameters include a verification result of a digital signature, a verification result of a Microsoft CAT signature, and manufacturer information; The step of determining, in response to monitoring the startup of a process on the terminal device, the hardware resource consumption on the terminal device after the process starts to start, and the matching status of the process with the rules in the rule base, includes: In response to monitoring the start of a process on the terminal device, monitoring a total CPU occupancy rate and a total memory occupancy rate on the terminal device after the process starts to start, and using the total CPU occupancy rate and the total memory occupancy rate as hardware resource consumption on the terminal device; In response to monitoring the start of a process on the terminal device, monitoring a CPU occupancy rate and a memory occupancy rate corresponding to the process after the process starts to start, and using the CPU occupancy rate and the memory occupancy rate corresponding to the process as hardware resource consumption status on the terminal device; Matching the process name and startup parameters of the process with the rules in the rule base to obtain a matching condition between the process and the rules in the rule base; The updating of the rule base based on the hardware resource consumption and the matching situation includes: In the case where the total CPU usage is higher than a first preset threshold and / or the total memory usage is higher than a second preset threshold within a first specified time; Alternatively, within the first specified time, the total CPU occupancy is not higher than the first preset threshold and the total memory occupancy is not higher than the second preset threshold, but within the second specified time after the process is fully started, the CPU occupancy corresponding to the process is higher than the third preset threshold and / or the memory occupancy corresponding to the process is higher than the fourth preset threshold; If the process name and the startup parameters corresponding to the process are not matched in the rule base, the process name and the startup parameters corresponding to the process are stored in the XML file; wherein the default operation of the process is set to intercept; If a process name and startup parameters corresponding to the process are matched in the rule base, the default action of the rule matching the process in the XML file is modified to intercept; The updating of the rule base based on the hardware resource consumption and the matching situation includes: When the process is not fully started, the CPU occupancy rate corresponding to the process is higher than a fifth preset threshold and / or the memory occupancy rate corresponding to the process is higher than a sixth preset threshold; and / or, when the process is not fully started, the rate at which the CPU occupancy rate corresponding to the process increases is higher than a seventh preset threshold and / or the rate at which the memory occupancy rate corresponding to the process increases is higher than an eighth preset threshold; If the process name and the startup parameters corresponding to the process are not matched in the rule base, the process name and the startup parameters corresponding to the process are stored in the XML file; wherein the default operation of the process is set to intercept; If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is modified to intercept.

2. The method according to claim 1, characterized in that The rule base has an external call interface, and the external call interface is used to add, delete and / or modify rules; The method further comprises: In response to detecting that the external call interface of the rule base is called, matching the process targeted by the external call interface with the rules in the rule base; The matching result of the process returned by the external call interface is obtained, and in response to a modification instruction sent by a user based on the matching result, the rule base is updated according to the modification instruction.

3. A security defense device based on the ATT&CK model, characterized in that: Applied to a terminal device, the terminal device is pre-installed with an initial rule base, the rule base is obtained by extracting the rules of the existing ATT&CK model in a preset manner, the ATT&CK model integrates historical hacker organizations and attack events, and uses attack strategies as clues to link attack technologies and software corresponding to different attack strategies. The device includes: A first determination module is used to monitor the process startup status on the terminal device and determine the rule base currently used by the terminal device for security defense; A second determination module is used to determine, in response to monitoring the startup of a process on the terminal device, the consumption of hardware resources on the terminal device after the process starts, and the matching of the process with the rules in the rule base; An updating module, configured to update the rule base based on the hardware resource consumption and the matching condition, so that the terminal device uses the updated target rule base for security defense, and return to the step of determining the rule base currently used by the terminal device for security defense; The rules in the rule base are stored in an XML file encrypted according to a specified algorithm; The rule at least includes: a process name, startup parameters and a default operation of the current rule, wherein the default operation includes interception and release; The rule also includes a parent process and custom parameters, wherein the custom parameters include a verification result of a digital signature, a verification result of a Microsoft CAT signature, and manufacturer information; The second determining module is used to perform the following operations: In response to monitoring the start of a process on the terminal device, monitoring the total CPU occupancy and the total memory occupancy on the terminal device after the process starts to start, and using the total CPU occupancy and the total memory occupancy as hardware resource consumption on the terminal device; In response to monitoring the start of a process on the terminal device, monitoring a CPU occupancy rate and a memory occupancy rate corresponding to the process after the process starts to start, and using the CPU occupancy rate and the memory occupancy rate corresponding to the process as hardware resource consumption status on the terminal device; Matching the process name and startup parameters of the process with the rules in the rule base to obtain a matching condition between the process and the rules in the rule base; The update module is used to perform the following operations: In the case where the total CPU usage is higher than a first preset threshold and / or the total memory usage is higher than a second preset threshold within a first specified time; Alternatively, within the first specified time, the total CPU occupancy is not higher than the first preset threshold and the total memory occupancy is not higher than the second preset threshold, but within the second specified time after the process is fully started, the CPU occupancy corresponding to the process is higher than the third preset threshold and / or the memory occupancy corresponding to the process is higher than the fourth preset threshold; If the process name and the startup parameters corresponding to the process are not matched in the rule base, the process name and the startup parameters corresponding to the process are stored in the XML file; wherein the default operation of the process is set to intercept; If a process name and startup parameters corresponding to the process are matched in the rule base, the default action of the rule matching the process in the XML file is modified to intercept; The update module is used to perform the following operations: When the process is not fully started, the CPU occupancy rate corresponding to the process is higher than a fifth preset threshold and / or the memory occupancy rate corresponding to the process is higher than a sixth preset threshold; and / or, when the process is not fully started, the rate at which the CPU occupancy rate corresponding to the process increases is higher than a seventh preset threshold and / or the rate at which the memory occupancy rate corresponding to the process increases is higher than an eighth preset threshold; If the process name and the startup parameters corresponding to the process are not matched in the rule base, the process name and the startup parameters corresponding to the process are stored in the XML file; wherein the default operation of the process is set to intercept; If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is modified to intercept.

4. An electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 2 is implemented.

5. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 2.

Images