Method, device, electronic device and readable medium for determining fileless attack scenario graph

Abstract

The embodiments of the present disclosure disclose a method, device, electronic device and readable medium for determining a fileless attack scenario graph. A specific implementation of the method includes: detecting the command line information corresponding to the system process to obtain a command line information detection result, wherein the command line information detection result includes: a normal result of the command line information detection and an abnormal result of the command line information detection; generating a feature vector set corresponding to the command line information based on the command line information; updating the label value of the annotated path node set based on the abnormal command line information after alarm processing to obtain an updated path node set; generating a path node credibility score set based on the updated path node set; and determining the path node corresponding scenario graph based on the path node credibility score set. This implementation improves the security of the system, improves the responsiveness of the system, and shortens the cycle of determining the fileless attack scenario graph.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to a method, device, electronic device, and readable medium for determining a fileless attack scenario graph. Background Art

[0002] With the rapid development of the Internet, network attack methods are becoming increasingly complex and diverse. A new type of network attack method (for example, fileless attack) uses legitimate software or system tools to perform attack behaviors during the attack process, avoiding leaving file traces of attack behaviors on the disk. By analyzing and scoring various command line information corresponding to system processes through path node graphs, the security of the system can be improved, the system's responsiveness can be improved, and the cycle of determining fileless attack scenario graphs can be shortened. In addition, credibility scoring of updated path node sets can also improve system security. Fileless attack scenario graph determination is a technology for determining path node graphs. At present, the method commonly used to determine fileless attack scenario graphs is to read the malware and perform causal analysis between nodes to determine the scenario graph corresponding to the path node.

[0003] However, when the above method is adopted, the following technical problems often occur:

[0004] First, command line detection may fail to effectively identify the corresponding behavior of the command line, resulting in lower system security. When abnormal command line information is detected, the system cannot respond promptly, resulting in lower system responsiveness and a longer period of time to determine the fileless attack scenario graph.

[0005] Second, since the security status of the system process cannot be confirmed after reading the malware, a large error occurs in determining the scene graph corresponding to the path node, resulting in lower system security.

[0006] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the Invention

[0007] The content of this disclosure is used to briefly introduce concepts that will be described in detail in the detailed description section below. The content of this disclosure is not intended to identify key features or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0008] Some embodiments of the present disclosure provide a method, apparatus, electronic device, and readable medium for determining a fileless attack scenario graph to solve one or more of the technical problems mentioned in the above background technology section.

[0009] In a first aspect, some embodiments of the present disclosure provide a method for determining a fileless attack scenario graph, the method comprising: detecting command line information corresponding to a system process to obtain a command line information detection result, wherein the command line information detection result comprises: a normal command line information detection result and an abnormal command line information detection result; generating a feature vector set corresponding to the command line information based on the command line information; in response to determining that the command line information detection result represents a normal command line information detection result, optimizing a pre-trained initial command line information detection model based on the command line information to obtain a command line information detection model, wherein the command line information detection model is a model for detecting abnormal command line information; and optimizing the feature vector set corresponding to the command line information. Input the command line information into the above-mentioned command line information detection model to obtain abnormal command line information, and perform alarm processing on the above-mentioned abnormal command line information; perform initial label value annotation on each path node in the path node graph corresponding to the above-mentioned system process to obtain a labeled path node set, wherein the above-mentioned labeled path node set includes: path nodes labeled with initial environment abnormality label values, path nodes labeled with initial process credibility label values, and path nodes labeled with initial integrity label values; according to the abnormal command line information after alarm processing, update the label values ​​of the above-mentioned labeled path node set to obtain an updated path node set; according to the above-mentioned updated path node set, generate a path node credibility score set; according to the above-mentioned path node credibility score set, determine the scene graph corresponding to the path node.

[0010] In a second aspect, some embodiments of the present disclosure provide a device for determining a fileless attack scenario graph, the device comprising: a detection unit, configured to detect command line information corresponding to a system process, and obtain a command line information detection result, wherein the command line information detection result comprises: a normal command line information detection result and an abnormal command line information detection result; a first generation unit, configured to generate a feature vector set corresponding to the command line information according to the command line information; an optimization unit, configured to optimize a pre-trained initial command line information detection model according to the command line information in response to determining that the command line information detection result represents a normal command line information detection result, and obtain a command line information detection model, wherein the command line information detection model is a model for detecting abnormal command line information; an input unit, configured to input the feature vector set corresponding to the command line information; Input into the above-mentioned command line information detection model to obtain abnormal command line information, and perform alarm processing on the above-mentioned abnormal command line information; the labeling unit is configured to perform initial label value labeling on each path node in the path node graph corresponding to the above-mentioned system process to obtain a labeled path node set, wherein the above-mentioned labeled path node set includes: path nodes labeled with initial environment abnormality label values, path nodes labeled with initial process credibility label values, and path nodes labeled with initial integrity label values; the updating unit is configured to update the label values ​​of the above-mentioned labeled path node set according to the abnormal command line information after alarm processing to obtain an updated path node set; the second generating unit is configured to generate a path node credibility score set according to the above-mentioned updated path node set; the determining unit is configured to determine the scene graph corresponding to the path node according to the above-mentioned path node credibility score set.

[0011] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0012] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation of the first aspect is implemented.

[0013] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the fileless attack scenario graph determination method of some embodiments of the present disclosure, the system security is improved, the system responsiveness is improved, and the cycle of determining the fileless attack scenario graph is shortened. Specifically, the reasons for the low security of the system, the low responsiveness of the system, and the long cycle of determining the fileless attack scenario graph are: when the command line is detected, the behavior corresponding to the command line may not be effectively identified, resulting in low system security. When the command line information is detected to be abnormal, it is impossible to respond in time, resulting in low system responsiveness and a long cycle of determining the fileless attack scenario graph. Based on this, the fileless attack scenario graph determination method of some embodiments of the present disclosure first detects the command line information corresponding to the system process to obtain the command line information detection result, wherein the command line information detection result includes: a normal command line information detection result and an abnormal command line information detection result. In this way, it is possible to effectively identify whether the behavior corresponding to the command line is normal. Then, based on the above command line information, a feature vector set corresponding to the command line information is generated. This facilitates subsequent processing. Next, in response to determining that the command line information detection result represents a normal command line information detection result, a pre-trained initial command line information detection model is optimized based on the command line information to obtain a command line information detection model. The command line information detection model is a model for detecting abnormal command line information. This improves the accuracy of identifying command line information. Next, the feature vector set corresponding to the command line information is input into the command line information detection model to obtain abnormal command line information, and an alert is performed on the abnormal command line information. This improves the system's responsiveness and shortens the cycle time for determining the fileless attack scenario graph. Then, each path node in the path node graph corresponding to the system process is annotated with initial label values ​​to obtain an annotated path node set. The annotated path node set includes path nodes annotated with initial environment anomaly label values, path nodes annotated with initial process credibility label values, and path nodes annotated with initial integrity label values. This facilitates evaluating the credibility of path nodes. Subsequently, the label values ​​of the annotated path node set are updated based on the abnormal command line information after the alert processing, resulting in an updated path node set that increases the credibility of the path nodes. Then, based on the updated set of path nodes, a set of path node credibility scores is generated. This facilitates the generation of a scenario graph corresponding to each path node. Finally, based on the set of path node credibility scores, the scenario graph corresponding to each path node is determined. This improves system security and responsiveness, and shortens the cycle time for determining the fileless attack scenario graph. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] The above and other features, advantages, and aspects of the various embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0015] Figure 1 is a flow chart of some embodiments of a method for determining a fileless attack scenario graph according to the present disclosure;

[0016] Figure 2 is a schematic structural diagram of some embodiments of a device for determining a fileless attack scenario graph according to the present disclosure;

[0017] Figure 3 It is a structural diagram of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0018] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are for illustrative purposes only and are not intended to limit the scope of protection of the present disclosure.

[0019] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other.

[0020] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0021] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, they should be understood as "one or more".

[0022] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0023] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0024] Figure 1This is a process 100 of some embodiments of the method for determining a fileless attack scenario graph of the present disclosure. The method for determining a fileless attack scenario graph includes the following steps:

[0025] Step 101: Detect command line information corresponding to the system process to obtain a command line information detection result.

[0026] In some embodiments, the execution entity (for example, a computing device) of the fileless attack scenario graph determination method can detect the command line information corresponding to the system process to obtain the command line information detection result, wherein the above-mentioned command line information detection result includes: normal command line information detection result and abnormal command line information detection result.

[0027] Here, the system process may refer to a process executed by the security system. Here, the command line information detection result includes: a normal command line information detection result and an abnormal command line information detection result.

[0028] As an example, the execution entity may first determine a detection rule for command line information. The detection rule may be a rule for detecting command line information, such as "PowerShell executes a ps1 script with the command line: powershell-ExecutionPolicy Bypass-File sample.ps1." The execution entity then detects the command line information corresponding to the system process according to the detection rule to obtain a command line information detection result, which includes a normal command line information detection result and an abnormal command line information detection result.

[0029] It should be noted that the computing device described above can be either hardware or software. When the computing device is hardware, it can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or as a single server or a single terminal device. For example, the computing device can be the target terminal described above. When the computing device is embodied as software, it can be installed in the hardware devices listed above. It can be implemented as multiple software or software modules, for example, to provide distributed services, or as a single software or software module. No specific limitations are given here.

[0030] Step 102: Generate a feature vector set corresponding to the command line information based on the command line information.

[0031] In some embodiments, the execution entity may generate a feature vector set corresponding to the command line information based on the command line information.

[0032] As an example, the execution entity may extract command line type information features and execution frequency features from the command line information to obtain a command line type information feature set. The command line type information feature set includes, but is not limited to, at least one of the following: command line type information features and execution frequency features. Feature conversion is then performed on the command line type information feature set to obtain a feature vector set. Finally, the feature vector set is normalized to obtain a feature vector set corresponding to the command line information.

[0033] Optionally, the execution entity may generate a feature vector set corresponding to the command line information according to the command line information through the following steps:

[0034] The first step is to input the above command line information into the word embedding model to obtain the word vector set corresponding to the command line information.

[0035] Here, the above-mentioned word embedding model may refer to a model that takes the above-mentioned command line information as input and outputs the word vector set corresponding to the above-mentioned command line information. The above-mentioned word embedding model is a model for generating word vectors. The above-mentioned word embedding model may refer to a Word2Vec model. Among them, the Word2Vec model is used to vectorize the features in the command line information. Here, the command line information corresponding word vector in the above-mentioned command line information corresponding word vector set may refer to the feature information in the above-mentioned command line information.

[0036] The second step is to create feature vectors for the word vector set corresponding to the above command line information to obtain a feature vector set corresponding to the command line information.

[0037] Optionally, the execution entity may create feature vectors for the word vector set corresponding to the command line information through the following steps to obtain a feature vector set corresponding to the command line information:

[0038] In the first step, average pooling is performed on the word vector set corresponding to the above command line information to obtain the word vector set corresponding to the command line information after average pooling.

[0039] Here, the above average pooling process can refer to The above Z may refer to the word vector set corresponding to the command line information after average pooling. The above L may refer to the number of word vectors corresponding to the command line information. The above v i It may refer to the i-th command line information corresponding word vector in the above command line information corresponding word vector set.

[0040] In the second step, the maximum pooling process is performed on the word vector set corresponding to the command line information after the above pooling process to obtain the word vector set corresponding to the command line information after the maximum pooling process.

[0041] Here, the maximum pooling process may refer to Z1=Max-pooling(v1, v2, ...vl). The above vl may refer to the lth pooled command line information corresponding word vector in the above pooled command line information corresponding word vector set. l may include {1, 2, 3, ...}. The above Z1 may refer to the command line information corresponding word vector set after the maximum pooling process.

[0042] As an example, the execution entity may divide the word vector set corresponding to the command line information after pooling into regions to obtain word vector sets corresponding to each region. Then, the maximum value within a preset first threshold range is selected for each region corresponding to the word vector set to obtain a maximum word vector set, which serves as the word vector set corresponding to the command line information after maximum pooling. The preset first threshold range may refer to a pre-set maximum range. No limitation is imposed on this.

[0043] In the third step, minimum pooling is performed on the word vector set corresponding to the command line information after the maximum pooling processing to obtain the word vector set corresponding to the command line information after the minimum pooling processing.

[0044] Here, the above-mentioned minimum pooling process may refer to Z2=Min-pooling(v1,v2,...,vl). The above-mentioned vl may refer to the lth word vector corresponding to the command line information after maximum pooling in the set of word vectors corresponding to the command line information after maximum pooling. l may include {1, 2, 3,...}. The above-mentioned Z2 may refer to the set of word vectors corresponding to the command line information after minimum pooling.

[0045] As an example, the execution entity may divide the word vector set corresponding to the command line information after the maximum pooling process into regions to obtain the maximum word vector set corresponding to each region. Then, the minimum value within the preset second threshold range is selected for each region corresponding to the maximum word vector set to obtain the minimum word vector set as the word vector set corresponding to the command line information after the minimum pooling process. The preset second threshold range may refer to a pre-set minimum range. No limitation is imposed on this.

[0046] The fourth step is to set the number of word vectors for the word vector set corresponding to the command line information after the minimum pooling processing to obtain the word vector set corresponding to the command line information after the setting.

[0047] Here, the number of word vectors mentioned above may refer to 10.

[0048] The fifth step is to add the preset command line information to the word vector set corresponding to the command line information after the above setting, and obtain the word vector set corresponding to the added command line information.

[0049] Here, the preset command line information may refer to pre-set command line information. For example, the preset command line information may refer to "notepad.exe / rfile.txt, cmd.exe / copy file.txt" information.

[0050] The sixth step is to classify the word vector set corresponding to the command line information after the addition to obtain the word vector type set corresponding to the command line information.

[0051] As an example, the execution entity may classify the word vector set corresponding to the added command line information as file operations to obtain a word vector set corresponding to file operations. Then, the word vector set corresponding to the added command line information may be classified as network operations to obtain a word vector set corresponding to the network operation classification. Finally, the word vector set corresponding to file operations and the word vector set corresponding to the network operation classification are determined as the word vector type set corresponding to the command line information.

[0052] Step 7: Determine the feature vector set corresponding to the command line information based on the word vector type set corresponding to the command line information.

[0053] As an example, the execution subject can extract the type feature information of each command line information corresponding word vector type in the command line information corresponding word vector type set to obtain a type feature information set. Finally, the feature vector is constructed for the type feature information set to obtain a feature vector set corresponding to the command line information. For example, the type feature information set includes: file operation type information and network operation type information. The feature vector set corresponding to the command line information includes: command line 1 (file operation): [0.5, 1.2, 5, 1, 3], command line 2 (network operation): [0.6, 2, 0, 2].

[0054] Step 103 : In response to determining that the command line information detection result represents a normal command line information detection result, a pre-trained initial command line information detection model is optimized according to the command line information to obtain a command line information detection model.

[0055] In some embodiments, the execution entity may, in response to determining that the command line information detection result represents a normal command line information detection result, optimize a pre-trained initial command line information detection model based on the command line information to obtain a command line information detection model, wherein the command line information detection model is a model for detecting abnormal command line information.

[0056] Here, the initial command line information detection model may refer to a model used to detect command line information.

[0057] As an example, the execution entity may add the command line information to a pre-trained initial command line information detection model to obtain a command line information detection model.

[0058] Optionally, the initial command line information detection model is trained through the following steps:

[0059] The first step is to obtain a sample set of command line information.

[0060] The second step is to select a command line information sample from the above command line information sample set.

[0061] Here, selecting a command line information sample from the command line information sample set refers to randomly selecting a command line information sample.

[0062] The third step is to input the above command line information samples into the initial convolutional neural network model to obtain command line information test data.

[0063] Here, the initial convolutional neural network model may be a convolutional neural network model that has not been trained.

[0064] The fourth step is to determine the data difference value between the command line information test data and the command line information sample label included in the command line information sample based on a preset command line information loss function.

[0065] Here, the command line information loss function may include but is not limited to: mean square error loss function (MSE), cross entropy loss function (CrossEntropy), etc.

[0066] In the fifth step, in response to the data difference value being greater than or equal to a preset data threshold, the network parameters of the initial command line information detection model are adjusted.

[0067] There are no restrictions on the setting of the preset data threshold. For example, the difference between the data difference value and the preset data threshold can be calculated to obtain the loss difference. Based on this, the data difference value is propagated from the last layer of the model forward using methods such as backpropagation and stochastic gradient descent to adjust the parameters of each layer. Of course, if necessary, the network freezing (dropout) method can also be used to keep the network parameters of some layers unchanged and not adjust them. There are no restrictions on this.

[0068] In the sixth step, in response to the data difference value being less than the preset data threshold, the initial convolutional neural network model is determined as the initial command line information detection model.

[0069] Here, there is no restriction on the setting of the preset data threshold.

[0070] Step 104 : Input the feature vector set corresponding to the command line information into the command line information detection model to obtain abnormal command line information, and perform alarm processing on the abnormal command line information.

[0071] In some embodiments, the execution entity may input the feature vector set corresponding to the command line information into the command line information detection model to obtain abnormal command line information, and perform alarm processing on the abnormal command line information.

[0072] Here, the abnormal command line information may refer to abnormal command line information.

[0073] Step 105 : annotate each path node in the path node graph corresponding to the system process with an initial label value to obtain a labeled path node set.

[0074] In some embodiments, the above-mentioned execution entity can perform initial label value annotation on each path node in the path node graph corresponding to the above-mentioned system process to obtain a set of annotated path nodes, wherein the above-mentioned annotated path node set includes: path nodes annotated with initial environmental anomaly label values, path nodes annotated with initial process credibility label values, and path nodes annotated with initial integrity label values.

[0075] Here, the aforementioned path node after the initial environment anomaly label value is annotated may refer to a path node after the environment anomaly label value is annotated as "0." The aforementioned path node after the initial process credibility label value is annotated may refer to a path node after the process credibility label value is annotated as "0." The aforementioned path node after the initial integrity label value is annotated may refer to a path node after the integrity label value is annotated as "1."

[0076] As an example, the execution entity may extract key information from each path node in the path node graph corresponding to the system process to obtain a path node key information set, and then label the path node key information set to obtain a labeled path node set.

[0077] Optionally, after the above “step 105”, the above method further includes:

[0078] In the first step, the integrity label value corresponding to at least one of the labeled path nodes with an initial integrity label value in the labeled path node set is numerically increased to obtain an increased integrity label value set.

[0079] As an example, the execution entity may add one to the integrity label value corresponding to at least one initial integrity label value labeled path node in the labeled path node set to obtain a added integrity label value set.

[0080] In the second step, based on the added integrity label value set, label decay is performed on the system process for multiple preset periods to obtain a decayed label value set.

[0081] Here, the preset period may refer to a pre-set period. For example, the preset period may refer to the period between the integrity tag value and its incremented value.

[0082] Optionally, the execution entity may perform label decay for the system process for multiple preset periods based on the added integrity label value set to obtain a decayed label value set by performing the following steps:

[0083] Sub-step 1: multiply each added integrity label value in the added integrity label value set by a preset attenuation factor to generate a processed label value, thereby obtaining a processed label value set.

[0084] Here, the preset attenuation factor may represent the influence of the predetermined integrity tag value after the increase in the attenuation process. The value range of the preset attenuation factor is (0, 1).

[0085] As an example, the execution subject can be Each added integrity label value in the added integrity label value set is multiplied by a preset attenuation factor to generate a processed label value, thereby obtaining a processed label value set. The above V. may refer to the processed label value set. The above vi may refer to the added integrity label value set, and the above i may refer to {1, 2, 3...}. The maximum value of the above i is equal to the number of added integrity label values ​​in the added integrity label value set. The d in can refer to the attenuation factor. The n in may refer to n preset cycles. The b in the string can be a numeric identifier.

[0086] Sub-step 2: generating an attenuated label value set according to the preset static value, the preset attenuation factor and the processed label value set.

[0087] As an example, the execution subject can be According to the preset static value, the preset attenuation factor and the processed label value set, the attenuated label value set is generated. n It can refer to the set of attenuated label values. n The n in may refer to n preset cycles. The above v0 may refer to the integrity tag value after the addition. The d in can refer to the attenuation factor. The n in may refer to n preset cycles. The b in can be a numerical identifier. qb It can refer to a static value, and the above qb can refer to an identifier of the static value.

[0088] In the third step, based on the abnormal command line information after the alarm processing, each labeled path node corresponding to the above-mentioned attenuated label value set is determined as the updated path node set.

[0089] As an example, the execution entity may bind the abnormal command line information after alarm processing to each annotated path node corresponding to the attenuated label value set to obtain a bound path node set as the updated path node set.

[0090] Step 106 : updating the label value of the annotated path node set according to the abnormal command line information after the alarm is processed, to obtain an updated path node set.

[0091] In some embodiments, the execution entity may update the label value of the annotated path node set according to the abnormal command line information after the alarm is processed to obtain an updated path node set.

[0092] Here, the updated path node set may refer to the updated path node set after the label value is updated. For example, the updated path node set may include the annotated path node whose environmental anomaly label value is marked as "1." The initial process credibility label value annotated path node may refer to the annotated path node whose process credibility label value is marked as "1." The initial integrity label value annotated path node may refer to the annotated path node whose integrity label value is marked as "1."

[0093] As an example, the execution entity may analyze the abnormal command line information after the alarm processing to obtain analyzed command line information. Then, the execution entity may read the integrity label value of the analyzed command line information and modify the integrity label value to obtain a modified integrity label value. Finally, the modified integrity label value is added to the annotated path node set to obtain an added path node set, which serves as the updated path node set.

[0094] Step 107: Generate a path node credibility score set based on the updated path node set.

[0095] In some embodiments, the execution entity may generate a path node credibility score set based on the updated path node set.

[0096] As an example, the execution entity may determine the credibility scores of the updated path nodes in the updated path node set to generate credibility scores and obtain a credibility score set as the path node credibility score set.

[0097] Optionally, the execution entity may generate a path node credibility score set based on the updated path node set by performing the following steps:

[0098] In the first step, the updated path node set is divided into process categories to obtain a path node group set after process category division, wherein the path node group set after process category division includes: a normal process category division path node group and an abnormal process category division path node group.

[0099] As an example, the execution entity may determine the process category of each updated path node in the updated path node set to obtain a path node process category set, and then divide the path node process category set to obtain a process category-divided path node group set.

[0100] In the second step, the process level of the abnormal process category-divided path node groups included in the above process category-divided path node group set is determined to obtain a process level result.

[0101] Here, the above process level results include: process trust level results, process suspicious level results, and process untrust level results.

[0102] In the third step, in response to determining that the process level result represents an untrustworthy process, a label transfer operation is performed on the path node group after the abnormal process category is divided according to the event type condition.

[0103] Here, the event type condition may refer to a condition of a response event type. For example, the event type condition may refer to an event type condition of a file being read (read file).

[0104] In the fourth step, in response to determining that the process level result represents the process trust level result, according to the event type condition, a label transfer operation is performed on the path node group after the abnormal process category is divided.

[0105] As an example, the execution subject may determine the event type condition, and perform a label transfer operation on the path node group after the abnormal process category corresponding to the event type condition is divided.

[0106] In the fifth step, in response to determining that the process level result represents an unknown level result of the process credibility, a label decay operation is performed on the path node group after the abnormal process category is divided according to the event type condition.

[0107] Here, the label decay may refer to a decrease in the integrity label value corresponding to the path node group after the abnormal process is classified, for example, the integrity label value is decreased from 1 to 0.

[0108] In the sixth step, according to the obtained operation results and the integrity label value corresponding to the updated path node set, the path node graph is screened multiple times to obtain the screened path node graph set.

[0109] As an example, the execution entity can sort the integrity label values ​​corresponding to the updated path node set from largest to smallest based on the obtained operation results to obtain a sequence of integrity label values. Then, the 10 smallest label values ​​are selected from the sequence of integrity label values ​​to obtain a set of path nodes corresponding to the selected integrity label values, which serves as the filtered path node graph.

[0110] In the seventh step, the label value corresponding to each filtered path node graph in the filtered path node graph set is determined to generate a label value group and obtain a label value group set.

[0111] In the eighth step, for each tag value group in the tag value group set, each tag value in the tag value group is multiplied by the corresponding weight to generate a credibility score corresponding to the tag value group, thereby obtaining a credibility score set corresponding to the tag value group.

[0112] In the ninth step, nodes are determined for the credibility score set corresponding to the above label value group to obtain a node set corresponding to the credibility score.

[0113] Here, the above-mentioned node may refer to a node in a path node graph.

[0114] The tenth step is to determine, for each credibility score corresponding node in the credibility score corresponding node set, the environmental anomaly score of the credibility score corresponding node, the process credibility score of the credibility score corresponding node, and the integrity score of the credibility score corresponding node, as well as the weights corresponding to the environmental anomaly score, the process credibility score, and the integrity score.

[0115] In the eleventh step, a path node credibility score set is generated based on the environmental anomaly score, the process credibility score, the integrity score, and the weights corresponding to the environmental anomaly score, the process credibility score, and the integrity score.

[0116] As an example, the execution entity may generate a path node credibility score set based on the environmental anomaly score, the process credibility score, the integrity score, the environmental anomaly score, and the weights corresponding to the process credibility score and the integrity score through score(i) = α*int(i) + β*trust(i) + γ*susp(i). Here, score(i) represents the path node credibility score set. int(i) represents the integrity score. trust(i) represents the process credibility score. susp(i) represents the environmental anomaly score. α represents the weight of the integrity score. β represents the weight of the process credibility score. γ represents the weight of the environmental anomaly score. For example, α may be 0.4. β may be 0.3. γ is 0.3.

[0117] The relevant content of steps 1-11 above, as an inventive feature of this disclosure, addresses the second technical problem mentioned in the background art: "The inability to confirm the security status of the system process after reading the malware results in significant errors in determining the scene graph corresponding to the path node, thereby resulting in low system security." Factors that contribute to low system security are often as follows: The inability to confirm the security status of the system process after reading the malware results in significant errors in determining the scene graph corresponding to the path node, thereby resulting in low system security. Resolving these factors can improve system security. To achieve this, in the first step, the updated path node set is classified by process category to obtain a set of process-classified path node groups, wherein the process-classified path node groups include normal process-classified path node groups and abnormal process-classified path node groups. In the second step, the abnormal process-classified path node groups included in the process-classified path node groups are subjected to process level determination to obtain a process level result. In the third step, in response to determining that the process level result indicates a process untrustworthiness level, a label transfer operation is performed on the abnormal process-classified path node groups based on an event type condition. Step 4: In response to determining that the process level result represents a process trustworthiness result, a label transfer operation is performed on the path node group after the abnormal process classification is performed based on the event type condition. Step 5: In response to determining that the process level result represents an unknown process trustworthiness result, a label decay operation is performed on the path node group after the abnormal process classification is performed based on the event type condition. Step 6: Based on the obtained operation results and the integrity label values ​​corresponding to the updated path node set, the path node graph is subjected to multiple node screening to obtain a filtered path node graph set. This reduces the possibility of large errors in determining the scene graph corresponding to the path nodes. Step 7: Determine the label value corresponding to each filtered path node graph in the filtered path node graph set to generate a label value group, thereby obtaining a label value group set. Step 8: For each label value group in the label value group set, multiply each label value in the label value group by the corresponding weight to generate a credibility score corresponding to the label value group, thereby obtaining a credibility score set corresponding to the label value group. Step 9: Perform node determination on the credibility score set corresponding to the label value group, thereby obtaining a credibility score node set. The tenth step is to determine, for each credibility score corresponding node in the credibility score corresponding node set, the environmental anomaly score of the credibility score corresponding node, the process credibility score of the credibility score corresponding node, and the integrity score of the credibility score corresponding node, as well as the weights corresponding to the environmental anomaly score, the process credibility score, and the integrity score.In the eleventh step, a set of path node credibility scores is generated based on the weights corresponding to the environment anomaly score, the process credibility score, and the integrity score. This reduces the likelihood of large errors in determining the scene graph corresponding to the path node, thereby improving system security.

[0118] Step 108: Determine the scene graph corresponding to the path node based on the above path node credibility score set.

[0119] In some embodiments, the execution entity may determine the scene graph corresponding to the path node based on the path node credibility score set.

[0120] As an example, the execution entity may classify the path nodes corresponding to the path node credibility score set to obtain a classified credibility score set, wherein the classified credibility score set includes a low credibility score set, a medium credibility score set, and a high credibility score set. The classified credibility scores in the classified credibility score set are then connected in descending order of credibility to obtain a connected scene graph, which serves as the scene graph corresponding to the path node.

[0121] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the fileless attack scenario graph determination method of some embodiments of the present disclosure, the system security is improved, the system responsiveness is improved, and the cycle of determining the fileless attack scenario graph is shortened. Specifically, the reasons for the low security of the system, the low responsiveness of the system, and the long cycle of determining the fileless attack scenario graph are: when the command line is detected, the behavior corresponding to the command line may not be effectively identified, resulting in low system security. When the command line information is detected to be abnormal, it is impossible to respond in time, resulting in low system responsiveness and a long cycle of determining the fileless attack scenario graph. Based on this, the fileless attack scenario graph determination method of some embodiments of the present disclosure first detects the command line information corresponding to the system process to obtain the command line information detection result, wherein the command line information detection result includes: a normal command line information detection result and an abnormal command line information detection result. In this way, it is possible to effectively identify whether the behavior corresponding to the command line is normal. Then, based on the above command line information, a feature vector set corresponding to the command line information is generated. This facilitates subsequent processing. Next, in response to determining that the command line information detection result represents a normal command line information detection result, a pre-trained initial command line information detection model is optimized based on the command line information to obtain a command line information detection model. The command line information detection model is a model for detecting abnormal command line information. This improves the accuracy of identifying command line information. Next, the feature vector set corresponding to the command line information is input into the command line information detection model to obtain abnormal command line information, and an alert is performed on the abnormal command line information. This improves the system's responsiveness and shortens the cycle time for determining the fileless attack scenario graph. Then, each path node in the path node graph corresponding to the system process is annotated with initial label values ​​to obtain an annotated path node set. The annotated path node set includes path nodes annotated with initial environment anomaly label values, path nodes annotated with initial process credibility label values, and path nodes annotated with initial integrity label values. This facilitates evaluating the credibility of path nodes. Subsequently, the label values ​​of the annotated path node set are updated based on the abnormal command line information after the alert processing, resulting in an updated path node set that increases the credibility of the path nodes. Then, based on the updated set of path nodes, a set of path node credibility scores is generated. This facilitates the generation of a scenario graph corresponding to each path node. Finally, based on the set of path node credibility scores, the scenario graph corresponding to each path node is determined. This improves system security and responsiveness, and shortens the cycle time for determining the fileless attack scenario graph.

[0122] Further references Figure 2As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a method for determining a fileless attack scenario graph. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the device can be specifically applied to various electronic devices.

[0123] like Figure 2 As shown, some embodiments of the fileless attack scenario graph determination device 200 include: a detection unit 201, a first generation unit 202, an optimization unit 203, an input unit 204, a labeling unit 205, an update unit 206, a second generation unit 207 and a determination unit 208. The detection unit 201 is configured to detect the command line information corresponding to the system process and obtain a command line information detection result, wherein the command line information detection result includes: a normal result of the command line information detection and an abnormal result of the command line information detection; the first generation unit 202 is configured to generate a feature vector set corresponding to the command line information according to the command line information; the optimization unit 203 is configured to optimize a pre-trained initial command line information detection model according to the command line information in response to determining that the command line information detection result represents a normal result of the command line information detection, and obtain a command line information detection model, wherein the command line information detection model is a model for detecting abnormal command line information; the input unit 204 is configured to input the feature vector set corresponding to the command line information into the command line information detection model to obtain Abnormal command line information, and alarm processing of the above-mentioned abnormal command line information; the labeling unit 205 is configured to perform initial label value labeling on each path node in the path node graph corresponding to the above-mentioned system process to obtain a labeled path node set, wherein the above-mentioned labeled path node set includes: path nodes after being labeled with initial environment abnormal label values, path nodes after being labeled with initial process credibility label values, and path nodes after being labeled with initial integrity label values; the updating unit 206 is configured to update the label values ​​of the above-mentioned labeled path node set according to the abnormal command line information after alarm processing to obtain an updated path node set; the second generating unit 207 is configured to generate a path node credibility score set according to the above-mentioned updated path node set; the determining unit 208 is configured to determine the scene graph corresponding to the path node according to the above-mentioned path node credibility score set.

[0124] It is understood that the units described in the device 200 are similar to those described in the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the device 200 and the units included therein, and will not be repeated here.

[0125] Reference below Figure 3, which shows a structural diagram of an electronic device (such as a computing device) 300 suitable for implementing some embodiments of the present disclosure. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0126] like Figure 3 As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 304. Various programs and data required for the operation of the electronic device 300 are also stored in the RAM 303. The processing device 301, the ROM 302, and the RAM 304 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0127] Typically, the following devices may be connected to the I / O interface 305: an input device 306 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 308 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 309. The communication device 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as needed.

[0128] In particular, according to some embodiments of the present disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from a network via the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the functions defined in the methods of some embodiments of the present disclosure are performed.

[0129] It should be noted that the computer-readable medium described in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In some embodiments of the present disclosure, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or device. In some embodiments of the present disclosure, the computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0130] In some embodiments, the client and server can communicate using any currently known or future developed network protocol, such as HTTP (Hypertext Transfer Protocol), and can be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0131] The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist independently without being assembled into the electronic device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: detects the command line information corresponding to the system process to obtain a command line information detection result, wherein the above-mentioned command line information detection result includes: a normal result of command line information detection and an abnormal result of command line information detection; generates a feature vector set corresponding to the command line information based on the above-mentioned command line information; in response to determining that the above-mentioned command line information detection result represents a normal result of command line information detection, optimizes a pre-trained initial command line information detection model based on the above-mentioned command line information to obtain a command line information detection model, wherein the above-mentioned command line information detection model is a model for detecting abnormal command line information; and optimizes the above-mentioned command line information detection model. The feature vector set is input into the above-mentioned command line information detection model to obtain abnormal command line information, and the above-mentioned abnormal command line information is alarm-processed; each path node in the path node graph corresponding to the above-mentioned system process is labeled with an initial label value to obtain a labeled path node set, wherein the above-mentioned labeled path node set includes: path nodes labeled with initial environment abnormality label values, path nodes labeled with initial process credibility label values, and path nodes labeled with initial integrity label values; according to the abnormal command line information after alarm processing, the label values ​​of the above-mentioned labeled path node set are updated to obtain an updated path node set; according to the above-mentioned updated path node set, a path node credibility score set is generated; according to the above-mentioned path node credibility score set, the scene graph corresponding to the path node is determined.

[0132] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0133] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0134] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be provided in a processor, for example, may be described as: a processor comprising: a detection unit, a first generation unit, an optimization unit, an input unit, a labeling unit, a second generation unit and a determination unit. The names of these units do not, in certain cases, constitute a limitation on the units themselves. For example, the acquisition unit may also be described as "a unit for detecting the command line information corresponding to the system process and obtaining a command line information detection result, wherein the above-mentioned command line information detection result includes: a unit for detecting normal command line information detection results and abnormal command line information detection results".

[0135] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0136] The above description is only an illustration of some preferred embodiments of the present disclosure and the technical principles used therein. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by the specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above inventive concept. For example, the above features are replaced with (but not limited to) technical features with similar functions disclosed in the embodiments of the present disclosure by each other to form a technical solution.

Claims

1. A method for determining a fileless attack scenario graph, comprising: Detecting command line information corresponding to the system process to obtain a command line information detection result, wherein the command line information detection result includes: a normal command line information detection result and an abnormal command line information detection result; Generating a feature vector set corresponding to the command line information according to the command line information; In response to determining that the command line information detection result represents a normal command line information detection result, optimizing a pre-trained initial command line information detection model based on the command line information to obtain a command line information detection model, wherein the command line information detection model is a model for detecting abnormal command line information; Inputting the feature vector set corresponding to the command line information into the command line information detection model to obtain abnormal command line information, and performing alarm processing on the abnormal command line information; Annotate each path node in the path node graph corresponding to the system process with an initial label value to obtain a labeled path node set, wherein the labeled path node set includes: path nodes annotated with an initial environment anomaly label value, path nodes annotated with an initial process credibility label value, and path nodes annotated with an initial integrity label value; According to the abnormal command line information after the alarm processing, the label value of the marked path node set is updated to obtain an updated path node set; generating a path node credibility score set based on the updated path node set; According to the path node credibility score set, a scene graph corresponding to the path node is determined.

2. The method according to claim 1, wherein Generating a feature vector set corresponding to the command line information according to the command line information includes: Inputting the command line information into a word embedding model to obtain a word vector set corresponding to the command line information; Create feature vectors for the word vector set corresponding to the command line information to obtain a feature vector set corresponding to the command line information.

3. The method according to claim 1, wherein The initial command line information detection model is trained by the following steps: Get a sample set of command line information; Selecting a command line information sample from the command line information sample set; Inputting the command line information sample into the initial convolutional neural network model to obtain command line information test data; Determining, based on a preset command line information loss function, a data difference value between the command line information test data and the command line information sample label included in the command line information sample; In response to the data difference value being greater than or equal to a preset data threshold, network parameters of the initial command line information detection model are adjusted.

4. The method according to claim 3, wherein: The method further comprises: In response to the data difference value being less than the preset data threshold, the initial convolutional neural network model is determined as an initial command line information detection model.

5. The method according to claim 2, wherein: The step of creating a feature vector for the word vector set corresponding to the command line information to obtain a feature vector set corresponding to the command line information includes: Performing average pooling processing on the word vector set corresponding to the command line information to obtain the word vector set corresponding to the command line information after average pooling; Performing maximum pooling processing on the word vector set corresponding to the pooled command line information to obtain the word vector set corresponding to the command line information after maximum pooling processing; Performing minimum pooling processing on the word vector set corresponding to the command line information after the maximum pooling processing to obtain the word vector set corresponding to the command line information after the minimum pooling processing; Setting the number of word vectors for the word vector set corresponding to the command line information after the minimum pooling process to obtain the word vector set corresponding to the command line information after the setting process; Adding preset command line information to the word vector set corresponding to the set command line information to obtain a word vector set corresponding to the added command line information; Classifying the word vector set corresponding to the added command line information to obtain a word vector type set corresponding to the command line information; According to the word vector type set corresponding to the command line information, a feature vector set corresponding to the command line information is determined.

6. The method according to claim 1, wherein After labeling each path node in the path node graph corresponding to the system process with an initial label value to obtain a labeled path node set, the method further includes: Increasing the value of the integrity label value corresponding to at least one path node labeled with an initial integrity label value in the labeled path node set to obtain an increased integrity label value set; According to the added integrity label value set, performing label decay for the system process for a plurality of preset periods to obtain a decayed label value set; According to the abnormal command line information after the alarm processing, each labeled path node corresponding to the decayed label value set is determined as an updated path node set.

7. The method according to claim 6, wherein: The step of performing label decay for the system process for a plurality of preset periods according to the added integrity label value set to obtain a decayed label value set includes: Multiplying each added integrity label value in the added integrity label value set by a preset attenuation factor to generate a processed label value, thereby obtaining a processed label value set; A decayed label value set is generated according to the preset static value, the preset decay factor and the processed label value set.

8. A device for determining a fileless attack scenario graph, comprising: The detection unit is configured to detect command line information corresponding to the system process and obtain a command line information detection result, wherein the command line information detection result includes: a normal command line information detection result and an abnormal command line information detection result; A first generating unit is configured to generate a feature vector set corresponding to the command line information according to the command line information; an optimization unit configured to, in response to determining that the command line information detection result represents a normal command line information detection result, optimize a pre-trained initial command line information detection model based on the command line information to obtain a command line information detection model, wherein the command line information detection model is a model for detecting abnormal command line information; an input unit configured to input the feature vector set corresponding to the command line information into the command line information detection model to obtain abnormal command line information, and perform alarm processing on the abnormal command line information; a labeling unit configured to label each path node in the path node graph corresponding to the system process with an initial label value to obtain a labeled path node set, wherein the labeled path node set includes: path nodes labeled with an initial environment anomaly label value, path nodes labeled with an initial process credibility label value, and path nodes labeled with an initial integrity label value; an updating unit configured to update the label value of the annotated path node set according to the abnormal command line information after the alarm processing, to obtain an updated path node set; a second generating unit configured to generate a path node credibility score set based on the updated path node set; The determining unit is configured to determine the scene graph corresponding to the path node according to the path node credibility score set.

9. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer-readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images