Rebound shell process detection method, device, electronic device and storage medium

Abstract

The present invention provides a rebound shell process detection method, device, electronic device and storage medium, which monitor a target process; obtain behavioral attribute characteristics of the target process; analyze the obtained behavioral attribute characteristics, and determine whether the target process is a rebound shell process based on the analysis results. By analyzing the behavioral attribute characteristics of the rebound shell, more comprehensive and effective detection of the rebound shell process is achieved, so that the detected rebound shell process can be controlled in time, thereby improving network security.

Description

Technical Field

[0001] The present invention relates to the field of network detection technology, and in particular to a rebound shell process detection method, device, electronic device and storage medium. Background Art

[0002] A rebound shell occurs when a control terminal listens on a TCP / UDP port, and the controlled terminal initiates requests to that port, redirecting its command line input and output to the control terminal. Because rebound shells are initiated from within the network, they are often treated as secure connections by firewalls and allowed through. However, among all hacker attack methods, rebound shells are the most widely used and effective method for long-term remote control of compromised hosts, and have gradually evolved into dozens of different attack variants.

[0003] Traditional rule-based command line detection methods can only handle some known specific attack methods, but are almost helpless against current rebound shell attacks such as those based on dynamic languages ​​using encrypted scripts, and are unable to perform effective detection. Summary of the Invention

[0004] The present invention provides a rebound shell process detection method, device, electronic device and storage medium, which are used to solve the problem that the existing rebound shell attack detection method can only detect some known specific rebound shell attacks but cannot effectively detect rebound shell attacks that have evolved and mutated. By analyzing the behavioral attribute characteristics of the rebound shell, the present invention solves the problem that the existing rebound shell attack detection method can only detect some known specific rebound shell attacks but cannot effectively detect rebound shell attacks that have evolved and mutated. This achieves more comprehensive and effective detection of the rebound shell process, so that the detected rebound shell process can be controlled in time, thereby improving the security of the network.

[0005] In a first aspect, the present invention provides a rebound shell process detection method, comprising:

[0006] Monitor target progress;

[0007] Obtaining behavioral attribute characteristics of the target process;

[0008] The obtained behavior attribute characteristics are analyzed, and based on the analysis results, it is determined whether the target process is a rebound shell process.

[0009] Furthermore, obtaining the behavior attribute characteristics of the target process includes:

[0010] Obtain network connection attribute characteristics, IO behavior characteristics, and file descriptor attribute characteristics of the target process;

[0011] Acquire a process tree attribute feature of the target process and / or a process file attribute feature of the target process.

[0012] Furthermore, analyzing the obtained behavior attribute characteristics and determining whether the target process is a rebound shell process according to the analysis results includes:

[0013] Determining whether the target process satisfies all first-category conditions based on the behavioral attribute characteristics of the target process;

[0014] If the target process satisfies all the first-category conditions, determining that the target process is a rebound shell process;

[0015] The first type of conditions include:

[0016] Determining, based on the network connection attribute characteristics of the target process, that the network connection port of the target process is external and the number of connections is not greater than a first threshold;

[0017] Determining, based on the IO behavior characteristics of the target process, that the IO operation volume of the target process is less than a second threshold;

[0018] According to the attribute characteristics of the file descriptor of the target process, it is determined that the file descriptor of the target process is less than a third threshold.

[0019] Furthermore, the step of analyzing the obtained behavior attribute characteristics and determining whether the target process is a rebound shell process based on the analysis result further includes:

[0020] determining, based on behavioral attribute characteristics of the target process, whether the target process satisfies at least one second condition;

[0021] If the target process satisfies all first-category conditions and at least one second-category condition, the target process is determined to be a rebound shell process; wherein the second-category condition includes:

[0022] Determining, based on the process tree attribute characteristics of the target process, that an abnormality exists in the attribute characteristics of the parent process of the target process;

[0023] According to the process file attribute characteristics of the target process, it is determined that the process file attribute characteristics of the target process are abnormal.

[0024] Furthermore, determining, based on the process tree attribute characteristics of the target process, that an abnormality exists in the attribute characteristics of the parent process of the target process includes:

[0025] Determining a parent process of the target process according to a process tree attribute feature of the target process;

[0026] Determine whether the running duration or the number of times the parent process of the target process is called within a preset time period is less than a fourth threshold;

[0027] When the running duration or the number of calls is less than a fourth threshold, it is determined that an abnormality exists in the attribute characteristics of the parent process of the target process.

[0028] Further, determining that the process file attribute characteristics of the target process are abnormal based on the process file attribute characteristics of the target process includes:

[0029] Determining the process file size of the target process according to the process file attribute characteristics of the target process;

[0030] Determining whether the process file size of the target process is greater than a fifth threshold or less than a sixth threshold; wherein the fifth threshold is greater than the sixth threshold;

[0031] When the process file size of the target process is greater than the fifth threshold or less than the sixth threshold, it is determined that an abnormality exists in the process file attribute feature of the target process.

[0032] In a second aspect, the present invention further provides a rebound shell process detection device, comprising a monitoring module, an acquisition module, and a determination module, wherein:

[0033] Monitoring module, used to monitor the target process;

[0034] An acquisition module, configured to acquire behavioral attribute characteristics of the target process;

[0035] The determination module is used to analyze the obtained behavior attribute characteristics and determine whether the target process is a rebound shell process based on the analysis results.

[0036] Furthermore, the acquisition module specifically includes:

[0037] Used to obtain the network connection attribute characteristics, IO behavior characteristics, and file descriptor attribute characteristics of the target process;

[0038] Acquire a process tree attribute feature of the target process and / or a process file attribute feature of the target process.

[0039] In a third aspect, the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of any of the above-described rebound shell process detection methods are implemented.

[0040] In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described rebound shell process detection methods.

[0041] In a fifth aspect, the present invention further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the steps of any of the above-described rebound shell process detection methods.

[0042] The present invention provides a rebound shell process detection method, device, electronic device and storage medium, which monitor a target process; obtain behavioral attribute characteristics of the target process; analyze the obtained behavioral attribute characteristics, and determine whether the target process is a rebound shell process based on the analysis results. By analyzing the behavioral attribute characteristics of the rebound shell, more comprehensive and effective detection of the rebound shell process is achieved, so that the detected rebound shell process can be controlled in a timely manner, thereby improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the present invention or the prior art, a brief introduction is given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0044] Figure 1 This is a flowchart of a rebound shell process detection method provided by one embodiment of the present invention;

[0045] Figure 2 This is a flowchart of a rebound shell process detection method provided by another embodiment of the present invention;

[0046] Figure 3 This is a structural block diagram of a rebound shell process detection device provided by one embodiment of the present invention;

[0047] Figure 4 This is a structural block diagram of a rebound shell process detection electronic device provided by another embodiment of the present invention. DETAILED DESCRIPTION

[0048] To make the objectives, technical solutions, and advantages of the present invention more clear, the technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0049] Figure 1 This is a flowchart of a method for detecting a rebound shell process provided by this embodiment. Figure 1 , the method comprising:

[0050] Step 101: Monitor the target process;

[0051] The target process is a running process.

[0052] It should be further explained that in order to be able to promptly detect and block the rebound shell process, a detection device is required to monitor the process on the process running device in real time. For example, the process on the process running device can be monitored at the moment the process is just started. The process running device can be a desktop computer, a laptop computer, a tablet computer, and any other device that can run a process. No specific limitation is made here. The detection device is a device with a detection program for executing the rebound shell detection method of this application. It can be the same device as the process running device or a different device.

[0053] Specifically, the target process in the process running device is monitored in real time.

[0054] For example, a detection host A of a network security company monitors all running processes on employee A's dedicated computer a in real time.

[0055] Step 102: Obtaining behavioral attribute characteristics of the target process;

[0056] Among them, the obtained behavioral attribute characteristics of the target process include the network connection attribute characteristics, IO behavior characteristics, file descriptor attribute characteristics, process tree attribute characteristics and process file attribute characteristics of the target process; among them, the network connection attribute characteristics of the target process are the direction of the network connection port and the number of network connections of the target process; the IO behavior characteristics of the target process are the input and output operation volume of the target process; the file descriptor attribute characteristics of the target process are the number characteristics of the file descriptors generated during the operation of the target process; the process tree attribute characteristics of the target process are the attribute characteristics of the parent process of the process tree of the target process; the process file attribute characteristics of the target process are the size and capacity characteristics of the process file itself of the target process.

[0057] Specifically, the detection device obtains behavioral attribute characteristics of the monitored target process.

[0058] For example, a detection host A of a network security company monitors process 1 and process 2 running on employee A's dedicated computer a in real time, and obtains the behavioral attribute characteristics of process 1 and process 2 respectively.

[0059] Step 103: Analyze the acquired behavior attribute characteristics, and determine whether the target process is a rebound shell process based on the analysis result.

[0060] It should be further explained that the monitoring device analyzes the acquired network connection attribute characteristics, IO behavior characteristics, file descriptor attribute characteristics, process tree attribute characteristics and process file attribute characteristics of the target process, that is, it performs a combined judgment analysis on the behavioral attribute characteristics of the rebound shell process, among which the network connection attribute characteristics, IO behavior characteristics and file descriptor attribute characteristics of the target process are mandatory characteristics, and the process tree attribute characteristics and process file attribute characteristics of the target process are optional characteristics. Only when the network connection attribute characteristics, IO behavior characteristics and file descriptor attribute characteristics of the target process meet the relevant conditions preset in the detection device, can the target process be determined to be a rebound shell process.

[0061] Specifically, the detection device performs a combined judgment analysis on the acquired behavior attribute features, and determines whether the target process is a rebound shell process according to the analysis result.

[0062] For example, after obtaining the behavioral attribute characteristics of process 1 and process 2 running on employee A's dedicated computer a, the detection host A of a network security company performs a combined judgment analysis on the behavioral attribute characteristics of process 1 and the behavioral attribute characteristics of process 2, and determines whether the target process is a rebound shell process based on the analysis results.

[0063] This embodiment provides a rebound shell process detection method, which monitors a target process; obtains behavioral attribute characteristics of the target process; analyzes the obtained behavioral attribute characteristics, and determines whether the target process is a rebound shell process based on the analysis results. By analyzing the behavioral attribute characteristics of the rebound shell, the problem that the existing rebound shell attack detection method can only detect some known specific rebound shell attacks but cannot effectively detect evolved and mutated rebound shell attacks is solved. This method achieves more comprehensive and effective detection of rebound shell processes, so that the detected rebound shell processes can be controlled in a timely manner, thereby improving network security.

[0064] Based on the content of the above embodiment, in this embodiment, the step 102 of obtaining the behavior attribute characteristics of the target process can be specifically implemented as follows:

[0065] Obtain network connection attribute characteristics, IO behavior characteristics, and file descriptor attribute characteristics of the target process;

[0066] Acquire a process tree attribute feature of the target process and / or a process file attribute feature of the target process.

[0067] It should be further explained that, according to the need for combined judgment and analysis of the rebound shell process behavior attribute characteristics, the network connection attribute characteristics, IO behavior characteristics, and file descriptor attribute characteristics of the target process obtained are the characteristics that must be obtained to determine whether the target process is a rebound shell process, and the process tree attribute characteristics and process file attribute characteristics of the target process obtained are the characteristics that can be optionally obtained to determine whether the target process is a rebound shell process. Among them, the main purpose of the obtained process tree attribute characteristics and process file attribute characteristics of the target process is to avoid the problem of false positive detection.

[0068] Specifically, the detection device obtains the network connection attribute characteristics, IO behavior characteristics, and file descriptor attribute characteristics of the target process; obtains the process tree attribute characteristics of the target process and / or the process file attribute characteristics of the target process.

[0069] For example, a network security company's detection host A monitors process 1 and process 2 running on employee A's dedicated computer a in real time, and obtains the network connection attribute characteristics, IO behavior characteristics, file descriptor attribute characteristics, process tree attribute characteristics and process file attribute characteristics of process 1 and process 2 respectively.

[0070] This embodiment provides a rebound shell process detection method, which obtains the network connection attribute characteristics, IO behavior characteristics, and file descriptor attribute characteristics of the target process; obtains the process tree attribute characteristics of the target process and / or the process file attribute characteristics of the target process. By obtaining various behavioral attribute characteristics of the target process, the detection of the rebound shell process is made more comprehensive and effective.

[0071] Based on the content of the above embodiment, in this embodiment, step 103 analyzes the acquired behavior attribute characteristics and determines whether the target process is a rebound shell process based on the analysis results. This can be specifically achieved in the following manner:

[0072] Determining whether the target process satisfies all first-category conditions based on the behavioral attribute characteristics of the target process;

[0073] If the target process satisfies all the first-category conditions, determining that the target process is a rebound shell process;

[0074] Among them, the first type of conditions includes: determining, based on the network connection attribute characteristics of the target process, that the network connection port of the target process is external and the number of connections is not greater than a first threshold; determining, based on the IO behavior characteristics of the target process, that the IO operation volume of the target process is less than a second threshold; and determining, based on the file descriptor attribute characteristics of the target process, that the file descriptor of the target process is less than a third threshold.

[0075] It can be understood that the object set by the first threshold is the number of network connections, the object set by the second threshold is the IO operation volume, and the object set by the third threshold is the number of file descriptors. Since the objects set by the first threshold, the second threshold, and the third threshold are different, there is no correlation between the three thresholds; the sizes of the first threshold, the second threshold, and the third threshold can be specifically set according to the needs of technical personnel in this field.

[0076] It should be further explained that, when the target process meets all the first-category conditions, the target process can be determined to be a rebound shell process, that is, only when the network connection port of the target process is external and the number of connections is not greater than the first threshold, the IO operation volume of the target process is less than the second threshold, and the file descriptor of the target process is less than the third threshold, the target process is determined to be a rebound shell process. In other cases, the target process cannot be determined to be a rebound shell process.

[0077] Specifically, based on the behavioral attribute characteristics of the target process, determine whether the target process meets all the first-category conditions; if the target process meets all the first-category conditions, determine that the target process is a rebound shell process; wherein, the first-category conditions include: based on the network connection attribute characteristics of the target process, determine that the network connection port of the target process is external and the number of connections is not greater than a first threshold; based on the IO behavioral characteristics of the target process, determine that the IO operation volume of the target process is less than a second threshold; based on the file descriptor attribute characteristics of the target process, determine that the file descriptor of the target process is less than a third threshold.

[0078] For example, after a network security company's detection host A obtains the behavioral attribute characteristics of process 1 and process 2 running in employee A's dedicated computer a, it first performs a combined judgment and analysis on the behavioral attribute characteristics of process 1, and finds that the network connection port of process 1 is external, and the number of connections is 1, which is not greater than the first threshold, the value of the first threshold is 1, the IO operation volume is 1, which is less than the second threshold, the value of the second threshold is 2, the file descriptor is 2, which is less than the third threshold, and the value of the third threshold is 3. It can be determined that process 1 is a rebound shell process; then a combined judgment and analysis is performed on the behavioral attribute characteristics of process 2, and it is found that the network connection port of process 2 is external, and the number of connections is 0, which is less than the first threshold, the IO operation volume is 0, which is less than the second threshold, and the file descriptor is 4, which is greater than the third threshold. Since the file descriptor of process 2 does not meet the requirement of being less than the third threshold, it is impossible to determine that process 2 is a rebound shell process.

[0079] This embodiment provides a rebound shell process detection method, which determines whether the target process meets all first-category conditions based on the behavioral attribute characteristics of the target process. If the target process meets all first-category conditions, the target process is determined to be a rebound shell process. By performing combined judgment and analysis on the behavioral attribute characteristics of the rebound shell, the detection of the rebound shell process is achieved more comprehensively and effectively.

[0080] Based on the content of the above embodiment, in this embodiment, the step 103 of analyzing the acquired behavior attribute characteristics and determining whether the target process is a rebound shell process according to the analysis results can also be implemented in the following specific manner:

[0081] determining, based on behavioral attribute characteristics of the target process, whether the target process satisfies at least one second condition;

[0082] If the target process satisfies all first-category conditions and at least one second-category condition, determining that the target process is a rebound shell process;

[0083] Among them, the second type of conditions includes: determining that there is an abnormality in the attribute characteristics of the parent process of the target process based on the process tree attribute characteristics of the target process; determining that there is an abnormality in the process file attribute characteristics of the target process based on the process file attribute characteristics of the target process; the first type of conditions have been mentioned in the above embodiment and will not be repeated here.

[0084] It should be further explained that, when the target process meets all the first-category conditions and the target process meets at least one second-category condition, the target process is determined to be a rebound shell process, that is, when the network connection port of the target process is external and the number of connections is not greater than the first threshold, the IO operation volume of the target process is less than the second threshold, the file descriptor of the target process is less than the third threshold, and the attribute characteristics of the parent process of the target process are abnormal and / or the process file attribute characteristics of the target process are abnormal, the target process is determined to be a rebound shell process. The existence of the second-category conditions is to more accurately determine that the target process is a rebound shell process to prevent false detection.

[0085] In this embodiment, if the target process satisfies all the first-category conditions and any one of the second-category conditions is determined to be satisfied, the target process can be determined to be a rebound shell process without further determination of the remaining condition.

[0086] Specifically, based on the behavioral attribute characteristics of the target process, determine whether the target process meets at least one second-category condition; when the target process meets all the first-category conditions and the target process meets at least one second-category condition, determine that the target process is a rebound shell process; wherein, the second-category conditions include: based on the process tree attribute characteristics of the target process, determining that there is an abnormality in the attribute characteristics of the parent process of the target process; based on the process file attribute characteristics of the target process, determining that there is an abnormality in the process file attribute characteristics of the target process.

[0087] For example, after obtaining the behavioral attribute characteristics of process 1, process 2, and process 3 running on employee A's dedicated computer a, the detection host A of a network security company first performs a combined judgment analysis on the behavioral attribute characteristics of process 1 and finds that the network connection port of process 1 is external, and the number of connections is 0, which is less than the first threshold value, the value of the first threshold value is 1, the IO operation volume is 1, which is less than the second threshold value, the value of the second threshold value is 2, the file descriptor is 2, which is less than the third threshold value, the value of the third threshold value is 3, and the attribute characteristics of the parent process of process 1 are abnormal, so process 1 can be judged as a rebound shell process; then the behavioral attribute characteristics of process 2 are analyzed. A combined judgment analysis was performed, and it was found that the network connection port of process 2 was external, and the number of connections was 0, which was less than the first threshold, the IO operation volume was 0, which was less than the second threshold, and the file descriptor was 4, which was greater than the third threshold. In other words, process 2 could not be judged as a rebound shell process; a combined judgment analysis was performed on the behavioral attribute characteristics of process 3, and it was found that the network connection port of process 3 was external, and the number of connections was 0, which was less than the first threshold, the IO operation volume was 1, which was less than the second threshold, and the file descriptor was 2, which was less than the third threshold. However, the attribute characteristics of the parent process of process 3 and the process file attribute characteristics were normal, and process 3 could not be judged as a rebound shell process either.

[0088] This embodiment provides a rebound shell process detection method, which determines whether the target process meets at least one second-category condition based on the behavioral attribute characteristics of the target process. If the target process meets all the first-category conditions and at least one second-category condition, the target process is determined to be a rebound shell process. By performing combined judgment and analysis on the behavioral attribute characteristics of the rebound shell, the problem of false positives in detection is avoided, thereby achieving more comprehensive and effective detection of rebound shell processes.

[0089] Based on the content of the above embodiment, in this embodiment, determining that the attribute characteristics of the parent process of the target process are abnormal based on the process tree attribute characteristics of the target process specifically includes:

[0090] Determining a parent process of the target process according to a process tree attribute feature of the target process;

[0091] Determine whether the running duration or the number of times the parent process of the target process is called within a preset time period is less than a fourth threshold;

[0092] When the running duration or the number of calls is less than a fourth threshold, it is determined that an abnormality exists in the attribute characteristics of the parent process of the target process.

[0093] In this embodiment, determining whether the running duration or the number of times the parent process of the target process is called within the preset time period is less than the fourth threshold is essentially to determine whether the parent process of the target process is a commonly used process. If the parent process of the target process is not a commonly used process, that is, the running duration or the number of times the parent process of the target process is called within the preset time period is less than the fourth threshold, it is determined that there is an abnormality in the attribute characteristics of the parent process of the target process. Among them, the object set by the fourth threshold is the running duration or the number of times the parent process of the target process is called within the preset time period. The size of the fourth threshold can be specifically set according to the needs of technical personnel in this field.

[0094] Specifically, based on the process tree attribute characteristics of the target process, the parent process of the target process is determined; it is judged whether the running duration or the number of times the parent process of the target process is called within a preset time period is less than a fourth threshold; when the running duration or the number of times it is called is less than the fourth threshold, it is determined that there is an abnormality in the attribute characteristics of the parent process of the target process.

[0095] For example, a detection host A of a network security company obtains the process tree attribute characteristics of process 1 and process 2 running on employee A's dedicated computer a, and determines that the parent process of process 1 is 01 and the parent process of process 2 is 02. Since the number of times the parent process 01 of process 1 is called within the preset time period is 1, which is less than the fourth threshold, where the value of the fourth threshold is 2, and the number of times the parent process 02 of process 2 is called within the preset time period is 3, which is greater than the fourth threshold, it can be determined that there is an abnormality in the attribute characteristics of process 1's parent process 01, and there is no abnormality in the attribute characteristics of process 2's parent process 02.

[0096] This embodiment provides a rebound shell process detection method, which determines the parent process of the target process based on the process tree attribute characteristics of the target process; determines whether the running duration or the number of times the parent process of the target process is called within a preset time period is less than a fourth threshold; if the running duration or the number of times it is called is less than the fourth threshold, determines that there is an abnormality in the attribute characteristics of the parent process of the target process. By describing in detail the judgment and analysis process of the process tree attribute characteristics, one of the behavioral attribute characteristics of the rebound shell process, and analyzing the optional judgment conditions of the behavioral attribute characteristics of the rebound shell process, the problem of false detection is prevented, and the detection of the rebound shell process is achieved more comprehensively and effectively.

[0097] Based on the content of the above embodiment, in this embodiment, determining that the process file attribute characteristics of the target process are abnormal according to the process file attribute characteristics of the target process specifically includes:

[0098] Determining the process file size of the target process according to the process file attribute characteristics of the target process;

[0099] Determining whether the process file size of the target process is greater than a fifth threshold or less than a sixth threshold;

[0100] When the process file size of the target process is greater than the fifth threshold or less than the sixth threshold, it is determined that an abnormality exists in the process file attribute feature of the target process.

[0101] It should be further explained that the fifth threshold and the sixth threshold are set by those skilled in the art according to the size of the process file, wherein the fifth threshold is greater than the sixth threshold.

[0102] Specifically, based on the process file attribute characteristics of the target process, the process file size of the target process is determined; it is judged whether the process file size of the target process is greater than the fifth threshold or less than the sixth threshold; if the process file size of the target process is greater than the fifth threshold or less than the sixth threshold, it is determined that there is an abnormality in the process file attribute characteristics of the target process.

[0103] For example, when a detection host A of a network security company obtains the process file attribute characteristics of process 1 and process 2 running on employee A's dedicated computer a, it is found that the process file size of process 1 is 3KB, which is smaller than the sixth threshold value, where the value of the sixth threshold value is 5KB, so there is an abnormality in the process file attribute characteristics of process 1; the process file size of process 2 is 5MB, which is neither larger than the fifth threshold value nor smaller than the sixth threshold value, where the value of the fifth threshold value is 50MB, so there is no abnormality in the process file attribute characteristics of process 2.

[0104] This embodiment provides a rebound shell process detection method, which determines the process file size of the target process according to the process file attribute characteristics of the target process; determines whether the process file size of the target process is greater than a fifth threshold or less than a sixth threshold; wherein the fifth threshold is greater than the sixth threshold; when the process file size of the target process is greater than the fifth threshold or less than the sixth threshold, determines that there is an abnormality in the process file attribute characteristics of the target process. By describing in detail the judgment and analysis process of the process file attribute characteristics, which is one of the behavioral attribute characteristics of the rebound shell process, and analyzing the optional judgment conditions of the behavioral attribute characteristics of the rebound shell process, the problem of false detection is prevented, and the detection of the rebound shell process is achieved more comprehensively and effectively.

[0105] Figure 2 This is a flowchart of a rebound shell process detection method provided by another embodiment of the present application, refer to Figure 2. Real-time monitoring of the started process; real-time acquisition of the monitored process's network connection attributes, IO, file descriptors, process tree and other attribute behaviors; analysis of various types of information in the attribute behaviors to determine the characteristics of the rebound shell; if the analysis shows that the process's network connection port is external and the number of connections is not greater than a certain threshold (usually 1), if the analysis shows that the IO operation volume of the process is less than a certain threshold, if the analysis shows that the file descriptor is less than a certain threshold (usually only input and output but no file descriptors), if the analysis shows that the parent process attributes of the process tree are abnormal, such as the parent process is a very common process, if the analysis shows that the process file itself has abnormal attributes, such as abnormal size, etc., based on the analysis of the above behavioral characteristics, it can be determined whether there is a rebound shell connection.

[0106] Figure 3 This is a structural block diagram of the software version upgrade device provided in this embodiment. The device includes a monitoring module 301, an acquisition module 302, and a determination module 303, wherein:

[0107] Monitoring module 301, used to monitor the target process;

[0108] The target process is a running process.

[0109] It should be further explained that in order to be able to promptly detect and block the rebound shell process, a detection device is required to monitor the process on the process running device in real time. For example, the process on the process running device can be monitored at the moment the process is just started. The process running device can be a desktop computer, a laptop computer, a tablet computer, and any other device that can run a process. No specific limitation is made here. The detection device is a device with a detection program for executing the rebound shell detection method of this application. It can be the same device as the process running device or a different device.

[0110] Specifically, the target process in the process running device is monitored in real time.

[0111] For example, a detection host A of a network security company monitors all running processes on employee A's dedicated computer a in real time.

[0112] An acquisition module 302 is configured to acquire behavioral attribute characteristics of the target process;

[0113] Among them, the obtained behavioral attribute characteristics of the target process include the network connection attribute characteristics, IO behavior characteristics, file descriptor attribute characteristics, process tree attribute characteristics and process file attribute characteristics of the target process; among them, the network connection attribute characteristics of the target process are the direction of the network connection port and the number of network connections of the target process; the IO behavior characteristics of the target process are the input and output operation volume of the target process; the file descriptor attribute characteristics of the target process are the number characteristics of the file descriptors generated during the operation of the target process; the process tree attribute characteristics of the target process are the attribute characteristics of the parent process of the process tree of the target process; the process file attribute characteristics of the target process are the size and capacity characteristics of the process file itself of the target process.

[0114] Specifically, the detection device obtains behavioral attribute characteristics of the monitored target process.

[0115] For example, a detection host A of a network security company monitors process 1 and process 2 running on employee A's dedicated computer a in real time, and obtains the behavioral attribute characteristics of process 1 and process 2 respectively.

[0116] The determination module 303 is configured to analyze the acquired behavior attribute characteristics and determine whether the target process is a rebound shell process based on the analysis result.

[0117] It should be further explained that the monitoring device analyzes the acquired network connection attribute characteristics, IO behavior characteristics, file descriptor attribute characteristics, process tree attribute characteristics and process file attribute characteristics of the target process, that is, it performs a combined judgment analysis on the behavioral attribute characteristics of the rebound shell process, wherein the network connection attribute characteristics, IO behavior characteristics and file descriptor attribute characteristics of the target process are mandatory characteristics, and the process tree attribute characteristics and the process file attribute characteristics of the target process are optional characteristics. Only when the network connection attribute characteristics, IO behavior characteristics and file descriptor attribute characteristics of the target process all meet the relevant conditions preset in the detection device, and at least one of the process tree attribute characteristics of the target process and the process file attribute characteristics of the target process meet the preset relevant conditions, can the target process be determined to be a rebound shell process.

[0118] Specifically, the detection device performs a combined judgment analysis on the acquired behavior attribute features, and determines whether the target process is a rebound shell process according to the analysis result.

[0119] For example, after obtaining the behavioral attribute characteristics of process 1 and process 2 running on employee A's dedicated computer a, the detection host A of a network security company performs a combined judgment analysis on the behavioral attribute characteristics of process 1 and the behavioral attribute characteristics of process 2, and determines whether the target process is a rebound shell process based on the analysis results.

[0120] This embodiment provides a rebound shell process detection device, including a monitoring module 301 for monitoring a target process; an acquisition module 302 for acquiring behavioral attribute characteristics of the target process; and a determination module 303 for analyzing the acquired behavioral attribute characteristics and determining whether the target process is a rebound shell process based on the analysis results. By analyzing the behavioral attribute characteristics of the rebound shell, the problem that the existing rebound shell attack detection method can only detect some known specific rebound shell attacks but cannot effectively detect evolved and mutated rebound shell attacks is solved. This achieves more comprehensive and effective detection of rebound shell processes, so that the detected rebound shell processes can be controlled in a timely manner, thereby improving network security.

[0121] Optionally, the acquisition module 302 specifically includes:

[0122] Used to obtain the network connection attribute characteristics, IO behavior characteristics, and file descriptor attribute characteristics of the target process;

[0123] Acquire a process tree attribute feature of the target process and / or a process file attribute feature of the target process.

[0124] This embodiment provides a rebound shell process detection device, which is used to obtain the network connection attribute characteristics, IO behavior characteristics, and file descriptor attribute characteristics of the target process; obtain the process tree attribute characteristics of the target process and / or the process file attribute characteristics of the target process. By obtaining various behavioral attribute characteristics of the target process, the detection of the rebound shell process is made more comprehensive and effective.

[0125] Optionally, the determining module 303 specifically includes:

[0126] for determining whether the target process satisfies all first-category conditions based on the behavioral attribute characteristics of the target process;

[0127] If the target process satisfies all the first-category conditions, determining that the target process is a rebound shell process;

[0128] The first category of conditions includes:

[0129] Determining, based on the network connection attribute characteristics of the target process, that the network connection port of the target process is external and the number of connections is not greater than a first threshold;

[0130] Determining, based on the IO behavior characteristics of the target process, that the IO operation volume of the target process is less than a second threshold;

[0131] According to the attribute characteristics of the file descriptor of the target process, it is determined that the file descriptor of the target process is less than a third threshold.

[0132] This embodiment provides a rebound shell process detection device, wherein the determination module 303 is configured to determine whether the target process satisfies all first-category conditions based on the behavioral attribute characteristics of the target process; if the target process satisfies all first-category conditions, the target process is determined to be a rebound shell process. By performing combined judgment and analysis on the behavioral attribute characteristics of the rebound shell, the detection of the rebound shell process is achieved more comprehensively and effectively.

[0133] Optionally, the determining module 303 further includes:

[0134] for determining, based on behavioral attribute characteristics of the target process, whether the target process satisfies at least one second condition;

[0135] If the target process satisfies all first-category conditions and at least one second-category condition, the target process is determined to be a rebound shell process; wherein the second-category condition includes:

[0136] Determining, based on the process tree attribute characteristics of the target process, that an abnormality exists in the attribute characteristics of the parent process of the target process;

[0137] According to the process file attribute characteristics of the target process, it is determined that the process file attribute characteristics of the target process are abnormal.

[0138] This embodiment provides a rebound shell process detection device, wherein the determination module 303 is configured to determine whether the target process satisfies at least one second-category condition based on the behavioral attribute characteristics of the target process; if the target process satisfies all the first-category conditions and at least one second-category condition, the target process is determined to be a rebound shell process. By performing combined judgment and analysis on the behavioral attribute characteristics of the rebound shell, the problem of false positives in detection is avoided, thereby achieving more comprehensive and effective detection of the rebound shell process.

[0139] Optionally, the device further includes:

[0140] Used to determine the parent process of the target process according to the process tree attribute characteristics of the target process;

[0141] Determine whether the running duration or the number of times the parent process of the target process is called within a preset time period is less than a fourth threshold;

[0142] When the running duration or the number of calls is less than a fourth threshold, it is determined that an abnormality exists in the attribute characteristics of the parent process of the target process.

[0143] This embodiment provides a rebound shell process detection device, which is used to determine the parent process of the target process based on the process tree attribute characteristics of the target process; determine whether the running duration or the number of times the parent process of the target process is called within a preset time period is less than a fourth threshold; if the running duration or the number of times it is called is less than the fourth threshold, determine that there is an abnormality in the attribute characteristics of the parent process of the target process. By describing in detail the judgment and analysis process of the process tree attribute characteristics, one of the behavioral attribute characteristics of the rebound shell process, and analyzing the optional judgment conditions of the behavioral attribute characteristics of the rebound shell process, the problem of false detection is prevented, and the detection of the rebound shell process is achieved more comprehensively and effectively.

[0144] Optionally, the device further includes:

[0145] Used to determine the process file size of the target process according to the process file attribute characteristics of the target process;

[0146] Determining whether the process file size of the target process is greater than a fifth threshold or less than a sixth threshold; wherein the fifth threshold is greater than the sixth threshold;

[0147] When the process file size of the target process is greater than the fifth threshold or less than the sixth threshold, it is determined that an abnormality exists in the process file attribute feature of the target process.

[0148] This embodiment provides a rebound shell process detection device, which is used to determine the process file size of the target process according to the process file attribute characteristics of the target process; determine whether the process file size of the target process is greater than a fifth threshold or less than a sixth threshold; wherein the fifth threshold is greater than the sixth threshold; when the process file size of the target process is greater than the fifth threshold or less than the sixth threshold, it is determined that there is an abnormality in the process file attribute characteristics of the target process. By describing in detail the judgment and analysis process of the process file attribute characteristics, which is one of the behavioral attribute characteristics of the rebound shell process, and analyzing the optional judgment conditions of the behavioral attribute characteristics of the rebound shell process, the problem of false detection is prevented, and the detection of the rebound shell process is achieved more comprehensively and effectively.

[0149] Figure 4 A schematic diagram of the physical structure of an electronic device provided by an embodiment of the present invention is shown in FIG. Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other through the bus 440. The bus 440 can be used for information transmission between the electronic device and the sensor. The processor 410 can call the logic instructions in the memory 430 to execute the following method: monitor the target process; obtain the behavioral attribute characteristics of the target process; analyze the obtained behavioral attribute characteristics, and determine whether the target process is a rebound shell process based on the analysis results.

[0150] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0151] On the other hand, an embodiment of the present invention provides a non-transitory computer-readable storage medium, which stores computer instructions. The computer instructions enable a computer to execute a rebound shell process detection method provided by the above embodiment, for example, including: monitoring a target process; obtaining behavioral attribute characteristics of the target process; analyzing the obtained behavioral attribute characteristics, and determining whether the target process is a rebound shell process based on the analysis results.

[0152] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, or of course, by hardware. Based on this understanding, the essence of the above technical solution or the part that contributes to the existing technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiments.

[0153] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute a rebound shell process detection method provided by the above methods, the method including: monitoring the target process; obtaining behavioral attribute characteristics of the target process; analyzing the obtained behavioral attribute characteristics, and determining whether the target process is a rebound shell process based on the analysis results.

[0154] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for detecting a rebound shell process, characterized in that: include: Monitor target progress; Obtaining behavioral attribute characteristics of the target process; Analyze the obtained behavior attribute characteristics and determine whether the target process is a rebound shell process based on the analysis results; The obtaining of the behavior attribute characteristics of the target process includes: Obtain network connection attribute characteristics, IO behavior characteristics, and file descriptor attribute characteristics of the target process; Acquiring process tree attribute characteristics of the target process and / or process file attribute characteristics of the target process; Analyzing the acquired behavior attribute characteristics and determining whether the target process is a rebound shell process according to the analysis result includes: Determining whether the target process satisfies all first-category conditions based on the behavioral attribute characteristics of the target process; If the target process satisfies all the first-category conditions, determining that the target process is a rebound shell process; The first type of conditions include: Determining, based on the network connection attribute characteristics of the target process, that the network connection port of the target process is external and the number of connections is not greater than a first threshold; Determining, based on the IO behavior characteristics of the target process, that the IO operation volume of the target process is less than a second threshold; Determining, based on a file descriptor attribute characteristic of the target process, that the file descriptor of the target process is less than a third threshold; The analyzing the obtained behavior attribute characteristics and determining whether the target process is a rebound shell process according to the analysis result further includes: determining, based on behavioral attribute characteristics of the target process, whether the target process satisfies at least one second condition; If the target process satisfies all first-category conditions and at least one second-category condition, the target process is determined to be a rebound shell process; wherein the second-category condition includes: Determining, based on the process tree attribute characteristics of the target process, that an abnormality exists in the attribute characteristics of the parent process of the target process; According to the process file attribute characteristics of the target process, it is determined that the process file attribute characteristics of the target process are abnormal.

2. The rebound shell process detection method according to claim 1 is characterized in that: The determining, based on the process tree attribute characteristics of the target process, that an abnormality exists in the attribute characteristics of the parent process of the target process includes: Determining a parent process of the target process according to a process tree attribute feature of the target process; Determine whether the running duration or the number of times the parent process of the target process is called within a preset time period is less than a fourth threshold; When the running duration or the number of calls is less than a fourth threshold, it is determined that an abnormality exists in the attribute characteristics of the parent process of the target process.

3. The rebound shell process detection method according to claim 1 is characterized in that: The determining, based on the process file attribute characteristics of the target process, that the process file attribute characteristics of the target process are abnormal, includes: Determining the process file size of the target process according to the process file attribute characteristics of the target process; Determining whether the process file size of the target process is greater than a fifth threshold or less than a sixth threshold; wherein the fifth threshold is greater than the sixth threshold; When the process file size of the target process is greater than the fifth threshold or less than the sixth threshold, it is determined that an abnormality exists in the process file attribute feature of the target process.

4. A rebound shell process detection device, characterized in that: include: Monitoring module, acquisition module, determination module, among which: Monitoring module, used to monitor the target process; An acquisition module, configured to acquire behavioral attribute characteristics of the target process; A determination module is used to analyze the obtained behavior attribute characteristics and determine whether the target process is a rebound shell process based on the analysis results; The acquisition module is used to: Obtain network connection attribute characteristics, IO behavior characteristics, and file descriptor attribute characteristics of the target process; Acquiring process tree attribute characteristics of the target process and / or process file attribute characteristics of the target process; The determining module is configured to: Determining whether the target process satisfies all first-category conditions based on the behavioral attribute characteristics of the target process; If the target process satisfies all the first-category conditions, determining that the target process is a rebound shell process; The first category of conditions includes: Determining, based on the network connection attribute characteristics of the target process, that the network connection port of the target process is external and the number of connections is not greater than a first threshold; Determining, based on the IO behavior characteristics of the target process, that the IO operation volume of the target process is less than a second threshold; Determining, based on a file descriptor attribute characteristic of the target process, that the file descriptor of the target process is less than a third threshold; The determining module further includes: determining, based on behavioral attribute characteristics of the target process, whether the target process satisfies at least one second condition; If the target process satisfies all first-category conditions and at least one second-category condition, the target process is determined to be a rebound shell process; wherein the second-category condition includes: Determining, based on the process tree attribute characteristics of the target process, that an abnormality exists in the attribute characteristics of the parent process of the target process; According to the process file attribute characteristics of the target process, it is determined that the process file attribute characteristics of the target process are abnormal.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the steps of the rebound shell process detection method according to any one of claims 1 to 3 are implemented.

6. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a rebound shell process detection method as described in any one of claims 1 to 3 are implemented.

7. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of a rebound shell process detection method as described in any one of claims 1 to 3 are implemented.

Images