Host compromise detection method, apparatus, and device

Abstract

The embodiment of the present application relates to the technical field of computer network, and discloses a host compromise detection method, device and equipment, the method is applied to a firewall, comprising: obtaining the service traffic of a to-be-detected host; performing feature extraction on the service traffic of the to-be-detected host to obtain feature information of the service traffic of the to-be-detected host; matching the feature information with a compromise feature library, and in the case that the feature information matches the compromise feature library, determining that the to-be-detected host is a compromised host, wherein the compromise feature library comprises an intrusion prevention system (IPS) feature library and / or a virus feature library. The technical scheme of the present application can improve the detection accuracy of the compromised host.

Description

Technical Field

[0001] This invention relates to the field of computer network technology, specifically to a method, apparatus, and device for detecting host compromise. Background Technology

[0002] With the continuous development of information technology, network threats are becoming more diverse and complex, and we are also facing challenges from various new types of threats. These threats not only spread faster, but also have an increasingly wider attack surface.

[0003] Compromised host detection is one of the effective detection methods for enterprises to deal with new threats. However, existing compromised host detection technologies mostly rely on abnormal Domain Name System (DNS) information in traffic to determine whether a host is compromised. This method is very prone to identifying normal hosts or servers as compromised, resulting in a large number of false positives and low detection accuracy. Summary of the Invention

[0004] In view of the above problems, embodiments of the present invention provide a host compromise detection method, apparatus and device to solve the problem of low detection accuracy of compromised hosts in the prior art.

[0005] According to one aspect of the present invention, a host compromise detection method is provided, applied to a firewall. The method includes: acquiring the service traffic of a host to be detected; extracting features from the service traffic of the host to be detected to obtain feature information of the service traffic of the host to be detected; matching the feature information with a compromise feature database; and determining that the host to be detected is a compromised host if the feature information matches the compromise feature database, wherein the compromise feature database includes an IPS feature database and / or a virus feature database.

[0006] In one optional approach, the feature information includes at least one of a communication protocol, port information, and message digest. The step of matching the feature information with a compromised feature library, and determining the host to be detected as a compromised host when the feature information matches the compromised feature library, includes: matching the feature information with the IPS feature library, and determining the host to be detected as a compromised host when the IPS feature library includes at least one of the communication protocol, the port information, and the message digest.

[0007] In one optional approach, the feature information includes at least one of information digest, business file features, virus signature identifier, virus type, and virus name. The step of matching the feature information with a compromised feature database, and determining the host to be detected as a compromised host when the feature information matches the compromised feature database, includes: matching the feature information with the virus feature database, and determining the host to be detected as a compromised host when the virus feature database includes at least one of the information digest, business file features, virus signature identifier, virus type, and virus name.

[0008] In one optional approach, the feature information includes the business file features and the message digest. Matching the feature information with the virus signature database to determine that the host to be detected is a compromised host includes: matching the business file features with virus file features in the virus signature database, wherein the data type of the virus file features in the virus signature database is Bit-Map data; if the virus file features in the virus signature database are the same as the business file features, matching the hash value of the message digest with the hash value of the message digest of the virus file in the virus signature database; if the hash value of the message digest is the same as the hash value of the message digest of the virus file in the virus signature database, determining that the host to be detected is a compromised host.

[0009] In an optional embodiment, the method further includes: determining a vulnerability type verification rule corresponding to the service traffic of the compromised host based on the feature information; the vulnerability type verification rule includes IPS verification rules and / or virus verification rules; matching the service traffic of the compromised host with the vulnerability type verification rule to determine the vulnerability type of the compromised host, wherein the vulnerability type includes at least one of Trojan communication, spyware communication, data leakage, virus intrusion, and mining program intrusion.

[0010] In an optional embodiment, after determining that the host to be detected is a compromised host, the method further includes: determining, based on the service traffic of the compromised host, an associated host that has generated a preset communication behavior with the compromised host, the preset communication behavior including process communication and / or file transfer communication; acquiring the service traffic of the associated host; and, based on the service traffic of the associated host, determining that the associated host is a compromised host when it is determined that the associated host has generated the preset communication behavior with other hosts.

[0011] In an optional approach, after determining that the host to be detected is a compromised host, the method further includes: matching the feature information of the service traffic of the compromised host with a compromise feature database based on the service traffic of the compromised host; and determining the compromise level of the compromised host based on the number of successful matches between the feature information of the service traffic of the compromised host and the compromise feature database.

[0012] In one alternative approach, after determining the compromise level of the compromised host, the method further includes: if the compromise level of the compromised host is higher than a first threshold level, then adding the compromised host to a blacklist; if the compromise level of the compromised host is lower than a second threshold level, then generating compromise information of the compromised host and sending the compromise information to the user terminal so that the user can configure the compromised host according to the compromise information.

[0013] According to another aspect of the present invention, a host compromise detection device is provided, applied to a firewall. The device includes: an acquisition module for acquiring the service traffic of a host to be detected; an extraction module for extracting features from the service traffic of the host to be detected to obtain feature information of the service traffic of the host to be detected; and a determination module for matching the feature information with a compromise feature database, and determining the host to be detected as a compromised host if the feature information matches the compromise feature database; the compromise feature database includes an IPS feature database and / or a virus feature database.

[0014] According to another aspect of the present invention, a host compromise detection device is provided, characterized in that it includes: a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to perform the operation of the host compromise detection method described above by executing the executable instructions.

[0015] According to another aspect of the present invention, a computer-readable storage medium is provided, the storage medium storing at least one executable instruction, which, when executed on a host compromise detection device / apparatus, causes the host compromise detection device / apparatus to perform the operation of any of the host compromise detection methods described above.

[0016] This invention acquires the service traffic of the host to be detected, extracts features from the service traffic, obtains feature information of the service traffic of the host to be detected, and matches the feature information with a compromise feature database. If the feature information matches the compromise feature database, including the IPS feature database and / or virus feature database, the host to be detected is determined to be a compromised host. It can link the firewall's IPS detection and virus detection functions to identify compromised hosts, improve the accuracy of compromise detection, and the entire detection process is completed independently by the firewall, simplifying the compromise detection configuration process.

[0017] The above description is merely an overview of the technical solutions of the embodiments of the present invention. In order to better understand the technical means of the embodiments of the present invention and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0018] The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0019] Figure 1 A schematic flowchart of a host compromise detection method provided by the present invention is shown;

[0020] Figure 2 A flowchart illustrating another host compromise detection method provided by the present invention is shown;

[0021] Figure 3 This diagram illustrates a method for extracting feature information provided by the present invention.

[0022] Figure 4 A flowchart illustrating a method for determining a compromised host provided by the present invention is shown;

[0023] Figure 5 A flowchart illustrating a method for determining the type of failure provided by the present invention is shown;

[0024] Figure 6 A flowchart illustrating a method for determining a failure type verification rule provided by the present invention is shown.

[0025] Figure 7 A schematic diagram of a method for determining the level of collapse provided by the present invention is shown;

[0026] Figure 8 A flowchart illustrating another host compromise detection method provided by the present invention is shown;

[0027] Figure 9 A schematic diagram of the structure of a host loss detection device provided by the present invention is shown;

[0028] Figure 10 A schematic diagram of the structure of a host failure detection device provided by the present invention is shown. Detailed Implementation

[0029] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0030] In one related technical approach, EDR (Endpoint Detection and Response) software can be used to determine whether a network device has been compromised. After determining whether compromise has occurred, the EDR software can return the result to the firewall, allowing the firewall to isolate or block the compromised network device. However, the judgment result of this method depends heavily on the EDR software, its accuracy is unreliable, and it is not conducive to the firewall's controllable security protection.

[0031] To address the issues of low detection accuracy of compromised hosts and the difficulty in providing controllable security protection through firewalls, this application provides a host compromise detection method. This method can link the firewall's IPS detection and virus detection functions to identify compromised hosts, thereby improving the accuracy of compromise detection. Furthermore, the entire detection process is completed independently by the firewall, simplifying the compromise detection configuration process.

[0032] Figure 1 The flowchart illustrates a host compromise detection method provided by an embodiment of the present invention. This method can be applied to firewalls, enabling them to perform compromise analysis on service traffic monitored by the firewall and determine whether hosts within the internal network are at risk of compromise. Figure 1 As shown, the method includes the following steps S110 to S130:

[0033] Step S110: Obtain the service traffic of the host to be tested.

[0034] The host under test refers to a server within the intranet that provides data management and computing services. The service traffic of the host under test refers to the data traffic generated by the host when accessing the internet via mobile communication technology or using related value-added data services. A firewall, as a protective barrier constructed at the interface between the intranet and the extranet, and between a private network and the public network, is composed of software and hardware devices and protects hosts within the intranet from unauthorized intrusion.

[0035] For example, a firewall can monitor the connections and interactions between internal and external networks and can monitor business traffic. For instance, a firewall can monitor the communication behavior and data flow of all hosts that have firewall functionality enabled.

[0036] Step S120: Extract features from the service traffic of the host to be tested to obtain feature information of the service traffic of the host to be tested.

[0037] The characteristic information of the service traffic of the host under investigation refers to data with certain prominent characteristics in the service traffic, which is the key to distinguishing service traffic. For the service traffic of the host under investigation, the firewall can extract features from the service traffic. For example, it can decode the service traffic and extract data size, keywords, destination and source addresses, domain name rules, etc., to obtain the characteristic information of the service traffic of the host under investigation.

[0038] Through the above step S120, the firewall can extract features from the service traffic of the host to be detected in order to obtain key data for analyzing whether the host to be detected has been compromised.

[0039] In one alternative approach, the aforementioned feature information may include intrusion prevention system (IPS) features, which include at least one of communication protocol, port information, and message digest.

[0040] Among them, communication protocols refer to the common network language that provides communication support for interconnected networks with different operating systems and hardware architectures. They can include Transmission Control Protocol (TCP), User Datagram Protocol (UDP), Hypertext Transfer Protocol (HTTP), Internet Protocol (IP), Internet Control Message Protocol (ICMP), File Transfer Protocol (FTP), Internet Message Access Protocol (IMAP), PostOffice Protocol version 3 (POP3), Simple Mail Transfer Protocol (SMTP), etc.

[0041] Ports include physical ports and logical ports. Physical ports can include interfaces on hubs, switches, and routers used to connect to other network devices, such as RJ-45 ports and SC ports. Logical ports can be internal ports within a computer or within a switch or router; they are generally not visible and can include ports such as port 80, port 21, and port 23 on a computer. Port information can include the port type and name. A message digest is a "fingerprint" of data generated using a message digest algorithm. Message digest algorithms can include hash algorithms and hashing algorithms, such as the MD5 algorithm.

[0042] When extracting the above-mentioned feature information, the firewall can use specific detection engines, such as the underlying Deep Packet Inspection (DPI) service, to perform detection and protocol decoding to obtain the communication protocol and port information of the business traffic of the host to be detected, and generate information digests of the business traffic or the files it transmits.

[0043] In an alternative approach, the aforementioned feature information may further include virus features, which include at least one of the following: message digest, business document features, virus signature identifier, virus type, and virus name.

[0044] The aforementioned message digest refers to the message digest generated using other detection engines, such as virus detection engines. It may differ from or be the same as the message digest generated by the DPI service. Business file characteristics can include the characteristics of the files corresponding to the business traffic, such as the transmitted file name, file size, file type, and content characteristics. The virus signature identifier can be a specific string that uniquely identifies a virus, and can consist of numbers, characters, and special symbols. Virus types generally include system viruses, worm viruses, Trojan viruses, script viruses, virus implantation program viruses, destructive program viruses, and bundled machine viruses.

[0045] When extracting the above feature information, such as Figure 2 As shown, step S210 can be executed first to restore the file of the decoded business traffic of the host to be detected transmitted via protocols such as HTTP. For example, for a file, it needs to be transmitted in multiple business traffic segments. Each transmission of business traffic can contain the file data and file information transmitted in this transmission, such as the file header, file size and marker data. When restoring the file, the business traffic of each transmission can be obtained, and then the range of file data for each transmission can be determined. The file data is then merged according to the file header, file size and marker data to obtain the complete file data.

[0046] Then, step S220 can be executed to extract business file features, virus signature identifiers, virus types and virus names from the file data. For the information digest, step S230 needs to be executed to determine whether the file data is compressed. If it is, step S240 needs to be executed to decompress it. If not, step S250 is executed to calculate the information digest of the file data using a hash algorithm or hashing algorithm, thereby obtaining all the feature information.

[0047] For some business traffic, the parsed data may contain some feature information. In this case, the feature information can be directly read from the parsed data. For example... Figure 3As shown, when parsing the header data of the traffic from the business traffic, the data of the corresponding fields can be read to obtain the above-mentioned information summary, virus signature identifier, virus type and virus name.

[0048] Step S130: Match the feature information with the compromised feature library. If the feature information matches the compromised feature library, determine that the host to be detected is a compromised host.

[0049] The compromise signature database can include an IPS signature database and / or a virus signature database. An IPS is a computer network security device capable of monitoring the data transmission behavior of a network or network devices. It can identify protocol anomalies and transmission anomalies in service traffic, and can also identify abnormal situations and intercept harmful system requests by comparing normal and abnormal data. The IPS signature database is a signature database of compromised host characteristics detected by the IPS detection engine, and can include data characteristics, protocol characteristics, and request characteristics of abnormal data.

[0050] A virus signature database is a collection of characteristic information of compromised hosts detected by a virus detection engine. Specifically, a virus detection engine can detect whether a specific program on a network device is a virus, and whether a program running on a network device has been attacked by a virus. Therefore, a virus signature database can include all virus programs detected by the virus detection engine and the virus characteristics of devices attacked by viruses. For example, it can include the name, type, frequency of attacks, and type of program that attacked the virus.

[0051] For IPS signature databases and virus signature databases, the features in the database can be represented as a set of signature codes. Each signature code can be a string formed according to specific rules that can identify a certain feature. Furthermore, IPS signature databases and virus signature databases can be a single file or database data composed of multiple files.

[0052] After obtaining the characteristic information of the service traffic of the host to be detected, the characteristic information can be matched with the characteristics in the IPS characteristic database and the virus characteristic database respectively. If there is a characteristic information that matches any one or more characteristics in the IPS characteristic database and the virus characteristic database, it means that the host to be detected meets the characteristics of being compromised, and it can be identified as a compromised host.

[0053] In an alternative approach, when the feature information is an IPS feature, the IPS feature can be matched with features in the IPS feature library. For example, when the feature information includes at least one of communication protocol, port information, and message digest, step S130 can be implemented by the following method:

[0054] The feature information is matched with the IPS feature library. If the IPS feature library includes at least one of the following: communication protocol, port information, and message digest, the host to be detected is identified as a compromised host.

[0055] When matching feature information with the IPS feature library, each feature information can be matched one by one with the features in the IPS feature library to determine whether the IPS feature library contains the three types of information in the feature information: communication protocol, port information, and message digest. If one or more of the feature values ​​are consistent with the features in the IPS feature library, it means that the feature information of the service traffic of the host to be detected matches the features in the IPS feature library. Therefore, the host to be detected meets the characteristics of being compromised and is a compromised host.

[0056] In an alternative approach, when the feature information is a virus feature, the virus feature can be matched with features in a virus feature database. For example, when the feature information includes at least one of message digest, business document features, virus signature identifier, virus type, and virus name, step S130 can also be implemented using the following method:

[0057] The feature information is matched with the virus feature database. If the virus feature database includes at least one of the following: information digest, business file features, virus signature identifier, virus type and virus name, the host to be detected is identified as a compromised host.

[0058] When matching feature information with the virus signature database, each feature information can be matched one by one with the features in the virus signature database to determine whether the virus signature database contains the information digest, business file features, virus signature identifier, virus type and virus name in the feature information. If one or more pieces of information are consistent with the feature values ​​of the features in the virus signature database, it also means that the feature information of the business traffic of the host to be tested matches the features in the virus signature database, and the host to be tested meets the characteristics of being compromised, and is a compromised host.

[0059] In some embodiments, when the feature information of the service traffic of the host to be detected includes both IPS features and virus features, the IPS features of the service traffic of the host to be detected can be matched with the features in the IPS feature library, and the virus features of the service traffic of the host to be detected can be matched with the features in the virus feature library, thereby determining whether the host to be detected has been compromised.

[0060] In addition, when matching each feature with the features in the IPS feature library or virus feature library one by one, since the features in the IPS feature library and virus feature library can be represented in the form of feature codes, in order to improve the matching speed, each feature can also be converted into a feature code in the same way as the feature code. Then, the feature code that matches the feature code is searched in the feature code set corresponding to the IPS feature library and virus feature library to determine whether each feature is the same as the feature value of the feature in the feature library. If they are the same, the host to be detected is determined to be a compromised host.

[0061] The above method can be used to match feature information using IPS feature database and virus feature database to determine whether the host to be detected has been compromised, realizing the linkage between IPS detection and virus detection and improving the accuracy of compromise detection.

[0062] Furthermore, as the feature database continues to expand, the number of features within it will increase significantly, drastically increasing the workload of a one-to-one matching approach. Therefore, to improve the efficiency of feature matching, one optional approach is to include the aforementioned business file features and information digests in the feature information. Thus, when matching the feature information against the virus feature database to determine if the host to be detected is compromised, such as... Figure 4 As shown, the following methods can be executed:

[0063] Step S410: Match the business file characteristics with the virus file characteristics in the virus characteristic database. The data type of the virus file characteristics in the virus characteristic database is Bit-Map data.

[0064] Bit-Map is a data structure that operates and records data based on binary bits. It has only two states: 0 and 1. Its basic idea is to use a bit to mark the value corresponding to an element, and the key is that element. That is, one bit represents a virus characteristic, such as the size of a virus file.

[0065] For example, during matching, the virus detection engine can generate a Bit-Map data file for all virus files after loading the virus signature database. Then, during matching, the business file features can be converted into Bit-Map data, and this data can be compared with the data in the Bit-Map data file for consistency verification. Since storing data in bits requires very little data, it can save storage space and improve the efficiency of feature matching.

[0066] Step S420: If the virus file characteristics in the virus signature database are the same as the business file characteristics, match the hash value of the message digest with the hash value of the message digest of the virus file in the virus signature database.

[0067] A hash value is the process of converting input characters of arbitrary length into a password and producing a fixed output, thus mapping a long piece of data to a shorter one. For all virus file features in a virus signature database, each feature can correspond to a hash value, and all hash values ​​can be stored in hash buckets. Hash values ​​with the same address belong to the same hash bucket. A virus detection engine can use the hash bucket algorithm to convert the information digest of virus files in the virus signature database into hash values, and then allocate hash buckets according to these hash values, thereby storing the information digests of virus files in the virus signature database in hash buckets.

[0068] When the Bit-Map data of the business file characteristics matches the Bit-Map data of the virus file characteristics, the hash value of the message digest can be further matched with the hash value of the message digest of the virus file in the virus signature database. For example, the hash bucket corresponding to the hash value of the message digest can be found through a hash algorithm, and then it can be determined whether the hash value of the message digest matches the hash value of the virus file's message digest. When the Bit-Map data of the business file characteristics does not match the Bit-Map data of the virus file characteristics, message digest matching is no longer performed.

[0069] Due to the advantage of hash value length, this matching method can greatly improve the efficiency of matching virus file characteristics with business file characteristics. Furthermore, the use of hash buckets can also resolve hash collision issues.

[0070] Step S430: If the hash value of the message digest is the same as the hash value of the message digest of the virus file in the virus signature database, the host to be detected is determined to be a compromised host.

[0071] When the hash value of the message digest matches the hash value of the message digest of a virus file in the virus signature database, it indicates that the host under test meets the characteristics of a compromised host, thus confirming that the host under test is a compromised host. Because the hash value of the message digest occupies less memory, its comparison is more efficient than comparing the message digest of a direct virus file.

[0072] Therefore, the above methods can not only identify compromised hosts, but also improve the efficiency of feature matching by utilizing specific data formats, such as Bit-Map data and hash values.

[0073] Once a compromised host is identified, it can be added to the firewall's compromise list. The list can include the compromised host's IP address, compromise type, user, and compromise level, so that the firewall or user can take action against it.

[0074] In one alternative approach, such as Figure 5As shown, when it is determined in steps S110 to S130 that the host to be detected is compromised, the above method may further include steps S510 to S520:

[0075] Step S510: Based on the feature information, determine the vulnerability type verification rules corresponding to the service traffic of the host to be detected.

[0076] The vulnerability type verification rules include IPS verification rules and / or virus verification rules. IPS verification rules are determined based on at least one of IPS characteristics, such as communication protocols, port information, and message digests. Virus verification rules are determined based on at least one of virus characteristics, such as message digests, business file characteristics, virus signature identifiers, virus types, and virus names. These two types of verification rules may partially overlap or be completely different.

[0077] When determining the verification rules for compromise types, verification rules can be filtered according to IPS characteristics or virus characteristics. Taking IPS verification rules as an example, the IPS verification rules corresponding to the service traffic of the host to be detected can be determined in the form of "communication protocol - port information - rule chain". For example, first determine the communication protocol of the service traffic of the host to be detected, and then find the rule chain according to the port information. Figure 6 As shown, for service traffic with TCP as the communication protocol, its destination address and starting address are further determined. If the destination address is the server, the IPS verification rule for the service traffic is determined to be rule chain 1-100. If the starting address is from host a to the server, the IPS verification rule for the service traffic is determined to be rule 7-9.

[0078] Step S520: Match the service traffic of the compromised host with the compromise type verification rules to determine the compromise type of the compromised host.

[0079] The types of compromise include at least one of the following: Trojan communication, spyware communication, data leakage, virus intrusion, and mining program intrusion.

[0080] Specifically, when the service traffic of a compromised host matches any one or more of the compromise type verification rules, the compromise type corresponding to any one or more rules can be determined as the compromise type of the compromised host.

[0081] For example, if the traffic of a compromised host matches the "Trojan / Backdoor" and "Trojan External Connection" rules in the IPS verification rules, then the compromise type of the compromised host can be determined to be Trojan communication. If the traffic of a compromised host matches the "Illegal Server External Connection," "Threat Intelligence," and "DNS Tunnel" rules in the IPS verification rules, as well as the "Backdoor Virus" rule in the virus verification rules, then the compromise type of the compromised host can be determined to be data transmission.

[0082] It should be noted that, for IPS verification rules and virus verification rules, since there may be some overlap in the verification rules, the compromise type of a compromised host can also correspond to one or more.

[0083] Using the above method, compromise type verification rules can be configured based on different feature libraries, which can further subdivide the compromise types of compromised hosts, improve the accuracy of compromise detection, and in subsequent compromise processing, different processing methods can be used to process compromised hosts of different compromise types, thus providing a basis for compromise processing.

[0084] In one alternative approach, after determining that the host to be detected is a compromised host, associated hosts that have engaged in preset communication behaviors with the compromised host can be identified based on the compromised host's service traffic; the service traffic of the associated hosts can be obtained; and based on the associated hosts' service traffic, when it is determined that the associated host has engaged in preset communication behaviors with other hosts, the associated host is identified as a compromised host. The preset communication behaviors may include process communication and / or file transfer communication.

[0085] Once the compromised host is identified, its traffic can be monitored for a period, such as 24 hours. Based on this traffic, associated hosts that have been communicating with the compromised host via process or file transfer can be identified. The firewall can then use the traffic of these associated hosts to determine if they are engaging in the same process or file transfer communication with other hosts. If so, these associated hosts are at risk of being compromised and can also be identified as compromised hosts. This allows for correlation analysis of other hosts communicating with the identified compromised hosts, helping to determine the compromise status of other hosts within the internal network.

[0086] In addition, for compromised hosts discovered through correlation analysis, abnormal processes on the compromised hosts can be controlled through terminal software. If the abnormal processes have a higher priority than the control processes of the terminal software, a firewall can be used for network isolation and access control to isolate the communication between the compromised hosts and other hosts, thereby preventing the widespread spread of risks and ensuring the network security of the internal network.

[0087] Furthermore, in an alternative approach, after determining that the host to be detected is a compromised host, the characteristic information of the compromised host's service traffic can be matched with a compromised feature database based on the compromised host's service traffic characteristics; the compromise level of the compromised host can be determined based on the number of successful matches between the characteristic information of the compromised host's service traffic and the compromised feature database.

[0088] Once a compromised host is added to the firewall's compromised list, its service traffic can be continuously monitored, and its characteristic information can be extracted. Every so often, such as every 24 hours, the number of successful matches between the characteristic information of the compromised host's service traffic and the characteristics in compromised feature databases, such as IPS feature databases and virus feature databases, can be counted. The compromise level of the compromised host can then be classified according to the number of successful matches.

[0089] like Figure 7 As shown, after determining the host to be detected as a compromised host through steps S710 and S720 and adding the compromised host to the compromised list, step S730 can be executed to count the number of successful feature matches for the compromised host every 24 hours. If the number of successful feature matches every 24 hours is greater than a first threshold, the compromised host is determined to be a high-risk host. If the number of successful feature matches every 24 hours is greater than a second threshold but less than the first threshold, the compromised host is determined to be a medium-risk host. If the number of successful feature matches every 24 hours is less than the second threshold, the compromised host is determined to be a low-risk host. The first threshold is greater than the second threshold. This method enables dynamic monitoring of compromised hosts, making the detection results more accurate and continuous, and providing a basis for subsequent handling of compromised hosts.

[0090] In one alternative approach, after determining the compromise level of the compromised host, the following method can also be performed: if the compromise level of the compromised host is higher than a first threshold level, the compromised host is added to a blacklist; if the compromise level of the compromised host is lower than a second threshold level, compromise information of the compromised host is generated and sent to the user terminal so that the user can configure the compromised host according to the compromise information.

[0091] The first threshold level and the second threshold level can be the same or different. When the first threshold level and the second threshold level are different, the first threshold level is higher than the second threshold level. The compromise information may include the compromised host's IP address, hostname, compromise time, compromise type, and level.

[0092] Regarding the handling of compromised hosts, when the compromise level of a compromised host is higher than the first threshold level, the compromised host can be directly added to the firewall's blacklist to isolate its communication with other hosts and networks. When the compromise level of a compromised host is lower than the second threshold level, compromise information of the compromised host can be generated and then sent to the user terminal in the form of email, SMS, etc., so that the user can determine whether to take action against the compromised host and how to take action against the compromised host based on the compromise information.

[0093] This method allows for differentiated handling of compromised hosts, avoiding the network impact caused by simply blacklisting them.

[0094] Figure 8 Another host compromise detection method is shown in an embodiment of the present invention, such as... Figure 8 As shown, the following steps may be included:

[0095] Step S801: Obtain the service traffic of the host to be tested.

[0096] Firewall traffic monitoring capabilities allow for the acquisition and detection of the service traffic of the host under investigation. Furthermore, based on the data encoding format of the service traffic, the firewall can decode the traffic to obtain analyzable data.

[0097] Step S802: Extract the characteristic information of the business traffic.

[0098] After decoding the service traffic of the host to be inspected, the firewall can extract features from the service traffic to obtain its feature information, such as IPS features extracted by the IPS detection engine, such as communication protocols, port information and message digests, and virus features extracted by the virus detection engine, such as message digests, service file features, virus signatures, virus types and virus names.

[0099] Step S803: Match the IPS feature library with the feature information.

[0100] Specifically, the IPS feature library can be matched with the IPS features in the feature information to determine whether a certain feature in the IPS features matches the corresponding feature in the IPS feature library, that is, whether the feature values ​​of the two features are consistent.

[0101] Step S804: Match the virus signature database with the signature information.

[0102] Specifically, the virus signature database can be matched with the virus signatures in the signature information to determine whether a certain feature in the virus signature database matches the corresponding feature in the virus signature database.

[0103] Step S805: Determine whether the host to be tested is a compromised host.

[0104] When an IPS signature matches a corresponding signature in the IPS signature database, it indicates that the host to be detected meets the characteristics of a compromised host, and the host can be identified as a compromised host. Similarly, when a virus signature matches a corresponding signature in the virus signature database, the host to be detected can also be identified as a compromised host.

[0105] Step S806: Determine the type of compromise of the compromised host.

[0106] After identifying the host under test as a compromised host, the compromise type can be further determined. Specifically, the compromise type verification rules can be determined first based on the extracted feature information of the compromised host's service traffic. For example, IPS verification rules can be determined based on IPS characteristics, and virus verification rules can be determined based on virus characteristics. Then, the service traffic of the compromised host can be verified using the IPS verification rules and virus verification rules, and the compromise type corresponding to the rules that the compromised host conforms to is determined as the compromise type of the compromised host.

[0107] Step S807: Add the compromised host to the compromised list.

[0108] Once the host to be detected is identified as a compromised host, it can be added to the firewall's compromised list. This allows the firewall to automatically add it to the blacklist, or it can help users manually configure the compromised host for isolation.

[0109] Step S808: Monitor the service traffic of the compromised host.

[0110] Once the host under test is identified as a compromised host, the firewall can isolate it from the external network. However, it may still be able to communicate with hosts on the internal network. Therefore, to ensure the security of the internal network, the firewall can also continuously monitor the compromised host.

[0111] Step S809: Determine the compromise level of the compromised host.

[0112] When monitoring the service traffic of a compromised host, the firewall can further analyze this traffic. For example, it can statistically analyze the host's service traffic every 24 hours, extract its characteristic information, and match this information against features in the IPS signature database and virus signature database. The number of successful matches is then calculated, and the compromised host is categorized as low-risk, medium-risk, or high-risk based on this number. This method allows for dynamic assessment of the compromised host's severity, providing a reference for the appropriate configuration of compromised hosts.

[0113] Step S810: Determine the associated host and whether the associated host has been compromised.

[0114] Since a compromised host may become the control point for other hosts after being attacked, in order to prevent it from "infecting" other hosts, the communication behavior of the compromised host can be monitored, and the associated hosts communicating with it can be identified. If the associated hosts also have communication behavior with other hosts, and if this communication behavior is the same as the communication behavior between the compromised host and the associated hosts, then it is determined that the associated hosts have also been compromised; otherwise, it is determined that the associated hosts have not been compromised.

[0115] also, Figure 8The order of steps S809 and S810 shown is for illustrative purposes only. Depending on actual needs, these two steps can be performed simultaneously or sequentially.

[0116] Step S811: Process the compromised associated host.

[0117] After confirming that the associated host has been compromised, the associated host can be added to the compromised list, allowing the firewall and users to take action against the host.

[0118] In summary, the host compromise detection method according to the embodiments of the present invention can acquire the service traffic of the host to be detected, extract features from the service traffic of the host to be detected to obtain feature information of the service traffic of the host to be detected, match the feature information with the compromise feature database, and determine the host to be detected as a compromised host when the feature information matches the compromise feature database, including the IPS feature database and / or virus feature database. It can link the IPS detection and virus detection functions of the firewall to identify compromised hosts, improve the accuracy of compromise detection, and the entire detection process is completed independently by the firewall, simplifying the compromise detection configuration process.

[0119] Figure 9 A schematic diagram of a host compromise detection device according to an embodiment of the present invention is shown. This host compromise detection device can be applied to a firewall. Figure 9 As shown, the host compromise detection device 900 may include: an acquisition module 910 for acquiring the service traffic of the host to be detected; an extraction module 920 for extracting features from the service traffic of the host to be detected to obtain feature information of the service traffic of the host to be detected; and a determination module 930 for matching the feature information with a compromise feature database, and determining the host to be detected as a compromised host if the feature information matches the compromise feature database; the compromise feature database includes an IPS feature database and / or a virus feature database.

[0120] In one alternative approach, the feature information includes at least one of communication protocol, port information, and message digest. The determining module 930 is used to match the feature information with the IPS feature library. If the IPS feature library includes at least one of communication protocol, port information, and message digest, the host to be detected is determined to be a compromised host.

[0121] In one alternative approach, the feature information includes at least one of information digest, business file features, virus signature identifier, virus type, and virus name. The determining module 930 is used to match the feature information with a virus feature database. If the virus feature database includes at least one of information digest, business file features, virus signature identifier, virus type, and virus name, the host to be detected is determined to be a compromised host.

[0122] In one optional approach, the feature information includes business file features and a message digest. The determining module 930 is used to match the business file features with virus file features in a virus feature database. The data type of the virus file features in the virus feature database is Bit-Map data. If the virus file features in the virus feature database are the same as the business file features, the hash value of the message digest is compared with the hash value of the message digest of the virus file in the virus feature database. If the hash value of the message digest is the same as the hash value of the message digest of the virus file in the virus feature database, the host to be detected is determined to be a compromised host.

[0123] In an optional manner, the determining module 930 is further configured to determine the vulnerability type verification rule corresponding to the service traffic of the compromised host based on the feature information. The vulnerability type verification rule includes IPS verification rule and / or virus verification rule. The service traffic of the compromised host is matched with the vulnerability type verification rule to determine the vulnerability type of the compromised host. The vulnerability type includes at least one of Trojan communication, spyware communication, data leakage, virus intrusion, and mining program intrusion.

[0124] In one alternative approach, after determining that the host to be detected is a compromised host, the determining module 930 is further configured to determine, based on the service traffic of the compromised host, an associated host that has a preset communication behavior with the compromised host, the preset communication behavior including process communication and / or file transfer communication, obtain the service traffic of the associated host, and, based on the service traffic of the associated host, determine that the associated host is a compromised host when it is determined that the associated host has a preset communication behavior with other hosts.

[0125] In one alternative approach, after determining that the host to be detected is a compromised host, the determining module 930 is further configured to match the characteristic information of the compromised host's service traffic with the compromised feature database based on the compromised host's service traffic, and determine the compromise level of the compromised host based on the number of successful matches between the characteristic information of the compromised host's service traffic and the compromised feature database.

[0126] In one alternative approach, after determining the compromise level of the compromised host, the determining module 930 is further configured to add the compromised host to a blacklist if the compromise level of the compromised host is higher than a first threshold level, and generate compromise information of the compromised host if the compromise level of the compromised host is lower than a second threshold level, and send the compromise information to the user terminal so that the user can configure the compromised host according to the compromise information.

[0127] The host compromise detection device provided in this embodiment of the invention can acquire the service traffic of the host to be detected, extract features from the service traffic of the host to be detected to obtain feature information of the service traffic of the host to be detected, match the feature information with a compromise feature database, and determine that the host to be detected is a compromised host when the feature information matches the compromise feature database, including the IPS feature database and / or virus feature database. It can link the IPS detection and virus detection functions of the firewall to identify compromised hosts, improve the accuracy of compromise detection, and the entire detection process is completed independently by the firewall, simplifying the compromise detection configuration process.

[0128] Figure 10 The diagram shows a schematic of a host loss detection device provided by an embodiment of the present invention. The specific implementation of the present invention does not limit the specific implementation of the host loss detection device.

[0129] like Figure 10 As shown, the host compromise detection device may include: a processor 1002, a communications interface 1004, a memory 1006, and a communications bus 1008.

[0130] The processor 1002, communication interface 1004, and memory 1006 communicate with each other via communication bus 1008. Communication interface 1004 is used to communicate with other network elements such as clients or other servers. The processor 1002 executes program 1010, specifically performing the relevant steps described in the embodiment of the host compromise detection method.

[0131] Specifically, program 1010 may include program code, which includes computer-executable instructions.

[0132] The processor 1002 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention. The host compromise detection device includes one or more processors, which may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0133] Memory 1006 is used to store program 1010. Memory 1106 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0134] Specifically, program 1010 can be called by processor 1002 to cause the host compromise detection device to execute the aforementioned host compromise detection method.

[0135] This invention provides a computer-readable storage medium storing at least one executable instruction. When the executable instruction is executed on a host compromise detection device / apparatus, it causes the host compromise detection device / apparatus to perform the host compromise detection method in any of the above method embodiments.

[0136] The executable instructions can be used to cause the host compromise detection device / app to perform the aforementioned host compromise detection method.

[0137] The algorithms or displays provided herein are not inherently related to any particular computer, virtual system, or other device. Furthermore, the embodiments of this invention are not directed to any particular programming language.

[0138] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. Similarly, for the sake of brevity and to aid in understanding one or more aspects of the invention, in the description of exemplary embodiments of the invention above, various features of the embodiments are sometimes grouped together in a single embodiment, figure, or description thereof. The claims, which follow the detailed description, are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of the invention.

[0139] Those skilled in the art will understand that the modules in the device of the embodiment can be adaptively changed and placed in one or more devices different from that embodiment. Modules, units, or components in the embodiment can be combined into a single module, unit, or component, and further, they can be divided into multiple sub-modules, sub-units, or sub-components, except that at least some of such features and / or processes or units are mutually exclusive.

[0140] It should be noted that the above embodiments are illustrative of the invention and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names. The steps in the above embodiments, unless otherwise specified, should not be construed as limiting the order of execution.

Claims

1. A method for host compromise detection, the method comprising: The method is applied to a firewall, and the method comprises: acquiring service traffic of a to-be-detected host, the to-be-detected host being a server in an internal network that provides data management and operation services; extracting features of the service traffic of the to-be-detected host to obtain feature information of the service traffic of the to-be-detected host; converting the feature information into a feature code, and matching the feature code with a compromised feature library, in a case where the feature information matches the compromised feature library, determining that the to-be-detected host is a compromised host, the compromised feature library comprising an intrusion prevention system (IPS) feature library and / or a virus feature library, the compromised feature library being a set of feature codes, and the feature code being a string for identifying features formed based on a preset rule; and adding the compromised host into a compromised list of the firewall; wherein the IPS feature library is a feature library of feature information of the compromised host detected by an IPS detection engine, and the virus feature library is a feature library of feature information of the compromised host detected by a virus engine; determining, according to the feature information, a compromised type checking rule corresponding to the service traffic of the to-be-detected host, the compromised type checking rule comprising an IPS checking rule and / or a virus checking rule; matching the service traffic of the compromised host with the compromised type checking rule to determine a compromised type of the compromised host; after determining that the to-be-detected host is a compromised host, the method further comprises: based on the service traffic of the compromised host, determining an associated host that produces a preset communication behavior with the compromised host, the preset communication behavior comprising process communication and / or file transfer communication; acquiring service traffic of the associated host; based on the service traffic of the associated host, in a case where the associated host produces the preset communication behavior with other hosts, determining that the associated host is a compromised host, and controlling an abnormal process of the compromised host through terminal software, if a priority of the abnormal process is higher than that of a control process of the terminal software, performing network isolation and access control through the firewall to network-isolate communication between the compromised host and other hosts.

2. The method of claim 1, wherein, The feature information comprises at least one of a communication protocol, port information, and information digest, and the matching of the feature information with the compromised feature library, in a case where the feature information matches the compromised feature library, comprises: matching the feature information with the IPS feature library, and in a case where the IPS feature library comprises at least one of the communication protocol, the port information, and the information digest, determining that the to-be-detected host is a compromised host.

3. The method of claim 1, wherein, The feature information comprises at least one of an information digest, a service file feature, a virus signature identifier, a virus type, and a virus name, and the matching of the feature information with the compromised feature library, in a case where the feature information matches the compromised feature library, comprises: The feature information is matched with the virus feature library, and in a case where the virus feature library includes at least one of the information digest, the service file feature, the virus signature identifier, the virus type and the virus name, it is determined that the to-be-detected host is a compromised host.

4. The method of claim 3, wherein, The feature information includes the service file feature and the information digest, and the feature information is matched with the virus feature library to determine that the to-be-detected host is a compromised host, including: The service file feature is matched with a virus file feature in the virus feature library, and a data type of the virus file feature in the virus feature library is Bit-Map data; In a case where the virus file feature in the virus feature library is the same as the service file feature, a hash value of the information digest is matched with a hash value of a virus file in the virus feature library; In a case where the hash value of the information digest is the same as the hash value of the virus file in the virus feature library, it is determined that the to-be-detected host is a compromised host.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: The compromised type includes at least one of Trojan communication, spyware communication, data export, virus intrusion and mining program intrusion.

6. The method according to any one of claims 1-4, characterized in that, After it is determined that the to-be-detected host is a compromised host, the method further includes: Based on the service traffic of the compromised host, feature information of the service traffic of the compromised host is matched with a compromised feature library; According to a number of successful times of matching of the feature information of the service traffic of the compromised host and the compromised feature library, a compromised level of the compromised host is determined.

7. The method of claim 6, wherein, After the compromised level of the compromised host is determined, the method further includes: If the compromised level of the compromised host is higher than a first threshold level, the compromised host is added to a blacklist; If the compromised level of the compromised host is lower than a second threshold level, compromised information of the compromised host is generated, and the compromised information is sent to a user terminal, so that the user configures the compromised host according to the compromised information.

8. A host trap detection apparatus, comprising: The device is applied to a firewall, and the device includes: An acquisition module is configured to acquire service traffic of a to-be-detected host, the to-be-detected host being a server in an internal network that provides data management and operation services; An extraction module is configured to perform feature extraction on the service traffic of the to-be-detected host to obtain feature information of the service traffic of the to-be-detected host; A determination module is configured to convert the feature information into a feature code, match the feature code with a compromised feature library, and in a case where the feature information matches the compromised feature library, determine that the to-be-detected host is a compromised host; the compromised feature library includes an intrusion prevention system (IPS) feature library and / or a virus feature library, the compromised feature library is a feature code set, and the feature code is a character string formed based on a preset rule and used for identifying features; and the compromised host is added to a compromised list of the firewall. The IPS feature library is a feature library of feature information of a compromised host detected by an IPS detection engine, and the virus feature library is a feature library of feature information of a compromised host detected by a virus engine. According to the feature information, a compromise type check rule corresponding to the service flow of the to-be-detected host is determined; the compromise type check rule includes an IPS check rule and / or a virus check rule; The service flow of the compromised host is matched with the compromise type check rule, and a compromise type of the compromised host is determined; After determining that the to-be-detected host is a compromised host, the determination module is further configured to determine, based on the service flow of the compromised host, an associated host that produces a preset communication behavior with the compromised host, the preset communication behavior including process communication and / or file transfer communication; obtain the service flow of the associated host; based on the service flow of the associated host, when it is determined that the associated host produces the preset communication behavior with other hosts, determine that the associated host is a compromised host, and control an abnormal process of the compromised host through terminal software, if a priority of the abnormal process is higher than that of a control process of the terminal software, perform network isolation and access control through the firewall to network-isolate the communication between the compromised host and other hosts.

9. A host trap detection device, characterized by, Comprise: a processor; a memory for storing executable instructions of the processor; wherein the processor is configured to perform the operations of the host compromise detection method of any one of claims 1-7 via executing the executable instructions.

10. A computer-readable storage medium, characterized in that, The storage medium has at least one executable instruction stored therein, and the executable instruction, when running on a host compromise detection device / apparatus, causes the host compromise detection device / apparatus to perform the operations of the host compromise detection method of any one of claims 1-7.

Images