Security defense method, device, electronic device and storage medium

Abstract

The embodiments of this specification relate to the field of network security technology, and in particular to a security defense method, device, electronic device, and storage medium. The security defense method includes: constructing multiple defense rules of different defense types in a terminal device to be defended; monitoring the number of times the terminal device hits each of the defense rules within a preset monitoring period; after each monitoring period expires, resetting the number of hits for each of the defense rules to zero, and re-monitoring the number of hits for each of the defense rules by the terminal device within the next monitoring period; and determining the defense strategy for the terminal device based on the number of hits for each of the defense rules within the monitoring period. The technical solution provided in this specification can defend against unknown viruses.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of network security technology, and in particular to a security defense method, device, electronic device, and storage medium. Background Art

[0002] With the widespread use of computer technology in various fields of social life, viruses have also emerged as its accessories. Due to the infectiousness, replication and destructiveness of these viruses, they have become a major problem threatening computer security.

[0003] However, when an unknown virus is first generated, security vendors may not be able to provide effective security defense against it. Summary of the Invention

[0004] In order to defend against unknown viruses, the embodiments of this specification provide a security defense method, device, electronic device and storage medium.

[0005] In a first aspect, the embodiments of this specification provide a security defense method, including:

[0006] Build multiple defense rules of different types in the terminal device to be defended;

[0007] Monitoring the number of times the terminal device hits each of the defense rules within a preset monitoring period; wherein, after each monitoring period expires, resetting the number of hits for each of the defense rules to zero, and re-monitoring the number of times the terminal device hits each of the defense rules within the next monitoring period;

[0008] A defense strategy for the terminal device is determined based on the number of hits of each defense rule within the monitoring period.

[0009] In a possible design, the defense types of the defense rules include a process-based defense type, a file-based defense type, a registry-based defense type, and a scheduled task-based defense type.

[0010] In one possible design, process-based defense rules include:

[0011] When a process on the terminal device is started, determining whether the name of the process and its startup parameters match a preset ATT&CK model;

[0012] and / or,

[0013] File-based defense rules include:

[0014] When a file is created on the terminal device, determining whether the binary content of the file matches a preset virus feature;

[0015] and / or,

[0016] Registry-based defense rules include:

[0017] When a registry of the terminal device is created and / or modified, and the process of creating and / or modifying the registry does not have signature information, determining whether the type of the registry matches a preset registry type;

[0018] and / or,

[0019] Plan-based defense rules include:

[0020] When a scheduled task is created on the terminal device, determine whether the binary content of the process to be started in the scheduled task hits a preset virus feature; and / or, when a scheduled task is created on the terminal device, determine whether the name of the process to be started in the scheduled task and its startup parameters hit a preset ATT&CK model.

[0021] In one possible design, determining the defense strategy of the terminal device based on the number of hits of each defense rule within the monitoring period includes:

[0022] For each of the defense rules, in response to the current defense rule being hit more than a first preset number of times within the monitoring period, an operation behavior that hits the current defense rule again is prohibited.

[0023] In a possible design, after prohibiting the operation behavior that hits the current defense rule again, the method further includes:

[0024] Ending the operations that have hit the current defense rules and have been executed within the monitoring period;

[0025] and / or,

[0026] A first snapshot process is performed on the current system environment of the terminal device, so that the terminal device is restored to the system environment at the time of the first snapshot process after restart.

[0027] In one possible design, determining the defense strategy of the terminal device based on the number of hits of each defense rule within the monitoring period includes:

[0028] In response to the hit count of all defense rules within the monitoring period exceeding a second preset count, a second snapshot process is performed on the current system environment of the terminal device, and a shutdown operation is executed.

[0029] In a possible design, after performing the shutdown operation, the method further includes:

[0030] After the terminal device is restarted, if the terminal device has at least one defense rule whose hit count exceeds a first preset count within the monitoring period before the terminal device is shut down, the terminal device is restored to the system environment at the time of the second snapshot processing.

[0031] In a second aspect, the embodiments of this specification further provide a security defense device, including:

[0032] A construction module is used to construct multiple defense rules of different defense types in the terminal device to be defended;

[0033] A monitoring module, configured to monitor the number of times the terminal device hits each of the defense rules within a preset monitoring period; wherein, after each monitoring period expires, the number of hits for each of the defense rules is reset to zero, and the number of times the terminal device hits each of the defense rules is re-monitored within the next monitoring period;

[0034] The determination module is used to determine the defense strategy of the terminal device based on the number of hits of each defense rule within the monitoring period.

[0035] In a third aspect, an embodiment of this specification further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any embodiment of this specification is implemented.

[0036] In a fourth aspect, an embodiment of this specification further provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in any embodiment of this specification.

[0037] The embodiments of this specification provide a security defense method, device, electronic device and storage medium. By constructing multiple defense rules of different defense types in the terminal device to be defended, the defense rules can be used to monitor whether the terminal device is attacked by malicious behavior of unknown viruses; then the number of times the terminal device hits each defense rule within a preset monitoring period is monitored. In this way, the defense strategy of the terminal device can be determined based on the number of hits of each defense rule within the monitoring period, thereby protecting the security of the terminal device. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0039] Figure 1 This is a flow chart of a security defense method provided in an embodiment of this specification;

[0040] Figure 2 This is a hardware architecture diagram of an electronic device provided in an embodiment of this specification;

[0041] Figure 3 This is a structural diagram of a security defense device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of the embodiments of this specification clearer, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are part of the embodiments of this specification, not all the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this specification.

[0043] Please refer to Figure 1 , an embodiment of this specification provides a security defense method, the method comprising:

[0044] Step 100: Construct multiple defense rules of different defense types in the terminal device to be defended;

[0045] Step 102: Monitor the number of times the terminal device hits each defense rule within a preset monitoring period; wherein, after each monitoring period expires, reset the number of times each defense rule is hit to zero, and re-monitor the number of times the terminal device hits each defense rule within the next monitoring period;

[0046] Step 104: Determine the defense strategy of the terminal device based on the number of hits of each defense rule within the monitoring period.

[0047] In the embodiments of this specification, by constructing multiple defense rules of different defense types in the terminal device to be defended, the defense rules can be used to monitor whether the terminal device is attacked by malicious behavior of unknown viruses; then the number of times the terminal device hits each defense rule within a preset monitoring period is monitored, so that the defense strategy of the terminal device can be determined based on the number of hits of each defense rule within the monitoring period, thereby protecting the security of the terminal device.

[0048] Described below Figure 1 How to perform the steps shown.

[0049] For step 100:

[0050] In one embodiment of the present specification, the defense types of the defense rules include process-based defense types, file-based defense types, registry-based defense types, and scheduled task-based defense types.

[0051] In this embodiment, by enriching the defense rules (ie, application scenarios) of terminal device security defense, the security of the terminal device can be more effectively protected. Here, the embodiment of this specification does not limit the specific defense type.

[0052] Regarding step 102:

[0053] In some embodiments, the monitoring period may be three minutes, which is not limited here. That is, the number of hits against each defense rule on the terminal device is counted every three minutes. Furthermore, upon expiration of the current monitoring period, the timer is restarted and the hit count is reset to zero, thereby ensuring the accuracy of the hit count statistics.

[0054] In one embodiment of this specification, the process-based defense rules include:

[0055] When a process on a terminal device starts, determine whether the process name and its startup parameters match the preset ATT&CK model.

[0056] In this embodiment, the ATT&CK model, as a fine-grained attack and defense framework, provides defense rules for exploitable processes and their corresponding startup parameters. The ATT&CK model primarily integrates historical hacker groups and attack incidents, using attack strategies as clues to link attack techniques and software corresponding to different attack strategies. This provides information security practitioners with an executable, moderately abstract model. Specifically, the ATT&CK model specifies which processes, when launched with which startup parameters, constitute malicious threat behavior.

[0057] For example, if the cmd.exe process is started with the parameter / d assoc, it indicates that the cmd.exe process may be maliciously exploited. In this case, the number of hits against the process-based defense rule is increased by 1. If it is not hit, the number does not increase.

[0058] In one embodiment of this specification, the file-based defense rules include:

[0059] When a file is created on a terminal device, it is determined whether the binary content of the file matches a preset virus signature.

[0060] For example, when a file is created on a terminal device, the terminal device's antivirus engine (which stores preset virus signatures) scans the binary content of the file. If the scan result is black, the number of hits against the file-based defense rule is increased by 1. If not, the number does not increase.

[0061] In one embodiment of this specification, the registry-based defense rules include:

[0062] When a registry of a terminal device is created and / or modified, and the process of creating and / or modifying the registry does not have signature information, it is determined whether the type of the registry matches a preset registry type.

[0063] In some implementations, the preset registry types include, but are not limited to, important registry entries such as startup, services, and file associations.

[0064] Generally speaking, if a process that creates and / or modifies a registry does not have signature information, it is likely that the process is untrustworthy. Therefore, if the type of registry created and / or modified by the process matches the preset registry type, then the creation and / or modification of the registry is malicious, and the number of hits for the registry-based defense rule is increased by 1. If it does not hit, the number does not increase.

[0065] In one embodiment of this specification, the defense rules based on the planned tasks include:

[0066] When a scheduled task is created on a terminal device, determine whether the binary content of the process to be started in the scheduled task matches a preset virus signature; and / or, when a scheduled task is created on a terminal device, determine whether the name of the process to be started in the scheduled task and its startup parameters match a preset ATT&CK model.

[0067] It should be noted that when a scheduled task is created on a terminal device, the terminal device will generate a process file, i.e., the process to be started. Therefore, a defense rule based on the scheduled task can be used to determine whether the binary content of the process to be started in the scheduled task hits the preset virus signature. For example, the terminal device's anti-virus engine (which stores the preset virus signature) can be used to scan the binary content of the process to be started. If the scan result is black, the number of times the defense rule based on the scheduled task is hit is increased by 1. If it does not hit, the number does not increase.

[0068] Similarly, because endpoint devices generate processes to be launched, you can determine whether the name of the scheduled process and its startup parameters match the preset ATT&CK model to serve as a scheduled task-based defense rule. For example, if the cmd.exe process is launched with the parameter / d assoc, it indicates that the cmd.exe process may be maliciously exploited. In this case, the number of hits against the process-based defense rule is increased by 1. If it does not, the number does not increase.

[0069] Regarding step 104:

[0070] In one embodiment of this specification, step 104 may specifically include:

[0071] For each defense rule, in response to the current defense rule being hit more than a first preset number of times within a monitoring period, an operation behavior that hits the current defense rule again is prohibited.

[0072] In this embodiment, by prohibiting the operation behavior that hits the current defense rule again as the defense strategy of the terminal device, the security of the terminal device can be effectively protected.

[0073] In some implementations, the first preset number of times may be 5 times, which is not limited here.

[0074] In one embodiment of the present specification, after the step of "prohibiting the operation behavior that hits the current defense rule again", the following steps are further included:

[0075] End the operations that have hit the current defense rules and been executed within the monitoring period.

[0076] In this embodiment, for the operational behaviors that have hit the current defense rules and have been executed within the monitoring period, since these operational behaviors are also malicious threat behaviors, it is necessary to terminate these operational behaviors in order to effectively protect the security of the terminal device.

[0077] For example, when the number of hits on a process-based defense rule exceeds a first preset number within a monitoring period, all subsequent startup operations of processes on the terminal device that hit the current defense rule will be prohibited, and the processes that have hit the current defense rule and have been started within the monitoring period will be terminated.

[0078] When the number of hits of the file-based defense rule exceeds the first preset number within the monitoring period, all subsequent file creation operations of the terminal device that hit the current defense rule will be prohibited, and the files that have hit the current defense rule and have been created within the monitoring period will be deleted.

[0079] When the number of hits of the registry-based defense rules exceeds the first preset number within the monitoring period, the creation and / or modification operations of all subsequent processes of the registry that hit the current defense rules on the terminal device will be prohibited, and the registry that has hit the current defense rules and been created within the monitoring period will be deleted, and the modified registry will be restored.

[0080] When the number of hits based on the defense rules of the scheduled tasks exceeds the first preset number within the monitoring period, all subsequent creation operations of the scheduled tasks of the terminal device that hit the current defense rules will be prohibited, and the scheduled tasks that have hit the current defense rules and have been created within the monitoring period will be deleted.

[0081] In one embodiment of the present specification, after the step of "prohibiting the operation behavior that hits the current defense rule again", the following steps are further included:

[0082] A first snapshot process is performed on the current system environment of the terminal device, so that the terminal device is restored to the system environment at the time of the first snapshot process after restart.

[0083] In this embodiment, for subsequent on-site restoration and behavior analysis, after prohibiting the operation behavior that hits the current defense rule again, the first snapshot processing operation of the current system environment of the terminal device can be performed, so that the terminal device can be restored to the system environment at the time of the first snapshot processing after restart.

[0084] In one embodiment of the present specification, after the step of "prohibiting the operation behavior that hits the current defense rule again", the following steps are further included:

[0085] Disable the network card of the terminal device.

[0086] In this embodiment, when a terminal device detects that one of the defense rules is frequently triggered during a monitoring period, the terminal device's network card is disabled to effectively protect the terminal device's security. Alternatively, a forced operation such as restarting or shutting down the terminal device may be performed, which is not limited here.

[0087] In another embodiment of this specification, step 104 may specifically include:

[0088] In response to the number of hits of all defense rules within the monitoring period exceeding a second preset number, a second snapshot processing is performed on the current system environment of the terminal device, and a shutdown operation is executed.

[0089] In this embodiment, when the number of hits for all defense rules within a monitoring period exceeds a second preset number, it indicates that the terminal device is experiencing a high level of malicious threat activity. To further ensure the security of the terminal device, a second snapshot of the terminal device's current system environment may be taken, followed by a shutdown operation. Taking a second snapshot of the terminal device's current system environment facilitates on-site restoration and scenario analysis.

[0090] In some implementations, the second preset number of times is greater than the first preset number of times. For example, the second preset number of times may be 10 times, which is not limited herein.

[0091] In one embodiment of this specification, after the step of "performing a shutdown operation", the method further includes:

[0092] After the terminal device is restarted, if the terminal device has at least one defense rule whose hit count exceeds a first preset count within the monitoring period before the terminal device is shut down, the terminal device is restored to the system environment at the time of the second snapshot processing.

[0093] In this embodiment, if at least one defense rule has a hit count exceeding a first preset count within a monitoring period before the terminal device is shut down, this indicates that the defense rule with a hit count exceeding the first preset count is hit more frequently by malicious behavior, i.e., this defense rule should be given special attention. Therefore, it may be considered to restore the terminal device to the system environment at the time of the second snapshot processing, rather than restoring the terminal device to the initial state (i.e., the state when the terminal device was last powered on). Of course, it is also possible to restore the terminal device to the initial state, which is not limited here.

[0094] It can be understood that the defense strategy of the defense rule of a single defense type and the defense strategy of the defense rule of all defense types do not affect each other and can be hit at the same time.

[0095] In some embodiments, the time point of the first snapshot processing is earlier than the time point of the second snapshot processing, and the terminal device can be restored to the system environment of the first snapshot processing or the system environment of the second snapshot processing after restarting, which is not limited here.

[0096] like Figure 2 、 Figure 3 As shown, the embodiment of this specification provides a security defense device. The device embodiment can be implemented by software, hardware, or a combination of software and hardware. From the hardware level, such as Figure 2 The figure shows a hardware architecture diagram of an electronic device where a security defense device is provided in an embodiment of this specification. Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, it is formed by the CPU of the electronic device in which it is located reading the corresponding computer program in the non-volatile memory into the internal memory and running it.

[0097] like Figure 3 As shown, this embodiment provides a security defense device, including:

[0098] A construction module 300 is used to construct a plurality of defense rules of different defense types in the terminal device to be defended;

[0099] The monitoring module 302 is configured to monitor the number of times the terminal device hits each of the defense rules within a preset monitoring period; wherein, after each monitoring period expires, the number of hits for each of the defense rules is reset to zero, and the number of times the terminal device hits each of the defense rules is re-monitored within the next monitoring period;

[0100] The determination module 304 is configured to determine a defense strategy for the terminal device based on the number of hits of each defense rule within the monitoring period.

[0101] In the embodiment of this specification, the construction module 300 can be used to execute step 100 in the above method embodiment, the monitoring module 302 can be used to execute step 102 in the above method embodiment, and the determination module 304 can be used to execute step 104 in the above method embodiment.

[0102] In one embodiment of the present specification, the defense type of the defense rule includes a process-based defense type, a file-based defense type, a registry-based defense type, and a scheduled task-based defense type.

[0103] In one embodiment of the present specification, the process-based defense rules include:

[0104] When a process on the terminal device is started, determining whether the name of the process and its startup parameters match a preset ATT&CK model;

[0105] and / or,

[0106] File-based defense rules include:

[0107] When a file is created on the terminal device, determining whether the binary content of the file matches a preset virus feature;

[0108] and / or,

[0109] Registry-based defense rules include:

[0110] When a registry of the terminal device is created and / or modified, and the process of creating and / or modifying the registry does not have signature information, determining whether the type of the registry matches a preset registry type;

[0111] and / or,

[0112] Plan-based defense rules include:

[0113] When a scheduled task is created on the terminal device, determine whether the binary content of the process to be started in the scheduled task hits a preset virus feature; and / or, when a scheduled task is created on the terminal device, determine whether the name of the process to be started in the scheduled task and its startup parameters hit a preset ATT&CK model.

[0114] In one embodiment of this specification, the determining module is configured to perform the following operations:

[0115] For each of the defense rules, in response to the current defense rule being hit more than a first preset number of times within the monitoring period, an operation behavior that hits the current defense rule again is prohibited.

[0116] In one embodiment of this specification, the determining module is further configured to perform the following operations:

[0117] Ending the operations that have hit the current defense rules and have been executed within the monitoring period;

[0118] and / or,

[0119] A first snapshot process is performed on the current system environment of the terminal device, so that the terminal device is restored to the system environment at the time of the first snapshot process after restart.

[0120] In one embodiment of this specification, the determining module is configured to perform the following operations:

[0121] In response to the hit count of all defense rules within the monitoring period exceeding a second preset count, a second snapshot process is performed on the current system environment of the terminal device, and a shutdown operation is executed.

[0122] In one embodiment of this specification, the determining module is further configured to perform the following operations:

[0123] After the terminal device is restarted, if the terminal device has at least one defense rule whose hit count exceeds a first preset count within the monitoring period before the terminal device is shut down, the terminal device is restored to the system environment at the time of the second snapshot processing.

[0124] It should be understood that the structures illustrated in the embodiments of this specification do not constitute specific limitations on a security defense device. In other embodiments of this specification, a security defense device may include more or fewer components than illustrated, or may combine or separate certain components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0125] The information interaction, execution process, etc. between the modules in the above-mentioned device are based on the same concept as the method embodiments of this specification. For specific contents, please refer to the description in the method embodiments of this specification and will not be repeated here.

[0126] An embodiment of this specification also provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a security defense method in any embodiment of this specification is implemented.

[0127] An embodiment of this specification also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes a security defense method in any embodiment of this specification.

[0128] Specifically, a system or device equipped with a storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program codes stored in the storage medium.

[0129] In this case, the program code read from the storage medium itself can realize the function of any one of the above embodiments, and thus the program code and the storage medium storing the program code constitute part of this specification.

[0130] Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0131] In addition, it should be clear that the functions of any of the above embodiments can be achieved not only by executing the program code read by the computer, but also by enabling the operating system operating on the computer to complete part or all of the actual operations based on the instructions of the program code.

[0132] In addition, it can be understood that the program code read from the storage medium is written into a memory provided in an expansion board inserted into the computer or into a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above embodiments.

[0133] It should be noted that, in this article, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply the existence of any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprising a ..." do not exclude the presence of other identical factors in the process, method, article or device comprising the elements.

[0134] Those skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk, etc. Various media that can store program codes.

[0135] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this specification, rather than to limit them. Although this specification has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of this specification.

Claims

1. A security defense method, characterized in that: include: Build multiple defense rules of different types in the terminal device to be defended; Monitoring the number of times the terminal device hits each of the defense rules within a preset monitoring period; wherein, after each monitoring period expires, resetting the number of hits for each of the defense rules to zero, and re-monitoring the number of times the terminal device hits each of the defense rules within the next monitoring period; Determining a defense strategy for the terminal device based on the number of hits of each defense rule within the monitoring period; The defense types of the defense rules include process-based defense type, file-based defense type, registry-based defense type and scheduled task-based defense type; Process-based defense rules include: When a process on the terminal device is started, determining whether the name of the process and its startup parameters match a preset ATT&CK model; and / or, File-based defense rules include: When a file is created on the terminal device, determining whether the binary content of the file matches a preset virus feature; and / or, Registry-based defense rules include: When a registry of the terminal device is created and / or modified, and the process of creating and / or modifying the registry does not have signature information, determining whether the type of the registry matches a preset registry type; and / or, Plan-based defense rules include: When a scheduled task is created on the terminal device, determine whether the binary content of the process to be started in the scheduled task hits a preset virus feature; and / or, when a scheduled task is created on the terminal device, determine whether the name of the process to be started in the scheduled task and its startup parameters hit a preset ATT&CK model.

2. The method according to claim 1, characterized in that The determining of the defense strategy of the terminal device based on the number of hits of each defense rule within the monitoring period includes: For each of the defense rules, in response to the current defense rule being hit more than a first preset number of times within the monitoring period, an operation behavior that hits the current defense rule again is prohibited.

3. The method according to claim 2, characterized in that After prohibiting the operation behavior that hits the current defense rule again, the method further includes: Ending the operations that have hit the current defense rules and have been executed within the monitoring period; and / or, A first snapshot process is performed on the current system environment of the terminal device, so that the terminal device is restored to the system environment at the time of the first snapshot process after restart.

4. The method according to claim 1, wherein The determining of the defense strategy of the terminal device based on the number of hits of each defense rule within the monitoring period includes: In response to the hit count of all defense rules within the monitoring period exceeding a second preset count, a second snapshot process is performed on the current system environment of the terminal device, and a shutdown operation is executed.

5. The method according to claim 4, characterized in that After the shutdown operation is performed, the method further includes: After the terminal device is restarted, if the terminal device has at least one defense rule whose hit count exceeds a first preset count within the monitoring period before the terminal device is shut down, the terminal device is restored to the system environment at the time of the second snapshot processing.

6. A security defense device, characterized in that: include: A construction module is used to construct multiple defense rules of different defense types in the terminal device to be defended; A monitoring module, configured to monitor the number of times the terminal device hits each of the defense rules within a preset monitoring period; wherein, after each monitoring period expires, the number of hits for each of the defense rules is reset to zero, and the number of times the terminal device hits each of the defense rules is re-monitored within the next monitoring period; a determination module, configured to determine a defense strategy for the terminal device based on the number of hits of each defense rule within the monitoring period; The defense types of the defense rules include process-based defense type, file-based defense type, registry-based defense type and scheduled task-based defense type; Process-based defense rules include: When a process on the terminal device is started, determining whether the name of the process and its startup parameters match a preset ATT&CK model; and / or, File-based defense rules include: When a file is created on the terminal device, determining whether the binary content of the file matches a preset virus feature; and / or, Registry-based defense rules include: When a registry of the terminal device is created and / or modified, and the process of creating and / or modifying the registry does not have signature information, determining whether the type of the registry matches a preset registry type; and / or, Plan-based defense rules include: When a scheduled task is created on the terminal device, determine whether the binary content of the process to be started in the scheduled task hits a preset virus feature; and / or, when a scheduled task is created on the terminal device, determine whether the name of the process to be started in the scheduled task and its startup parameters hit a preset ATT&CK model.

7. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 5.

Images