Behavior tree generation method and device based on command line and storage medium

Abstract

The invention discloses a behavior tree generation method and device based on a command line and a storage medium, and relates to the technical field of network security and the technical field of computers. The method comprises the steps that an acquired target command line is analyzed, an analysis result is obtained, and the analysis result comprises a plurality of commands in the target command line; obtaining function call behavior information of a target instruction executed by the target command line agent; according to the analysis result and the function calling behavior information, a behavior tree of the target command line is generated, and the behavior tree of the target command line is used for representing execution behavior information generated in the execution process of multiple commands in the target command line. The technical problem that in the prior art, the Shell command line and behavior information generated in the command execution process cannot be subjected to associated tracking, and consequently the execution intention of the Shell command line is difficult to judge is solved.

Description

Technical Field

[0001] The present application relates to the fields of network security technology and computer technology, and in particular to a command line-based behavior tree generation method, device, and storage medium. Background Art

[0002] Shell commands are instructions used in the command line interface to interact with the operating system and perform various management and operation tasks. These commands can help users complete various functions such as file management, system monitoring, process control, network communication, etc.

[0003] In the prior art, when analyzing a Shell command line composed of multiple Shell commands, each Shell command itself is usually analyzed. However, the Shell command itself is only a function expression and does not represent the specific operation behavior of the computer system. Moreover, a Shell command may map a lot of process and system call information.

[0004] Therefore, currently, the existing technology is unable to correlate and track the Shell command line with the process behavior information generated during the Shell command execution, which leads to the technical problem that it is difficult to judge the execution intention of the Shell command line.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The present application provides a method, device and storage medium for generating a behavior tree based on a command line, so as to at least solve the technical problem in the prior art that it is difficult to judge the execution intention of the Shell command line due to the inability to associate and track the behavior information generated during the command execution process.

[0007] According to one aspect of the present application, a command line-based behavior tree generation method is provided, comprising: parsing a collected target command line to obtain a parsing result, wherein the parsing result includes multiple commands in the target command line; obtaining function call behavior information of a target instruction executed by the target command line agent; generating a behavior tree of the target command line according to the parsing result and the function call behavior information, wherein the behavior tree of the target command line is used to characterize execution behavior information generated during the execution of multiple commands in the target command line.

[0008] Optionally, in the command line-based behavior tree generation method provided in the present application, the collected target command line is parsed to obtain a parsing result, including: according to the command separator in the target command line, the target command line is divided into multiple slice command lines, wherein each slice command line includes at least one command; determining the command type of each slice command line; and generating the parsing result according to the multiple slice command lines obtained by dividing the target command line and the command type of each slice command line.

[0009] Optionally, in the command line-based behavior tree generation method provided in the present application, the command type is any one of the following types: a first type, wherein the process behavior information of the first type of slicing command line needs to be collected through a calling module of the target instruction; a second type, wherein the second type of slicing command line belongs to a slicing command line executed by a background process agent of the target command line; a third type, wherein the third type of slicing command line belongs to a slicing command line in an encrypted state; a fourth type, wherein the fourth type of slicing command line belongs to a slicing command line other than the first type, the second type and the third type.

[0010] Optionally, in the command line-based behavior tree generation method provided in the present application, a behavior tree of a target command line is generated according to the parsing results and the function call behavior information, including: determining, from the function call behavior information, execution behavior information generated when executing each slice command line according to the process identifier and command parameter information of each slice command line; using the execution behavior information generated when executing each slice command line as the command behavior tree corresponding to each slice command line; constructing a behavior queue of the target command line based on the command behavior tree corresponding to each slice command line, wherein the behavior queue includes multiple triplets, each triplet includes a slice command line, a command type of the slice command line, and a command behavior tree corresponding to the slice command line; and generating a behavior tree of the target command line according to the behavior queue of the target command line.

[0011] Optionally, in the process of building a behavior queue of the command line based on the command behavior tree corresponding to each slice command line, the command line-based behavior tree generation method also includes: detecting whether all processes corresponding to each slice command line in the behavior queue have been executed; when all processes corresponding to the i-th slice command line in the behavior queue have been executed, determining that the command behavior tree corresponding to the i-th slice command line does not need to be updated, wherein the i-th slice command line is any slice command line in the behavior queue; when there is a target process that has not been executed among all the processes corresponding to the i-th slice command line in the behavior queue, each time the target process is executed, the command behavior tree corresponding to the i-th slice command line is updated according to the execution behavior information of the target process that has been executed.

[0012] Optionally, in the command line-based behavior tree generation method provided in the present application, a behavior tree of the target command line is generated according to a behavior queue of the target command line, including: generating a behavior tree of the target command line according to a process identifier corresponding to each slice command line in the behavior queue and a process behavior relationship between processes corresponding to different slice command lines, wherein each tree node of the behavior tree of the target command line represents a command in the target command line and execution behavior information generated by executing the command, and the edges between adjacent tree nodes of the behavior tree of the target command line represent the association relationship between the adjacent tree nodes.

[0013] Optionally, in the command line-based behavior tree generation method provided in the present application, when it is detected that all processes corresponding to each slice command line in the behavior queue have been executed, a label is set for the behavior queue, wherein the label is used to indicate that the behavior queue stops updating triples; when it is detected that new process behavior information related to the process corresponding to any slice command line in the behavior queue appears in the function call behavior information, the new process behavior information is updated to the target behavior queue, wherein the target behavior queue is a behavior queue for processes that are not labeled and are related to the new process behavior information.

[0014] Optionally, the execution behavior information generated when executing each slice command line is used as the command behavior tree corresponding to each slice command line, including: when executing the i-th slice command line, if it is detected that the j-th command line associated with the i-th slice command line is executed during the execution process, the j-th command line is parsed, wherein i and j are both positive integers; according to the parsing result of the j-th command line, a behavior queue of the j-th command line is generated; and the behavior queue of the j-th command line is used as the information in the command behavior tree corresponding to the i-th slice command line.

[0015] According to another aspect of the present application, a command line-based behavior tree generation device is also provided, wherein the command line-based behavior tree generation device includes: a parsing unit, used to parse the collected target command line to obtain a parsing result, wherein the parsing result includes multiple commands in the target command line; an acquisition unit, used to obtain function call behavior information of the target instruction executed by the target command line agent; a generation unit, used to generate a behavior tree of the target command line according to the parsing result and the function call behavior information, wherein the behavior tree of the target command line is used to characterize execution behavior information generated during the execution of multiple commands in the target command line.

[0016] According to another aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes any one of the above-mentioned command-line-based behavior tree generation methods.

[0017] In the present application, the collected target command line is first parsed to obtain a parsing result, wherein the parsing result includes multiple commands in the target command line. Then, the function call behavior information of the target instruction executed by the target command line agent is obtained. Finally, a behavior tree of the target command line is generated according to the parsing result and the function call behavior information, wherein the behavior tree of the target command line is used to characterize the execution behavior information generated by the multiple commands in the target command line during the execution process.

[0018] As can be seen from the above content, the present application collects a complete target command line (such as a Shell command line) and parses the target command line to obtain the parsing result of the target command line, and monitors the function call behavior information of the target instruction executed by the target command line agent (such as the calling process of the key function of Syscall), and associates the function call behavior information with the parsing result. Then, based on the established association relationship, a behavior tree for characterizing the execution process of the target command line is generated. Since the tree structure of the behavior tree can visualize the association relationship between the function call behavior information and the parsing result, the technical effect of determining the execution intention of the entire target command line through the behavior tree of the target command line is achieved, thereby solving the technical problem in the prior art that it is difficult to associate and track the Shell command line with the behavior information generated during the command execution process, which makes it difficult to judge the execution intention of the Shell command line. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0020] Figure 1 is a flowchart of an optional command line-based behavior tree generation method according to an embodiment of the present application;

[0021] Figure 2 is a schematic diagram of an optional command line analysis system according to an embodiment of the present application;

[0022] Figure 3 is a schematic diagram of an optional command line-based behavior tree generation device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] It should also be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) collected by this application are information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data are in compliance with the relevant laws, regulations and standards of the relevant regions, necessary confidentiality measures are taken, and public order and good customs are not violated, and corresponding operation portals are provided for users to choose to authorize or refuse. For example, an interface is set up between this system and relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0026] According to an embodiment of the present application, an embodiment of a command line-based behavior tree generation method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0027] Figure 1 is a flowchart of an optional command line-based behavior tree generation method according to an embodiment of the present application, such as Figure 1 As shown, the method comprises the following steps:

[0028] Step S101, parse the collected target command line to obtain a parsing result.

[0029] In step S101, the parsing result includes multiple commands in the target command line.

[0030] Optionally, a command line analysis system can be used as the execution subject of the command line-based behavior tree generation method in the embodiment of the present application, wherein the command line analysis system can be a software system or an embedded system combining software and hardware. In addition, it should be noted that in addition to using the command line analysis system as the execution subject of the technical solution in the embodiment of the present application, other devices or apparatuses in other forms of expression can also be used as the execution subject, and the present application does not specifically limit this.

[0031] For the convenience of description, the technical solution of this application is explained below using the command line analysis system as the execution entity.

[0032] In an optional embodiment, Figure 2 is a schematic diagram of an optional command line analysis system according to an embodiment of the present application, such as Figure 2 As shown, the command line analysis system includes a Shell command monitoring module, a Syscall monitoring module, and a behavior view module. Among them, Syscall is a computer instruction executed by the Shell command line agent.

[0033] Among them, the Shell command monitoring module is mainly used to monitor the execution process of the Shell command, collect the complete Shell command line, and parse the Shell command line to obtain the parsing result.

[0034] Optionally, the target command line can be a command line executable by various computer devices, for example, the target command line is a Shell command line or other types of command lines, or the target command line can be a command line executed by a specified process. The technical solution of the present application itself does not limit the specific type of the target command line, for example, any command line that needs to analyze the behavior of the relevant process can be used as the target command line.

[0035] For the convenience of description, the technical solution of the present application is explained below by taking a complete Shell command line as an example of the target command line.

[0036] Optionally, Shell commands are instructions used in the command line interface to interact with the operating system and perform various management and operation tasks. These commands can help users complete various functions such as file management, system monitoring, process control, network communication, etc.

[0037] Optionally, the program that executes the Shell command is mainly various Shell environments themselves, as well as programming language interpreters or applications that can call Shell commands. Among them, some Shell environments are exemplified as follows:

[0038] Bash (Bourne Again Shell, a command line interface for users to interact with the operating system) is the most commonly used default Shell environment in Linux and macOS. In this type of Shell environment, users can execute Shell commands by directly entering them in the terminal.

[0039] Zsh (Z Shell, a command line interface), a feature-rich shell environment, provides many enhanced features, such as better auto-completion, etc. The usage of this type of shell environment is similar to Bash.

[0040] Fish (Friendly Interactive Shell) is a shell environment that focuses on ease of use and friendly user interface.

[0041] Optionally, the parsing of the Shell command line needs to be performed in the user space, and the parsing process involves reading user input information, parsing command syntax, processing variable expansion, command substitution, etc. This stage is mainly completed by the Shell interpreter (such as Bash, Zsh, etc.) itself, without the need to directly interact with the kernel space.

[0042] The parsing process is used to monitor the user's keyboard input information through the Shell environment, and / or to parse the string input by the user through the Shell environment, and / or to construct one or more commands to be executed and their parameter lists according to the parsed information of the Shell command line.

[0043] Optionally, the parsing process of the Shell command line may include the following:

[0044] Read input: Monitor the user's keyboard input information through the Shell environment. This process is usually completed through the file descriptor of the standard input (stdin), but this is not a direct system call, but is handled by standard library functions (such as fgets, readline, etc.).

[0045] Parsing the command line: Once the user presses the Enter key, the Shell environment begins to parse the string entered by the user. This process includes word segmentation, parsing command structure, processing quotation marks, escape characters, variables and command substitution, etc. These are all logical implementations within the Shell program.

[0046] Build a command execution plan: After parsing the Shell command line, the Shell environment constructs one or more commands to be executed and their parameter lists based on the parsing results to prepare for the next system call.

[0047] In an optional embodiment, the entire execution process of the Shell command line may include the following:

[0048] Parsing compound shell command lines in the shell environment, such as "whoami;id;", involves kernel calls before these command lines are broken down into separate commands and executed. Specifically, this process can be divided into several steps, each of which interacts with the kernel, as summarized below:

[0049] The analysis of the Shell command line includes: When the user enters the Shell command line in the Shell environment and presses the Enter key, the Shell environment (such as Bash, Zsh, etc.) first analyzes the command. This stage is mainly the behavior of the user space. The Shell will recognize the separator (such as ";") and understand that it contains multiple independent commands. Although this step occurs directly in the user space, it prepares for the subsequent system calls.

[0050] Forking (creating) a new process: For each command that needs to be executed, the shell will create a new child process through the "fork()" system call. This is a key kernel call, through which the address space of the parent process (i.e., the shell) can be copied to prepare the environment for the new command to be executed.

[0051] Executing the new command: In the new child process, the shell environment then uses "execve()" or a similar system call to replace the current process image with the execution image of the new command. This system call requires the name of the program to be executed (such as "whoami" or "id") and the parameter list and environment variables passed to the program. This is another important kernel call that can be used to load a new program into memory and start execution.

[0052] Command execution completion and waiting: After each command is executed, the process may be terminated through the "_exit()" or "exit_group()" system call to notify the kernel that the process has ended. Then, if the shell command is configured to wait for the child process (usually the case), the "wait()" or "waitpid()" system call is used to wait for the child process to end and collect its exit status.

[0053] Step S102, obtaining function call behavior information of a target instruction executed by a target command line agent.

[0054] Optionally, the execution subject of step S102 is a Syscall monitoring module of the command line analysis system, wherein the Syscall monitoring module can be used to collect Linux system call information, and capture process, file, network and other behavior information by calling system functions. The relevant tools for system call collection can be auditd, falco, etc. The collection of behavior data is achieved by parsing the log output of the collection tool.

[0055] Optionally, the function call behavior information includes but is not limited to at least one of the following information: process name, process ID, parent process ID, command line parameter information, execution result, permission information and other information.

[0056] Take the auditd log as an example, where the following is a piece of log information:

[0057] type=SYSCALL msg=audit(1719309895.983:675530):arch=c000003esyscall=59success=yes exit=0ppid=369246pid=369247auid=0uid=0gid=0euid=0suid=0fsuid=0egid=0sgid=0fsgid=0tty=pts65 ses=9030comm="ping" exe=" / usr / bin / ping" key=(null)type=EXECVE msg=audit(1719309895.983:675530):argc=4a0="ping"a1="-c"a2="5"a3="8.8.8.8".

[0058] The analysis results of the above logs are as follows:

[0059] Log type: syscall = 59, which means the execution of execve, corresponding to the process start event;

[0060] Process name: exe = " / usr / bin / ping", which means the process name is / usr / bin / ping;

[0061] Process ID: pid=369247, which means the process ID is 369247;

[0062] Parent process ID: ppid=369246, which means the parent process ID is 369246;

[0063] Whether the execution is successful: success = yes, indicating successful execution;

[0064] Permission information: auid=0uid=0gid=0euid=0suid=0fsuid=0egid=0sgid=0fsgid=0, which indicates the audit user ID, real user ID, real group ID, effective user ID, effective group ID, file system user ID, and file system group ID. All of them are 0, which means that this operation is performed by the root user.

[0065] Command line parameters: a0="ping"a1="-c"a2="5"a3="8.8.8.8", which means the command line contains four parameters. The complete command line should be ping-c 5 8.8.8.8.

[0066] Optionally, the information collection process of other system calls is similar to the process of process startup information collection, so it will not be repeated. All collected system call information will be encapsulated into a single behavior event and sent to the behavior view module.

[0067] Step S103: Generate a behavior tree of the target command line according to the parsing result and the function call behavior information.

[0068] In step S103, the behavior tree of the target command line is used to represent the execution behavior information generated during the execution of multiple commands in the target command line.

[0069] Optionally, the execution subject of step S103 may be a Syscall monitoring module of the command line analysis system.

[0070] It should be noted that the present application collects a complete target command line (such as a Shell command line) and parses the target command line to obtain the parsing result of the target command line, and monitors the function call behavior information of the target instruction executed by the target command line agent (such as the calling process of the key function of syscall), and associates the function call behavior information with the parsing result. Based on the established association relationship, a behavior tree for characterizing the execution process of the target command line is generated. Since the tree structure of the behavior tree can visualize the association relationship between the function call behavior information and the parsing result, the technical effect of determining the execution intention of the entire target command line through the behavior tree of the target command line is achieved, thereby solving the technical problem in the prior art that it is difficult to associate and track the Shell command line with the behavior information generated during the command execution process, which makes it difficult to judge the execution intention of the Shell command line.

[0071] In an optional embodiment, in the process of parsing the collected target command line to obtain the parsing result, the command line analysis system can divide the target command line into multiple sliced ​​command lines according to the command separator in the target command line, wherein each sliced ​​command line includes at least one command. Subsequently, the command line analysis system can determine the command type of each sliced ​​command line, wherein the command type is used to characterize the command behavior type corresponding to the sliced ​​command line. Finally, the command line analysis system generates the parsing result according to the multiple sliced ​​command lines obtained by segmenting the target command line and the command type of each sliced ​​command line.

[0072] Optionally, the Shell command monitoring module can implement a Shell command line collection function and can also implement a Shell command line parsing function.

[0073] The Shell command monitoring module has the function of collecting Shell command lines. There are many collection schemes, including but not limited to: modifying Shell subroutines such as Bash and Zsh, or capturing command lines through Prompt+History, or collecting command execution processes through script programs. These schemes can capture complete command line information, which includes the Shell process ID that executes the Shell command, the complete string of the executed command, the start time of the command line execution, and other information.

[0074] It should be noted that for the Shell command line running in the background, the end time of the Shell command line cannot be captured well, because in the background running mode, the current Shell command line will be handed over to the child Shell process built by the current Shell process for execution. The current Shell process will complete the execution task of the Shell command in advance, although the background Shell command has not actually ended. The behavior view of this type of scenario is also relatively special, which will be explained later.

[0075] The Shell command monitoring module has the function of parsing the Shell command line. The parsing process is as follows:

[0076] First, the Shell command monitoring module parses various command separators, such as semicolon (;), newline (\n), logical operators (&, |), pipe (|), redirection separators (>, >>), etc., and splits the command line according to the separators to generate multiple sliced ​​command lines.

[0077] Secondly, parse various Shell built-in commands, such as echo, cd, history, etc., and determine whether each slice command line is a Shell built-in command. Shell built-in commands are commands that cannot be captured through process startup behavior, and the behavior information of such commands can only be collected through the Syscall system call module.

[0078] Then, the background running flag of each slice command line is parsed in turn. If a slice command line ends with an "&" character, it means that the slice command line is executed by a background Shell process proxy, and the slice command line is marked as a background Shell command.

[0079] Finally, parse each slice command line to see if it has a decryption execution feature, such as openssl enc-d-aes-256-cbc, {base64,-d}, etc. The decryption execution feature indicates that the command line is using the OpenSSL or Base64 program to perform AES or base64 decryption on the command line. The slice command line with the decryption execution feature is marked as an encrypted Shell command.

[0080] It should be noted that the Shell command monitoring module will uniformly forward the collected command line information and command line parsing information to the behavior view module.

[0081] Through the above parsing process, the word segmentation processing of the target command line is realized, and each slice command line is parsed separately, so as to determine the feature information of each slice command line.

[0082] Optionally, you can use one or more of the following command separators to split the command line:

[0083] Logical operators (&, |): such as "&&" and "||", are used for logical connections of "and" and "or", respectively, allowing the next command to be executed based on the success or failure of the previous command. Although these are not pure command separators, they play a similar role in implementing command sequences.

[0084] Newline (\n): A natural command terminator. When the user presses the Enter key, Bash interprets it as the end of a line of commands.

[0085] Pipe (|): The pipe is used to use the output of one command as the input of another command. The pipe is also a special separator between commands, but its main function is to connect rather than terminate commands.

[0086] Redirection separators (>, >>), > (overwrite redirection), >> (append redirection), redirect the standard output stream of the command to other destinations.

[0087] In an optional embodiment, the command type of the slicing command line is any one of the following types:

[0088] The first type, wherein the execution behavior information of the first type of slice command line needs to be collected through the calling module of the target instruction;

[0089] The second type, wherein the second type of sliced ​​command line belongs to a sliced ​​command line executed by a background process agent of the target command line;

[0090] The third type, wherein the slice command line of the third type belongs to the slice command line in an encrypted state;

[0091] The fourth type, wherein the slicing command line of the fourth type belongs to the slicing command lines other than the first type, the second type and the third type.

[0092] Optionally, the first type of slicing command line corresponds to the above-mentioned Shell built-in command; the second type of slicing command line corresponds to the above-mentioned background Shell command, and the third type of slicing command line corresponds to the above-mentioned encrypted Shell command. The fourth type of slicing command line does not belong to any of the three commands of Shell built-in command, background Shell command and encrypted Shell command, and the fourth type of slicing command line can be collectively referred to as "slicing command".

[0093] In an optional embodiment, in the process of generating a behavior tree of the target command line based on the parsing results and the function call behavior information, the behavior view module can determine the execution behavior information generated when executing each slice command line from the function call behavior information based on the process identifier and command parameter information of each slice command line, and then the behavior view module uses the execution behavior information generated when executing each slice command line as the command behavior tree corresponding to each slice command line. The behavior view module can also construct a behavior queue of the target command line based on the command behavior tree corresponding to each slice command line, wherein the behavior queue includes multiple triplets, each triplet includes a slice command line, the command type of the slice command line, and the command behavior tree corresponding to the slice command line. Finally, the behavior view module generates a behavior tree of the target command line based on the behavior queue of the target command line.

[0094] Optionally, the behavior view module generates a behavior tree of the Shell command line by constructing a behavior queue of the Shell command line. The behavior queue of the Shell command line includes multiple elements, each of which is a triple<C,T,B> ,C represents a complete command line slice, T represents the type of the command line slice, and B represents the command line behavior tree corresponding to the command line slice.

[0095] Optionally, when building the behavior queue of the Shell command line, the behavior view module will fill in the triple information according to the command line parsing information. The construction process of the incomplete background Shell command queue is as follows:

[0096] Step a, assign values ​​to C in the triplet in the order of the slice command line, and the content is the slice command line string;

[0097] Step b, if a slice command line is a Shell built-in command, then the "T" of the slice command line is assigned the value of "built-in command", and there is no need to track the subsequent process behavior link. For the "B" of the slice command line, the corresponding system call information can be retrieved on demand. Since built-in commands can usually express the command intent more clearly, whether to retrieve the call information is not a necessary process;

[0098] Step c, if a certain slice command line is an encrypted Shell command, then assign the value of "T" of the slice command line to "encrypted command". This is mainly used to mark the suspiciousness of the encrypted instruction and let the user pay attention to the subsequent behavior. Usually, the decryption result of the encrypted command is passed to the next slice command line for execution, so the content of "B" of such slice command line may not be assigned a value. Of course, you can also consider parsing the encryption algorithm to obtain the actual command line to be executed, and then assign a value to "B";

[0099] Step d, if a slice command line is a background Shell command, then assign the value of "T" of the slice command line to "background command". At this time, it is necessary to first retrieve the child Shell process created by the Shell process associated with the behavior queue, and then retrieve the behavior event data sent by the Syscall monitoring module based on the ID of the child Shell process and the command parameter information of the slice command line, and find the behavior event data that matches "the behavior type is a process start event, the process parent process ID is equal to the child Shell process ID, and the process command line parameters are the command parameter information of the slice command line", and locate the process start information corresponding to the slice command line from the detected behavior event data.

[0100] Step e, if a slice command line does not belong to the above three types, assign the value of "T" of the slice command line to "slice command", and then retrieve the behavior event data sent by the Syscall monitoring module according to the Shell process ID associated with the behavior queue and the command parameter information of the slice command, and find the behavior event data that matches "the behavior type is a process start event, the process parent process ID is equal to the child Shell process ID, and the process command line parameters are the command parameter information of the slice command line", and locate the process start information corresponding to the slice command line from the detected behavior event data.

[0101] From the above content, it can be seen that by generating a triplet for each slice command line, the feature information of each slice command line can be recorded from three dimensions, especially the process behavior information corresponding to each slice command line (represented by a command line behavior tree).

[0102] In an optional embodiment, in the process of constructing a behavior queue of command lines based on the command behavior tree corresponding to each slice command line, the behavior view module can detect whether all processes corresponding to each slice command line in the behavior queue have been completely executed. In the case where all processes corresponding to the ith slice command line in the behavior queue have been completely executed, the behavior view module determines that the command behavior tree corresponding to the ith slice command line does not need to be updated, wherein the ith slice command line is any slice command line in the behavior queue; when there is a target process that has not been executed among all the processes corresponding to the ith slice command line in the behavior queue, each time the target process is executed, the command behavior tree corresponding to the ith slice command line is updated according to the execution behavior information of the target process that has been executed.

[0103] Optionally, the behavior view module can analyze the characteristics of the behavior event data most recently sent by the Syscall monitoring module in real time, and determine whether the newly generated behavior event data can be used to supplement the behavior queue (i.e., update the triples in the behavior queue). This is because when the behavior view module receives the command line information sent by the Shell command monitoring module, some aspect command lines may not be completely executed, such as background commands. Since they are handed over to the child Shell process for execution, it may appear that the command line has been executed on the surface, but is actually still running in the background. In order to deal with such scenarios, the behavior view module needs to be able to determine in real time whether the newly generated behavior event data can be used to supplement the behavior queue. If the newly generated behavior event data can be used to supplement the behavior queue, the behavior queue will be updated accordingly.

[0104] It should be noted that the supplementary logic of the behavior queue is similar to the retrieval logic, that is, the behavior event data that matches "behavior type is process start event, process parent process ID is equal to child Shell process ID, process command line parameters and command parameter information of the slice command line" is retrieved from the behavior event data recently sent by the Syscall monitoring module, and the process start information corresponding to the slice command line that needs to be updated is located from the detected behavior event data. If the slice command line is a background command, it needs to be compared with the child Shell process of the Shell process.

[0105] Through the above process, the behavior queue can be updated in time to ensure that the behavior queue stores sufficient and complete execution behavior information generated during the execution of the slice command line.

[0106] In an optional embodiment, in the process of generating a behavior tree of the target command line according to the behavior queue of the target command line, the behavior view module can generate a behavior tree of the target command line according to the process identifier corresponding to each slice command line in the behavior queue and the process behavior between processes corresponding to different slice command lines, wherein each tree node of the behavior tree of the target command line represents a command in the target command line and execution behavior information generated by executing the command, and the edges between adjacent tree nodes of the behavior tree of the target command line represent the association relationship between adjacent tree nodes.

[0107] Optionally, when the behavior queue has completed the above-mentioned queue element replenishment process, the behavior view module can perform link replenishment operations on the execution behavior information of the commands in the behavior queue according to the process ID or other dimensions corresponding to each slice command line, thereby constructing a behavior tree of the Shell command line, thereby achieving the purpose of converting the behavior queue into a behavior tree.

[0108] Optionally, the command behavior relationship includes, but is not limited to, behavior relationships such as file creation, process access, and creation of remote threads. For example, process A injects code into process B, process B creates another file C, and file C is called by another process, and so on.

[0109] In an optional embodiment, when it is detected that all processes corresponding to each slice command line in the behavior queue have been executed, the behavior view module can set a label for the behavior queue, wherein the label is used to indicate that the behavior queue stops updating triples; when it is detected that new process behavior information related to the process corresponding to any slice command line in the behavior queue appears in the function call behavior information, the new process behavior information is updated to the target behavior queue, wherein the target behavior queue is a behavior queue for processes that are not labeled and are related to the new process behavior information.

[0110] Optionally, when the command line analysis system captures a process stop event and finds that the stopped process ID matches a certain Shell process ID, the command line analysis system needs to label the behavior queue, indicating that the behavior queue has been terminated, and only link supplementation is allowed in the future, and no further supplementation of the triplet information of the queue element is allowed. If matching data is found, it must mean that a Shell process with the same process ID has been started, and the newly added process behavior information needs to be added to the new behavior queue.

[0111] Through the above process, the technical problem of confusing the process information corresponding to different Shell command lines for analysis can be avoided.

[0112] In an optional embodiment, after building a behavior queue of the target command line based on the command behavior tree corresponding to each sliced ​​command line, the behavior view module can build a unique identifier of the target command line based on the process identifier of the target command line, the target command line, and the start execution time of the target command line, and then use the unique identifier as the queue name of the behavior queue of the target command line.

[0113] Optionally, when receiving the command line information and command line parsing information forwarded by the Shell command monitoring module, the behavior view module can construct a unique identifier of the Shell command line based on the Shell process ID, the Shell command line itself, and the execution start time of the Shell command line. The specific construction method can use plain text character splicing, calculate hash values, or combine according to specific logic. At the same time, the behavior view module can use the generated unique identifier as the name of the behavior queue.

[0114] It should be noted that although the Shell process ID will not overlap at the same time, when the Shell process ends, other Shell processes may have the same process ID. Therefore, the Shell process ID cannot be used as a unique identifier. Secondly, if the command line identifier is generated by combining the Shell process ID with the command line, the uniqueness of the Shell command cannot be guaranteed because the Shell process with the same ID can also execute the same command line. In addition, if the command line identifier is generated by combining the start time of the command line with the Shell process ID, the uniqueness of the command execution cannot be guaranteed because the same Shell process can execute multiple Shell commands. Finally, if the command line start time is combined with the command line, it is also impossible to guarantee the generation of a unique identifier because different Shell processes can run the same command line at the same time.

[0115] In summary, only by using the Shell process ID, the Shell command line itself, and the execution start time of the Shell command line at the same time can the unique identifier of the Shell command line be constructed.

[0116] In an optional embodiment, the execution behavior information generated when executing each slice command line is used as the command behavior tree corresponding to each slice command line, including: when executing the i-th slice command line, if it is detected that the j-th command line associated with the i-th slice command line is executed during the execution process, the j-th command line is parsed, wherein i and j are both positive integers; a behavior queue of the j-th command line is generated according to the parsing result of the j-th command line; and the behavior queue of the j-th command line is used as the information in the command behavior tree corresponding to the i-th slice command line.

[0117] Optionally, in the triple of a certain slice command line, the command behavior tree can nest a command behavior view. For example, assuming that a certain slice command line (corresponding to the above-mentioned i-th slice command line) is a slice command line in an encrypted state, when decrypting the slice command line, a new command line (corresponding to the above-mentioned j-th command line) needs to be executed. Since the new command line may also contain multiple slice commands, a new slice command can be parsed for the command line at this time to form a new command behavior queue (i.e., the behavior queue of the j-th command line). In other words, the information of B in the triple in the i-th slice command line can also include the behavior queue of the j-th command line.

[0118] In an optional embodiment, the technical solution of the embodiment of the present application can be applied to at least the following two scenarios:

[0119] Scenario 1: Applied to the audit scenario of system behavior, according to the technical solution of this application, a behavior tree view can be constructed based on the complete command line, and then the entire process of command execution can be observed according to the behavior tree view, and each slice command of command execution and the behavior tree corresponding to the slice command can be understood. At the same time, the execution of command slices such as background commands, built-in commands, and encrypted commands can be accurately located, which can well remind auditors to pay full attention to the details of each command execution.

[0120] Scenario 2: Applied to the detection scenario of terminal intrusion behavior, by building a behavior tree view of the command line, the attacker's encryption, disguise, background hidden execution and other attack methods will have nowhere to hide. The command line execution action will be directly associated with the system call. Combined with the intrusion detection strategy, it can not only effectively identify the attack, but also accurately locate the full picture of the attack behavior.

[0121] In summary, the technical solution of this application can at least achieve the following technical effects:

[0122] According to the technical solution of the present application, the section command lines corresponding to all command lines can be accurately located and associated with the process behavior link, thereby enabling a complete and clear understanding of the complete behavioral view of command execution and all the impacts that command execution can have on the system.

[0123] According to the technical solution of the present application, background commands, built-in commands, encrypted commands, etc. that are easily missed in conventional observations can be effectively marked and subsequent behavioral associations can be established, which is particularly effective for identifying abnormal behaviors.

[0124] According to another aspect of the embodiment of the present application, a behavior tree generating device based on a command line is also provided, wherein: Figure 3 is a schematic diagram of an optional command line-based behavior tree generation device according to an embodiment of the present application, such as Figure 3 As shown, the behavior tree generating device based on command line includes: a parsing unit 301, an acquiring unit 302, and a generating unit 303.

[0125] Among them, the parsing unit 301 is used to parse the collected target command line to obtain a parsing result, wherein the parsing result includes multiple commands in the target command line; the acquisition unit 302 is used to obtain the function call behavior information of the target instruction executed by the target command line agent; the generation unit 303 is used to generate a behavior tree of the target command line according to the parsing result and the function call behavior information, wherein the behavior tree of the target command line is used to represent the execution behavior information generated by multiple commands in the target command line during the execution process.

[0126] Optionally, the parsing unit 301 includes: a slicing subunit, a first determining subunit, and a second determining subunit. The slicing subunit is used to slice the target command line into multiple slice command lines according to the command separator in the target command line, wherein each slice command line includes at least one command; the first determining subunit is used to determine the command type of each slice command line; and the second determining subunit is used to generate a parsing result according to the multiple slice command lines obtained by slicing the target command line and the command type of each slice command line.

[0127] Optionally, the command type is any one of the following types: a first type, wherein the execution behavior information of the first type of slice command line needs to be collected through a calling module of the target instruction; a second type, wherein the second type of slice command line belongs to a slice command line executed by a background process agent of the target command line; a third type, wherein the third type of slice command line belongs to a slice command line in an encrypted state; a fourth type, wherein the fourth type of slice command line belongs to a slice command line other than the first type, the second type and the third type.

[0128] Optionally, the generation unit 303 includes: a third determination subunit, a first processing subunit, a construction subunit, and a generation subunit. The third determination subunit is used to determine the execution behavior information generated when executing each slice command line from the function call behavior information according to the process identifier and command parameter information of each slice command line; the first processing subunit is used to use the execution behavior information generated when executing each slice command line as the command behavior tree corresponding to each slice command line; the construction subunit is used to construct a behavior queue of the target command line according to the command behavior tree corresponding to each slice command line, wherein the behavior queue includes multiple triplets, each triplet includes a slice command line, the command type of the slice command line, and the command behavior tree corresponding to the slice command line; the generation subunit is used to generate the behavior tree of the target command line according to the behavior queue of the target command line.

[0129] Optionally, the construction subunit includes: a detection module, a first determination module and an update module. The detection module is used to detect whether all processes corresponding to each slice command line in the behavior queue have been executed; the first determination module is used to determine that the command behavior tree corresponding to the i-th slice command line does not need to be updated when all processes corresponding to the i-th slice command line in the behavior queue have been executed, wherein the i-th slice command line is any slice command line in the behavior queue; the update module is used to update the command behavior tree corresponding to the i-th slice command line according to the execution behavior information of the target process that has been executed when there is an unfinished target process among all processes corresponding to the i-th slice command line in the behavior queue.

[0130] Optionally, the generation subunit includes: a generation module, which is used to generate a behavior tree of the target command line according to the process identifier corresponding to each slice command line in the behavior queue and the process behavior relationship between processes corresponding to different slice command lines, wherein each tree node of the behavior tree of the target command line represents a command in the target command line and execution behavior information generated by executing the command, and the edges between adjacent tree nodes of the behavior tree of the target command line represent the association relationship between adjacent tree nodes.

[0131] Optionally, the command line-based behavior tree generation device also includes: a label setting unit and an updating unit, wherein the label setting unit is used to set a label for the behavior queue when it is detected that all processes corresponding to each slice command line in the behavior queue have been executed, wherein the label is used to indicate that the behavior queue stops updating triples; the updating unit is used to update the newly added process behavior information to the target behavior queue when it is detected that new process behavior information related to the process corresponding to any slice command line in the behavior queue appears in the function call behavior information, wherein the target behavior queue is a behavior queue for processes that are not labeled and are related to the newly added process behavior information.

[0132] Optionally, the command line-based behavior tree generation device further includes: a first parsing unit, a first generating unit, and a first processing unit. The first parsing unit is used to parse the jth command line when executing the i-th slice command line, if it is detected that the jth command line associated with the i-th slice command line is executed during the execution process, wherein i and j are both positive integers; the first generating unit is used to generate a behavior queue of the jth command line according to the parsing result of the j-th command line; and the first processing unit is used to use the behavior queue of the j-th command line as information in the command behavior tree corresponding to the i-th slice command line.

[0133] According to another aspect of the present application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer-readable storage medium, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes any one of the above-mentioned command-line-based behavior tree generation methods.

[0134] According to another aspect of the present application, an electronic device is also provided, wherein the electronic device includes one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors are implemented to run the programs, wherein the program is configured to execute any one of the above-mentioned command line-based behavior tree generation methods at runtime.

[0135] The above-mentioned embodiments or examples disclosed in the present application are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection disclosed in the present application. In the absence of contradiction, each step in a certain embodiment or example in the present application can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.

[0136] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0137] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0138] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0139] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0140] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0141] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0142] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A command line based behavior tree generation method, It is characterized in that include: Parsing the collected target command line to obtain a parsing result, wherein the parsing result includes multiple commands in the target command line; Acquire function call behavior information of a target instruction executed by the target command line agent; A behavior tree of the target command line is generated according to the parsing result and the function call behavior information, wherein the behavior tree of the target command line is used to represent execution behavior information generated during the execution of multiple commands in the target command line.

2. The command line based behavior tree generation method according to claim 1, It is characterized in that Parse the collected target command line to obtain the parsing results, including: According to the command separator in the target command line, the target command line is divided into a plurality of slice command lines, wherein each slice command line includes at least one command; Determine the command type of each slice command line; The parsing result is generated according to the multiple slice command lines obtained by segmenting the target command line and the command type of each slice command line.

3. The command line based behavior tree generation method according to claim 2, It is characterized in that The command type is any of the following: The first type, wherein the execution behavior information of the slice command line of the first type needs to be collected through the calling module of the target instruction; The second type, wherein the second type of slice command line belongs to a slice command line executed by a background process agent of the target command line; The third type, wherein the slice command line of the third type belongs to the slice command line in an encrypted state; A fourth type, wherein the fourth type of slicing command line belongs to a slicing command line other than the first type, the second type and the third type.

4. The command line based behavior tree generation method according to claim 2, It is characterized in that Generating a behavior tree of the target command line according to the parsing result and the function call behavior information includes: Determining, from the function call behavior information, execution behavior information generated when executing each slice command line according to the process identifier and command parameter information of each slice command line; Using the execution behavior information generated when executing each of the slice command lines as the command behavior tree corresponding to each of the slice command lines; According to the command behavior tree corresponding to each slice command line, a behavior queue of the target command line is constructed, wherein the behavior queue includes a plurality of triplets, each triplet includes a slice command line, a command type of the slice command line, and a command behavior tree corresponding to the slice command line; A behavior tree of the target command line is generated according to the behavior queue of the target command line.

5. The command line based behavior tree generation method according to claim 4, It is characterized in that In the process of constructing the behavior queue of the command line according to the command line behavior tree corresponding to each sliced ​​command line, the command line-based behavior tree generation method further includes: Detect whether all processes corresponding to each slice command line in the behavior queue have been executed; When all processes corresponding to the i-th slice command line in the behavior queue are executed, it is determined that the command behavior tree corresponding to the i-th slice command line does not need to be updated, wherein the i-th slice command line is any slice command line in the behavior queue; When there is an unfinished target process among all the processes corresponding to the i-th slice command line in the behavior queue, each time one of the target processes is executed and completed, the command behavior tree corresponding to the i-th slice command line is updated according to the execution behavior information of the finished target process.

6. The command line based behavior tree generation method according to claim 4, It is characterized in that Generating a behavior tree of the target command line according to the behavior queue of the target command line includes: A behavior tree of the target command line is generated according to the process identifier corresponding to each slice command line in the behavior queue and the process behavior relationship between processes corresponding to different slice command lines, wherein each tree node of the behavior tree of the target command line represents a command in the target command line and execution behavior information generated by executing the command, and the edges between adjacent tree nodes of the behavior tree of the target command line represent the association relationship between the adjacent tree nodes.

7. The command line based behavior tree generation method according to claim 4, It is characterized in that The command line-based behavior tree generation method further includes: When it is detected that all processes corresponding to each slice command line in the behavior queue have been completely executed, a label is set for the behavior queue, wherein the label is used to indicate that the behavior queue stops updating the triplet; When new process behavior information related to a process corresponding to any slice command line in the behavior queue is detected in the function call behavior information, the new process behavior information is updated to the target behavior queue, wherein the target behavior queue is a behavior queue for a process that is not labeled and related to the new process behavior information.

8. The command line based behavior tree generation method according to claim 4, It is characterized in that The execution behavior information generated when executing each slice command line is used as the command behavior tree corresponding to each slice command line, including: When executing the i-th slice command line, if it is detected that the j-th command line associated with the i-th slice command line is executed during the execution process, the j-th command line is parsed, wherein i and j are both positive integers; Generate a behavior queue of the j-th command line according to the parsing result of the j-th command line; The behavior queue of the j-th command line is used as the information in the command behavior tree corresponding to the i-th slice command line.

9. A behavior tree generation device based on command line, It is characterized in that include: A parsing unit, configured to parse the collected target command line to obtain a parsing result, wherein the parsing result includes a plurality of commands in the target command line; an acquisition unit, configured to acquire function call behavior information of a target instruction executed by the target command line agent; A generating unit is used to generate a behavior tree of the target command line according to the parsing result and the function call behavior information, wherein the behavior tree of the target command line is used to represent execution behavior information generated during the execution of multiple commands in the target command line.

10. A computer-readable storage medium, It is characterized in that The computer-readable storage medium stores a computer program, wherein when the computer program is executed, the device where the computer-readable storage medium is located executes the command line-based behavior tree generation method according to any one of claims 1 to 8.

Images