Method and device for detecting data flow returned by secret stealing Trojan horse

Abstract

The present invention discloses a method and device for detecting data flow returned by a secret-stealing Trojan, and belongs to the field of information security. The method includes: based on a preset configuration file, real-time monitoring of the reading of sensitive files by each process and real-time hooking of the calling of encryption API by each process, and recording the encryption API calling information of each process; wherein the configuration file contains the encryption API to be hooked and the sensitive files to be monitored, and the encryption API calling information at least includes the calling sequence of the encryption API, the name, parameter and return value of each encryption API; when the read sensitive files exceed the set threshold, the data packet sent by the process is intercepted; based on the encryption API calling information of the process, the intercepted data packet is reversely decrypted to identify the sensitive information stolen by the secret-stealing Trojan. This solution can quickly decrypt data packets, and by monitoring the reading of sensitive files, it can timely discover and prevent potential sensitive information leakage.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and device for detecting data flow returned by a secret-stealing Trojan horse. Background Art

[0002] With the continuous advancement of network technology, secret-stealing Trojans have become one of the main threats in network attacks. This type of Trojan specifically targets users' sensitive information, such as browser cookies, digital wallets, and other files that store key data, and uses sophisticated technical means to read and encrypt them, and then transmit them back to the attacker's control server.

[0003] Traditional security detection methods have difficulty in quickly decrypting complex encrypted files, and have difficulty identifying and intercepting theft, making the leakage of sensitive information a serious security risk.

[0004] Therefore, there is an urgent need to provide a new method for detecting the return data traffic of a secret-stealing Trojan horse. Summary of the invention

[0005] In order to solve the problem that the current secret-stealing Trojan horse is difficult to be detected and blocked by the traditional security system when stealing sensitive information and transmitting it back through encryption, the embodiment of the present invention provides a method and device for detecting the data traffic transmitted back by the secret-stealing Trojan horse.

[0006] On the one hand, a method for detecting data traffic returned by a secret stealing Trojan is provided, the method comprising:

[0007] Based on a preset configuration file, monitor the reading of sensitive files by each process in real time and hook the calls of encryption API by each process in real time, and record the encryption API call information of each process; wherein the configuration file contains the encryption API to be hooked and the sensitive files to be monitored, and the encryption API call information at least includes the calling order of the encryption API, the name, parameters and return value of each encryption API;

[0008] When the number of sensitive files read exceeds the set threshold, the data packets sent by the process are intercepted;

[0009] Based on the encrypted API call information of the process, the intercepted data packets are reversely decrypted to identify sensitive information stolen by the stealing Trojan horse.

[0010] On the other hand, a device for detecting data traffic returned by a secret stealing Trojan is provided, which is used to implement the steps described in any method embodiment of the specification, and the device includes:

[0011] A monitoring unit, for monitoring the reading of sensitive files by each process and hooking the calls of encryption APIs by each process in real time based on a preset configuration file, and recording the encryption API call information of each process; wherein the configuration file contains the encryption API to be hooked and the sensitive files to be monitored, and the encryption API call information at least includes the calling order of the encryption API, the name, parameters and return value of each encryption API;

[0012] The interception unit is used to intercept the data packets sent by the process when the number of sensitive files read exceeds the set threshold;

[0013] The decryption unit is used to reversely decrypt the intercepted data packets based on the encrypted API call information of the process to identify sensitive information stolen by the stealing Trojan horse.

[0014] On the other hand, a computer device is provided, which includes a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of the above-mentioned method.

[0015] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned method are implemented.

[0016] On the other hand, a computer program product is provided, comprising a computer program, wherein the computer program implements the steps of the above method when executed by a processor.

[0017] The technical solution provided by the present invention can at least bring the following beneficial effects:

[0018] By hooking the encryption API in the system, the various encryption API information called by the malicious code is accurately recorded. When the malicious code encrypts sensitive information and is ready to send it back, the data packet is intercepted. The recorded encryption API call information is used to quickly reverse decrypt the data packet, so that the system can effectively identify and prevent the behavior of unknown stealing Trojans, and effectively identify the stolen sensitive information. Therefore, this solution can quickly decrypt data packets, and by monitoring the reading of sensitive files, it can timely discover and prevent potential sensitive information leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 It is a flow chart of a method for detecting data flow returned by a secret-stealing Trojan horse provided by an embodiment of the present invention;

[0021] Figure 2 It is a structural diagram of a detection device for a secret stealing Trojan horse return data flow provided by an embodiment of the present invention;

[0022] Figure 3 It is a hardware architecture diagram of a computer device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0024] The specific implementation of the above concept is described below.

[0025] Please refer to Figure 1 , an embodiment of the present invention provides a method for detecting a data flow returned by a secret stealing Trojan horse, the method comprising:

[0026] Step 100: Based on a preset configuration file, monitor the reading of sensitive files by each process in real time and hook the calls of encryption API by each process in real time, and record the encryption API call information of each process; wherein the configuration file contains the encryption API to be hooked and the sensitive files to be monitored, and the encryption API call information at least includes the calling order of the encryption API, the name, parameters and return value of each encryption API;

[0027] Step 102: When the number of sensitive files read exceeds a set threshold, intercept the data packets sent by the process to the outside;

[0028] Step 104: Based on the encrypted API call information of the process, the intercepted data packet is reversely decrypted to identify the sensitive information stolen by the stealing Trojan horse.

[0029] As mentioned above, secret-stealing Trojans such as "Magic Thief" usually encrypt data packets containing sensitive information by calling the system's built-in encryption API (such as AES, Base64, etc.), and transmit the encrypted data packets to their remote servers through the network. Since these encryption operations are regarded as legitimate system calls, traditional protection measures are difficult to identify and intercept these behaviors. Even if the data packets are intercepted, decrypting them using traditional decryption algorithm libraries will waste a lot of time and computing resources, making the leakage of sensitive information a serious security risk.

[0030] In the embodiment of the present invention, the encryption API in the hook system is used to accurately record various encryption API information called by the malicious code. When the malicious code encrypts sensitive information and is ready to transmit it back, the data packet is intercepted, and the recorded encryption API call information is used to quickly reverse decrypt the data packet, so that the system can effectively identify and prevent the behavior of unknown stealing Trojans, and effectively identify the stolen sensitive information. Therefore, this solution can quickly decrypt the data packet, and by monitoring the reading of sensitive files, it can timely discover and prevent potential sensitive information leakage.

[0031] Described below Figure 1 How the various steps are performed.

[0032] For step 100:

[0033] In the embodiment of the present invention, the configuration file will pre-define which APIs need to be hooked and which sensitive files need to be monitored. Encryption APIs include at least AES, DES, Base64, etc. Sensitive files include Cookie files, digital wallet data, etc.

[0034] By using Hook technology to monitor the encryption API calls in the system, when a process calls the encryption API, the encryption API call information of the process will be recorded, and the call will not be blocked, so it will not be detected by the stealing Trojan. Among them, the encryption API call information includes the call order of the encryption API, the name of each encryption API, parameters (such as encryption key, initial vector) and return value, as well as the call timestamp and call stack information, etc. This information will be serialized and stored in the monitoring log for subsequent reverse decryption and analysis.

[0035] Monitoring of sensitive files can be done by calling specific file monitoring APIs to capture file access events and record detailed information for each access, including access time, process ID, accessed file path, etc., so as to subsequently determine which sensitive file the sensitive information stolen by the stealing Trojan comes from.

[0036] In summary, compared with traditional full system monitoring, the embodiment of the present invention adopts API Hook technology, which only intercepts and analyzes at key operation points, reducing unnecessary resource consumption. By accurately locating and processing specific encryption operations, a comprehensive scan of the entire system is avoided, thereby reducing CPU and memory usage, allowing the system to run efficiently while maintaining high security.

[0037] Regarding step 102:

[0038] In this step, once it is detected that a process reads more than the set threshold of sensitive files such as browser cookies and digital wallets, it is considered a suspicious process. When a suspicious process wants to send data packets to the outside, an interception point for network communications will be set in the system, especially focusing on those suspicious network connections. When a suspicious process attempts to send data packets, the monitoring module will intercept these data packets to decrypt and analyze the transmission content. This function not only helps to timely detect and prevent potential sensitive information leakage, but also ensures that data transmission in the network environment is more secure and reduces the risk of information leakage.

[0039] Regarding step 104:

[0040] In this step, since not all packets contain encrypted data, and not all packets are encrypted using the encryption API, they may be customized encryption algorithms. If all are reverse decrypted, it will increase time cost and waste resources. Therefore, before reverse decryption, the packets can be screened first.

[0041] Specifically, before step 104 "reverse decrypting the intercepted data packet based on the encrypted API call information of the process", it also includes:

[0042] Match the content of the intercepted data packet with the return value in the encrypted API call information corresponding to the process;

[0043] If there is a match, the encrypted data packet is saved for reverse decryption;

[0044] If there is no match, the data packet is detected to see if it is a custom encrypted data packet; if it is a custom encrypted data packet, the data packet is first decrypted and then analyzed to see if it is a secret-stealing Trojan horse; if the detected data packet is not encrypted, it is directly analyzed to see if it is a secret-stealing Trojan horse.

[0045] In this embodiment, the system will match the content in the data packet with the return value in the previously recorded encrypted API call information to determine whether it contains encrypted data. If it matches, the destination address, port number, communication protocol and other information of the data packet will be recorded, and the data packet will be saved for subsequent reverse decryption and analysis. If it does not match, it will detect whether the data packet is encrypted. It can be understood that if it is not encrypted, it can be directly analyzed whether it is a secret-stealing Trojan horse. If it is encrypted, it means that the data packet is a custom encrypted data packet, and the decryption algorithm library can be used to decrypt the data packet, and then analyze whether it is a secret-stealing Trojan horse.

[0046] In some implementations, after detecting a custom encrypted data packet, the method further includes:

[0047] Add the calling file of the data packet to the configuration file and record the decryption algorithm of the data packet to optimize the protection rules.

[0048] In some implementations, step 104 may include:

[0049] According to the calling sequence of the encryption API of the process, based on the algorithm and key parameters of each encryption API, the data packets are decrypted in reverse order to obtain the original data;

[0050] Analyze the original data, determine the sensitive information contained in the original data, and compare it with the preset normal system behavior table to determine whether it is a secret-stealing Trojan horse.

[0051] In this embodiment, based on the recorded encryption API call sequence, the encryption process of the program is reproduced in sequence, and the encrypted data is restored in reverse order using the recorded key and API encryption algorithm. Reverse decryption using the recorded encryption API call information allows rapid decryption even when faced with complex encryption algorithms, enhancing the system's ability to protect against unknown threats.

[0052] After successful decryption, the original data is checked to analyze whether it contains sensitive information, such as user credentials, browser cookies, etc., and compared with normal system behavior. For example, the email client only obtains information related to the mailbox. If the original data contains a lot of information unrelated to the mailbox, it can be judged as a secret-stealing Trojan; or if the original data contains unauthorized sensitive information, it can be judged as a secret-stealing Trojan.

[0053] In some implementations, after determining that the Trojan horse is a secret stealing horse, the following steps are further included:

[0054] Generate an analysis report based on the malicious behavior of the stealing Trojan, the processes and sensitive files involved, and the decryption process information;

[0055] Assign a risk score to the secret-stealing Trojan based on the amount of sensitive information stolen by the secret-stealing Trojan, the category of sensitive files, and the sensitivity of sensitive files;

[0056] Based on the level of risk score, corresponding response measures are automatically executed.

[0057] In this embodiment, if abnormal data is found, the system will generate a detailed analysis report. The report will include a description of the malicious behavior, the processes and files involved, detailed information about the decryption process, etc. At the same time, the system will also generate a risk score and automatically execute corresponding response measures based on the risk score.

[0058] Specifically, when the risk score is high, all network connections and communications can be cut off; when the risk score is medium, the program can be prohibited from accessing the network, preventing it from further accessing sensitive files, or freezing its process for further analysis; when the risk score is low, access control of specific files can be enhanced to avoid core data leakage. In addition, in order to prevent malicious code from escaping, the system can also use memory protection technology to prevent isolated processes from self-deletion or tampering. At the same time, the isolation operation steps and results will be recorded in the log for auditing.

[0059] While automatically executing the corresponding response measures, the early warning mechanism can also be triggered immediately. The early warning information should be notified to the administrator through multiple channels, such as system pop-up windows, emails, text messages, etc. At the same time, the early warning system will provide detailed response suggestions, such as further analyzing malicious behavior, updating protection strategies, or isolating infected systems.

[0060] In some embodiments, the risk score is calculated by the following formula:

[0061]

[0062] In the formula, is the risk factor of the amount of sensitive information, The number of sensitive file categories stolen. For the stolen The sensitivity of sensitive files. For the stolen The amount of sensitive information in each sensitive file.

[0063] In this embodiment, sensitive files in the system include system data (such as keyboard logs, screenshots, etc.), browser clients, email clients, etc. Each sensitive file is preset with a sensitivity. The higher the sensitivity, the higher the risk score and the greater the threat. Multiple thresholds are set for the number of sensitive information, which are located at different quantity levels and assigned different risk coefficient values. It can be understood that the more sensitive file categories are stolen, the lower the probability that the program is a normal system program, and the greater the risk. Therefore, through the above calculation formula, the risk score of the stealing Trojan can be obtained more accurately, so that the system can make more reasonable automatic response measures to prevent potential sensitive information leakage.

[0064] Please refer to Figure 2 The embodiment of the present invention provides a device for detecting the return data flow of a secret stealing Trojan horse, which is used to implement the steps of any method embodiment in the specification, and the device includes:

[0065] The monitoring unit 201 is used to monitor the reading of sensitive files by each process and the calling of encryption API by each process in real time based on a preset configuration file, and record the encryption API calling information of each process; wherein the configuration file contains the encryption API to be hooked and the sensitive files to be monitored, and the encryption API calling information at least includes the calling order of the encryption API, the name, parameter and return value of each encryption API;

[0066] The interception unit 202 is used to intercept the data packets sent by the process when the sensitive files read exceed the set threshold;

[0067] The decryption unit 203 is used to reversely decrypt the intercepted data packets based on the encrypted API call information of the process to identify the sensitive information stolen by the stealing Trojan horse.

[0068] In one embodiment of the present invention, before the decryption unit 203 and after the interception unit 202, a screening unit 204 is further included, which is used to execute:

[0069] Match the content of the intercepted data packet with the return value in the encrypted API call information corresponding to the process;

[0070] If there is a match, the encrypted data packet is saved for reverse decryption;

[0071] If there is no match, the data packet is detected to see if it is a custom encrypted data packet; if it is a custom encrypted data packet, the data packet is first decrypted and then analyzed to see if it is a secret-stealing Trojan horse; if the detected data packet is not encrypted, it is directly analyzed to see if it is a secret-stealing Trojan horse.

[0072] After detecting the custom encrypted data packet, the screening unit 204 is further used to:

[0073] Add the calling file of the data packet to the configuration file and record the decryption algorithm of the data packet to optimize the protection rules.

[0074] In one embodiment of the present invention, the decryption unit 203 is used to perform:

[0075] According to the calling sequence of the encryption API of the process, based on the algorithm and key parameters of each encryption API, the data packets are decrypted in reverse order to obtain the original data;

[0076] Analyze the original data, determine the sensitive information contained in the original data, and compare it with the preset normal system behavior table to determine whether it is a secret-stealing Trojan horse.

[0077] In one embodiment of the present invention, after determining that the decryption unit 203 is a secret stealing Trojan horse, it is further used to:

[0078] Generate an analysis report based on the malicious behavior of the stealing Trojan, the processes and sensitive files involved, and the decryption process information;

[0079] Assign a risk score to the secret-stealing Trojan based on the amount of sensitive information stolen by the secret-stealing Trojan, the category of sensitive files, and the sensitivity of sensitive files;

[0080] Based on the level of risk score, corresponding response measures are automatically executed.

[0081] In one embodiment of the present invention, the risk score in the decryption unit 203 is calculated by the following formula:

[0082]

[0083] In the formula, is the risk factor of the amount of sensitive information, The number of sensitive file categories stolen. For the stolen The sensitivity of sensitive files. For the stolen The amount of sensitive information in each sensitive file.

[0084] It should be noted that the detection device for the return data traffic of the secret stealing Trojan provided in the above embodiment is only illustrated by the division of the above functional units. In practical applications, the above functions can be assigned to different functional units as needed, that is, the internal structure of the device can be divided into different functional units to complete all or part of the functions described above. In addition, the above device embodiment and the method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0085] The embodiment of the present application also provides a computer device, please refer to Figure 3The computer device includes a processor and a memory, in which at least one instruction, at least one program, code set or instruction set is stored, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the detection method of the data traffic returned by the stealing Trojan provided by the above-mentioned method embodiments.

[0086] An embodiment of the present application also provides a computer-readable storage medium, on which is stored at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by a processor to implement the method for detecting the data traffic returned by the secret-stealing Trojan horse provided by the above-mentioned method embodiments.

[0087] An embodiment of the present application also provides a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium, and the processor executes the computer program, so that the computer device executes any method for detecting data traffic returned by a secret-stealing Trojan horse in the above-mentioned embodiments.

[0088] For the convenience of description, the above system or device is described by dividing it into various modules or units according to its functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0089] It can be known from the description of the above implementation methods that those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform. Based on such an understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product can be stored in a storage medium such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment of the present application or some parts of the embodiments.

[0090] Finally, it should be noted that, in this article, relational terms such as first, second, third and fourth are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0091] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for detecting the return data flow of a secret stealing Trojan horse, characterized in that: include: Based on a preset configuration file, monitor the reading of sensitive files by each process in real time and hook the calls of encryption API by each process in real time, and record the encryption API call information of each process; wherein the configuration file contains the encryption API to be hooked and the sensitive files to be monitored, and the encryption API call information at least includes the calling order of the encryption API, the name, parameters and return value of each encryption API; When the number of sensitive files read exceeds the set threshold, the data packets sent by the process are intercepted; Based on the encrypted API call information of the process, the intercepted data packets are reversely decrypted to identify sensitive information stolen by the stealing Trojan horse; Before reverse decrypting the intercepted data packet based on the encrypted API call information of the process, the method further includes: Matching the content of the intercepted data packet with the return value in the encrypted API call information corresponding to the process; If there is a match, the encrypted data packet is saved for reverse decryption; If there is no match, then check whether the data packet is a custom encrypted data packet; if it is a custom encrypted data packet, first decrypt the data packet and then analyze whether it is a secret stealing Trojan horse; if the detected data packet is not encrypted, directly analyze whether it is a secret stealing Trojan horse; After detecting a custom encrypted packet, it also includes: Adding the calling file of the data packet to the configuration file and recording the decryption algorithm of the data packet to optimize the protection rules; The encrypted API call information based on the process is used to reversely decrypt the intercepted data packets to identify sensitive information stolen by the stealing Trojan horse, including: According to the calling sequence of the encryption API of the process, based on the algorithm and key parameters of each encryption API, the data packets are decrypted in reverse order to obtain the original data; The original data is analyzed to determine the sensitive information contained in the original data, and compared with a preset normal system behavior table to determine whether it is a secret-stealing Trojan horse.

2. The method according to claim 1, characterized in that After being identified as a secret-stealing Trojan, it also includes: Generate an analysis report based on the malicious behavior of the stealing Trojan, the processes and sensitive files involved, and the decryption process information; Assign a risk score to the secret-stealing Trojan based on the amount of sensitive information stolen by the secret-stealing Trojan, the category of sensitive files, and the sensitivity of sensitive files; Based on the level of the risk score, corresponding response measures are automatically executed.

3. The method according to claim 2, characterized in that The risk score is calculated by the following formula: In the formula, is the risk factor of the amount of sensitive information, The number of sensitive file categories stolen. For the stolen The sensitivity of sensitive files. For the stolen The amount of sensitive information in each sensitive file.

4. A device for detecting the return data flow of a secret stealing Trojan, used to implement the steps of any of the methods described in claims 1-3, characterized in that: The device includes: A monitoring unit, for monitoring the reading of sensitive files by each process and hooking the calls of encryption APIs by each process in real time based on a preset configuration file, and recording the encryption API call information of each process; wherein the configuration file contains the encryption API to be hooked and the sensitive files to be monitored, and the encryption API call information at least includes the calling order of the encryption API, the name, parameters and return value of each encryption API; The interception unit is used to intercept the data packets sent by the process when the number of sensitive files read exceeds the set threshold; The decryption unit is used to reversely decrypt the intercepted data packets based on the encrypted API call information of the process to identify sensitive information stolen by the stealing Trojan horse.

5. A computer device, characterized in that: The computer device includes a memory and a processor, the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to implement the steps of any of the methods described in claims 1-3.

6. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 3 are implemented.

7. A computer program product, characterized in that The method comprises a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1 to 3.

Images