Attack behavior defense method, device, apparatus and storage medium

Abstract

The application discloses an attack behavior defense method and device, equipment and a storage medium, and belongs to the technical field of network security. The application can induce an attacker to initiate an attack behavior on a virtual machine by running at least one virtual machine, thereby ensuring the safety of a business system. Further, the application can obtain underlying running data of the virtual machine through a manager of the virtual machine, and can obtain relevant data of the attack behavior suffered by the virtual machine without the virtual machine being aware, so that the attacker cannot easily find that the attack behavior has been captured, and thus will not stop the attack, thereby enabling complete data of the attack behavior to be obtained. Based on the obtained data, the attack behavior can be more perfectly defended, and further, the isolation strategy of the business system can be perfected according to the isolation strategy of the virtual machine, thereby further ensuring the safety of the system.

Description

TECHNICAL FIELD

[0001] The present application relates to the network security technical field, and particularly relates to an attack behavior defense method and device, equipment and a storage medium. BACKGROUND

[0002] With the development of network technology, various network attack behaviors occur frequently, which causes the business system of an enterprise to be destroyed and affects the normal operation of the enterprise. In related technologies, abnormal traffic with network attack behaviors is forwarded to a pre-set honeynet system through detection of traffic accessing a business system, and related data of attack behaviors are further obtained through the honeynet system, so as to serve as a basis for enhancing the defense strategy of the business system.

[0003] In the above technology, since the operation of forwarding abnormal traffic can be easily identified by an attacker, the attacker cannot be induced to perform further attack behaviors, so that complete attack behavior data cannot be obtained, and the attack behaviors cannot be perfectly defended based on the obtained data. SUMMARY

[0004] Embodiments of the present application provide an attack behavior defense method, device, equipment and storage medium, which can capture attack behaviors initiated by an attacker without the attacker being aware, so that complete attack behavior data can be obtained, and the attack behaviors can be more perfectly defended. The technical solution is as follows:

[0005] In one aspect, an attack behavior defense method is provided, and the method comprises the following steps.

[0006] At least one virtual machine corresponding to a target vulnerability in a business system is operated, the virtual machine runs a virtual business system, and the virtual business system is used to simulate the business logic of a network node in the business system;

[0007] Bottom layer running data of the at least one virtual machine is obtained through a manager of the at least one virtual machine, and the bottom layer running data is used to represent attack behaviors suffered by the at least one virtual machine;

[0008] For any virtual machine, an attack model corresponding to the virtual machine is determined based on the bottom layer running data of the virtual machine, and the attack model is used to describe the attack behaviors suffered by the virtual machine.

[0009] A target connection of the virtual machine is processed based on an isolation strategy corresponding to the attack model, the isolation strategy is used to defend the attack behaviors suffered by the virtual machine, and the target connection corresponds to the isolation strategy.

[0010] In one aspect, an attack behavior defense device is provided, and the device comprises the following.

[0011] The running module is configured to run at least one virtual machine corresponding to a target vulnerability in a business system, wherein the virtual machine runs a virtual business system configured to simulate a business logic of a network node in the business system.

[0012] The obtaining module is configured to obtain, by a manager of the at least one virtual machine, underlying running data of the at least one virtual machine, wherein the underlying running data is configured to represent an attack behavior suffered by the at least one virtual machine.

[0013] The determining module is configured to determine, for any virtual machine, an attack model corresponding to the virtual machine based on the underlying running data of the virtual machine, wherein the attack model is configured to describe the attack behavior suffered by the virtual machine.

[0014] The defense module is configured to process a target connection of the virtual machine based on an isolation strategy corresponding to the attack model, wherein the isolation strategy is configured to defend against the attack behavior suffered by the virtual machine, and the target connection corresponds to the isolation strategy.

[0015] In some embodiments, the obtaining module is configured to obtain, by a manager of the at least one virtual machine, call information of target code configured to perform a target behavior on the at least one virtual machine, wherein the manager is independent of the at least one virtual machine; and in response to detecting a call operation on the target code based on the call information, obtain the underlying running data of the at least one virtual machine.

[0016] In some embodiments, the apparatus further comprises:

[0017] The stopping module is configured to stop running the target code.

[0018] In some embodiments, the defense module comprises:

[0019] The first processing submodule is configured to disconnect the virtual machine from other virtual machines in a case where the attack model indicates that the attack behavior includes an operation between virtual machines.

[0020] The second processing submodule is configured to disconnect a network connection of the virtual machine in a case where the attack model indicates that the attack behavior includes accessing an abnormal web page.

[0021] The third processing submodule is configured to disconnect a network connection between the virtual machine and other devices in a case where the attack model indicates that the attack behavior includes downloading a file from the virtual machine.

[0022] The fourth processing submodule is configured to limit a data type transmitted between the virtual machine and other devices based on a network connection in a case where the attack model indicates that the attack behavior includes downloading a file from the virtual machine.

[0023] In some embodiments, the first processing submodule is configured to determine, based on the underlying running data of the virtual machine, a number of target virtual machines operated by the virtual machine; if the number of target virtual machines is greater than a first number threshold, disconnect the virtual machine from all other virtual machines; and if the number of target virtual machines is less than or equal to the first number threshold, disconnect the virtual machine from the target virtual machines.

[0024] In some embodiments, the second processing submodule is configured to determine, based on the underlying running data of the virtual machine, target network ports of the virtual machine, the target network ports being network ports corresponding to the abnormal webpages; if the number of target network ports is greater than a second number threshold, disable all network ports of the virtual machine; and if the number of target network ports is less than or equal to the second number threshold, disable the target network ports of the virtual machine.

[0025] In some embodiments, the fourth processing submodule comprises:

[0026] a detection unit configured to detect a file type of a file downloaded by the attack behavior;

[0027] a restriction unit configured to, in response to a file transmission occurring between any device and the virtual machine based on a network connection, detect a file type of the transmitted file, and if the file type is the same as the file type of the file downloaded by the attack behavior, restrict the transmission of the file.

[0028] In some embodiments, the restriction unit is configured to perform any of the following:

[0029] not send the file; or, transfer the file to an isolated space; or, lock the file.

[0030] In some embodiments, the acquisition module is further configured to, for any virtual machine, based on a target file set in a virtual service system of the virtual machine, acquire attacker information of the virtual machine, the attacker information being used to describe an attacker who initiates an attack behavior on the virtual machine, the target file being a service file in the virtual service system of the virtual machine.

[0031] The apparatus further comprises:

[0032] a determination module configured to determine, based on the attacker information of the virtual machine, an attacker of the virtual machine.

[0033] In some embodiments, the acquisition module is configured to acquire, based on a control program carried by the target file, attacker information sent by an attack device, the control program being used to control the attack device to send the attacker information to the virtual machine based on an opening operation on the target file, the attack device being a device that initiates an attack behavior on the virtual machine.

[0034] In an aspect, a computer device is provided, which includes one or more processors and one or more memories having stored therein at least one computer program that is loaded and executed by the one or more processors to implement the attack behavior defense method.

[0035] In an aspect, a computer readable storage medium is provided, which has stored therein at least one computer program that is loaded and executed by a processor to implement the attack behavior defense method.

[0036] In an aspect, a computer program product is provided, which includes at least one computer program stored in a computer readable storage medium. A processor of a computer device reads the at least one computer program from the computer readable storage medium, and the processor executes the at least one computer program to cause the computer device to implement the attack behavior defense method.

[0037] The technical solution provided by the embodiments of the present application can induce an attacker to initiate an attack behavior on a virtual machine, thereby ensuring the security of a business system. Further, the manager of the virtual machine can obtain the underlying running data of the virtual machine, and can obtain the relevant data of the attack behavior on the virtual machine without the awareness of the virtual machine. Therefore, the attacker cannot easily find that the attack behavior has been captured, and will not stop the attack, so that the complete data of the attack behavior can be obtained. Based on the obtained data, the attack behavior can be more perfectly defended, and the isolation policy of the business system can be improved according to the isolation policy of the virtual machine, thereby further ensuring the system security. BRIEF DESCRIPTION OF DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0039] Figure 1 is a schematic diagram of an implementation environment of an attack behavior defense method provided by the embodiments of the present application;

[0040] Figure 2 is a flowchart of an attack behavior defense method provided by the embodiments of the present application;

[0041] Figure 3 is a flowchart of an attack behavior defense method provided by the embodiments of the present application;

[0042] Figure 4 is a flowchart of a method for attack behavior defense provided by an embodiment of the present application;

[0043] Figure 5 is a schematic diagram of a virtual machine introspection function provided by an embodiment of the present application;

[0044] Figure 6 is a schematic diagram of an attack behavior defense system provided by an embodiment of the present application;

[0045] Figure 7 is a structural schematic diagram of an attack behavior defense device provided by an embodiment of the present application;

[0046] Figure 8 is a structural schematic diagram of a server provided by an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the objectives, technical solutions and advantages of the present application clearer, the embodiments of the present application will be further described in detail below with reference to the drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0048] In the present application, the terms "first", "second", and the like are used to distinguish the same or similar items with basically the same function, and it should be understood that there is no logical or time sequence dependency between "first", "second", and "n", and the quantity and execution order are not limited.

[0049] In order to facilitate the understanding of the technical process of the embodiments of the present application, some terms related to the embodiments of the present application are explained below.

[0050] The technical solutions provided by the embodiments of the present application relate to cloud security technology in cloud technology. Cloud technology is a general term of network technology, information technology, integration technology, management platform technology, application technology and the like applied based on cloud computing business model, which can form a resource pool and be used on demand, and is flexible and convenient.

[0051] Cloud Security refers to the general term of security software, hardware, users, institutions, and security cloud platforms based on the cloud computing business model. Cloud Security combines emerging technologies and concepts such as parallel processing, grid computing, and unknown virus behavior judgment. Through the abnormal monitoring of software behavior in the network by a large number of clients in a network, the latest information of Internet Trojans and malicious programs is obtained, and the obtained information is automatically analyzed and processed, and the solutions for viruses and Trojans are distributed to each client.

[0052] Deception is a network defense technology that exposes itself to attackers and malicious applications to observe the behavior of attackers. Through the observation of the behavior of attackers, technical personnel can design effective protection measures.

[0053] Blockchain is a new application mode of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, and encryption algorithm. Blockchain is essentially a decentralized database, which is a series of data blocks associated using cryptography. Each data block contains information about a batch of network transactions, which is used to verify the validity of the information (anti-fake) and generate the next block. Blockchain can include a blockchain underlying platform, a platform product service layer, and an application service layer.

[0054] The implementation environment of the present application is introduced as follows, Figure 1 is a schematic diagram of an implementation environment of an attack behavior defense method provided by an embodiment of the present application, referring to Figure 1 The implementation environment includes a terminal 101 and a server 102. The terminal 101 is directly or indirectly connected to the server 102 through wired or wireless means, and the present application is not limited in this regard.

[0055] The terminal 101 can be a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto. The server 102 can be a standalone physical server, a server cluster or a distributed system composed of multiple physical servers, a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms, etc. basic cloud computing services, and the present application is not limited in this regard.

[0056] In some embodiments, the terminal 101 is configured to configure at least one virtual machine, deploy the configured virtual machine in the server 102, and the server 102 is configured to obtain data related to attack behaviors of the virtual machine. Accordingly, the terminal 101 is further configured to display the data obtained by the server 102. The terminal 101 is a terminal used by an object, for example, a terminal used by a technician.

[0057] In some embodiments, the terminal 101 and the server 102 described above can serve as nodes in a blockchain.

[0058] It should be understood that the number of terminals and servers described above can be more, and the embodiments of the present application are only illustrated by taking the terminal 101 and the server 102 as an example.

[0059] Based on Figure 1 the implementation environment shown in the figure, Figure 2 is a flowchart of an attack behavior defense method provided by an embodiment of the present application, which is executed by a server, as shown in Figure 2 the figure, the embodiment includes the following steps.

[0060] 201, the server runs at least one virtual machine corresponding to a target vulnerability in a business system, and the virtual machine runs a virtual business system, and the virtual business system is configured to simulate the business logic of a network node in the business system.

[0061] The target vulnerability refers to a file or program in the business system that is vulnerable to attack. The virtual machine is configured to provide a running environment for the virtual business system, and the virtual business system can highly simulate the business logic of the network node in the business system. For example, the business logic corresponds to a network information browsing service, a file transfer service, a data storage service, or a remote operation service, etc. In some embodiments, the business system includes a plurality of network nodes, and different network nodes correspond to different business logic. The virtual business system in each virtual machine is configured to simulate the business logic of a network node.

[0062] The virtual business system in the at least one virtual machine is deployed with the target vulnerability of the business system to lure attackers to launch attack behaviors on the virtual business system of the virtual machine, so as to obtain data related to the attack behaviors while protecting the business system from attacks.

[0063] In some embodiments, the target vulnerability corresponds to the business logic of the virtual business system. For example, if the business logic of the virtual business system corresponds to a network information browsing business, a target business port of the network information browsing business can be determined first, the target business port being a network port with access times exceeding a threshold in a target time period, an abnormal access page is set for the target business port in the virtual business system, the abnormal access page being capable of highly simulating a real access page but having a different Internet Protocol (IP) address from the real access page, so as to lure an attacker to launch an attack behavior on the target business port of the virtual business system, and the attacker directly enters the abnormal access page, and the server is capable of obtaining relevant data of the attack behavior through the abnormal access page.

[0064] For another example, if the business logic of the virtual business system corresponds to a file transmission business or a data storage business, a false business file can be set in the virtual business system to lure an attacker to perform a read-write behavior or a download behavior on the file.

[0065] For another example, if the business logic of the virtual business system corresponds to a remote operation business, a weak password can be set for the virtual business system, and a false active operation record is set, so as to lure an attacker to log in to the virtual business system and perform further remote operation behaviors through the virtual business system.

[0066] 202. The server obtains underlying running data of the at least one virtual machine, the underlying running data being used to represent an attack behavior suffered by the at least one virtual machine.

[0067] The server obtains the underlying running data through a manager of the at least one virtual machine. The manager runs in the server and is independent of the at least one virtual machine. The underlying running data is data represented by an underlying machine language, such as binary data.

[0068] In some embodiments, the attack behavior suffered by the virtual machine includes a detection behavior suffered by the virtual machine and an attack behavior suffered by a target vulnerability of the virtual machine, the detection behavior being a non-discriminatory scanning of all files in the virtual machine or all IP addresses in a network segment corresponding to the virtual machine by an attacker. It can be understood that the attacker is capable of determining the target vulnerability existing in the virtual machine through the detection, so as to launch further attacks on the target vulnerability. Optionally, the underlying running data is also capable of representing other types of attack behaviors suffered by the virtual machine, which are not limited in the embodiments of the present application.

[0069] The manager is used to obtain the underlying running data of the at least one virtual machine, so that the relevant data of the attack behavior suffered by the virtual machine can be obtained without the awareness of the virtual machine, and thus the attacker cannot easily realize that the attack behavior has been captured, and will not stop the attack behavior, so that the server can obtain the complete relevant data of the attack behavior. Meanwhile, since the manager is independent of the at least one virtual machine, the manager can be avoided to be unloaded when the attacker initiates the attack behavior to the virtual machine. Optionally, the manager is a Hypervisor.

[0070] Optionally, if different target vulnerabilities are set in different virtual business systems of different virtual machines, the attack behaviors initiated to different target vulnerabilities are also different, that is, the underlying running data of different virtual machines represent different attack behaviors. For example, if a weak password is set in the virtual business system, the corresponding attack behavior can be system login, creation of a new file, and creation of a new process, etc.; if a false business file is set in the virtual business system, the corresponding attack behavior can be promotion of access permission, file reading and writing, and file downloading, etc.

[0071] 203. For any virtual machine, the server determines, based on the underlying running data of the virtual machine, an attack model corresponding to the virtual machine, the attack model being used to describe the attack behavior suffered by the virtual machine.

[0072] In some embodiments, a plurality of attack models are pre-stored in the server, and the server compares the attack behavior described by the underlying running data with the attack behaviors described by each attack model to determine the attack model corresponding to the virtual machine.

[0073] 204. The server processes a target connection of the virtual machine based on an isolation strategy corresponding to the attack model, the isolation strategy being used to defend the attack behavior suffered by the virtual machine, and the target connection corresponding to the isolation strategy.

[0074] In some embodiments, the target connection of the virtual machine refers to a connection maintained between the virtual machine and another virtual machine, or a connection maintained between the virtual machine and another device, or all network connections of the virtual machine.

[0075] By processing the target connection based on the isolation strategy, the attack behavior can be defended, so that the virtual business system can be prevented from being destroyed due to the attack behavior.

[0076] The technical scheme provided by the embodiments of the present application can induce an attacker to initiate an attack behavior on a virtual machine, thereby ensuring the security of a business system, and further acquire underlying running data of the virtual machine through a manager of the virtual machine, so that relevant data of the attack behavior received by the virtual machine can be acquired without awareness of the virtual machine, and therefore the attacker cannot easily find that the attack behavior has been captured, and will not stop the attack, so that complete data of the attack behavior can be acquired, and based on the acquired data, the attack behavior can be more perfectly defended, and further, the isolation policy of the business system can be perfected according to the isolation policy of the virtual machine, thereby further ensuring the system security.

[0077] Figure 2 The corresponding embodiments are only a brief introduction to the attack behavior defense method proposed in the present application, and the method will be described in detail below in combination with Figure 3 . Figure 3 is a flowchart of an attack behavior defense method provided by the embodiments of the present application, and the method is executed by a server, as shown in Figure 3 , the embodiment includes the following steps.

[0078] 301. The terminal acquires configuration information of at least one virtual machine corresponding to a target vulnerability in a business system, and sends the configuration information to a server, wherein the virtual machine is configured with a virtual business system, the virtual business system is used to simulate the business logic of a network node in the business system, and the configuration information is used to create the at least one virtual machine.

[0079] In some embodiments, the terminal is provided with a configuration interface of the virtual machine, and a technician can configure the at least one virtual machine through the configuration interface. The terminal acquires the configuration information of the at least one virtual machine in response to a configuration operation of the at least one virtual machine on the configuration interface, and sends the configuration information of the at least one virtual machine to the server. Optionally, the configuration information of the virtual machine includes an IP address of the virtual machine, configuration information of the virtual business system, and configuration information of the target vulnerability, etc.

[0080] In some embodiments, the technician can configure the virtual machine according to the business involved in the business system. As shown in Figure 4 , the technician first combs the business assets included in the business system to determine the network nodes included in the business system and the business logic of each network node, and then determines the virtual machine to be configured and the virtual business system in the virtual machine according to the business logic of each network node. Optionally, the business assets of the business system include servers, network architecture, security assets, and internal / external network interfaces, etc., wherein the security assets refer to relevant programs for protecting the system security in the business system, such as network isolation services and firewalls, etc. Further, as shown in Figure 4At step 402, the technician can set the target vulnerability in the virtual business system based on the business logic corresponding to the virtual business system, so that the target vulnerability matches the business scenario of the virtual business system, thereby being able to lure the attacker to launch an attack on the target vulnerability, and also being able to avoid the situation that the target vulnerability does not match the business logic and is identified by the attacker.

[0081] 302. The server receives the configuration information of the at least one virtual machine, and creates the at least one virtual machine based on the configuration information, and runs the at least one virtual machine.

[0082] In some embodiments, the server creates the at least one virtual machine based on the received configuration information, configures the corresponding virtual business system in the at least one virtual machine, deploys the target vulnerability in the virtual business system, and runs the at least one virtual machine.

[0083] In some embodiments, the at least one virtual machine can be updated at a certain period, for example, the server updates the content of the virtual business system running in the at least one virtual machine based on the content change frequency of the real business system, and also can stop running the virtual machine that is out of date and may be attacked by the attacker, so as to simulate the real business system, and then can continuously induce the attacker to launch an attack on the virtual business system.

[0084] 303. The server obtains the underlying running data of the at least one virtual machine through the manager of the at least one virtual machine, and the underlying running data is used to represent the attack behavior suffered by the at least one virtual machine.

[0085] In some embodiments, the server obtains the calling information of the target code through the manager of the at least one virtual machine, the target code is used to perform a target behavior on the at least one virtual machine, and the server obtains the underlying running data of the at least one virtual machine in response to detecting a calling operation on the target code based on the calling information. The target code is the underlying code in the kernel of the server operating system, and optionally, the target code is the underlying function in the server, such as the privilege escalation function, the process creation function, the file read-write function, the instruction execution function, and the network connection function.

[0086] In some embodiments, as Figure 5As shown, the manager has a virtual machine introspection function, based on which the manager can acquire underlying running data in the at least one virtual machine, convert the underlying running data into attack behavior data based on system knowledge of an operating system run by the at least one virtual machine. The system knowledge of the operating system refers to kernel information of the operating system, such as system data structure, process descriptor, and file descriptor, etc. The attack behavior data is data with more explicit semantics, and can represent attack operations performed on the virtual machine, such as called functions, downloaded files, created new files, created new processes, and established connections, etc. By converting the underlying running data, the semantic isolation between the underlying binary data and the virtual machine system information is broken, and attack behavior data with more explicit semantics is obtained, so that relevant technical personnel can more easily analyze attack behaviors suffered by the virtual machine.

[0087] It should be noted that when the attacker launches an attack on the virtual machine, the attacker needs to call target code in the server through the virtual machine to perform corresponding attack operations. The manager can acquire underlying running data of the virtual machine when the virtual machine is attacked by acquiring call information of the target code, so as to acquire relevant data of the attack behavior without awareness of the virtual machine.

[0088] In some embodiments, after the server acquires the underlying behavior data, the server stops running the target code, so as to prevent the attack behavior from damaging the virtual business system and prevent important system information from being leaked.

[0089] 304. The server acquires attacker information of the at least one virtual machine, the attacker information being used to describe an attacker who launches an attack behavior on the virtual machine.

[0090] In some embodiments, the attacker information includes device information of an attack device used by the attacker and identity information of the attacker, etc. The device information includes host name, operating system version, keyboard type, operating system language, and IP address of the attack device, etc. The identity information includes time zone where the attacker is located and identifier of the attacker, etc.

[0091] In some embodiments, as shown in step 402, the server acquires underlying behavior data of the at least one virtual machine, the underlying behavior data being used to describe an attack behavior launched on the virtual machine. Figure 4 As shown in step 403, for any virtual machine, when a target file is set in a virtual business system of the virtual machine, the server acquires attacker information of the virtual machine based on the target file, the target file being a business file in the virtual business system of the virtual machine. Optionally, the target file is a Word file, an Excel file, an extensible markup language (XML) file, a PDF file, or a PowerPoint file, etc.

[0092] Exemplarily, taking a file transmission service as an example, the process of obtaining the attacker information is described. For example, the target file is a false service file set in the virtual service system, and the target file carries a control program. The control program is used to control the attack device to send the attacker information to the virtual machine based on an opening operation on the target file. When the attack device downloads and opens the target file, the control program carried by the target file can be triggered to run, so as to control the attack device to send the attacker information to the virtual machine, and the server receives the attacker information sent by the attack device.

[0093] It should be noted that the steps 303 and 304 can be executed in parallel, and are not limited to the current timing.

[0094] 305、The server stores the hypervisor running data and the attacker information of the at least one virtual machine.

[0095] In some embodiments, as Figure 4 As shown in step 404, the server can store the obtained hypervisor running data and the attacker information in a database, so that the attack behavior in a historical time period can be further analyzed according to the data stored in the database, and the technical personnel can also check the data in the database at any time and analyze the attack behavior according to personal experience. Optionally, the database is a remote dictionary database (Redis). Optionally, the server stores the attack behavior data corresponding to the hypervisor running data in the database. Since the attack behavior data has more explicit semantics, the technical personnel can more easily analyze the data.

[0096] In some embodiments, the server can also transfer the data stored in the database to an associated data platform, and further analyze the data through the data platform, such as a splunk platform and an elasticsearch platform.

[0097] 306、For any virtual machine, the server determines an attack model corresponding to the virtual machine based on the hypervisor running data of the virtual machine, and the attack model is used to describe the attack behavior suffered by the virtual machine.

[0098] The attack behavior described by the attack model can include one attack operation or multiple attack operations. For example, one attack operation can be logging into a system, opening a false service file, or downloading false service data, and multiple attack operations can be logging into a system and upgrading the access permission of the login user, logging into a system and scanning the system, or accessing an abnormal webpage and implanting code. Optionally, the attack model also includes an attack type corresponding to the attack behavior, such as an encryption attack and a malicious code injection attack.

[0099] In some embodiments, the server is pre-provisioned with a plurality of attack models, and for any virtual machine, the server compares the attack behavior described by the underlying running data of the virtual machine with the attack behaviors described by the plurality of attack models, and in response to the attack behavior described by the underlying running data matching the attack behavior described by any attack model, determines the attack model as the attack model corresponding to the virtual machine. Optionally, the attack behavior described by the underlying running data matches the attack behavior described by any attack model if the attack behavior described by the underlying running data and the attack behavior described by the attack model have at least one same attack operation, or the attack behavior described by the underlying running data and the attack behavior described by the attack model correspond to completely same attack operations.

[0100] It should be noted that if the underlying running data of the virtual machine cannot match all attack models, the server can label the underlying running data of the virtual machine in the database, so that the technical personnel can create a corresponding attack model based on the labeled data, thereby strengthening the isolation strategy of the business system, and when the virtual machine is attacked again, the attack model can be matched to facilitate the technical personnel to better analyze the attack situation.

[0101] 307、The server processes the target connection of the virtual machine based on the isolation strategy corresponding to the attack model, the isolation strategy being used to defend the attack behavior suffered by the virtual machine, and the target connection corresponding to the isolation strategy.

[0102] In some embodiments, the server is pre-provisioned with a plurality of attack models corresponding to isolation strategies, and each isolation strategy is used to defend the attack behavior of the corresponding attack model. The server can process the target connection of the virtual machine based on the isolation strategy corresponding to the attack model of the virtual machine by any of the following methods.

[0103] In an implementation manner, in a case where the attack model indicates that the attack behavior includes operations between virtual machines, the server disconnects the connection between the virtual machine and other virtual machines. In some embodiments, if the server detects that the model identifier of the attack model corresponding to the virtual machine is Mou1, the server determines that the attack model of the virtual machine corresponds to a first isolation strategy, the first isolation strategy being used to indicate to disconnect the connection between the virtual machine and other virtual machines, and the server disconnects the connection between the virtual machine and other virtual machines based on the first isolation strategy.

[0104] Exemplarily, the virtual machine can keep connection with other virtual machines in the server to implement the service of the virtual service system in the virtual machine. For example, taking the case that the virtual service system of the virtual machine corresponds to the remote operation service as an example, if the attack behavior indicated by the attack model of the virtual machine is to log in the system and remotely operate other virtual machines through the system, and the model identifier of the attack model is Mou1, the server determines that the attack model corresponds to the first isolation strategy, and based on the first isolation strategy, the connection between the virtual machine and other virtual machines is disconnected.

[0105] In some embodiments, the first isolation strategy includes a first sub-strategy of two levels, and the higher the level is, the more strict the isolation manner of the virtual machine is. Wherein, the first sub-strategy of level 1 is to disconnect the virtual machine from a target virtual machine, and the target virtual machine is other virtual machine operated by the virtual machine, and the first sub-strategy of level 2 is to disconnect the virtual machine from all other virtual machines. In the case that the attack model of the virtual machine corresponds to the first isolation strategy, the server determines the number of target virtual machines operated by the virtual machine based on the underlying running data of the virtual machine. If the number of target virtual machines is greater than a first number threshold, the server disconnects the virtual machine from all other virtual machines; if the number of target virtual machines is less than or equal to the first number threshold, the server disconnects the virtual machine from the target virtual machine.

[0106] In another implementation manner, in the case that the attack model indicates that the attack behavior includes accessing non-normal web pages, the server disconnects the network connection of the virtual machine. In some embodiments, if the server detects that the model identifier of the attack model corresponding to the virtual machine is Mou2, it is determined that the attack model of the virtual machine corresponds to a second isolation strategy, and the second isolation strategy is used to instruct the server to disconnect the network connection of the virtual machine. The server disconnects the network connection of the virtual machine based on the second isolation strategy.

[0107] Exemplarily, taking the case that the virtual service system of the virtual machine corresponds to the network information browsing service as an example, if the attack behavior indicated by the attack model of the virtual machine is to access non-normal web pages and implant codes, and the model identifier of the attack model is Mou2, the server determines that the attack model corresponds to the second isolation strategy, and based on the second isolation strategy, the network port of the virtual machine is disabled to disconnect the network connection of the virtual machine.

[0108] In some embodiments, the second isolation policy includes a second sub-policy of two levels, and a higher level indicates a more stringent isolation manner of the virtual machine. The first level of the second sub-policy is to disable a target network port of the virtual machine, and the target network port is a network port corresponding to an abnormal webpage. The second level of the second sub-policy is to disable all network ports of the virtual machine. In a case where the attack model of the virtual machine corresponds to the second isolation policy, the server determines the target network port of the virtual machine based on the underlying running data of the virtual machine. If the number of the target network ports is greater than a second number threshold, the server disables all network ports of the virtual machine. If the number of the target network ports is less than or equal to the second number threshold, the server disables the target network port of the virtual machine.

[0109] In another implementation, in a case where the attack model indicates that the attack behavior includes downloading a file from the virtual machine, the server disconnects the network connection between the virtual machine and other devices. In some embodiments, if the server detects that the model identifier of the attack model corresponding to the virtual machine is Mou3, the server determines that the attack model of the virtual machine corresponds to a third isolation policy, the third isolation policy is used to instruct the server to disconnect the network connection between the virtual machine and other devices, and the server disconnects the network connection between the virtual machine and other devices based on the third isolation policy.

[0110] For example, taking a file transmission service corresponding to a virtual service system of a virtual machine as an example, in a case where the virtual machine is attacked, if the attack behavior indicated by the attack model of the virtual machine is to download a file, and the model identifier of the attack model is Mou3, the server determines that the attack model corresponds to a third isolation policy, detects a target network connection maintained by the virtual machine and other devices based on the third isolation policy, determines a port and a network address corresponding to the target network connection, and disconnects the communication between the port and the network address.

[0111] In another implementation, in a case where the attack model indicates that the attack behavior includes downloading a file from the virtual machine, the server limits the type of data transmitted between the virtual machine and other devices based on a network connection. In some embodiments, if the server detects that the model identifier of the attack model corresponding to the virtual machine is Mou4, the server determines that the attack model of the virtual machine corresponds to a fourth isolation policy, the fourth isolation policy is used to limit the type of data transmitted between the virtual machine and other devices based on a network connection, and the server limits the type of data transmitted between the virtual machine and other devices based on a network connection based on the fourth isolation policy.

[0112] Exemplarily, taking a file transmission service corresponding to a virtual service system of a virtual machine as an example, in a case where the virtual machine is attacked, if an attack behavior indicated by an attack model of the virtual machine is downloading a file, and a model identifier of the attack model is Mou4, the server determines that the attack model corresponds to a fourth isolation strategy, detects a file type of the file downloaded by the attack behavior based on the fourth isolation strategy, detects a file type of a file transmitted between any device and the virtual machine based on network connection, and limits transmission of the file if the file type is the same as the file type of the file downloaded by the attack behavior. Optionally, the server limits transmission of the file in any of the following manners: the server does not send the file; or, the server transfers the file to an isolated space; or, the server locks the file.

[0113] In some embodiments, the plurality of isolation strategies are divided into different levels, and a higher level indicates that the isolation manner of the corresponding isolation strategy for the virtual machine is more strict, for example, the corresponding levels of the second isolation strategy and the third isolation strategy can be 2 and 1. Accordingly, the server can determine whether the attack behavior received by the virtual machine matches the attack model based on the level of the isolation strategy corresponding to the attack model. Exemplarily, the higher the level of the isolation strategy corresponding to the attack model, the more strict the matching condition of the attack model. For example, if a certain attack model corresponds to a level 1 isolation strategy, the matching condition of the attack model is that the attack behavior received by the virtual machine has at least one same attack operation as the attack behavior described by the attack model; if a certain attack model corresponds to a level 2 isolation strategy, the matching condition of the attack model is that the attack behavior received by the virtual machine is completely same as the attack operation corresponding to the attack behavior described by the attack model. Determining the attack model corresponding to the virtual machine through the level of the isolation strategy can improve the accuracy of matching the attack model, so that different attack behaviors can be prevented by different isolation strategies, and the system security is ensured.

[0114] Processing the virtual machine through the isolation strategy can avoid damage to other virtual machines in the server caused by the attack behavior, so that the normal operation of other virtual machines can be maintained in a case where a certain virtual machine is attacked.

[0115] Optionally, the server stores the attack model and the isolation strategy corresponding to the attack behavior received by the at least one virtual machine in a database, so that the number of times that the attack behavior received by the virtual machine can match the attack model and the isolation strategy can be determined according to the data stored in the database, and then the effectiveness of the set attack model and isolation strategy can be analyzed by the technician.

[0116] 308、The server determines the attacker of the at least one virtual machine based on the attacker information of the at least one virtual machine.

[0117] In some embodiments, for any virtual machine, in a case where the server obtains attacker information of the virtual machine, the server determines a plurality of candidate regions based on the operating system and the keyboard type of the attack device, in which there are devices using the same operating system and keyboard, further determines the region where the attacker is located from the plurality of candidate regions based on the time zone where the attacker is located and the IP address of the attack device used, queries data matching the attacker information in an object information library, the object information library is used to store information related to attackers who have launched attack behaviors on other business systems, and if any information related to the attacker is found matching the attacker information, the server obtains the information related to the attacker from the object information library, so as to obtain more complete information of the attacker. It should be noted that the data in the object information library is data that has been fully authorized.

[0118] Optionally, the process of determining the attacker is also called attack tracing.

[0119] It should be noted that steps 305 to 307 correspond to steps 405 in Figure 4 Step 306, step 307 and step 308 can be executed in parallel, and are not limited to the current timing.

[0120] 309、The server sends the attack model, the isolation strategy and the attacker corresponding to the at least one virtual machine to the terminal.

[0121] In some embodiments, the server can send the attack model, the isolation strategy and the information related to the attacker to the terminal in real time, so that the terminal can display the received data, thereby facilitating the technical personnel to analyze the attack situation of the virtual machine.

[0122] Optionally, the server also sends the terminal related data of other attack behaviors, such as attack behavior data corresponding to underlying running data, attack type and attacked business, so that the terminal can display more rich data.

[0123] 310、The terminal receives the attack model, the isolation strategy and the attacker corresponding to the at least one virtual machine, and displays the attack model, the isolation strategy and the attacker.

[0124] In some embodiments, as Figure 4At step 406, the terminal receives the data sent by the server, and displays an attack behavior analysis page, in which the received attack model, isolation strategy and related information for tracing the attacker are displayed. Optionally, if the server also sends other attack behavior related data to the terminal, the terminal can also display other attack behavior related data in the analysis page based on the data sent by the server. By displaying the attack behavior related data, the technical personnel can understand the attack method, attack type and attack tracing related information of the attack behavior initiated by the attacker against the business system, so as to optimize the isolation strategy of the business system and ensure the security of the business system.

[0125] In some embodiments, the terminal can directly obtain attack behavior data and corresponding isolation strategies in a historical time period from the database, and based on the obtained data, the number of times of attacks on the virtual machine and the number of times of defense in the historical time period are obtained by statistics, and the statistical data is displayed in the attack behavior analysis page.

[0126] In some embodiments, based on the attack behavior related data sent by the server, the terminal determines the network node in the business system corresponding to the attacked virtual machine, obtains an attack distribution diagram of the business system based on the corresponding network node, and displays the attack distribution diagram in the attack behavior analysis page. In this way, the technical personnel can more intuitively understand the part of the business system that is vulnerable to attack, so as to better perfect the isolation strategy of the system to more accurately defend against attack behavior.

[0127] The technical scheme provided by the embodiments of the present application can induce an attacker to initiate an attack behavior on a virtual machine, thereby ensuring the security of a business system. Further, by using a virtual machine manager to obtain the underlying running data of the virtual machine, the related data of the attack behavior received by the virtual machine can be obtained without the awareness of the virtual machine. Therefore, the attacker cannot easily discover that the attack behavior has been captured, and will not stop the attack, so that complete attack behavior data can be obtained. Based on the obtained data, the attack behavior can be more perfectly defended, and the isolation strategy of the business system can be perfected according to the isolation strategy of the virtual machine, thereby further ensuring the security of the system.

[0128] The embodiments of the present application also provide a system for executing the attack behavior defense method described above, Figure 6 is a schematic diagram of an attack behavior defense system provided by the embodiments of the present application, like Figure 6As shown, the attack behavior defense system provides a plurality of services, including a data collection service 601, a data storage service 602, a data analysis service 603, and a data display service 604. Among them, the data collection service 601 is used to obtain attack behavior data and attacker information of at least one virtual machine based on virtual machine introspection technology. The data storage service 602 is used to store the obtained data into a database. The data analysis service 603 is used to determine the corresponding attack model and isolation strategy based on the obtained attack behavior data, and determine the attacker who initiates the attack behavior based on the obtained attacker information. The data display service 604 is used to display the relevant information of the attack behavior, including the attacked business, the attack type, the attack model, the isolation strategy, the attack times, the defense times, and the attack tracing information, etc.

[0129] Figure 7 is a structural schematic diagram of an attack behavior defense device provided by an embodiment of the present application, referring to Figure 7 The device comprises a running module 701, an obtaining module 702, a determining module 703, and a defense module 704.

[0130] The running module 701 is used to run at least one virtual machine corresponding to a target vulnerability in a business system, the virtual machine running a virtual business system, the virtual business system being used to simulate the business logic of a network node in the business system.

[0131] The obtaining module 702 is used to obtain the underlying running data of the at least one virtual machine through a manager of the at least one virtual machine, the underlying running data being used to represent the attack behavior suffered by the at least one virtual machine.

[0132] The determining module 703 is used to, for any virtual machine, determine the attack model corresponding to the virtual machine based on the underlying running data of the virtual machine, the attack model being used to describe the attack behavior suffered by the virtual machine.

[0133] The defense module 704 is used to process the target connection of the virtual machine based on the isolation strategy corresponding to the attack model, the isolation strategy being used to defend the attack behavior suffered by the virtual machine, the target connection corresponding to the isolation strategy.

[0134] In some embodiments, the obtaining module 702 is used to obtain the calling information of the target code through the manager of the at least one virtual machine, the target code being used to perform a target behavior on the at least one virtual machine, the manager being independent of the at least one virtual machine; and in response to detecting the calling operation on the target code based on the calling information, the underlying running data of the at least one virtual machine is obtained.

[0135] In some embodiments, the device further comprises:

[0136] a stopping module, configured to stop running the target code.

[0137] In some embodiments, the defense module 704 includes:

[0138] a first processing submodule, configured to disconnect the virtual machine from other virtual machines if the attack model indicates that the attack behavior includes operations between virtual machines;

[0139] a second processing submodule, configured to disconnect the network connection of the virtual machine if the attack model indicates that the attack behavior includes accessing abnormal webpages;

[0140] a third processing submodule, configured to disconnect the network connection between the virtual machine and other devices if the attack model indicates that the attack behavior includes downloading files from the virtual machine;

[0141] a fourth processing submodule, configured to limit the type of data transmitted between the virtual machine and other devices based on network connection if the attack model indicates that the attack behavior includes downloading files from the virtual machine.

[0142] In some embodiments, the first processing submodule is configured to determine the number of target virtual machines operated by the virtual machine based on the underlying running data of the virtual machine; if the number of target virtual machines is greater than a first number threshold, disconnect the virtual machine from all other virtual machines; if the number of target virtual machines is less than or equal to the first number threshold, disconnect the virtual machine from the target virtual machines.

[0143] In some embodiments, the second processing submodule is configured to determine the target network port of the virtual machine based on the underlying running data of the virtual machine, the target network port being the network port corresponding to the abnormal webpage; if the number of target network ports is greater than a second number threshold, disable all network ports of the virtual machine; if the number of target network ports is less than or equal to the second number threshold, disable the target network port of the virtual machine.

[0144] In some embodiments, the fourth processing submodule includes:

[0145] a detection unit, configured to detect the file type of the files downloaded by the attack behavior;

[0146] a limiting unit, configured to, in response to file transmission occurring between any device and the virtual machine based on network connection, detect the file type of the transmitted file, and if the file type is the same as the file type of the files downloaded by the attack behavior, limit the transmission of the file.

[0147] In some embodiments, the limiting unit is configured to perform any of the following:

[0148] not sending the file; or, moving the file to an isolated space; or, locking the file.

[0149] In some embodiments, the obtaining module is further configured to, for any virtual machine, if a target file is set in a virtual service system of the virtual machine, obtain attacker information of the virtual machine based on the target file, the attacker information being used to describe an attacker who initiates an attack behavior on the virtual machine, the target file being a service file in the virtual service system of the virtual machine.

[0150] The apparatus further includes:

[0151] The determining module is configured to determine the attacker of the virtual machine based on the attacker information of the virtual machine.

[0152] In some embodiments, the obtaining module is configured to obtain attacker information sent by an attack device based on a control program carried by the target file, the control program being used to control the attack device to send the attacker information to the virtual machine based on an opening operation on the target file, the attack device being a device that initiates an attack behavior on the virtual machine.

[0153] It should be noted that the attack behavior defense apparatus provided in the above embodiments is only used for example to divide the above functional modules when defending against attack behaviors, and in actual application, the above functions can be completed by different functional modules according to needs, that is, the internal structure of the apparatus is divided into different functional modules to complete all or part of the above described functions. In addition, the attack behavior defense apparatus and the attack behavior defense method provided in the above embodiments belong to the same concept, and the specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0154] The present disclosure provides a computer device for executing the attack behavior defense method described above, in some embodiments, the computer device is provided as a server, Figure 8 is a structural schematic diagram of a server provided by an embodiment of the present application. The server 800 can have great differences due to different configurations or performances, and can include one or more processors (Central Processing Units, CPUs) 801 and one or more memories 802. The one or more memories 802 store at least one program code, which is loaded and executed by the one or more processors 801 to implement the method provided by each method embodiment described above. Of course, the server 800 can also have a wired or wireless network interface, a keyboard, and an input and output interface, and other components for realizing the functions of the device, which will not be repeated here.

[0155] In an example embodiment, a computer readable storage medium, for example, a memory including at least one program code, is also provided, and the at least one program code is executable by a processor to complete the attack behavior defense method in the above-mentioned embodiments. For example, the computer readable storage medium can be a Read-Only Memory (ROM), a Random Access Memory (RAM), a Compact Disc Read-Only Memory (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, etc.

[0156] In an example embodiment, a computer program product is also provided, and the computer program product includes at least one computer program stored in a computer readable storage medium. The processor of the computer device reads the at least one computer program from the computer readable storage medium, and the processor executes the at least one computer program to make the computer device perform the operations performed by the attack behavior defense method.

[0157] In some embodiments, the computer program related to the embodiments of the present application can be deployed to execute on one computer device, or on multiple computer devices located in one place, or on multiple computer devices distributed in multiple places and interconnected through a communication network, and the multiple computer devices distributed in multiple places and interconnected through a communication network can constitute a blockchain system.

[0158] Those of ordinary skill in the art can understand that all or part of the steps of the above-mentioned embodiments can be completed by hardware, or by a program instructing relevant hardware, and the program can be stored in a computer readable storage medium, and the storage medium mentioned above can be a Read-Only Memory, a magnetic disk or an optical disk, etc.

[0159] The above is only an optional embodiment of the present application, and is not used to limit the present application, and any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An attack behavior defense method characterized by, The method comprises: running at least one virtual machine corresponding to a target vulnerability in a business system, the virtual machine running a virtual business system, the virtual business system being used to simulate the business logic of a network node in the business system; obtaining, by a manager of the at least one virtual machine, calling information of a target code, the target code being called to perform a corresponding attack operation when the at least one virtual machine is attacked, the target code comprising at least one of a privilege escalation function, a process creation function, a file read-write function, an instruction execution function, and a network connection function, the manager being independent of the at least one virtual machine; in response to detecting a calling operation on the target code based on the calling information, obtaining, by the manager of the at least one virtual machine, underlying running data of the at least one virtual machine, and stopping running the target code, the underlying running data being used to represent attack behavior suffered by the at least one virtual machine; based on system knowledge of an operating system run by the at least one virtual machine, converting the underlying running data to obtain attack behavior data, the system knowledge of the operating system being kernel information of the operating system, the attack behavior data being semantic data and being used to represent an attack operation performed on the at least one virtual machine; for any of the virtual machines, comparing attack behavior described by the underlying running data of the virtual machine with attack behavior described by a plurality of preset attack models; in response to the attack behavior described by the underlying running data of the virtual machine matching the attack behavior described by any of the attack models, determining the attack model as an attack model corresponding to the virtual machine, the attack model being used to describe attack behavior suffered by the virtual machine, the attack behavior described by the attack model comprising at least one attack operation; based on an isolation strategy corresponding to the attack model, processing a target connection of the virtual machine, the isolation strategy being used to defend against attack behavior suffered by the virtual machine, the target connection corresponding to the isolation strategy.

2. The method of claim 1, wherein, The processing of the target connection of the virtual machine based on the isolation strategy corresponding to the attack model comprises any of the following: in a case where the attack model indicates that the attack behavior comprises an operation between virtual machines, disconnecting the virtual machine from other virtual machines; in a case where the attack model indicates that the attack behavior comprises accessing an abnormal webpage, disconnecting the network connection of the virtual machine; in a case where the attack model indicates that the attack behavior comprises downloading a file from the virtual machine, disconnecting the network connection between the virtual machine and other devices; in a case where the attack model indicates that the attack behavior comprises downloading a file from the virtual machine, limiting the type of data transmitted between the virtual machine and other devices based on the network connection.

3. The method of claim 2, wherein, The disconnecting of the virtual machine from other virtual machines in a case where the attack model indicates that the attack behavior comprises an operation between virtual machines comprises: based on the underlying running data of the virtual machine, determining the number of target virtual machines operated by the virtual machine; if the number of the target virtual machines is greater than a first number threshold, disconnecting the virtual machine from all other virtual machines; if the number of the target virtual machines is less than or equal to the first number threshold, disconnecting the virtual machine from the target virtual machines.

4. The method of claim 2, wherein, the disconnecting the network connection of the virtual machine in the case that the attack model indicates that the attack behavior includes accessing an abnormal web page comprises: determining a target network port of the virtual machine based on underlying running data of the virtual machine, the target network port being a network port corresponding to the abnormal web page; if the number of the target network ports is greater than a second number threshold, disabling all network ports of the virtual machine; if the number of the target network ports is less than or equal to the second number threshold, disabling the target network ports of the virtual machine.

5. The method of claim 2, wherein, the limiting the type of data transmitted between the virtual machine and other devices based on a network connection in the case that the attack model indicates that the attack behavior includes downloading a file from the virtual machine comprises: detecting a file type of the file downloaded by the attack behavior; in response to file transmission occurring between any device and the virtual machine based on a network connection, detecting a file type of the transmitted file, and if the file type is the same as the file type of the file downloaded by the attack behavior, limiting transmission of the file.

6. The method of claim 5, wherein, the limiting transmission of the file comprises: not transmitting the file; or, transferring the file to an isolated space; or, locking the file.

7. The method of claim 1, wherein, the method further comprises: for any virtual machine, in the case that a target file is set in a virtual business system of the virtual machine, acquiring attacker information of the virtual machine based on the target file, the attacker information being used to describe an attacker who initiates an attack behavior on the virtual machine, the target file being a business file in the virtual business system of the virtual machine; determining an attacker of the virtual machine based on the attacker information of the virtual machine.

8. The method of claim 7, wherein, the acquiring the attacker information of the virtual machine based on the target file comprises: acquiring attacker information sent by an attack device based on a control program carried by the target file, the control program being used to control the attack device to send the attacker information to the virtual machine based on an opening operation on the target file, the attack device being a device that initiates an attack behavior on the virtual machine.

9. An attack behavior defense apparatus characterized by comprising: the apparatus comprises: a running module, configured to run at least one virtual machine corresponding to a target vulnerability in a business system, the virtual machine running a virtual business system, the virtual business system being used to simulate a business logic of a network node in the business system; The acquisition module is configured to acquire, by a manager of the at least one virtual machine, calling information of target code, the target code being called to perform a corresponding attack operation when the at least one virtual machine is attacked, the target code including at least one of a privilege escalation function, a process creation function, a file read-write function, an instruction execution function, and a network connection function, the manager being independent of the at least one virtual machine; in response to detecting, based on the calling information, a calling operation on the target code, acquiring, by the manager of the at least one virtual machine, underlying running data of the at least one virtual machine, and stopping running the target code, the underlying running data being used to represent attack behavior suffered by the at least one virtual machine; based on system knowledge of an operating system run by the at least one virtual machine, converting the underlying running data to obtain attack behavior data, the system knowledge of the operating system being kernel information of the operating system, and the attack behavior data being semantic data and being used to represent attack operations performed on the at least one virtual machine; The determination module is configured to, for any one of the virtual machines, compare attack behavior described by the underlying running data of the virtual machine with attack behavior described by a plurality of preset attack models; in response to the attack behavior described by the underlying running data of the virtual machine matching the attack behavior described by any one of the attack models, determining the attack model as a corresponding attack model of the virtual machine, the attack model being used to describe attack behavior suffered by the virtual machine, and the attack behavior described by the attack model including at least one attack operation; The defense module is configured to process a target connection of the virtual machine based on an isolation strategy corresponding to the attack model, the isolation strategy being used to defend against attack behavior suffered by the virtual machine, and the target connection corresponding to the isolation strategy.

10. The apparatus of claim 9, wherein, The defense module includes: The first processing submodule is configured to, in a case where the attack model indicates that the attack behavior includes operations between virtual machines, disconnect the virtual machine from other virtual machines; The second processing submodule is configured to, in a case where the attack model indicates that the attack behavior includes accessing an abnormal web page, disconnect a network connection of the virtual machine; The third processing submodule is configured to, in a case where the attack model indicates that the attack behavior includes downloading a file from the virtual machine, disconnect a network connection between the virtual machine and other devices; The fourth processing submodule is configured to, in a case where the attack model indicates that the attack behavior includes downloading a file from the virtual machine, limit a data type transmitted between the virtual machine and other devices based on the network connection.

11. The apparatus of claim 10, wherein, The first processing submodule is configured to: determine, based on the underlying running data of the virtual machine, a number of target virtual machines operated by the virtual machine; if the number of target virtual machines is greater than a first number threshold, disconnect the virtual machine from all other virtual machines; if the number of target virtual machines is less than or equal to the first number threshold, disconnect the virtual machine from the target virtual machines.

12. The apparatus of claim 10, wherein, The second processing submodule is configured to: determine a target network port of the virtual machine based on underlying running data of the virtual machine, the target network port being a network port corresponding to the abnormal webpage; if the number of the target network ports is greater than a second quantity threshold, disable all network ports of the virtual machine; if the number of the target network ports is less than or equal to the second quantity threshold, disable the target network ports of the virtual machine.

13. The apparatus of claim 10, wherein, The fourth processing sub-module comprises: a detection unit configured to detect a file type of a file downloaded by the attack behavior; a restriction unit configured to, in response to file transmission occurring between any device and the virtual machine based on a network connection, detect a file type of a transmitted file, and if the file type is the same as a file type of a file downloaded by the attack behavior, restrict transmission of the file.

14. The apparatus of claim 13, wherein, The restriction unit is configured to perform any of the following: not send the file; or, transfer the file to an isolated space; or, lock the file.

15. The apparatus of claim 9, wherein, The acquisition module is further configured to: for any virtual machine, based on a target file set in a virtual service system of the virtual machine, acquire attacker information of the virtual machine, the attacker information being used to describe an attacker initiating an attack behavior on the virtual machine, and the target file being a service file in the virtual service system of the virtual machine. The apparatus further comprises: a determination module configured to determine an attacker of the virtual machine based on the attacker information of the virtual machine.

16. The apparatus of claim 15, wherein, The acquisition module is configured to: acquire attacker information sent by an attack device based on a control program carried by the target file, the control program being used to control the attack device to send the attacker information to the virtual machine based on an opening operation on the target file, and the attack device being a device initiating an attack behavior on the virtual machine.

17. A computer device, comprising: The computer device comprises one or more processors and one or more memories, the one or more memories storing at least one computer program, the at least one computer program being loaded and executed by the one or more processors to implement operations performed by the attack behavior defense method according to any one of claims 1 to 8.

18. A computer-readable storage medium, characterized in that, The computer readable storage medium stores at least one computer program, the at least one computer program being loaded and executed by the processor to implement operations performed by the attack behavior defense method according to any one of claims 1 to 8.

19. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to implement the attack behavior defense method according to any one of claims 1 to 8.

Images