Real-time cross-host traceability graph construction method and system based on dynamic load delivery

Abstract

The invention relates to the technical field of network security, in particular to a real-time cross-host traceability graph construction method and system based on dynamic load delivery, system software and hardware and network environment information on suspicious equipment are collected based on a dynamic load delivery mode to construct a traceability graph, and a new suspicious target is identified according to the traceability graph. Iterating a load delivery and traceability analysis process, and constructing a traceability graph which comprises a complete attack process and crosses multiple hosts; comprising a load library, a load delivery module, a load, a data receiving module, a traceability graph construction module and a decision module. The load library is used for selecting a proper load according to the information of the suspicious equipment output by the decision module and transmitting the proper load to the load delivery module; the load delivery module is used for receiving the appropriate load from the load library and delivering the appropriate load from the load library to suspicious equipment; and the load is used for collecting information, which can be used for traceability graph construction, of the suspicious equipment.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and system for constructing a real-time cross-host traceability graph based on dynamic load delivery. Background Art

[0002] Provenance Graph technology is a basic technology for attack tracing. It associates isolated alarm information, takes the subject of the alarm information (usually a process, file, etc.) as the vertex, and connects the vertices to form edges (events / behaviors occurring between different subjects) according to the causal relationship between events between different vertices, thereby constructing an attack provenance graph that reflects a complete attack event / behavior. By analyzing the attack provenance graph, the attack source or the intermediate medium used by the attacker can be confirmed, as well as the attack path, so as to carry out more effective targeted defense and countermeasures.

[0003] The current traceability graph construction technology is divided into two categories: host-side traceability graph construction and network-side and terminal-side traceability graph construction.

[0004] The host-side traceability graph is constructed to mine the causal dependencies between processes, files, and file names. For example, the creation between processes, the read and write operations of different processes on the same file, the process calling the system call containing the file name, and other behaviors build a traceability graph between different behavior subjects in a single host. The above method only analyzes the intelligence information of the behavior subject in a single host, such as the creation, read and write behaviors of processes and files. Although some operations of the attacker on this device will be known, from the perspective of attack tracing, the defender cannot obtain more information about the complete attack process from this traceability graph. If the host that builds the traceability graph acts as a springboard in an attack, the source of the attack / initial access point cannot be determined, and the entry point of the attack behavior cannot be repaired.

[0005] The construction of the network-side and terminal-side traceability graphs takes into account that attack events are dynamic processes occurring between multiple hosts. This type of traceability graph tracks the sending and receiving of network data packets through related log records, and establishes the correlation between the socket process of the sender's host and the socket process of the receiver's host. On this basis, various performance optimization or packet marking technologies are considered to reduce the performance overhead generated when the network side and the terminal side are associated. Such technologies usually rely on the tracking of network data packets. The key technology is to associate the operating system logs with the network-side logs, so that intrusion behaviors on the network side can be detected. For example, behaviors such as malware downloaded and executed from the network can be captured by such traceability graphs. At the same time, when tracing the source across hosts, this solution also needs to maintain the IP address and host list in the network to identify the initiator and the receiver; if the network transmission initiator as the threat party does not respond to the socket connection from the other end device, then this type of tracing graph still cannot obtain fine-grained information about the threat party. This type of technology still has great limitations in building cross-host tracing graphs. The goal of the cross-host tracing graph is to show the complete attack process, so as to repair the system vulnerabilities shown on the tracing graph; and the existing cross-host tracing graph construction process is based on dependency analysis on the network side, with a high false alarm rate and runtime overhead, and cannot hunt for unknown threats in real time. Summary of the invention

[0006] 1. Technical issues to be solved

[0007] In view of the shortcomings of the prior art, the present invention provides a method and system for constructing a real-time cross-host traceability graph based on dynamic payload delivery. The method collects system hardware and software and network environment information on suspicious devices based on the dynamic payload delivery method to construct a traceability graph. According to new suspicious targets identified by the traceability graph, the payload delivery and traceability analysis process are iterated to construct a traceability graph across multiple hosts that includes the complete attack process.

[0008] (II) Technical solution

[0009] To achieve the above object, the present invention provides the following technical solutions: a real-time cross-host traceability graph construction system based on dynamic load delivery, comprising a load library, a load delivery module, a load, a data receiving module, a traceability graph construction module and a decision module;

[0010] Payload library: used to select appropriate payloads based on the suspicious device information output by the decision module and pass the appropriate payloads to the payload delivery module;

[0011] Payload delivery module: used to receive appropriate payloads from the payload library and deliver appropriate payloads from the payload library to suspicious devices;

[0012] Payload: used to collect information about suspicious devices that can be used to build a traceability map;

[0013] Data receiving module: used to receive information from the payload that can be used to construct the traceability graph, and transmit it to the traceability graph construction module;

[0014] Source tracing graph construction module: used to process the information collected by the payload on the suspicious device that can be used to construct the source tracing graph, and generate a cross-host source tracing graph;

[0015] Decision-making module: Based on the alarm information of the user device or the cross-host traceability graph from the traceability graph construction module, select suspicious targets that have not yet delivered appropriate payloads and record them as devices to be delivered. Based on the information of the devices to be delivered, notify the payload library to prepare appropriate payloads for subsequent delivery processes, analyze the cross-host traceability graph output by the traceability graph construction module, and mine newly associated suspicious targets.

[0016] Furthermore, the present invention is improved in that the payload library contains effective payloads for different platforms, different operating systems, and different file types.

[0017] Furthermore, the present invention has been improved in that the method of delivering the payload from the payload library to the suspicious device includes: Web service, SMB, RDP, AFP, AirDrop, NFS, SFTP, FTP and WebDAV.

[0018] Furthermore, the present invention is improved in that the information that can be used to construct the traceability graph includes the device's hardware information, operating system, application information, user name, user identity, application running and security log.

[0019] Furthermore, the present invention has been improved in that the information collected by the processing load on the suspicious device and which can be used to construct a traceability graph is used to generate a method for generating a cross-host traceability graph, comprising the following steps: mining the dependency relationships between processes, files, file names and network interfaces based on the causal relationships between the various behavioral entities within a single host, performing dependency analysis based on the IP and device information of the network data packet and the network environment and device information of the suspicious device, correlating and analyzing the data exchange, remote login and remote code execution behaviors between multiple hosts, and mining the dependency relationships between the various behavioral entities between different hosts.

[0020] Furthermore, the present invention has been improved in that the newly associated suspicious target is processed as follows: if the suspicious target has not delivered an appropriate payload, the payload library and the payload delivery module are notified to deliver the appropriate payload and collect information that can be used to construct a traceability graph; if there is no new suspicious target in the cross-host traceability graph, the cross-host traceability graph is output to complete the attack tracing process.

[0021] A method for constructing a real-time cross-host traceability graph based on dynamic load delivery of the present invention comprises the following steps:

[0022] Receive alarm information from user equipment and identify suspicious devices based on the alarm information;

[0023] Extract information from suspicious devices and determine appropriate payloads;

[0024] Deliver the determined appropriate payload to the suspicious device;

[0025] The appropriate payload collects information that can be used to construct a traceability map on the suspicious device. The collected information that can be used to construct a traceability map is used to construct a cross-host traceability map.

[0026] According to the alarm information of the user device or the cross-host tracing diagram, select suspicious devices that have not yet delivered appropriate payloads and record them as devices to be delivered. According to the information of the devices to be delivered, prepare appropriate payloads for the subsequent delivery process;

[0027] Analyze cross-host traceability graphs and discover newly associated suspicious targets.

[0028] Furthermore, the present invention has the following improvements: after mining the newly associated suspicious target, if the suspicious target has not delivered an appropriate payload, then determining the appropriate payload, delivering the appropriate payload, and constructing a cross-host traceability graph are performed; if there is no new suspicious target in the cross-host traceability graph, then the cross-host traceability graph is output to complete the attack tracing process.

[0029] (III) Beneficial effects

[0030] Compared with the prior art, the present invention provides a real-time cross-host traceability graph construction method and system based on dynamic payload delivery, which has the following beneficial effects: there is no need to deploy terminal detection programs on the device to be traced in advance, but various information of suspicious devices is collected by payload delivery, so as to complete the construction of the traceability graph related to the suspicious device. The construction of the cross-host traceability graph is divided into multiple stages. By analyzing the sub-tracing graphs of different stages, new suspicious devices are discovered, and the traceability graph construction process is iterated. The dependency relationship between the traceability graphs of different hosts is naturally established, and finally a cross-host traceability graph containing the complete attack process is constructed, which has strong real-time performance and correctness of cross-host dependencies. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a structural schematic diagram of a real-time cross-host traceability graph construction system based on dynamic load delivery of the present invention;

[0032] Figure 2 It is a flow chart of a method for constructing a real-time cross-host traceability graph based on dynamic load delivery of the present invention. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0034] See also Figure 1 ,The present invention is a real-time cross-host traceability graph construction system based on dynamic load delivery, including a load library, a load delivery module, a load, a data receiving module, a traceability graph construction module and a decision module;

[0035] Payload library: The payload library contains payloads for different platforms, different operating systems, and different file types. The payload library is used to select appropriate payloads based on the system version and platform information of the suspicious device output by the decision module, and pass the appropriate payload to the payload delivery module through Web services, SMB, RDP, AFP, AirDrop, NFS, SFTP, FTP, and WebDAV. More specifically, the payload library is used to select appropriate payloads based on the system version and platform information of the suspicious device output by the decision module. The method is as follows: Select different payload types based on the system version and platform information, mainly considering the support of different devices for executable files / scripts, specifically:

[0036] Linux:

[0037] ELF format: Executable and linking format (ELF) for Linux operating system, suitable for different architectures such as x86, x86_64, ARM, etc.

[0038] Shell script: A script executed by a command line interpreter such as bash or sh, which can be run on most Unix / Linux systems.

[0039] macOS:

[0040] Mach-O format: The executable file format used on macOS and iOS operating systems, suitable for x86_64 and ARM64 (Apple Silicon) architectures;

[0041] AppleScript: Scripts that automate tasks on macOS.

[0042] Windows:

[0043] PE format executable file: the standard executable file format of Windows, suitable for x86 and x64 architectures;

[0044] Script file: Batch file (.bat or .cmd): A script executed using the Windows command line interpreter (cmd.exe) that can execute commands, call programs, etc.

[0045] PowerShell scripts (.ps1): Scripts executed through Windows PowerShell, which are powerful and suitable for automated tasks;

[0046] Appropriate payloads are delivered to the payload delivery module via Web services, SMB, RDP, AFP, AirDrop, NFS, SFTP, FTP, and WebDAV. The specific selection method is as follows: The selection of the above protocols / channels mainly takes into account that different platforms have different supported and open protocols, and choose a more suitable delivery channel, as follows:

[0047] 1. Web service (HTTP / HTTPS protocol):

[0048] Applicable platform: cross-platform (Windows, Linux, macOS, etc.)

[0049] Transmission method: Through HTTP or HTTPS protocol, the payload file can be hosted on a web server and then downloaded through a URL link. Common methods include using curl or wget commands to directly download the payload file, or embedding it in a web page and downloading and executing it through the user's browser. HTTPS provides encrypted transmission and increased security.

[0050] 2.SMB (Server Message Block)

[0051] Applicable platforms: mainly Windows, some Linux systems support (through Samba);

[0052] Transfer method: The SMB protocol allows file sharing and remote file system access. In a Windows network, the payload file can be placed in a shared path accessible to the target device by sharing a folder. The target device can use the net use command or directly access the shared path to obtain the file.

[0053] 3.RDP (Remote Desktop Protocol)

[0054] Applicable platforms: mainly Windows;

[0055] Transfer method: RDP is not only used for remote desktop connection, but also for file transfer. Through the RDP session, users can directly copy and paste files between the local and remote computers, or map local drives to the remote session for easy file transfer. In the RDP session, files are transferred to the remote system through "mapped drive".

[0056] 4.AFP (Apple Filing Protocol)

[0057] Applicable platforms: mainly macOS;

[0058] Transmission method: The AFP protocol is used for file sharing between Apple devices. Users can set up AFP file sharing in the macOS system, upload the payload file to the shared directory, and then access the remote shared folder through Finder and download the payload file.

[0059] 5. AirDrop

[0060] Applicable platforms: macOS, iOS;

[0061] Transfer method: AirDrop is a near-field file transfer protocol based on Bluetooth and Wi-Fi. Users can use AirDrop to directly send payload files to nearby Apple devices, and the receiving device will pop up a confirmation box to ask the user to accept the file transfer. On a macOS or iOS device, select the payload file and send it to the target device via AirDrop. The target device will receive the file after confirming.

[0062] 6. NFS (Network File System)

[0063] Applicable platforms: mainly Linux and Unix systems, macOS is also supported;

[0064] Transmission method: NFS is used to share file systems across networks. In Linux / Unix environments, you can mount an NFS shared directory and place the payload file in the directory. The target device can access and download the file by mounting the NFS share.

[0065] 7.SFTP (SSH File Transfer Protocol)

[0066] Applicable platform: cross-platform (Windows, Linux, macOS, etc.);

[0067] Transmission method: SFTP is a file transfer protocol based on SSH that provides an encrypted transmission channel. You can upload payload files to a remote server or download payload files from a server using an SFTP client (such as the scp command or GUI tool).

[0068] 8.FTP (File Transfer Protocol)

[0069] Applicable platform: cross-platform (Windows, Linux, macOS, etc.);

[0070] Transmission method: FTP is a classic file transfer protocol that provides file upload and download functions. You can upload payload files to an FTP server or download payload files from a server through an FTP client (such as the ftp command, FileZilla, etc.). FTP is not encrypted by default, and FTPS uses TLS for encrypted transmission.

[0071] 9.WebDAV (Web Distributed Authoring and Versioning)

[0072] Applicable platform: cross-platform (Windows, Linux, macOS, etc.)

[0073] Transmission method: WebDAV is an extended HTTP protocol that allows users to manage files on a Web server. Through WebDAV, you can upload payload files to the server or download payload files through a WebDAV client (such as Windows network drive mapping, Linux davfs2 tool).

[0074] Payload delivery module: used to receive appropriate payloads from the payload library and deliver appropriate payloads from the payload library to suspicious devices;

[0075] Payload: used to collect information about suspicious devices that can be used to build a traceability map;

[0076] Data receiving module: used to receive information from the payload that can be used to construct the traceability graph, and transmit it to the traceability graph construction module. The information that can be used to construct the traceability graph includes the device's hardware information, operating system, application information, user name, user identity, application running and security log;

[0077] Source graph construction module: used to process the information collected by the payload on the suspicious device that can be used to construct the source graph, and generate a cross-host source graph, including the following steps: mining the dependency relationship between processes, files, file names and network interfaces based on the causal relationship between the various behavioral subjects in a single host, performing dependency analysis based on the IP and device information of the network data packet and the network environment and device information of the suspicious device, and correlating and analyzing the data exchange, remote login and remote code execution behaviors between multiple hosts, and mining the dependency relationship between the various behavioral subjects between different hosts;

[0078] Decision-making module: According to the alarm information of the user device or the cross-host traceability graph from the traceability graph construction module, select the suspicious target that has not yet delivered the appropriate payload and record it as the device to be delivered. According to the information of the device to be delivered, notify the payload library to prepare the appropriate payload for the subsequent delivery process, analyze the cross-host traceability graph output by the traceability graph construction module, and mine the newly associated suspicious targets; the newly associated suspicious targets are processed as follows: if the suspicious target has not yet delivered the appropriate payload, notify the payload library and the payload delivery module to deliver the appropriate payload and collect information that can be used for traceability graph construction; if there is no new suspicious target in the cross-host traceability graph, output the cross-host traceability graph to complete the attack tracing process.

[0079] In the above system, by delivering a payload to a suspicious device, the payload directly collects security logs and system logs, running processes and services, open ports, network environment and other information on the suspicious device, and transmits the relevant information back to the traceability system, and constructs a traceability graph by analyzing the collected information; the construction of a cross-host traceability graph is divided into multiple stages, analyzing the newly discovered suspicious devices in the traceability graph constructed in the previous stage, and iterating the process of payload delivery, information collection, and traceability graph construction again, constantly improving the traceability process, and finally constructing a cross-host traceability graph that includes the complete attack process.

[0080] like Figure 2 As shown, a real-time cross-host traceability graph construction method based on dynamic payload delivery of the present invention includes the following steps:

[0081] Receive alarm information from user equipment and identify suspicious devices based on the alarm information;

[0082] Extract information from suspicious devices and determine appropriate payloads;

[0083] Deliver the determined appropriate payload to the suspicious device;

[0084] The appropriate payload collects information that can be used to construct a traceability map on the suspicious device. The collected information that can be used to construct a traceability map is used to construct a cross-host traceability map.

[0085] According to the alarm information of the user device or the cross-host tracing diagram, select suspicious devices that have not yet delivered appropriate payloads and record them as devices to be delivered. According to the information of the devices to be delivered, prepare appropriate payloads for the subsequent delivery process;

[0086] Analyze the cross-host traceability graph and mine new associated suspicious targets. If the suspicious target has not delivered an appropriate payload, determine the appropriate payload, deliver the appropriate payload, and build a cross-host traceability graph. If there is no new suspicious target in the cross-host traceability graph, output the cross-host traceability graph to complete the attack tracing process.

[0087] The following example uses an external user trying to log in to a device through the ssh service to explain the operation process of the traceability system as follows:

[0088] ① Device alarm: The user device detects suspicious login behavior of external device A, and the security protection software of the user device reports this behavior to the traceability system;

[0089] ②Payload selection: The decision module of the traceability system informs the payload library to select an appropriate payload based on the IP address of the external suspicious device A and the system information when it establishes an SSH connection;

[0090] ③ Payload delivery: The payload delivery module delivers the appropriate payload selected by the payload library to the suspicious device through the SMB service;

[0091] ④ Information collection and feedback: The payload runs on the suspicious device A, collects various information of the suspicious device, and transmits it back to the traceability system;

[0092] ⑤ Construction of traceability graph: The traceability system analyzes the returned information and finds that CobaltStrike Beacon is running on suspicious device A. It also finds suspicious file upload behavior through system logs. The file upload behavior comes from suspicious device B. The traceability system builds a traceability graph based on this clue, which includes suspicious device A and its network and device information, CobaltStrike Beacon process, connection established by ssh service, suspicious device B and its network and device information, uploaded suspicious files, etc.

[0093] ⑥Whether a suspicious device is found: The decision module analyzes the first-stage traceability graph and finds a newly discovered suspicious device B. It then iterates steps ② to ⑤ to deliver a new payload to the suspicious device B, collect information, and build a traceability graph until no new suspicious devices are found. The output is a cross-host traceability graph that includes the complete attack process.

[0094] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A real-time cross-host traceability graph construction system based on dynamic load delivery, characterized in that: It includes payload library, payload delivery module, payload, data receiving module, traceability graph building module and decision module; Payload library: used to select appropriate payloads based on the suspicious device information output by the decision module and pass the appropriate payloads to the payload delivery module; Payload delivery module: used to receive appropriate payloads from the payload library and deliver appropriate payloads from the payload library to suspicious devices; Payload: used to collect information about suspicious devices that can be used to build a traceability map; Data receiving module: used to receive information from the payload that can be used to construct the traceability graph, and transmit it to the traceability graph construction module; Source tracing graph construction module: used to process the information collected by the payload on the suspicious device that can be used to construct the source tracing graph, and generate a cross-host source tracing graph; Decision module: According to the alarm information of the user device or the cross-host traceability graph from the traceability graph construction module, select the suspicious targets that have not yet delivered the appropriate payload and record them as the devices to be delivered. According to the information of the devices to be delivered, notify the payload library to prepare the appropriate payload, analyze the cross-host traceability graph output by the traceability graph construction module, and mine newly associated suspicious targets.

2. According to the real-time cross-host traceability graph construction system based on dynamic load delivery according to claim 1, it is characterized in that: The payload library contains payloads for different platforms, different operating systems, and different file types.

3. According to the real-time cross-host traceability graph construction system based on dynamic load delivery according to claim 1, it is characterized in that: The methods of delivering the payload from the payload library to the suspicious device include: Web service, SMB, RDP, AFP, AirDrop, NFS, SFTP, FTP and WebDAV.

4. According to claim 1, a real-time cross-host traceability graph construction system based on dynamic load delivery is characterized in that: The information that can be used to construct the traceability graph includes the device's hardware information, operating system, application information, user name, user identity, application running and security log.

5. A real-time cross-host traceability graph construction system based on dynamic load delivery according to claim 1, characterized in that: The method for generating a cross-host traceability graph by processing information collected by the load on a suspicious device and used for constructing a traceability graph includes the following steps: mining the dependency relationship between processes, files, file names and network interfaces based on the causal relationship between various behavioral subjects within a single host, performing dependency analysis based on the IP and device information of the network data packet and the network environment and device information of the suspicious device, correlating and analyzing the data exchange, remote login and remote code execution behaviors between multiple hosts, and mining the dependency relationship between various behavioral subjects between different hosts.

6. A real-time cross-host traceability graph construction system based on dynamic load delivery according to claim 1, characterized in that: The newly associated suspicious target is processed as follows: if the suspicious target has not delivered an appropriate payload, the payload library and payload delivery module are notified to deliver the appropriate payload and collect information that can be used to construct a traceability graph; if there is no new suspicious target in the cross-host traceability graph, the cross-host traceability graph is output.

7. A method for constructing a real-time cross-host traceability graph based on dynamic payload delivery, characterized in that: The following steps are involved: Receive alarm information from user equipment and identify suspicious devices based on the alarm information; Extract information from suspicious devices and determine appropriate payloads; Deliver the determined appropriate payload to the suspicious device; The appropriate payload collects information that can be used to construct a traceability map on the suspicious device. The collected information that can be used to construct a traceability map is used to construct a cross-host traceability map. According to the alarm information of the user device or the cross-host tracing diagram, select suspicious devices that have not yet delivered appropriate payloads and record them as devices to be delivered. According to the information of the devices to be delivered, prepare appropriate payloads for the subsequent delivery process; Analyze cross-host traceability graphs and discover newly associated suspicious targets.

8. A method for constructing a real-time cross-host traceability graph based on dynamic payload delivery according to claim 7, characterized in that: After mining the newly associated suspicious target, if the suspicious target has not delivered an appropriate payload, the appropriate payload is determined, the appropriate payload is delivered, and a cross-host tracing graph is constructed; if there is no new suspicious target in the cross-host tracing graph, the cross-host tracing graph is output to complete the attack tracing process.

Images