Asset detection methods and devices for attack purposes

Abstract

This invention provides a method and apparatus for asset detection at the attack end. The method includes: acquiring the attack end's preference rules for the jump servers based on intelligence data of known jump servers; determining the content management system (CMS) used by the known jump servers; searching for addresses that use the same CMS as the known jump servers and forming an address set; actively probing each address in the address set, and identifying the assets corresponding to addresses that satisfy the preference rules as assets of the attack end. This solution can proactively discover more assets used by the attack end during the attack phase, which is beneficial for the production of threat intelligence by the attack end.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for detecting assets on the attack end. Background Technology

[0002] Current tracking of APT (Advanced Persistent Threat) groups typically relies on sample-side and network-side features. Currently, both sample-side and network-side features are obtained based on the attacked endpoint's behavioral characteristics. However, sample-side and network-side features from the attacker's perspective are difficult to obtain. Therefore, a method for detecting attacker assets is needed to proactively discover these assets. Summary of the Invention

[0003] This invention provides a method and apparatus for detecting assets on the attacking end, which can proactively discover assets on the attacking end.

[0004] In a first aspect, embodiments of the present invention provide an asset detection method for an attacking end, comprising:

[0005] Based on intelligence data about known hop servers, obtain the attacking end's preference rules for hop servers;

[0006] Determine the content management system (CMS) used by the known hop server;

[0007] Search for addresses that use the same content management system (CMS) as the known jump server, and form a set of addresses;

[0008] Actively probe each address in the address set, and identify the assets corresponding to addresses that satisfy the preference rules as the assets of the attacking end.

[0009] In one possible implementation, the preference rule includes: a page with a backlink address responding to a first request that does not conform to the online data rule, and a page with a backlink address responding to a second request that conforms to the online data rule;

[0010] Actively probe each address in the address set, and identify the assets corresponding to addresses that satisfy the preference rules as the assets of the attacking end, including:

[0011] For each address in the address set, the following steps are performed: send a request that does not conform to the online data rules and a request that conforms to the online data rules to the page of that address; if the page of that address responds to the request that does not conform to the online data rules in the same way as the first request response, and the page of that address responds to the request that conforms to the online data rules in the same way as the second request response, then the asset corresponding to that address is identified as the asset of the attacking party.

[0012] In one possible implementation, the preference rule includes: intermediate files generated by the attacker in the known jump server;

[0013] Actively probe each address in the address set, and identify the assets corresponding to addresses that satisfy the preference rules as the assets of the attacking end, including:

[0014] Perform a file depth scan on each address in the address set, and determine the assets corresponding to the addresses of the intermediate files scanned as the assets of the attacking end.

[0015] In one possible implementation, the preference rules further include: URL path rules for backlink addresses;

[0016] After forming the address set and before conducting active probing, the method further includes: deleting addresses in the address set that do not meet the URL path rules of the backlink address, thereby obtaining a filtered address set.

[0017] In one possible implementation, after determining the assets corresponding to the addresses that satisfy the preference rules as the assets of the attacker, the method further includes: supplementing the threat intelligence of the attacker based on the determined assets of the attacker.

[0018] Secondly, embodiments of the present invention also provide an asset detection device for the attacking end, comprising:

[0019] The acquisition unit is used to acquire the attacking end's preference rules for the jump server based on the intelligence data of the known jump server;

[0020] CMS determination unit, used to determine the content management system (CMS) used by the known scaffolding machine;

[0021] The address set forming unit is used to search for addresses that use the same content management system (CMS) as the known jump server, and to form an address set.

[0022] The detection unit is used to actively detect each address in the address set and identify the assets corresponding to the addresses that satisfy the preference rules as the assets of the attacking end.

[0023] In one possible implementation, the preference rule includes: a page with a backlink address responding to a first request that does not conform to the online data rule, and a page with a backlink address responding to a second request that conforms to the online data rule;

[0024] The detection unit is specifically used to: for each address in the address set, perform the following actions: send a request that does not conform to the online data rules and a request that conforms to the online data rules to the page of that address in turn; if the page of that address responds to the request that does not conform to the online data rules in the same way as the first request response, and the page of that address responds to the request that conforms to the online data rules in the same way as the second request response, then the asset corresponding to that address is identified as the asset of the attacking end.

[0025] In one possible implementation, the preference rule includes: intermediate files generated by the attacker in the known jump server;

[0026] The detection unit is specifically used to: perform a file depth scan on each address in the address set, and determine the asset corresponding to the address of the scanned intermediate file as the asset of the attacking end.

[0027] Thirdly, embodiments of the present invention also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the method described in any embodiment of this specification.

[0028] Fourthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the methods described in any embodiment of this specification.

[0029] This invention provides a method and apparatus for asset detection at the attacking end. Based on intelligence data of known jump servers, it can analyze the attacking end's preference rules for these jump servers. Since attackers typically use the same type of websites or network devices as jump servers during the attack phase, and these websites or network devices generally use the same type of CMS, the known CMS used by the jump servers can be used to search for addresses using the same CMS and form an address set. Then, using the attacking end's preference rules for the jump servers, it can actively detect whether the assets corresponding to the addresses in the address set belong to the attacking end. Therefore, this solution can proactively discover more assets used by the attacking end during the attack phase, which is beneficial for the production of threat intelligence targeting the attacking end. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a flowchart of an asset detection method for an attack terminal provided by an embodiment of the present invention;

[0032] Figure 2 This is a hardware architecture diagram of an electronic device provided in an embodiment of the present invention;

[0033] Figure 3 This is a structural diagram of an asset detection device for an attack terminal provided in an embodiment of the present invention;

[0034] Figure 4 This is a structural diagram of another attack-side asset detection device provided in an embodiment of the present invention. Detailed Implementation

[0035] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0036] As mentioned earlier, current sample-side and network-side features are obtained based on the attacked behavior of the attacked endpoint. However, there is currently no method to detect the assets of the attacking endpoint, especially assets such as jump servers compromised by the attacking endpoint, within a certain range.

[0037] Regarding the asset detection method of the attacking end, the inventive concept of this invention is: to use known jump servers as threat intelligence to learn the attacking end's preference rules for jump servers, and then to actively probe the already sorted addresses using the attacker's preferences in order to detect the attacking end's assets.

[0038] The specific implementation of the above concept is described below.

[0039] Please refer to Figure 1 This invention provides an asset detection method for an attacker, the method comprising:

[0040] Step 100: Based on the intelligence data of known jump servers, obtain the attacking end's preference rules for jump servers;

[0041] Step 102: Determine the content management system (CMS) used by the known scaffold server;

[0042] Step 104: Search for addresses that use the same content management system (CMS) as the known jump server, and form an address set;

[0043] Step 106: Actively probe each address in the address set, and determine the assets corresponding to the addresses that satisfy the preference rules as the assets of the attacking end.

[0044] In this embodiment of the invention, based on intelligence data from known jump servers, the attacker's preference rules for these jump servers can be analyzed. Since attackers typically use the same type of websites or network devices as jump servers during the attack phase, and these websites or network devices generally use the same type of CMS, addresses using the known CMSs used by jump servers can be searched and a set of addresses can be formed. Then, using the attacker's preference rules for jump servers, the assets corresponding to the addresses in the address set can be actively probed to determine whether they belong to the attacker. Therefore, this solution can proactively discover more assets used by the attacker during the attack phase, which is beneficial for producing threat intelligence targeting the attacker.

[0045] The following description Figure 1 The execution method for each step is shown.

[0046] First, for step 100, based on the intelligence data of known jump servers, the attacking end's preference rules for jump servers are obtained.

[0047] Jump attack is a common form of cyberattack used by hackers. In order to better conceal their actions, attackers usually do not launch attacks directly from their own system to the target. Instead, they first compromise several intermediate systems and use these intermediate systems as jump servers to carry out their attacks.

[0048] Since an attacker typically uses multiple identical jump servers to complete an attack within a single phase, other jump servers for that attacker can be searched for using known jump servers.

[0049] In this embodiment of the invention, once a known jump server is identified, its intelligence data can be used to obtain the attacker's preference rules for that jump server. These preference rules are then used to carry out the attack.

[0050] In one embodiment of the present invention, the preference rule may include at least one of the following three:

[0051] The first scenario: The page at the backlink address responds to the first request that does not conform to the online data rules, and the page at the backlink address responds to the second request that conforms to the online data rules.

[0052] When sending a request to a page at a known bastion host's callback address, the bastion host page responds differently to requests that conform to the online data rules and those that do not. Specifically, it determines whether the data carried in the request meets its requirements. Online data refers to the data a trojan horse needs to carry when going online, such as the computer name and username. However, for pages at addresses other than bastion hosts, sending different data requests yields the same response. Therefore, the page's response to a first request that does not conform to the online data rules, and the page's response to a second request that conforms to the online data rules, can be considered a preference rule for filtering bastion hosts.

[0053] The online data rules, the first request response, and the second request response can all be obtained by analyzing the intelligence data of known scout machines using existing intelligence analysis methods.

[0054] The second type: intermediate files generated by the attacking end in the known jump server;

[0055] When an attacker uses a jump server to launch an attack, they typically use intermediate files to gain control. To obtain intermediate files generated by the attacker on a known jump server, the corresponding intermediate files can be retrieved through the URL path of the callback address.

[0056] The third type: URL path rules for backlink addresses.

[0057] The return address of a jump server consists of a domain name and a URL path. After an attacker compromises multiple jump servers in one phase of an attack, the URL path rules of the return addresses of the multiple jump servers are the same. Therefore, the URL path rules of the return addresses can be used as a preference rule to filter the assets of the attacker.

[0058] Then, the steps 102 "determine the content management system (CMS) used by the known hop host" and 104 "search for addresses that use the same content management system (CMS) as the known hop host and form an address set" will be explained simultaneously.

[0059] Considering that multiple hop servers compromised by the attacker within a single attack phase are of the same type, it is necessary to obtain the addresses of websites or network devices of the same type as the known hop servers. Furthermore, considering that websites or network devices of the same type use the same Content Management System (CMS) for content management, in this embodiment of the invention, a broad search can be conducted based on the known hop servers' CMS to find addresses using the same CMS, thereby obtaining the addresses of potential hop servers.

[0060] The CMS used by a known bastion host can be identified by analyzing the hierarchical structure of the folders on the corresponding website or network device. When searching for addresses that use the same CMS as a known bastion host, a space engine or search engine can be used.

[0061] Finally, for step 106, the preference rules are used to actively probe each address in the address set, and the assets corresponding to the addresses that satisfy the preference rules are identified as the assets of the attacking end.

[0062] In one embodiment of the present invention, if the preference rules include URL path rules for backlink addresses before active probing, the range of addresses in the address set can be narrowed down using the URL path rules for backlink addresses, thereby reducing the workload of active probing.

[0063] Specifically, addresses that do not meet the URL path rules for the backlink addresses are removed from the address set, resulting in a filtered address set. Active probing is then performed on each address in this filtered set. It is evident that the third preference rule described above is primarily used to narrow down the range of addresses requiring active probing. However, addresses that only meet the third preference rule cannot be definitively identified as assets of the attacking party. Therefore, it is necessary to combine the first and second preference rules to determine this.

[0064] The first and second preference rules mentioned above will be explained below.

[0065] First type of preference rule:

[0066] The preference rules obtained in step 100 include: the page at the backlink address responding to a first request that does not conform to the online data rules, and the page at the backlink address responding to a second request that conforms to the online data rules; therefore, step 106 may include:

[0067] For each address in the address set, the following steps are performed: send a request that does not conform to the online data rules and a request that conforms to the online data rules to the page of that address; if the page of that address responds to the request that does not conform to the online data rules in the same way as the first request response, and the page of that address responds to the request that conforms to the online data rules in the same way as the second request response, then that address is identified as an asset of the attacking party.

[0068] If the address is a normal address, the response results to the two requests sent sequentially will be the same; that is, at least one of the responses will be different from the request response in the preference rule. For example, the page at this address may respond differently to a request that does not conform to the online data rule than the first request response, and / or the page at this address may respond differently to a request that conforms to the online data rule than the second request response.

[0069] Therefore, if the third preference rule and the first preference rule are satisfied at the same time, the asset corresponding to the address is considered to be the asset of the attacker.

[0070] The second type of preference rule:

[0071] The preference rules obtained in step 100 include: intermediate files generated by the attacking end in the known jump server; therefore, step 106 may include:

[0072] Perform a file depth scan on each address in the address set, and determine the assets corresponding to the addresses of the intermediate files scanned as the assets of the attacking end.

[0073] Since the intermediate file is set up in the jump server by the attacker, if other addresses that meet the URL path rules in the third preference rule also store the intermediate file, then the address that scanned the intermediate file is also determined to be a jump server.

[0074] Furthermore, by simultaneously probing using the three preference rules mentioned above, if an address satisfies all three preference rules, then that address is identified as an asset belonging to the attacker. This method provides a more accurate determination of the attacker's assets.

[0075] In one embodiment of the present invention, since these assets are all used by the attacker, this method is based on one or some known jump servers and can automatically associate more attacker assets that cannot be found by relying on samples in the same batch of attacks. It can further supplement the threat intelligence of the attacker based on the identified assets of the attacker to enrich the intelligence data.

[0076] like Figure 2 , Figure 3As shown, this embodiment of the invention provides an asset detection device for the attack end. The device embodiment can be implemented through software, hardware, or a combination of both. From a hardware perspective, such as... Figure 2 The diagram shown is a hardware architecture diagram of an electronic device housing an asset detection device for an attack terminal, provided in an embodiment of the present invention. Besides... Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing packets. Taking software implementation as an example, such as... Figure 3 As shown, a device in a logical sense is formed by the CPU of its host electronic device reading the corresponding computer program from non-volatile memory into memory and running it. This embodiment provides an asset detection device for the attack end, comprising:

[0077] The acquisition unit 301 is used to acquire the attacking end's preference rules for the jump server based on the intelligence data of the known jump server;

[0078] CMS determination unit 302 is used to determine the content management system (CMS) used by the known scaffolding machine;

[0079] Address set forming unit 303 is used to search for addresses that use the same content management system (CMS) as the known jump server, and form an address set;

[0080] The detection unit 304 is used to actively detect each address in the address set and determine the assets corresponding to the addresses that satisfy the preference rules as the assets of the attacking end.

[0081] In one embodiment of the present invention, the preference rule includes: a page with a backlink address responding to a first request that does not conform to the online data rule, and a page with a backlink address responding to a second request that conforms to the online data rule;

[0082] The detection unit is specifically used to: for each address in the address set, perform the following actions: send a request that does not conform to the online data rules and a request that conforms to the online data rules to the page of that address in turn; if the page of that address responds to the request that does not conform to the online data rules in the same way as the first request response, and the page of that address responds to the request that conforms to the online data rules in the same way as the second request response, then the asset corresponding to that address is identified as the asset of the attacking end.

[0083] In one embodiment of the present invention, the preference rule includes: intermediate files generated by the attacking end in the known jump server;

[0084] The detection unit is specifically used to: perform a file depth scan on each address in the address set, and determine the asset corresponding to the address of the scanned intermediate file as the asset of the attacking end.

[0085] In one embodiment of the present invention, the preference rule further includes: URL path rules for the backlink address;

[0086] The detection unit is further configured to delete addresses in the address set that do not meet the URL path rules of the backlink address, thereby obtaining a filtered address set.

[0087] In one embodiment of the present invention, please refer to Figure 4 The device may also include:

[0088] Intelligence production unit 305 is used to supplement the threat intelligence of the attacking end based on the identified assets of the attacking end.

[0089] It is understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on an asset detection device for an attack target. In other embodiments of the present invention, an asset detection device for an attack target may include more or fewer components than illustrated, or combine some components, or split some components, or arrange different components. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0090] The information interaction and execution process between the modules in the above-mentioned device are based on the same concept as the method embodiment of the present invention, and the specific details can be found in the description in the method embodiment of the present invention, and will not be repeated here.

[0091] This invention also provides an electronic device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements an asset detection method for an attack terminal according to any embodiment of this invention.

[0092] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform an asset detection method for an attack terminal according to any embodiment of this invention.

[0093] Specifically, a system or apparatus equipped with a storage medium may be provided, on which software program code implementing the functions of any of the embodiments described above is stored, and the computer (or CPU or MPU) of the system or apparatus may read and execute the program code stored in the storage medium.

[0094] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute part of the present invention.

[0095] Examples of storage media used to provide program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer via a communication network.

[0096] Furthermore, it should be clear that not only can the program code read by the computer be executed, but also the operating system or other components operating on the computer can be instructed based on the program code to perform some or all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0097] Furthermore, it is understood that the program code read from the storage medium is written to the memory set in the expansion board inserted into the computer or to the memory set in the expansion module connected to the computer. Then, based on the instructions of the program code, the CPU or other components installed on the expansion board or expansion module execute some and all of the actual operations, thereby realizing the function of any of the above embodiments.

[0098] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0099] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as ROM, RAM, magnetic disk, or optical disk.

[0100] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An attack-side asset detection method, comprising: The method comprises the following steps: Based on the intelligence data of the known jumpboard machine, a preference rule set by an attack end for the jumpboard machine is obtained; the jumpboard machine is an intermediate system attacked by the attack end first when launching an attack from the jumpboard machine to a target; the preference rule is used to realize an attack behavior; A content management system (CMS) used by the known jumpboard machine is determined; An address set is formed by searching for addresses using the same content management system (CMS) as the known jumpboard machine; Each address in the address set is actively probed, and an asset corresponding to an address meeting the preference rule is determined as an asset of the attack end; The asset of the attack end is a jumpboard machine attacked by the attack end; The preference rule comprises: a first request response of a page of a back connection address to a request not meeting an online data rule and a second request response of the page of the back connection address to a request meeting the online data rule; Each address in the address set is actively probed, and an asset corresponding to an address meeting the preference rule is determined as an asset of the attack end, comprising: for each address in the address set, a request not meeting the online data rule and a request meeting the online data rule are sent to the page of the address in sequence; if the response of the page of the address to the request not meeting the online data rule is the same as the first request response, and the response of the page of the address to the request meeting the online data rule is the same as the second request response, the asset corresponding to the address is determined as the asset of the attack end.

2. The method of claim 1, wherein, The preference rule comprises: an intermediate file generated by the attack end in the known jumpboard machine; Each address in the address set is actively probed, and an asset corresponding to an address meeting the preference rule is determined as an asset of the attack end, comprising: Each address in the address set is file depth scanned, and an asset corresponding to an address scanning out the intermediate file is determined as the asset of the attack end.

3. The method according to claim 1 or 2, characterized in that, The preference rule further comprises: a URL path rule of a back connection address; After the address set is formed, before active probing is performed, the address set is further processed to obtain a screened address set, comprising: addresses in the address set not meeting the URL path rule of the back connection address are deleted.

4. The method of any one of claims 1-2, wherein, After the asset corresponding to the address meeting the preference rule is determined as the asset of the attack end, the threat intelligence of the attack end is supplemented based on the determined asset of the attack end.

5. An attack-side asset detection apparatus, comprising: The method comprises the following steps: An acquisition unit is configured to obtain, based on intelligence data of a known jumpboard machine, a preference rule set by an attack end for the jumpboard machine; The jumpboard machine is an intermediate system attacked by the attack end first when launching an attack from the jumpboard machine to a target; the preference rule is used to realize an attack behavior; A CMS determination unit is configured to determine a content management system (CMS) used by the known jumpboard machine; An address set formation unit is configured to search for addresses using the same content management system (CMS) as the known jumpboard machine, and form an address set; A probing unit is configured to actively probe each address in the address set, and determine an asset corresponding to an address meeting the preference rule as an asset of the attack end; The asset of the attack end is a jumpboard machine attacked by the attack end; The preference rule comprises: a first request response of a page of the backlink address to a request not conforming to the online data rule, and a second request response of the page of the backlink address to a request conforming to the online data rule; The detection unit is specifically configured to: for each address in the address set, perform the following operations in sequence: sending a request not conforming to the online data rule and a request conforming to the online data rule to a page of the address; if a response of the page of the address to the request not conforming to the online data rule is the same as the first request response, and a response of the page of the address to the request conforming to the online data rule is the same as the second request response, determining an asset corresponding to the address as an asset of the attack end.

6. The apparatus of claim 5, wherein, The preference rule comprises: an intermediate file generated by the attack end in the known jumpboard machine. The detection unit is specifically configured to: perform file depth scanning on each address in the address set, and determine an asset corresponding to an address from which the intermediate file is scanned out as an asset of the attack end. 7.An electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method of any one of claims 1-4. 8.A computer readable storage medium, having a computer program stored thereon, wherein the computer program, when executed in a computer, causes the computer to perform the method of any one of claims 1-4.

Images