A fileless attack detection method, device, equipment and storage medium

Abstract

The application provides a fileless attack detection method and device, equipment and a storage medium, wherein the method comprises: obtaining a target unique identifier of a target process in a system when the target process reads an external script; the target unique identifier is associated with a parent process of the target process; obtaining target association information of the target process based on the target unique identifier; analyzing various behaviors of the parent process and the target process contained in the target association information to obtain a script source of the external script; and analyzing the script source of the external script to determine whether there is a fileless attack detection result in the system.

Description

Technical Field

[0001] This application relates to the field of data processing technology in financial technology (Fintech), and includes, but is not limited to, a method, apparatus, device, and storage medium for detecting fileless attacks. Background Technology

[0002] With the development of computer computing, more and more technologies are being applied in the financial field. The traditional financial industry is gradually transforming into financial technology (Fintech). However, due to the security and real-time requirements of the financial industry, higher demands are also being placed on technology.

[0003] In the fintech field, current methods for detecting fileless attacks rely on monitoring downloaded files and analyzing script behavior. However, if an attacker downloads a script that isn't immediately executed but is hidden and has a persistent backdoor set up, a malicious script hidden within the system can be invoked by a white-label system program to launch a fileless attack when specific system conditions are triggered. A persistent backdoor refers to a backdoor (such as a script, process, or connection) placed on a server by an intruder after gaining control, facilitating future persistent intrusions. Because the system recognizes this as an existing file rather than a newly downloaded one, it considers it a normal file, bypassing relevant detection techniques and thus failing to detect the fileless attack. Therefore, current methods for detecting fileless attacks have limitations; they can miss some instances. Summary of the Invention

[0004] This application provides a method, apparatus, device, and storage medium for detecting fileless attacks, in order to solve the problem that existing fileless attack detection methods sometimes miss detections.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] This application provides a method for detecting fileless attacks, including:

[0007] When a target process in the system reads an external script, the target unique identifier of the target process is obtained; wherein the target unique identifier is associated with the parent process of the target process;

[0008] Based on the target unique identifier, obtain the target association information of the target process;

[0009] The script source of the external script is obtained by analyzing the various behaviors of the parent process and the target process contained in the target association information.

[0010] The source of the external script is analyzed to determine whether there are any fileless attack detection results in the system.

[0011] A fileless attack detection device, the device comprising:

[0012] The acquisition module is used to acquire the target unique identifier of the target process when the target process in the system reads an external script; wherein the target unique identifier is associated with the parent process of the target process;

[0013] The acquisition module is used to acquire the target association information of the target process based on the target unique identifier;

[0014] The processing module is used to analyze various behaviors of the parent process and the target process contained in the target association information to obtain the script source of the external script;

[0015] The processing module is used to analyze the script source of the external script and determine whether there is a fileless attack detection result in the system.

[0016] A detection device for fileless attacks, comprising:

[0017] A memory for storing executable instructions; a processor for implementing the above method when executing the executable instructions stored in the memory.

[0018] A computer-readable storage medium storing executable instructions for implementing the above-described method when executed by a processor.

[0019] The embodiments of this application have the following beneficial effects:

[0020] By obtaining the target process's unique identifier when it reads an external script, the system identifies the target process's unique identifier, which is associated with its parent process. Based on this identifier, the system obtains the target process's associated information. Analyzing the parent process and various behaviors of the target process within this associated information reveals the source of the external script. Further analysis of the external script's source determines whether fileless attacks are detected in the system. Therefore, given the source of the external script, and since the generated process PUID is associated with each process's parent process, the associated information obtained based on the process PUID includes not only the process's own behaviors but also those of its parent process. Combined with the joint analysis of the process and its parent process's related behaviors, the script source is located, ensuring that all files can be traced back to their script source. This allows for a more accurate determination of fileless attack detections in the system, preventing missed detections of network files. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of an optional architecture of the terminal provided in an embodiment of this application;

[0022] Figure 2 This is a flowchart illustrating the fileless attack detection method provided in the embodiments of this application. Figure 1 ;

[0023] Figure 3 This is a schematic diagram of the analysis process for the script source provided in the embodiments of this application;

[0024] Figure 4 This is a flowchart illustrating the fileless attack detection method provided in the embodiments of this application. Figure 2 ;

[0025] Figure 5 This is a flowchart illustrating the fileless attack detection method provided in the embodiments of this application. Figure 3 ;

[0026] Figure 6 This is a flowchart illustrating the fileless attack detection method provided in the embodiments of this application. Figure 4 ;

[0027] Figure 7 This is a flowchart illustrating the fileless attack detection method provided in the embodiments of this application. Figure 5 . Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0029] In the following description, references to "some embodiments" refer to a subset of all possible embodiments. However, it is understood that "some embodiments" may be the same or different subsets of all possible embodiments and may be combined with each other without conflict. Unless otherwise defined, all technical and scientific terms used in the embodiments of this application have the same meaning as commonly understood by one of ordinary skill in the art to which the embodiments of this application pertain. The terminology used in the embodiments of this application is for the purpose of describing the embodiments of this application only and is not intended to limit the application.

[0030] The following describes exemplary applications of the fileless attack detection device provided in this application. This fileless attack detection device can be implemented as any terminal with a screen display function, such as a laptop, tablet, desktop computer, mobile device (e.g., mobile phone, portable music player, personal digital assistant, dedicated messaging device, portable gaming device), or intelligent robot, or as a server. The following will describe exemplary applications of the fileless attack detection device implemented as a terminal.

[0031] See Figure 1 , Figure 1 This is a schematic diagram of the structure of the terminal 100 provided in the embodiments of this application. Figure 1 The terminal 100 shown includes at least one processor 110, at least one network interface 120, a user interface 130, and a memory 150. The various components in the terminal 100 are coupled together via a bus system 140. It is understood that the bus system 140 is used to implement communication between these components. In addition to a data bus, the bus system 140 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 1 The general labeled all buses as Bus System 140.

[0032] The processor 110 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0033] User interface 130 includes one or more output devices 131 that enable the presentation of media content, including one or more speakers and / or one or more visual displays. User interface 130 also includes one or more input devices 132, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0034] Memory 150 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard disk drives, optical disk drives, etc. Memory 150 may optionally include one or more storage devices physically located remote from processor 110. Memory 150 may include volatile memory or non-volatile memory, or both. Non-volatile memory may be read-only memory (ROM), and volatile memory may be random access memory (RAM). The memory 150 described in this application embodiment is intended to include any suitable type of memory. In some embodiments, memory 150 is capable of storing data to support various operations, examples of which include programs, modules, and data structures, or subsets or supersets thereof, as exemplified below.

[0035] Operating system 151 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, driver layer, etc., for implementing various basic business functions and handling hardware-based tasks;

[0036] The network communication module 152 is used to reach other computing devices via one or more (wired or wireless) network interfaces 120, such as Bluetooth, WiFi, and Universal Serial Bus (USB).

[0037] The input processing module 153 is used to detect and translate one or more user inputs or interactions from one or more input devices 132.

[0038] In some embodiments, the apparatus provided in this application can be implemented in software. Figure 1 A fileless attack detection device 154 stored in memory 150 is shown. This fileless attack detection device 154 can be a fileless attack detection device in terminal 100, and can be software in the form of programs and plug-ins, including the following software modules: an acquisition module 1541 and a processing module 1542. These modules are logically linked and can therefore be arbitrarily combined or further divided according to their implemented functions. The functions of each module will be described below.

[0039] In other embodiments, the apparatus provided in this application can be implemented in hardware. As an example, the apparatus provided in this application can be a processor in the form of a hardware decoding processor, which is programmed to execute the fileless attack detection method provided in this application. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0040] Currently, the primary method for detecting fileless attacks is to monitor scripts downloaded from the network for suspicious operations and then match behavioral characteristics. This matching includes, but is not limited to, the behavior of processes, scheduled tasks, system services, networks, the registry, files, system plugins (Windows Management Instrumentation, WMI), and memory. In other words, current methods detect fileless attacks by monitoring downloaded files and analyzing script behavior; however, this approach has limitations in detecting missed cases. Therefore, this application provides a method for detecting fileless attacks based on script origin. This method focuses on the script's source and is better able to combat various missed detections.

[0041] The following will describe the fileless attack detection method provided in this application embodiment, with reference to the exemplary application and implementation of the terminal 100 provided in the embodiments of this application. See also Figure 2 , Figure 2 This is an optional flowchart illustrating a fileless attack detection method provided in an embodiment of this application, which will be combined with... Figure 2 The steps shown are explained below.

[0042] Step S201: When the target process in the system reads an external script, obtain the target unique identifier of the target process.

[0043] The target's unique identifier is associated with the target process's parent process.

[0044] Here, a process refers to one execution of a program; it is the activity that occurs when a program and the data it uses are executed sequentially on the processor, and it is an independent unit for system resource allocation and scheduling. A parent process refers to a process that has created one or more child processes.

[0045] Currently, during file execution, although system processes have process identifiers (PIDs), when a file is stored and subsequently checked, the PID is cleared by the system after the file's process is closed, and the PID is reassigned. Therefore, there can be duplicate PIDs within a certain time interval. However, in the embodiments of this application, a unique identifier is assigned to each process, called a unique identifier (PUID). In some embodiments, a hash function can be used to create the PUID to facilitate the reconstruction of the process chain, thereby reconstructing the attack flowchart and providing a favorable basis for thorough attack detection and elimination.

[0046] For example, the PUID of the parent process of the first process created by the system is a default value, such as 0.

[0047] Here, a script refers to an executable file written in a specific descriptive language according to a certain format.

[0048] In a feasible scenario, an example illustrates how a target process reads an external script: An attacker induces a user to download an Office document containing embedded malicious code. When the user clicks on it, the main program, such as the WinWord process, retrieves and executes the script in the docm file. Therefore, this process obtains and executes the external script. This application does not specifically limit the implementation method of the target process reading the external script in this embodiment.

[0049] In this application embodiment, a computer program refers to a coded sequence that can be executed by a computer or other device with information processing capabilities in order to obtain a certain result, or a symbolic instruction sequence or symbolic statement sequence that can be automatically converted into a coded instruction sequence.

[0050] Step S202: Based on the target's unique identifier, obtain the target association information of the target process.

[0051] In this embodiment, the target association information is also referred to as the target process's related information (process_contents). Based on the target PUID, the obtained target process's process_contents include: process name (pname), process path (ppath), process internal name (process_internalName), process original name (process_OriginalFilename), and the target process's parent process name (ppname); of course, it may also include the target process's parent process path (pppath) and the target process's parent process PUID. The target process's related information can be obtained by retrieving the process's operation log recorded in a dictionary.

[0052] For example, the process operation log records generated using a dictionary are as follows:

[0053] The operation log records corresponding to process-related information 1 are as follows:

[0054] {"puid":"000000000000001C",

[0055] “process_contents”:{

[0056] "pname":"WINWORD.EXE",

[0057] "ppath":"D:\Office16\WINWORD.EXE",

[0058] "process_OriginalFilename":"WinWord.exe",

[0059] "process_internalName":"WinWord",

[0060] "ppname":"explorer.exe",

[0061] "pppath":"C:\Windows\explorer.exe",

[0062] "ppuid":"0000000000000005"}}

[0063] The operation log records corresponding to process-related information 2 are as follows:

[0064] {"puid":"0000000000000006",

[0065] “process_contents”:{

[0066] "pname":"wscript.exe",

[0067] "ppath":"C:\Windows\System32\wscript.exe",

[0068] "process_OriginalFilename":"wscript.exe",

[0069] "process_internalName":"wscript.exe",

[0070] "ppname":"explorer.exe",

[0071] "pppath":"C:\Windows\explorer.exe",

[0072] "ppuid":"0000000000000005"}}

[0073] Here, `puid` represents the process's PUID, `process_contents` contains process-related information, `pname` represents the process name, `ppath` represents the process file path, `process_OriginalFilename` represents the original name of the process file, `process_internalName` represents the internal name of the process file, `ppname` represents the parent process name, `pppath` represents the parent process file path, and `ppuid` represents the parent process's PUID.

[0074] In this embodiment, the behavior information of the target process is monitored in real time, including but not limited to process operation behavior, file behavior, network behavior and registry behavior; when the target process reads an external script, the target PUID of the target process is obtained; and relevant information of the target process is obtained based on the target PUID.

[0075] Step S203: Analyze the various behaviors of the parent process and the target process contained in the target association information to obtain the script source of the external script.

[0076] In this embodiment, by jointly analyzing the parent process and various behaviors of the target process contained in the target association information, the source of the external script can be determined. It should be noted that this application generates a target PUID for the target process, and when recording and storing this target PUID, it associates it with the parent process of the target process. Then, by analyzing the joint behavior of the processes, the source of the script can be determined, thereby achieving a more comprehensive detection of fileless attacks.

[0077] Here, process behavior refers to the various actions a process takes during its execution, such as creating or closing processes.

[0078] Furthermore, taking process behavior, including process operation behavior, file behavior, network behavior, and registry behavior, as an example, this paper further explains the process of analyzing various behaviors in step S203 to obtain the script source of the external script. In a feasible scenario, combined with... Figure 3 The analysis process shown is as follows:

[0079] Step S301: Monitor the behavior information of the process in real time.

[0080] Here, the various behaviors of a process include, but are not limited to, process operation behaviors, file behaviors, network behaviors, and registry behaviors.

[0081] Process operation behavior refers to a process's actions on other processes, such as creating a new process, terminating a process, or accessing another process. File behavior refers to a process's actions on files, including reading and writing. Network behavior refers to a process's actions on a network, such as connecting to a network, receiving network data, and sending data. Registry behavior refers to a process's actions on the registry. The registry is a core database in the Windows operating system, storing various parameters that directly control Windows startup, hardware driver loading, and the operation of some Windows applications, thus playing a crucial role in the entire system.

[0082] Step S302: Does the process read external scripts?

[0083] Step S303: Record the process operation information.

[0084] Here, when a process reads an external script, the process's PUID is obtained. Further, based on the PUID, relevant process information is retrieved, such as information obtained from the process's operation log recorded in a dictionary. This process operation information includes, but is not limited to, […]. Figure 3 The five types of operation information listed in step S303.

[0085] Step S304: Combine the analysis of the process behavior to obtain the script source of the external script.

[0086] Here, by combining the information about the external script and the process that is read with an analysis of the process's behavior, the source of the external script can be determined.

[0087] Example 1: If the external script script1 read is the same as the script script2 obtained by the process accessing the network, then the source of the script is determined to be the network (NET).

[0088] Example 2: If the external script script1 read is the same as the script script3 obtained by the process from reading the disk file, then the script source is determined to be a file (FILE).

[0089] Example 3: If the external script script1 read is the same as the script script4 obtained by the process from reading the registry, then the source of the script is determined to be the registry (REG).

[0090] Example 4: If the external script script1 read is the same as the script script5 obtained by the process reading the stream file (ADS), then the script source is determined to be (ADS).

[0091] Alternate Data Streams (ADS) is a feature of the NTFS disk format. Under the NTFS file system, each file can have multiple data streams. This means that in addition to the main file stream, many non-main file streams can reside within the main file stream. These non-main file streams, which utilize NTFS data streams and are hidden within the system, are called ADS stream files.

[0092] Example 5: If a process reads and obtains script6 from an unknown source, then the source of the script is determined to be something else.

[0093] In the examples above, Examples 1 to 4 are scripts from known sources; Example 5 is a script from an unknown source.

[0094] Step S204: Analyze the source of the external script to determine whether there are any fileless attack detection results in the system.

[0095] Understandably, the term "fileless attack" initially referred to attacks that did not persistently reside in memory. However, with the iteration of attack techniques, its scope has broadened. Currently, in the security industry, fileless attacks are considered an attack strategy aimed at preventing malicious files from being stored on the disk, thereby evading detection by security software. In this application's embodiments, fileless attack refers to an attack without malicious files. Attackers leave seemingly harmless files on the user's host or use trusted binary files to execute malicious actions to bypass antivirus software detection and achieve their attack objectives.

[0096] In this embodiment of the application, when the source of the external script is obtained, the generated process PUID is associated with the parent process of each process. Combined with the joint analysis of process-related behaviors, the source of the script is located, ensuring that all files can be traced back to the source of the script. This allows for a more accurate determination of whether there are any fileless attack detection results in the system, thus avoiding missed detection of network files.

[0097] The fileless attack detection method provided in this application obtains the target process's unique identifier when the target process in the system reads an external script. This unique identifier is associated with the target process's parent process. Based on the unique identifier, target association information is obtained. The various behaviors of the target process and its parent process, contained in the target association information, are analyzed to determine the source of the external script. Further analysis of the external script's source determines whether a fileless attack is detected in the system. Therefore, given the source of the external script, since the generated process PUID is associated with each process's parent process, the process association information obtained based on the process PUID includes not only the process's own behaviors but also the behaviors of its parent process. Combined with the joint analysis of the process and its parent process's related behaviors, the source of the script is located, ensuring that all files can be traced back to their script source. This more accurately determines whether a fileless attack is detected in the system, avoiding missed detections of network files.

[0098] In a feasible attack scenario, attackers are increasingly using system registry entries, stream files, and other similar formats as carriers to store malicious scripts. These malicious scripts are then executed by legitimate system programs, thereby bypassing detection.

[0099] The following is an attack example provided by an embodiment of this application: Attack Example 1: The attacker writes an HTA script as content into Office macro code. When the user clicks an Office file, the WinWord program simultaneously writes the HTA script into a stream file (C:\Windows\test.txt:virus.vbs) and an image file (C:\Users\Default\Documents\virus.png and C:\Users\Default\Documents\virus.bat). The host file of the stream file is a TXT file. At the same time, the attacker writes a command (wscript C:\Windows\test.txt:virus.vbs) into the Run startup item and a bat file to be executed (C:\Users\Default\Documents\virus.bat) into RunOnce. The Run startup item calls the system program wscript to execute the script in the stream file. In this way, the script will be automatically called and executed in the background every time the user restarts the system, attacking the user's computer. The batch script in the RunOnce startup item checks whether the stream file and the Run startup item have been cleaned up. If cleaned up, it calls cscript to retrieve and execute the vbs script in the png file (the script is not directly stored in the batch file to evade antivirus software detection). The script in the png file steganographically hides the malicious script in another location (e.g., C:\Windows\new.txt:newfile.vbs), and then creates an lnk file in the startup directory (the lnk file's content is cscript C:\Windows\new.png:newfile.vbs) to achieve automatic startup on boot, thus creating a fileless attack Trojan that is difficult to completely remove. Steganography refers to a technique that hides information containing malicious payloads in other benign files such as images. This application detects fileless attack behavior in the system by analyzing the suspiciousness of the script's source and combining it with information about the process that calls the script.

[0100] Regarding the attack example 1 above, the attacker first tricked the user into downloading an Office document containing embedded malicious code. When the user clicked on it, the WinWord process obtained and executed a script in the docm file. Therefore, the process obtained external script execution information. The terminal recorded the process's operation information and then analyzed that the script's source was a file, recording relevant information about the file from which the script originated. The results are as follows:

[0101]

[0102] Upon system restart, the attacker begins the attack. First, by analyzing process and file behavior, it is determined that the process with PUID 0000000000000006 has obtained an external script. Process and parent process information can be obtained through the PUID table. Then, analyzing the filename reveals a colon and the file is not on disk, indicating it is an ADS stream file. Therefore, the script originates from ADS, and the script source information is recorded as follows:

[0103]

[0104] Here, `script_id` is the script ID value, used to identify the script loaded by this process. When the same process loads multiple external scripts, the script ID value increments sequentially; `src_script` is the source of the script; and `script_path` records the file path of the stream file. For the recording methods of `src_script` and `script_path` for scripts from different sources, please refer to Table 1 for script source records.

[0105] Script source ADS stream file Registry network Local heterogeneous files src_script ADS REG NET FILE script_path Stream file path Registry key + key Website File path

[0106] Script source record table 1

[0107] Local heterogeneous files refer to scripts stored in files different from the script type, such as an HTA script stored in a PNG file. It should be noted that when the custom record table 1 records information related to script source and file path, it only records refined collected information, avoiding the collection and recording of unnecessary information.

[0108] To address this attack scenario, we can combine Figure 4 The process shown implements the script-based fileless attack detection method provided in this application. The steps are as follows:

[0109] Step S401: Collect and record relevant information about the process.

[0110] Here, process creation events are monitored in real-time within the system. These events are used to create new processes. When a process is created, the system assigns a process ID (PID). However, if the parent process closes after creation, the process's path cannot be found using the parent process's PID, resulting in missing process information and making it difficult to trace and reconstruct the attack chain. This application introduces a process PUID number to record relevant information for each process.

[0111] For example, the record format of the PUID table is as follows:

[0112]

[0113]

[0114] PUID table

[0115] For example, in the PUID table above, the process PUID number can be a 16-bit ID value to ensure the uniqueness of the process ID.

[0116] Step S402: Is the script to be executed from outside the process? If yes, then proceed to step S403.

[0117] Step S403: Record the source of the script.

[0118] Step S404 involves analyzing the script source to obtain a script source suspicion matrix.

[0119] In some embodiments of this application, if the script source is obtained, the script source of the external script can be analyzed to further obtain a script source suspicion matrix.

[0120] Step S405: Based on the suspicious script source matrix, determine whether there are any fileless attack detection results in the system.

[0121] In other embodiments of this application, step S202, based on the target unique identifier, obtains the target association information of the target process, which can be achieved by the following steps: searching for the target association information corresponding to the target unique identifier in the unique identifier list.

[0122] In other embodiments of this application, before performing the above-described search for the target association information corresponding to the target unique identifier in the unique identifier list, it is also possible to use methods such as... Figure 5 The steps outlined in the document are used to maintain the list of unique identifiers:

[0123] Step S501: If a process creation event is detected, obtain the process identifier of the new process and the unique identifier of the previous process of the new process.

[0124] Here, you can call the monitoring function to monitor process creation events in real time; the process creation event is used to create new processes.

[0125] Furthermore, upon detecting a process creation event, obtain the PID of the new process and the PUID of the previous process.

[0126] Step S502: Obtain the new process path of the new process based on the process identifier, and parse the new process name from the new process path.

[0127] Here, based on the new process PID, the new process path is obtained, and the new process name is parsed from the new process path.

[0128] Step S503: Based on the new process path, read the new process file information, and obtain the internal name and original name of the new process based on the new process file information.

[0129] Step S504: Generate a unique identifier for the new process based on the unique identifier of the previous process and the first parameter.

[0130] Here, the first parameter can be flexibly set according to actual needs. For example, the first parameter can be 1. The PUID value of the previous process is incremented by 1 to become the PUID of the new process.

[0131] Step S505: Based on the unique identifier of the new process, add the process name, path, internal name, original name, and unique identifier of the previous process of the new process to the unique identifier list as the association information of the new process.

[0132] Based on the above maintenance of the unique identifier list, it can be seen that the unique identifier list in this application realizes the recording of the script source. The unique identifier list is used for analysis and tracing, and the unique identifier list is obtained by preprocessing the information.

[0133] Taking attack example 1 as an example, the process of updating the records in the unique identifier list is illustrated as follows:

[0134] The attacker tricks the user into clicking on a downloaded Office file. At this point, the explorer.exe process launches the winword process to execute macro code within the Office file. Based on the above implementation method, the following information can be recorded in Table 1:

[0135]

[0136] Table 1 for recording relevant information

[0137] The actual attack occurs after the user restarts. The system uses explorer.exe to read the registry entries in the Run startup item and execute commands. These commands launch wscript.exe to execute scripts in stream files. At this point, the explorer process is newly generated, and the PUID table in the system is refreshed and starts recording again. Therefore, the record table 2 showing the relevant information obtained after the update is as follows:

[0138]

[0139] Record of relevant information Table 2

[0140] In other embodiments of this application, step S204 analyzes the script source of the external script to determine whether there are any fileless attack detection results in the system. This can be achieved through methods such as... Figure 6 The steps shown are to be implemented as follows:

[0141] Step S2041: Obtain the initialized script source suspicion matrix.

[0142] Here, the initialized script source suspicion matrix is ​​obtained by processing the script sources of the samples using a suspicion analysis algorithm. The script sources of the samples include the script sources of scripts called by positive sample processes, and the script sources of scripts called by negative sample processes when there is a no-sample attack. Specifically, the script sources of positive sample processes include those generated under normal circumstances through massive amounts of terminal process information and their called script information; these are also known as normal script sources. The script sources of negative sample processes include those obtained by analyzing the script sources called by the samples when they carry out attacks, after running a massive number of fileless attack samples.

[0143] Step S2042: Analyze the script source of the external script to obtain the first suspicion coefficient of the script source of the external script.

[0144] In this embodiment of the application, step S2042, which analyzes the script source of the external script to obtain a first suspicion coefficient of the script source, can be achieved through the following steps: First, from the pre-stored suspicion matrix of scripts from various file sources, the suspicion corresponding to the script source of the external script is searched; second, based on the relationship between the found suspicion and a first preset parameter, a first suspicion coefficient is generated. The pre-stored suspicion matrix of scripts from various file sources can be obtained by analyzing the script sources used as samples.

[0145] Step S2043: Based on the initialized script source suspicion matrix and the first suspicion coefficient, determine whether there is a detection result for a fileless attack.

[0146] In this embodiment, after analyzing the script source of the external script and obtaining the first suspicion coefficient of the script source, for sample scripts executed by the process chain from unknown or known sources, different calculation methods are selected to calculate the suspicion value of the sample script source corresponding to the execution of the sample script by the process chain. Further, the suspicion value of the sample script source corresponding to the execution of the sample script by the process chain is substituted into the initialized script source suspicion matrix to obtain the script source suspicion matrix of the external script. Finally, based on the script source suspicion matrix of the external script, the detection result of whether there is a fileless attack is determined.

[0147] In some embodiments of this application, when a suspicious source matrix of an external script is determined, the suspicious value of the suspicious source matrix of the external script can be found to be within a certain range based on a preset list of suspicious source levels, thereby quickly determining the degree of suspicion of the external script's source.

[0148] For example, the preset list of script source suspicion levels is shown below:

[0149] Suspicious level normal Low risk Medium risk High risk δ range δ<0.1 0.1<=δ<0.4 0.4 >= δ > 0.7 δ>=0.7

[0150] Preset list of script sources with suspicious levels

[0151] Among them, the different degrees of suspicion in the preset script source suspicion level list correspond to four suspicion value δ ranges. When δ≥0.7, the suspicion level is the highest and is regarded as high-risk level; when 0.4≤δ<0.7, the suspicion level decreases and is regarded as medium-risk level; when 0.1≤δ<0.4, the suspicion level further decreases and is regarded as low-risk level; when δ<0.1, the suspicion level is the lowest and is regarded as normal level.

[0152] Taking attack example 1 as an example, when attack example 1 is carried out, based on the relevant information record table 2, it can be seen that the process chain is explorer.exe->wscript.exe, the script source is ADS, and the corresponding δ is obtained through script source suspicion matrix analysis. Assuming that the value of δ is 0.8, based on the preset script source suspicion level list, the suspicion level of the external script source is quickly determined to be a high-risk source, thereby determining that there is a fileless attack behavior in the system.

[0153] In other embodiments of this application, the script source suspicion matrix initialized in step S2041 can be obtained through, for example... Figure 7 The steps shown yield the following:

[0154] Step S601: Obtain the second suspiciousness coefficient of the script source used as the sample.

[0155] The script sources used as samples include the script sources of scripts called by positive sample processes, and the script sources of scripts called by negative sample processes when there is a no-sample attack.

[0156] In this embodiment of the application, step S601, obtaining the second suspiciousness coefficient as the script source of the sample, can be achieved through the following steps:

[0157] A11, obtain the second number of script sources for scripts called by positive sample processes and the third number of script sources for scripts called by negative sample processes;

[0158] A12, based on the second and third quantities, determines the suspiciousness of scripts from various sources;

[0159] A13, based on the relationship between the suspiciousness of scripts from various sources and the first preset parameter, generates a second suspiciousness coefficient for each source.

[0160] Furthermore, in the process of performing steps A11-A13 above, further explanation is provided regarding the methods for determining the suspiciousness of scripts from various sources and generating the second suspiciousness coefficients for each source:

[0161] First, substitute the second number of script sources for scripts called by positive sample processes and the third number of script sources for scripts called by negative sample processes into the following calculation formula to calculate the suspiciousness of scripts from each type of source. The suspiciousness is represented by k. type ;

[0162] k type =type_file_sum / (type_file_sum+attack_sum);

[0163] The second quantity is represented by type_file_sum, and the third quantity is represented by attack_sum.

[0164] Secondly, based on k type The relationship between the second and the first preset parameters is used to generate a second suspicion coefficient.

[0165] Here, given the script source of the script called by the positive sample process, the suspiciousness k of each source is calculated. type And then based on k type The relationship with the first preset parameter is used to calculate the suspiciousness coefficient 'a' of the source of a file of a specified type. type .

[0166] The first preset parameter can be flexibly set according to actual needs; for example, the first preset parameter is set to 1. Let k... type Substitute into the following formula to calculate a. type :a type ={(k type =1)? 0,1}.

[0167] In other words, when k type When a equals 1, type The value is 0 when k typ When the value of a is other than a type The value is 1.

[0168] In some embodiments of this application, for scripts from which files originate, a suspicious file source matrix can be automatically generated, storing the suspiciousness k of scripts from various file sources. type Matrix Ktype As shown below:

[0169] Script source txt VBS EXE JS picture … k 0.40 0.00 0.21 0.81 1 …

[0170] Matrix K type

[0171] In the above matrix K type In the document, the source script's type includes TXT, VBS, EXE, JS, and image. For example, the suspiciousness level k of scripts from different source files... type k TXT =0.40, k VBS =0.00, k EXE =0.21, k JS =0.81, k 图片 =1. It can be seen that by analyzing the script sources used as samples, a suspiciousness matrix of scripts from various file sources can be obtained and stored. This suspiciousness matrix can be used to quickly determine the first suspiciousness coefficient of the script source of an external script when the target process in the system reads an external script.

[0172] Step S602: Based on the second suspiciousness coefficient, determine the suspicious value of the sample script source corresponding to the execution of the sample script in each process chain.

[0173] Here, based on the suspiciousness coefficient, the suspiciousness value of the script source corresponding to the execution of a specified type of script in each process chain can be determined. The suspiciousness value is used to initialize the script source suspiciousness matrix.

[0174] Here, a process chain refers to a process chain where a process generates a child process, and that child process generates another child process, until the last child process stops generating new child processes.

[0175] In other embodiments of this application, if each process chain executes a sample script from a known source, step S602 determines the suspicious value of the sample script source corresponding to the execution of the sample script by each process chain based on the second suspiciousness coefficient, which can be obtained through the following steps:

[0176] First, based on the fourth quantity corresponding to the positive sample process in each type of source, and the second suspicion coefficient of each type of source, the target quantity associated with the positive sample process is determined;

[0177] Secondly, based on the target quantity and the third quantity, suspicious values ​​of the sample script source are determined.

[0178] Here, if each process chain executes a sample script from a known source, the suspicious value of the corresponding sample script source is identified as δ1. Furthermore, the method for determining δ1 based on the target quantity and the third quantity is further explained:

[0179] The formula for calculating δ1 is as follows:

[0180] δ1=attack_sum / (∑(a type ×type_file_sum)+attack_sum). Where, ∑(a type ×type_file_sum) represents the number of targets.

[0181] In this embodiment of the application, when the type of the script source file is sufficiently suspicious, such as reading a script from an image file for execution, k 图片 =1, at this time, a type =0. Therefore, for the calculation of δ1, the smaller the denominator, the larger the value of δ1, indicating that the source of the script is sufficiently suspicious. Thus, data from other file types will not be used as the standard for calculation, making the detection more effective and able to resist large-scale attack events, such as when attackers launch large-scale attacks. There are too many such behaviors, and during automatic updates, the behavior is mistakenly identified as normal behavior and the detection is bypassed.

[0182] In some embodiments of this application, when (type_file_sum + attack_sum) = 0, k type =0.5; that is, when the source of the script is uncertain, it is set to grayscale, which means that it is neither a negative sample nor a positive sample.

[0183] When (∑(a type When (×type_file_sum)+attack_sum)=0, δ=0.5; that is, when the script source file has never appeared, since normal scripts will come from common files, it is set to medium risk by default.

[0184] In other embodiments of this application, if each process chain executes a sample script from an unknown source, step S602 determines the suspicious value of the sample script source corresponding to the execution of the sample script by each process chain based on the second suspiciousness coefficient, which can be obtained through the following steps:

[0185] First, obtain the number of times the sample script from an unknown source is called;

[0186] Secondly, based on the number of calls and the third quantity, suspicious values ​​of the sample script source are determined.

[0187] Here, if each process chain executes a sample script from an unknown source, the suspicious value of the corresponding sample script source is identified as δ2. Furthermore, the method for determining δ2 based on the number of calls and the third quantity is further explained:

[0188] The formula for calculating δ2 is as follows:

[0189] δ2 = attack_sum / (src_sum+attack_sum); where src_sum represents the number of calls to sample scripts from unknown sources.

[0190] Step S603: Based on the suspicious values ​​of the sample script source, obtain the initialized script source suspicious matrix.

[0191] Here is an example of the final initialized script source suspicion matrix:

[0192] Process linked list ADS REG NET FILE … A->B <![CDATA[δ1]]> <![CDATA[δ2]]> <![CDATA[δ3]]> <![CDATA[δ4,K type ]]> … A->C <![CDATA[δ5]]> <![CDATA[δ6]]> <![CDATA[δ7]]> <![CDATA[δ8,K type ]]> … A->D <![CDATA[δ9]]> <![CDATA[δ 10 ]]> <![CDATA[δ 11 ]]> <![CDATA[δ 12 ,K type ]]> … B->C <![CDATA[δ 13 ]]> <![CDATA[δ 14 ]]> <![CDATA[δ 15 ]]> <![CDATA[δ 16 ,K type ]]> …

[0193] The source of the initialization script is suspicious.

[0194] Among them, the initial script source is suspected in the matrix δ i This represents the suspicious value of the script source corresponding to the execution of a specified type of script in each process chain, where i is a positive integer. The script source suspicious matrix initialized above involves the following processes: process A, process B, process C, and process D.

[0195] Here, the contents of the initialized script source suspicion matrix are explained: A->B indicates that process A created process B, where A is the parent process and B is the child process; the script source matrix is ​​recorded and updated based on the script sources of child processes in the process chain. When the script source is a file, different types of scripts will correspond to different script source file type matrices K. type For example, if processes A->B execute a VBScript, an HTAScript, and an SCTScript respectively, then there will be three K matrices, namely K... vbs ,K hta and K sct .

[0196] Therefore, this application utilizes a suspiciousness analysis algorithm to process the script source of samples. By analyzing negative and positive samples, it calculates the suspiciousness coefficient for each source, determines the suspiciousness value of various file types based on the suspiciousness coefficient and sample quantity, and establishes an initial script source suspiciousness matrix based on these values. Consequently, in subsequent processes, if a process in the system reads an external script, the initial script source suspiciousness matrix can be used to accurately determine the suspiciousness of various file sources, improving detection accuracy. Here, when a new process chain executes a script, suspicious values ​​are obtained. This not only allows for automated detection of fileless attack behavior based on the initial script source suspiciousness matrix but also enables real-time updates to the initial script source suspiciousness matrix, such as updating the suspiciousness value of the script source within the matrix. This dynamic data update ensures the dynamic updating of suspicious results for script sources and further improves the accuracy of the calculation results.

[0197] In some embodiments of this application, in step S405, if the system is found to have a fileless attack based on the script source suspicion matrix, the attack chain can also be discovered by combining the relevant information record table, that is, the attack flowchart can be restored, providing a favorable basis for thoroughly detecting and eliminating the attack.

[0198] For example, the attack chain discovered by combining relevant information in Table 1 is shown below:

[0199] Office macro code execution -> Add startup item, create stream file -> Script in stream file is called and executed every time system restart -> Launch attack.

[0200] For example, the attack process for attack example 1 above can be reconstructed as follows:

[0201] When the first stage of attack example 1 (the script in the Run startup execution stream file) is detected and cleared, the RunOnce bat script will find that the first stage attack has been implemented and start the second stage attack. At this time, the cmd program calls cscript to execute the script in the png; when the png script is read and executed, this application obtains that the script in cscript comes from the image file, through K vbs The matrix acquisition process chain is cmd.exe -> cscipt.exe, and the source is the suspiciousness of the image file (as shown in the matrix above, the suspiciousness is 1). The suspiciousness is then calculated using the suspiciousness analysis algorithm as follows:

[0202] The following calculations are for the case where the process chain is cmd.exe -> cscipt.exe, and k type Substituting 1 into a type The calculation formula is as follows:

[0203] a vbs ={(k type ==1)? 0,1}={(1==1)? 0,1}=0;

[0204] ∑(a type ×type_file_sum)=∑(0×type_file_sum)=0;

[0205] δ=attack_sum / (∑(a type ×type_file_sum)+attack_sum)=attack_sum / attack_sum.

[0206] The results are as follows: If attack_sum = 0, then δ = 0.5, indicating a medium-risk source that requires further investigation; this often occurs when detecting unknown attacks. If attack_sum > 0, then δ = 1, indicating a high-risk source; this attack is a known attack and is detected.

[0207] Therefore, the process chain's behavior of executing scripts in image files indicates that the scripts were executed from medium- or high-risk sources, thus detecting the attack.

[0208] Accordingly, the attack chain is improved as follows:

[0209] Phase 1: Office macro code execution -> Add startup item and create stream file -> Script in stream file is called and executed every time the system restarts -> Launch attack;

[0210] When the first stage is cleaned up, the second stage is implemented: a bat file is executed -> a cscript is created in cmd -> the script code in the png is executed, writing the malicious script into a new stream file, and creating an lnk file in the startup directory to achieve persistent fileless attack.

[0211] Phase 3: Automatic startup upon system boot -> Execution of scripts in cscript stream files -> Implementation of the attack.

[0212] The detection code for the first and second stages is detailed above. As for the third stage detection, since the executed script originates from an ADS stream file, its logic is the same as the first stage, and this application can also detect it. Based on all the detection results, the attack flowchart can be completely reconstructed, helping endpoints and / or analysts achieve thorough attack detection and removal.

[0213] The following continues to describe the exemplary structure of the fileless attack detection device 154 provided in the embodiments of this application as a software module. In some embodiments, such as Figure 1As shown, the software module stored in the fileless attack detection device 154 in the memory 150 can be the fileless attack detection device in the terminal 100, including:

[0214] The module 1541 is used to obtain the target unique identifier of the target process when the target process in the system reads an external script.

[0215] The acquisition module 1541 is used to acquire target association information of the target process based on the target's unique identifier;

[0216] The processing module 1542 is used to analyze the various behaviors of the parent process and the target process contained in the target association information to obtain the script source of the external script;

[0217] Processing module 1542 is used to analyze the source of external scripts and determine whether there are any fileless attack detection results in the system.

[0218] In some embodiments, the processing module 1542 is configured to obtain an initialized script source suspicion matrix; analyze the script source of external scripts to obtain a first suspicion coefficient of the script source of external scripts; and determine whether there is a detection result of a fileless attack based on the initialized script source suspicion matrix and the first suspicion coefficient.

[0219] In some embodiments, the processing module 1542 is configured to obtain a second suspiciousness coefficient of the script source as a sample; wherein the script source as a sample includes the script source of the script called by the positive sample process, and the script source of the script called by the negative sample process when there is a no-sample attack; based on the second suspiciousness coefficient, determine the suspiciousness value of the sample script source corresponding to each process chain executing the sample script; and based on the suspiciousness value of the sample script source, obtain an initialized script source suspiciousness matrix.

[0220] In some embodiments, the processing module 1542 is configured to obtain a second number of script sources for scripts called by positive sample processes and a third number of script sources for scripts called by negative sample processes; determine the suspiciousness of scripts from various sources based on the second number and the third number; and generate a second suspiciousness coefficient for various sources based on the relationship between the suspiciousness of scripts from various sources and a first preset parameter.

[0221] In some embodiments, the processing module 1542 is configured to substitute the second number of script sources for scripts called by positive sample processes and the third number of script sources for scripts called by negative sample processes into the following calculation formula to calculate the suspiciousness of scripts from each type of source, where the suspiciousness is represented by k. type ;k type= type_file_sum / (type_file_sum+attack_sum); where the second quantity is represented by type_file_sum and the third quantity is represented by attack_sum; based on k type The relationship between the second and the first preset parameters is used to generate a second suspicion coefficient.

[0222] In some embodiments, the processing module 1542 is configured to, if each process chain executes a sample script from a known source, determine the target number associated with the positive sample process based on the fourth number corresponding to the positive sample process in each type of source and the second suspiciousness coefficient of each type of source; and determine the suspiciousness value of the sample script source based on the target number and the third number.

[0223] In some embodiments, the processing module 1542 is configured to, if each process chain executes a sample script from a known source, represent the suspicious value of the corresponding sample script source as δ1, and the formula for calculating δ1 is as follows:

[0224] δ1=attack_sum / (∑(a type ×type_file_sum)+attack_sum).

[0225] In some embodiments, the processing module 1542 is configured to, if each process chain executes a sample script from an unknown source, obtain the number of calls to the sample script from the unknown source; and, based on the number of calls and a third quantity, determine a suspicious value for the source of the sample script.

[0226] In some embodiments, the processing module 1542 is configured to, if each process chain executes a sample script from an unknown source, represent the suspicious value of the sample script source as δ2, and the formula for calculating δ2 is as follows:

[0227] δ2 = attack_sum / (src_sum + attack_sum); where src_sum represents the number of script calls from unknown sources.

[0228] In some embodiments, the acquisition module 1541 is used to search for target association information corresponding to the target unique identifier in the unique identifier list.

[0229] In some embodiments, the processing module 1542 is configured to, upon detecting a process creation event, obtain the process identifier of the new process and the unique identifier of the previous process of the new process; obtain the new process path of the new process based on the process identifier, and parse the new process name from the new process path; read the new process file information based on the new process path, and obtain the internal name and original name of the new process based on the new process file information; generate the unique identifier of the new process based on the unique identifier of the previous process and a first parameter; and add the process name, new process path, internal name, original name, and unique identifier of the previous process of the new process as associated information of the new process to the unique identifier list based on the unique identifier of the new process.

[0230] The fileless attack detection device provided in this application obtains the target process's unique identifier when the target process in the system reads an external script. This unique identifier is associated with the target process's parent process. Based on the unique identifier, target association information of the target process is obtained. The various behaviors of the target process and its parent process, contained in the target association information, are analyzed to determine the source of the external script. Further analysis of the external script's source determines whether a fileless attack is detected in the system. Therefore, given the source of the external script, since the generated process PUID is associated with each process's parent process, the process association information obtained based on the process PUID includes not only the process's own behaviors but also the behaviors of its parent process. Combined with the joint analysis of the process and its parent process's related behaviors, the source of the script is located, ensuring that all files can be traced back to their script source. This more accurately determines whether a fileless attack is detected in the system, avoiding missed detections of network files.

[0231] It should be noted that the description of the apparatus in this application embodiment is similar to the description of the method embodiment described above, and has similar beneficial effects as the method embodiment; therefore, it will not be repeated. For technical details not disclosed in this apparatus embodiment, please refer to the description of the method embodiment of this application for understanding.

[0232] This application provides a storage medium storing executable instructions. When these executable instructions are executed by a processor, they cause the processor to perform the method provided in this application, for example... Figure 2 The method shown.

[0233] The computer-readable storage medium provided in this application obtains a target unique identifier for a target process when the target process in the system reads an external script. This target unique identifier is associated with the target process's parent process. Based on the target unique identifier, target association information of the target process is obtained. The various behaviors of the parent process and the target process contained in the target association information are analyzed to obtain the script source of the external script. Analysis of the script source of the external script determines whether there are any fileless attack detection results in the system. Therefore, given the script source of the external script, since the generated process PUID is associated with the parent process of each process, the process association information obtained based on the process PUID includes not only the various behaviors of the process itself but also the various behaviors of its parent process. Combined with the joint analysis of the related behaviors of the process and its parent process, the script source is located, ensuring that all files can be traced back to the script source, thereby more accurately determining whether there are any fileless attack detection results in the system and avoiding missed detections of network files.

[0234] In some embodiments, the storage medium may be a computer-readable storage medium, such as a ferromagnetic random access memory (FRAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), flash memory, magnetic surface memory, optical disc, or a compact disk-read-only memory (CD-ROM); or it may be a device that includes one or any combination of the above-mentioned memories.

[0235] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0236] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may also be stored as part of a file containing other programs or data, for example, in one or more scripts within a Hyper Text Markup Language (HTL) document, in a single file dedicated to the program in question, or in multiple co-located files (e.g., files storing one or more modules, subroutines, or code sections). As an example, executable instructions may be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0237] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A method for detecting fileless attacks, characterized in that, include: When a target process in the system reads an external script, the target unique identifier of the target process is obtained; wherein the target unique identifier is associated with the parent process of the target process; Based on the target unique identifier, the target association information of the target process is obtained; the target unique identifier is created using a hash function; The script source of the external script is obtained by analyzing the various behaviors of the parent process and the target process contained in the target association information. Analyzing the script source of the external script to determine whether there are any fileless attack detection results in the system; the analysis of the script source of the external script to determine whether there are any fileless attack detection results in the system includes: Obtain the initialization script source suspicious matrix; The source of the external script is analyzed to obtain the first suspicion coefficient of the source of the external script; Based on the initialized script source suspicion matrix and the first suspicion coefficient, it is determined whether there is a detection result for a fileless attack.

2. The method according to claim 1, characterized in that, The process of obtaining the initial script source suspicion matrix includes: Obtain a second suspiciousness coefficient for the script source used as a sample; wherein, the script source used as a sample includes the script source of the script called by the positive sample process, and the script source of the script called by the negative sample process when there is a no-sample attack; Based on the second suspiciousness coefficient, the suspicious value of the sample script source corresponding to the execution of the sample script in each process chain is determined; Based on the suspicious values ​​of the sample script source, an initialized script source suspicious matrix is ​​obtained.

3. The method according to claim 2, characterized in that, The acquisition of the second suspiciousness coefficient as the source of the script for the sample includes: Obtain a first number of script sources for the scripts called by the positive sample process, and a second number of script sources for the scripts called by the negative sample process; Based on the first quantity and the second quantity, the suspiciousness of scripts from various sources is determined; Based on the relationship between the suspiciousness of scripts from the various sources and the first preset parameter, a second suspiciousness coefficient for each source is generated.

4. The method according to claim 3, characterized in that, The step of determining the suspicious value of the sample script source corresponding to the execution of the sample script in each process chain based on the second suspiciousness coefficient includes: If each process chain executes a sample script from a known source, the target number associated with the positive sample process is determined based on the third number corresponding to the positive sample process in each type of source and the second suspicion coefficient of each type of source. Based on the target quantity and the second quantity, a suspicious value for the source of the sample script is determined.

5. The method according to claim 3, characterized in that, The step of determining the suspicious value of the sample script source corresponding to the execution of the sample script in each process chain based on the second suspiciousness coefficient includes: If each process chain executes a sample script from an unknown source, obtain the number of calls to the sample script from the unknown source; Based on the number of calls and the second number, a suspicious value is determined for the source of the sample script.

6. The method according to any one of claims 1 to 5, characterized in that, The step of obtaining the target association information of the target process based on the target unique identifier includes: Search the list of unique identifiers for the target association information corresponding to the target unique identifier.

7. The method according to claim 6, characterized in that, Before searching for the target association information corresponding to the target unique identifier in the unique identifier list, the method further includes: If a process creation event is detected, obtain the process identifier of the new process and the unique identifier of the previous process of the new process; The new process path of the new process is obtained based on the process identifier, and the new process name is parsed from the new process path; Based on the new process path, read the new process file information, and obtain the internal name and original name of the new process based on the new process file information; The unique identifier of the new process is generated based on the unique identifier of the previous process and the first parameter; Based on the unique identifier of the new process, the process name, new process path, internal name, original name, and unique identifier of the previous process of the new process are added to the unique identifier list as the association information of the new process.

8. A detection device for fileless attacks, characterized in that, The device includes: The acquisition module is used to acquire the target unique identifier of the target process when the target process in the system reads an external script; wherein the target unique identifier is associated with the parent process of the target process; The acquisition module is used to acquire the target association information of the target process based on the target unique identifier; the target unique identifier is created using a hash function; The processing module is used to analyze various behaviors of the parent process and the target process contained in the target association information to obtain the script source of the external script; The processing module is used to analyze the script source of the external script and determine whether there is a fileless attack detection result in the system; The processing module is used to obtain an initialized script source suspicion matrix; analyze the script source of external scripts to obtain the first suspicion coefficient of the script source of external scripts; and determine whether there is a detection result of fileless attack based on the initialized script source suspicion matrix and the first suspicion coefficient.

9. A detection device for file-free attacks, characterized in that, include: Memory, used to store executable instructions; A processor, when executing executable instructions stored in the memory, implements the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, It stores executable instructions for causing a processor to execute, thereby implementing the method of any one of claims 1 to 7.

Images