A protection method, device and computing equipment based on the competitive characteristics of mining trojans

Abstract

The present invention provides a protection method, device and computing equipment based on the competition characteristics of mining Trojans, which relates to the field of computer technology. The method comprises: analyzing the obtained mining Trojan samples to obtain a mining Trojan sample library; running the mining Trojan samples to determine the target termination instructions included in the mining Trojan samples for terminating other mining Trojan processes; generating a suspicious process blacklist based on the process information corresponding to the target termination instructions; and performing protection according to the mining Trojan sample library and the suspicious process blacklist. The scheme can quickly identify mining Trojans, achieve efficient protection, and effectively improve the accuracy and timeliness of malware protection.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, specifically to the field of malicious code protection, and in particular to a protection method, device and computing equipment based on the competitive characteristics of mining Trojans. Background Art

[0002] Mining Trojans are a typical type of malware that uses a variety of intrusion methods to implant mining programs into the victim's computer system without the user's authorization. The program uses the victim's computing resources to mine cryptocurrencies, thereby generating illegal profits for the attacker. This behavior not only causes the victim's computer to suffer performance degradation and increase energy consumption, but may also cause system instability or even crash.

[0003] At present, the defense technology against mining Trojans mainly relies on signature scanning, behavior analysis, and machine learning algorithms. However, as mining Trojan technology continues to evolve, they have begun to use advanced encryption and code obfuscation strategies to hide themselves, or parasitize legitimate processes to cover up their malicious behavior, thereby evading existing security detection. This development trend allows mining Trojans to bypass protective measures and continue to conduct illegal mining operations, posing a persistent threat to the security of the network environment. Therefore, it is urgent to develop more effective and advanced detection and defense strategies to meet this challenge. Summary of the invention

[0004] In order to solve the above problems, the embodiments of the present invention provide a protection method, device and computing equipment based on the competitive characteristics of mining Trojans. The method can quickly identify mining Trojans and achieve efficient protection, while effectively improving the accuracy and timeliness of malware protection.

[0005] In a first aspect, an embodiment of the present invention provides a protection method based on the competition characteristics of mining trojans, including:

[0006] Analyze the acquired mining Trojan samples to obtain a mining Trojan sample library;

[0007] Running the mining Trojan sample, and determining a target termination instruction included in the mining Trojan sample for terminating other mining Trojan processes;

[0008] Generate a blacklist of suspicious processes based on process information corresponding to the target termination instruction;

[0009] Protection is performed based on the mining Trojan sample library and the suspicious process blacklist.

[0010] In a second aspect, an embodiment of the present invention further provides a protection device based on the competition characteristics of mining trojans, including:

[0011] An analysis module is used to analyze the acquired mining Trojan samples to obtain a mining Trojan sample library;

[0012] A competitive behavior extraction module, used to run the mining Trojan sample, determine the target termination instruction included in the mining Trojan sample for terminating other mining Trojan processes; and generate a suspicious process blacklist based on process information corresponding to the target termination instruction;

[0013] A protection module is used to provide protection based on the mining Trojan sample library and the suspicious process blacklist.

[0014] In a third aspect, an embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements any of the above-mentioned protection methods based on the competitive characteristics of mining Trojans.

[0015] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute any of the above-mentioned protection methods based on the competitive characteristics of mining Trojans.

[0016] In a fifth aspect, an embodiment of the present invention further provides a computer program product, comprising computer instructions, which, when executed by a processor, implement the steps of the method described in any first aspect of this specification.

[0017] The embodiment of the present invention provides a protection method, device and computing equipment based on the competitive characteristics of mining Trojans. The method first analyzes the mining Trojan samples to obtain a mining Trojan sample library including the characteristics of the mining Trojan samples, and then obtains the target termination instruction included in the mining Trojan samples for terminating other mining Trojan processes during operation, and generates a suspicious process blacklist for other mining Trojan processes based on the target termination instruction. In this way, based on the mining Trojan sample library and the suspicious process blacklist, the mining Trojan samples and other mining Trojan processes can be protected without specifically analyzing other mining Trojan processes. Therefore, through a small number of mining Trojan samples, the mining Trojan sample library and / or suspicious process blacklist for almost all current mining Trojans can be obtained, thereby achieving protection against almost all mining Trojans, realizing rapid identification of mining Trojans while performing efficient protection, and further effectively improving the accuracy and timeliness of malware protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flow chart of a protection method based on the competitive characteristics of mining trojans provided by an embodiment of the present invention;

[0020] Figure 2 is a hardware architecture diagram of a computing device provided by an embodiment of the present invention;

[0021] Figure 3 This is a structural diagram of a protection device based on the competitive characteristics of a mining trojan provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0023] In the prior art, when multiple Trojans infect the same computer at the same time, they may compete for system resources, such as CPU time, memory, and disk space. Therefore, in order to avoid conflicts with other Trojans, mining Trojans will try to increase their own priority or permissions at the beginning of their design, or design instructions to terminate other mining processes, so as to compete with other mining Trojan programs and better control the infected computer.

[0024] Based on this, the present invention considers using the termination instructions of other competing Trojans in the existing mining Trojans to implement protection against the mining Trojans, thereby protecting the system from related threats.

[0025] The following is the concept of the present invention: Figure 1 As shown, an embodiment of the present invention provides a protection method based on the competition characteristics of mining Trojans, the method comprising:

[0026] Step 100, analyzing the acquired mining Trojan samples to obtain a mining Trojan sample library;

[0027] Step 102, running the mining Trojan sample, and determining a target termination instruction included in the mining Trojan sample for terminating other mining Trojan processes;

[0028] Step 104, generating a blacklist of suspicious processes based on the process information corresponding to the target termination instruction;

[0029] Step 106: Perform protection based on the mining Trojan sample library and the suspicious process blacklist.

[0030] In the present invention, the mining Trojan sample is first analyzed to obtain a mining Trojan sample library including the characteristics of the mining Trojan sample, and then the target termination instruction for terminating other mining Trojan processes included in the mining Trojan sample is obtained during the running process, and a suspicious process blacklist for other mining Trojan processes is generated based on the target termination instruction. In this way, the mining Trojan sample and other mining Trojan processes can be protected based on the mining Trojan sample library and the suspicious process blacklist, without the need to specifically analyze other mining Trojan processes, so that the mining Trojan sample library and / or suspicious process blacklist for almost all current mining Trojans can be obtained through a small number of mining Trojan samples, thereby achieving protection against almost all mining Trojans, realizing rapid identification of mining Trojans while performing efficient protection, and reducing the consumption of system resources, further effectively improving the accuracy and timeliness of malware protection.

[0031] Described below Figure 1 How the various steps are performed.

[0032] In step 100, the mining Trojan sample is obtained by the following method, including:

[0033] Using at least two capture methods to obtain a first mining Trojan sample;

[0034] Analyze the first mining Trojan sample to obtain Trojan features; the analysis includes static analysis and / or dynamic analysis;

[0035] Write YARA rules based on the Trojan features, and use at least one capture method based on the YARA rules to obtain the second mining Trojan sample;

[0036] A union operation is performed on the first mining Trojan sample and the second mining Trojan sample to obtain a mining Trojan sample.

[0037] Specifically, the capture method includes using an independent honeypot system or threat intelligence platform specifically for capturing mining Trojans.

[0038] For example, when the capture method uses a honeypot system, the honeypot system is deployed on a virtual machine or physical machine to simulate a vulnerable environment to capture the latest mining Trojan samples. The honeypot system should include common operating systems (for example, Windows 10, Ubuntu, and other operating systems) and applications to attract malware; in addition, some common vulnerability ports (such as port 445 (i.e., SMB vulnerability)) should be opened to increase attractiveness. At the same time, the configuration of the honeypot system should be updated regularly to ensure that new mining Trojan variants can be captured; ensure the isolation of the honeypot system from the outside world to prevent the real network from being infected.

[0039] For example, when the capture method uses a threat intelligence platform (such as VirusTotal) to obtain the latest mining Trojan samples, you can subscribe to relevant security notices and research reports to keep abreast of the latest developments of mining Trojans. The threat intelligence platform also provides information such as the hash value and behavioral characteristics of the mining Trojan, which helps to quickly identify and locate samples.

[0040] In the present invention, at least two capture methods are used to obtain the latest mining Trojan samples, which can ensure the diversity and coverage of mining Trojan samples. Then, the first mining Trojan sample obtained by the above capture method is analyzed to obtain Trojan features, and YARA rules are written based on the Trojan features. Then, the above capture method is further captured based on the YARA rules to obtain a second mining Trojan sample. In this way, by performing a union operation on the first mining Trojan sample and the second mining Trojan sample, a more comprehensive mining Trojan sample with a wider coverage is further obtained.

[0041] In the present invention, YARA rules can also be regularly updated with newly acquired mining Trojan samples to adapt to the changes in the characteristics of mining Trojans, increase the capture capability, and improve the accuracy of detecting mining Trojans. The Trojan features obtained by dynamic analysis and static analysis are combined to further improve the YARA rules, ensuring that the YARA rules can effectively identify mining Trojans of different variants and further reduce false positives and false negatives.

[0042] It should be noted that YARA rules are composed of a series of metadata and conditions. The metadata describes the name, string, and variables of the rule, and the conditions describe the pattern to be matched. That is, YARA rules are obtained by combining multiple Trojan features. YARA rules are used to detect the features of mining Trojan samples, and different mining Trojans have different YARA rules.

[0043] With respect to step 100, the acquired mining Trojan samples are analyzed to obtain a mining Trojan sample library, including:

[0044] Perform static and / or dynamic analysis on mining Trojan samples to obtain Trojan features;

[0045] The Trojan features corresponding to the mining Trojan samples are stored to obtain a mining Trojan sample library.

[0046] It should be noted that for the static analysis in step 100, a disassembly tool (such as IDAPro) can be used to analyze the captured mining Trojan sample to identify features in its code, such as strings, API calls, function call sequences, etc. Dynamic analysis refers to running the mining Trojan sample in a controlled environment (such as VMware), monitoring its behavior and recording its runtime features.

[0047] In the present invention, a mining Trojan sample library is used to protect mining Trojan samples. By storing as many Trojan features of mining Trojan samples as possible in the mining Trojan sample library, effective detection and identification of mining Trojan samples can be achieved.

[0048] With respect to step 102, the mining Trojan sample is run to determine the target termination instruction included in the mining Trojan sample for terminating other mining Trojan processes, including:

[0049] Run the mining Trojan sample to obtain the running characteristics;

[0050] Determine the termination instruction according to the process termination flag included in the source code data of the mining trojan sample;

[0051] The termination instructions are screened based on the running characteristics to determine the target termination instructions for terminating other mining trojan processes.

[0052] It should be noted that the other mining Trojans described in this application are all mining Trojans that compete with the current mining Trojan sample, that is, when multiple Trojans infect computers and other devices at the same time, they compete with the current mining Trojan sample for resources and conflict with it.

[0053] In the present invention, a mining Trojan sample is run in a controlled security environment, its behavior is monitored and its operating characteristics are recorded, and it is debugged step by step during operation. The termination instruction is determined by the end process flag, and the operating characteristics are determined by observing how it terminates other processes. The termination instruction is further screened according to the operating characteristics to obtain the target termination instruction for terminating other mining Trojan processes.

[0054] In a preferred embodiment, the termination instructions are screened based on the running characteristics to determine the target termination instructions for terminating other mining trojan processes, including:

[0055] Obtaining the process information and system call information including the running characteristics;

[0056] Determine a first termination instruction corresponding to the security software process according to the process information and the system call information;

[0057] The first termination instruction is eliminated from the termination instructions to obtain the target termination instruction.

[0058] In the present invention, by analyzing the process information and system call information, the first termination instruction corresponding to the security software process can be determined, wherein the security software process refers to the process of common office software or the related process of conventional software such as browsers, thereby eliminating the termination instructions corresponding to these security software processes and obtaining the target termination instruction for terminating other mining Trojan processes.

[0059] With respect to step 104, based on the process information corresponding to the target termination instruction, a suspicious process blacklist is generated, including:

[0060] Obtaining process information when executing the target termination instruction; wherein the process information includes the process name and process ID;

[0061] The process name and process ID are stored in a suspicious process blacklist.

[0062] In the present invention, since the target termination instruction of the mining Trojan sample corresponds to other mining Trojan processes, by storing the process names and process IDs included in the termination instruction one by one, the process names and process IDs involved in the operation of other mining Trojan samples can be obtained, and then based on these process names, process IDs and other information, detection of other mining Trojan samples can be achieved.

[0063] In step 106, protection is performed based on the mining trojan sample library and the suspicious process blacklist, including:

[0064] Obtain the running program of the device to be detected and the process information corresponding to the running program;

[0065] Analyze the running program to obtain sample characteristics;

[0066] Compare the sample features with the features in the mining Trojan sample library. If the sample features exist in the mining Trojan sample library, isolate or terminate the running program corresponding to the sample features.

[0067] The process information is compared with the suspicious process blacklist. If the process information exists in the suspicious process blacklist, the process corresponding to the process information is isolated or terminated.

[0068] In the present invention, since the mining Trojan sample library stores the Trojan features of the mining Trojan samples, and the suspicious process blacklist stores the process information of other mining Trojans, both can accurately detect the corresponding mining Trojans. Therefore, by analyzing the current running program, if its sample features exist in the mining Trojan sample library, it is judged that the running program is threatening and needs to be isolated or terminated in time; similarly, if the process information corresponding to the current running program exists in the suspicious process blacklist, it is judged that the running program is threatening and needs to be isolated or terminated in time. In this way, the threatening processes or running programs are terminated or isolated by the above method to achieve protection.

[0069] In a preferred embodiment, after step 106, the method further includes:

[0070] Regularly obtain current mining Trojan samples and update the mining Trojan sample library and suspicious process blacklist by analyzing the current mining Trojan samples;

[0071] Regularly verify the updated mining Trojan sample library and suspicious process blacklist through preset attack scenarios to obtain verification results;

[0072] Based on the verification results, the updated mining Trojan sample library and suspicious process blacklist are further optimized.

[0073] In the present invention, the latest mining Trojan samples are obtained regularly, and the mining Trojan sample library and the suspicious process blacklist are updated regularly to ensure that the protection system can identify the latest threats. Different attack scenarios are simulated regularly in virtual machines and sandbox environments to test and verify the protection system, and the protection mechanism is optimized according to the test results (i.e., the mining Trojan sample library and the suspicious process blacklist are updated again) to ensure the accuracy and stability of the system.

[0074] In the present invention, only by analyzing a mining Trojan sample, the Trojan feature information for the mining Trojan sample and the process information of other competing mining Trojans included in the mining Trojan sample can be obtained. Based on the Trojan feature information and process information, the mining Trojan sample and its competing mining Trojans can be detected and identified. In this way, by analyzing several mining Trojan samples, the Trojan feature information and / or process information that basically covers all existing mining Trojans can be obtained, so there is no need to analyze all mining Trojans one by one. It is only necessary to focus on analyzing several mining Trojan samples to achieve comprehensive detection, thereby improving detection efficiency and detection accuracy.

[0075] Specifically, the present invention will be further described below by taking the Hezb mining Trojan as an example, but the protection scope of the present invention is not limited to this embodiment.

[0076] Using honeypot systems and threat intelligence platforms such as VirusTotal, we obtain the latest Hezb mining Trojan samples, obtain Trojan features through static and dynamic analysis, and write YARA rules for identifying Hezb mining Trojan features based on the Trojan features. Then, we obtain the latest Hezb mining Trojan samples again based on the YARA rules, remove the repeatedly captured Hezb mining Trojan samples, store the Trojan features of the remaining latest Hezb mining Trojan samples, and obtain a mining Trojan sample library for Hezb mining Trojans. Then, we extract the instructions for terminating the processes of other competing mining Trojans (including Kinsing mining Trojans, Outlaw mining Trojans, etc.) from the latest Hezb mining Trojan samples. By analyzing these termination instructions, we can determine the specific operations and target process information they perform, extract the process names and related information of other mining Trojans, and generate a blacklist of suspicious processes. Finally, based on the mining Trojan sample library and the suspicious process blacklist, we can protect against Hezb mining Trojans, Kinsing mining Trojans, Outlaw mining Trojans, etc. At the same time, we can also obtain new Hezb mining Trojan samples through the honeypot system and threat intelligence platform, so as to regularly update the mining Trojan sample library and the suspicious process blacklist.

[0077] like Figure 2 , Figure 3 As shown, the embodiment of the present invention provides a protection device based on the competitive characteristics of mining trojans. The device embodiment can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, Figure 2 As shown in FIG. 1 , a hardware architecture diagram of a computing device where a protection device based on the competition characteristics of mining trojans provided by an embodiment of the present invention is located is shown in FIG. Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown in the figure, the computing device in which the device is located in the embodiment may also generally include other hardware, such as a forwarding chip responsible for processing messages, etc. Taking software implementation as an example, Figure 3 As shown, as a device in a logical sense, the CPU of the computing device in which it is located reads the corresponding computer program in the non-volatile memory into the memory and runs it. This embodiment provides a protection device based on the competitive characteristics of mining trojans, including:

[0078] The analysis module 300 is used to analyze the acquired mining Trojan samples to obtain a mining Trojan sample library;

[0079] The competition behavior extraction module 302 is used to run the mining Trojan sample, determine the target termination instruction included in the mining Trojan sample for terminating other mining Trojan processes; and generate a suspicious process blacklist based on the process information corresponding to the target termination instruction;

[0080] The protection module 304 is used to provide protection based on the mining Trojan sample library and the suspicious process blacklist.

[0081] In some specific implementations, the analysis module 300 may be used to execute the above step 100 , the competition behavior extraction module 302 may be used to execute the above steps 102 and 104 , and the protection module 304 may be used to execute the above step 106 .

[0082] In some specific implementations, the device further includes an acquisition module, which is used to perform the following operations:

[0083] Using at least two capture methods to obtain a first mining Trojan sample;

[0084] Analyze the first mining Trojan sample to obtain Trojan features; the analysis includes static analysis and / or dynamic analysis;

[0085] Write YARA rules based on the Trojan features, and use the capture method according to the YARA rules to obtain the second mining Trojan sample;

[0086] A union operation is performed on the first mining Trojan sample and the second mining Trojan sample to obtain a mining Trojan sample.

[0087] In some specific implementations, the analysis module 300 is further configured to perform the following operations:

[0088] Perform static and / or dynamic analysis on mining Trojan samples to obtain Trojan features;

[0089] The Trojan features corresponding to the mining Trojan samples are stored to obtain a mining Trojan sample library.

[0090] In some specific implementations, the competitive behavior extraction module 302 is further configured to perform the following operations:

[0091] Run the mining Trojan sample to obtain the running characteristics;

[0092] Determine the termination instruction according to the process termination flag included in the source code data of the mining trojan sample;

[0093] Obtaining the process information and system call information including the running characteristics;

[0094] Determine a first termination instruction corresponding to the security software process according to the process information and the system call information;

[0095] Eliminate the first termination instruction from the termination instructions to obtain the target termination instruction;

[0096] Obtaining process information when executing the target termination instruction; wherein the process information includes the process name and process ID;

[0097] The process name and process ID are stored in a suspicious process blacklist.

[0098] In some specific implementations, the protection module 304 is further configured to perform the following operations:

[0099] Obtain the running program of the device to be detected and the process information corresponding to the running program;

[0100] Analyze the running program to obtain sample characteristics;

[0101] Compare the sample features with the features in the mining Trojan sample library. If the sample features exist in the mining Trojan sample library, isolate or terminate the running program corresponding to the sample features.

[0102] The process information is compared with the suspicious process blacklist. If the process information exists in the suspicious process blacklist, the process corresponding to the process information is isolated or terminated.

[0103] In some specific implementations, the device further includes an update module, which is used to perform the following operations:

[0104] Regularly obtain current mining Trojan samples and update the mining Trojan sample library and suspicious process blacklist by analyzing the current mining Trojan samples;

[0105] Regularly verify the updated mining Trojan sample library and suspicious process blacklist through preset attack scenarios to obtain verification results;

[0106] Based on the verification results, the updated mining Trojan sample library and suspicious process blacklist are further optimized.

[0107] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on a protective device based on the competitive characteristics of mining trojans. In other embodiments of the present invention, a protective device based on the competitive characteristics of mining trojans may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0108] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For the specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0109] An embodiment of the present invention further provides a computing device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a protection method based on the competitive characteristics of a mining Trojan in any embodiment of the present invention is implemented.

[0110] An embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes a protection method based on the competitive characteristics of a mining Trojan in any embodiment of the present invention.

[0111] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes a protection method based on the competitive characteristics of a mining Trojan as described in any of the above embodiments.

[0112] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.

[0113] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0114] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer via a communication network.

[0115] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0116] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0117] Each embodiment of the present invention has at least the following beneficial effects:

[0118] 1. In one embodiment of the present invention, the solution captures the latest mining Trojan samples through the honeypot system, and combined with the information of the threat intelligence platform, it can timely obtain and analyze the latest mining Trojan sample variants. Through the comprehensive application of static analysis, dynamic analysis and YARA rules, it can efficiently detect and identify various variant mining Trojans, effectively improving the accuracy and timeliness of malware protection.

[0119] 2. In one embodiment of the present invention, the solution is applicable to various operating systems and application environments, and has wide applicability and versatility. Whether it is Windows, Linux or other mainstream operating systems, the method can adapt to different environmental requirements through customized configuration and dynamic updates to ensure its protection effect in various scenarios. At the same time, YARA rules and protection strategies can also be flexibly adjusted to deal with different types of mining Trojan threats.

[0120] 3. In one embodiment of the present invention, the solution achieves real-time monitoring and blocking of malicious processes by accurately extracting target process information from the termination instructions of mining trojans and writing efficient protection rules. During the operation of the protection system, lightweight process monitoring and YARA rule matching technology are used to greatly reduce the occupation of system resources, ensuring that the protection system has minimal impact on normal business operations while providing efficient security protection.

[0121] 4. In one embodiment of the present invention, the latest mining Trojan samples captured are updated regularly to quickly update the mining Trojan sample library and the suspicious process blacklist. This dynamic update mechanism enables the system to maintain a rapid response capability to new mining Trojan threats, ensuring the long-term effectiveness and foresight of the protection system.

[0122] 5. In one embodiment of the present invention, the competitive characteristics between mining Trojans are utilized to protect other mining Trojans by analyzing and reversely utilizing their termination behaviors. This innovative mechanism greatly improves the intelligence and automation level of the protection system, which not only reduces the dependence on manual intervention, but also reduces the consumption of system resources and improves the overall protection efficiency.

[0123] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0124] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above method embodiments can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk, etc., various media that can store program codes.

[0125] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A protection method based on the competitive characteristics of mining Trojans, characterized in that: include: Analyze the acquired mining Trojan samples to obtain a mining Trojan sample library; Running the mining Trojan sample, and determining a target termination instruction included in the mining Trojan sample for terminating other mining Trojan processes; Generate a blacklist of suspicious processes based on process information corresponding to the target termination instruction; Protecting according to the mining Trojan sample library and the suspicious process blacklist; The mining Trojan samples are obtained by the following methods, including: Using at least two capture methods to obtain a first mining Trojan sample; Analyze the first mining Trojan sample to obtain Trojan features; the analysis includes static analysis and / or dynamic analysis; Writing a YARA rule based on the Trojan feature, and using at least one of the capture methods to obtain a second mining Trojan sample according to the YARA rule; Performing a union operation on the first mining Trojan sample and the second mining Trojan sample to obtain the mining Trojan sample; The step of running the mining Trojan sample and determining a target termination instruction included in the mining Trojan sample and used to terminate other mining Trojan processes includes: Run the mining Trojan sample to obtain the running characteristics; Determining a termination instruction according to an end process flag included in the source code data of the mining Trojan sample; The termination instruction is screened based on the running characteristics to determine a target termination instruction for terminating other mining Trojan processes.

2. The method according to claim 1, characterized in that The obtained mining Trojan samples are analyzed to obtain a mining Trojan sample library, including: Performing static analysis and / or dynamic analysis on the mining Trojan sample to obtain Trojan features; The Trojan features corresponding to the mining Trojan samples are stored to obtain the mining Trojan sample library.

3. The method according to claim 1, characterized in that The step of screening the termination instruction based on the running characteristics to determine a target termination instruction for terminating other mining Trojan processes includes: Acquire process information and system call information included in the operation characteristics; Determining a first termination instruction corresponding to the security software process according to the process information and the system call information; The first termination instruction is removed from the termination instructions to obtain the target termination instruction.

4. The method according to any one of claims 1 to 3, characterized in that: The generating a suspicious process blacklist based on the process information corresponding to the target termination instruction includes: Acquire process information when executing the target termination instruction; wherein the process information includes a process name and a process ID; The process name and the process ID are stored correspondingly in the suspicious process blacklist.

5. The method according to any one of claims 1 to 3, characterized in that: The protection according to the mining Trojan sample library and the suspicious process blacklist includes: Obtain the running program of the device to be detected and the process information corresponding to the running program; Analyzing the running program to obtain sample characteristics; Comparing the sample features with the features in the mining Trojan sample library, and if the sample features exist in the mining Trojan sample library, isolating or terminating the running program corresponding to the sample features; The process information is compared with the suspicious process blacklist, and if the process information exists in the suspicious process blacklist, the process corresponding to the process information is isolated or terminated.

6. A protection device based on the competitive characteristics of mining trojans, characterized in that: include: An analysis module is used to analyze the acquired mining Trojan samples to obtain a mining Trojan sample library; A competitive behavior extraction module, used to run the mining Trojan sample, determine the target termination instruction included in the mining Trojan sample for terminating other mining Trojan processes; and generate a suspicious process blacklist based on process information corresponding to the target termination instruction; A protection module, used for providing protection according to the mining Trojan sample library and the suspicious process blacklist; Get the module to perform the following operations: Using at least two capture methods to obtain a first mining Trojan sample; Analyze the first mining Trojan sample to obtain Trojan features; the analysis includes static analysis and / or dynamic analysis; Write YARA rules based on the Trojan features, and use the capture method according to the YARA rules to obtain the second mining Trojan sample; Performing a union operation on the first mining Trojan sample and the second mining Trojan sample to obtain a mining Trojan sample; The competitive behavior extraction module is also used to perform the following operations: Run the mining Trojan sample to obtain the running characteristics; Determining a termination instruction according to an end process flag included in the source code data of the mining Trojan sample; The termination instruction is screened based on the running characteristics to determine a target termination instruction for terminating other mining Trojan processes.

7. A computing device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 5.

9. A computer program product, characterized in that The method comprises computer instructions, which, when executed by a processor, implement the steps of the method according to any one of claims 1 to 5.

Images