A real-time cross-host traceability graph construction method and system based on dynamic payload delivery

Abstract

The present invention relates to the technical field of network security, and specifically to a real-time cross-host traceability graph construction method and system based on dynamic load delivery. The method collects system hardware and software and network environment information on suspicious devices based on the dynamic load delivery method for constructing a traceability graph, and iterates the load delivery and traceability analysis process according to new suspicious targets identified by the traceability graph to construct a traceability graph across multiple hosts that includes a complete attack process; the method includes a load library, a load delivery module, a load, a data receiving module, a traceability graph construction module and a decision module; the load library is used to select an appropriate load according to the information of the suspicious device output by the decision module, and pass the appropriate load to the load delivery module; the load delivery module is used to receive an appropriate load from the load library and deliver the appropriate load from the load library to the suspicious device; the load is used to collect information of the suspicious device that can be used to construct the traceability graph.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method and system for constructing a real-time cross-host traceability graph based on dynamic payload delivery. Background Art

[0002] Provenance graph technology is a foundational technique for attack tracing. It correlates isolated alerts, using the actors (typically processes, files, etc.) of the alerts as vertices. Based on the causal relationships between events, these vertices are connected to form edges (events / actions occurring between different actors), thereby constructing an attack provenance graph that reflects a complete attack event / action. By analyzing the provenance graph, we can identify the attack source or the intermediate media used by the attacker, as well as the attack path, enabling more effective targeted defense and countermeasures.

[0003] Current traceability graph construction technologies are divided into two categories: host-side traceability graph construction and network-side and terminal-side traceability graph construction.

[0004] The host-side traceability graph is constructed to mine the causal dependencies between processes, files, and file names. For example, the creation between processes, the read and write operations of different processes on the same file, the process calling the system call containing the file name, and other behaviors build a traceability graph between different behavior subjects in a single host. The above method only analyzes the intelligence information of the behavior subjects in a single host, such as the creation, read and write behaviors of processes and files. Although some operations of the attacker on this device will be known, from the perspective of attack tracing, the defender cannot obtain more information about the complete attack process from this traceability graph. If the host that constructs the traceability graph acts as a springboard in an attack, the source of the attack / initial access point cannot be determined, and the entry point of the attack behavior cannot be repaired.

[0005] The construction of the network-side and terminal-side traceability graphs takes into account that attack events are dynamic processes occurring between multiple hosts. This type of traceability graph uses relevant log records to track the sending and receiving of network data packets, and establishes the correlation between the socket process of the sending host and the socket process of the receiving host; on this basis, various performance optimization or data packet marking technologies are considered to reduce the performance overhead generated when the network side and the terminal side are associated; such technologies usually rely on tracking network data packets, and the key technology is to associate operating system logs with network-side logs, so that intrusion behaviors on the network side can be detected, such as behaviors such as downloading and executing malware from the network can be captured by such traceability graphs. At the same time, when tracing the source across hosts, this solution also needs to maintain the IP address and host list in the network to identify the initiator and the receiver; if the network transmission initiator as the threat party does not respond to the socket connection from the other end device, then this type of tracing graph still cannot obtain fine-grained information about the threat party. This type of technology still has great limitations in constructing cross-host tracing graphs. The goal of the cross-host tracing graph is to show the complete attack process, so as to repair the system vulnerabilities shown on the tracing graph; the existing cross-host tracing graph construction process is based on network-side dependency analysis, has a high false alarm rate and runtime overhead, and cannot hunt for unknown threats in real time. Summary of the Invention

[0006] (1) Technical problems solved

[0007] In response to the shortcomings of the existing technology, the present invention provides a real-time cross-host traceability graph construction method and system based on dynamic payload delivery. Based on the dynamic payload delivery method, the system hardware and software and network environment information on suspicious devices are collected to construct a traceability graph. According to the new suspicious targets identified by the traceability graph, the payload delivery and traceability analysis process are iterated to construct a traceability graph across multiple hosts that includes the complete attack process.

[0008] (2) Technical solution

[0009] To achieve the above-mentioned object, the present invention provides the following technical solutions: a real-time cross-host traceability graph construction system based on dynamic payload delivery, comprising a payload library, a payload delivery module, a payload, a data receiving module, a traceability graph construction module, and a decision module;

[0010] Payload library: used to select appropriate payloads based on the suspicious device information output by the decision module and pass the appropriate payloads to the payload delivery module;

[0011] Payload delivery module: used to receive appropriate payloads from the payload library and deliver appropriate payloads from the payload library to suspicious devices;

[0012] Payload: used to collect information about suspicious devices that can be used to construct a traceability map;

[0013] Data receiving module: used to receive information from the payload that can be used to construct the traceability graph and transmit it to the traceability graph construction module;

[0014] The traceability graph construction module processes the information collected by the payload on the suspicious device and generates a cross-host traceability graph.

[0015] Decision-making module: Based on the alarm information of the user device or the cross-host traceability graph from the traceability graph construction module, select suspicious targets that have not yet delivered appropriate payloads and record them as devices to be delivered. Based on the information of the devices to be delivered, notify the payload library to prepare appropriate payloads for subsequent delivery processes, analyze the cross-host traceability graph output by the traceability graph construction module, and mine newly associated suspicious targets.

[0016] Furthermore, the present invention is improved in that the payload library contains payloads for different platforms, different operating systems, and different file types.

[0017] Furthermore, the present invention is improved in that the method of delivering the payload from the payload library to the suspicious device includes: Web service, SMB, RDP, AFP, AirDrop, NFS, SFTP, FTP and WebDAV.

[0018] Furthermore, the present invention has been improved in that the information that can be used to construct the traceability graph includes the device's hardware information, operating system, application information, user name, user identity, application running and security log.

[0019] Furthermore, the present invention has improvements in that the information collected by the processing load on the suspicious device and which can be used to construct the traceability graph, and the method for generating a cross-host traceability graph, includes the following steps: mining the dependency relationship between processes, files, file names and network interfaces based on the causal relationship between each behavioral subject within a single host, performing dependency analysis based on the IP and device information of the network data packet and the network environment and device information of the suspicious device, correlating and analyzing the data exchange, remote login and remote code execution behaviors between multiple hosts, and mining the dependency relationship between each behavioral subject between different hosts.

[0020] Furthermore, the present invention has the following improvements: if the suspicious target has not yet delivered an appropriate payload, the payload library and payload delivery module are notified to deliver the appropriate payload and collect information that can be used to construct a traceability graph; if there is no new suspicious target in the cross-host traceability graph, the cross-host traceability graph is output to complete the attack tracing process.

[0021] A method for constructing a real-time cross-host traceability graph based on dynamic payload delivery of the present invention comprises the following steps:

[0022] Receive alarm information from user devices and identify suspicious devices based on the alarm information;

[0023] Extract information from suspicious devices and determine appropriate payloads;

[0024] Deliver the determined appropriate payload to the suspicious device;

[0025] Appropriate payloads collect information on suspicious devices that can be used to construct a traceability map. The collected information is used to construct a cross-host traceability map.

[0026] Based on the alarm information of the user device or the cross-host traceability map, suspicious devices that have not yet delivered the appropriate payload are selected and recorded as the devices to be delivered. Based on the information of the devices to be delivered, appropriate payloads are prepared for the subsequent delivery process;

[0027] Analyze cross-host traceability graphs and discover newly associated suspicious targets.

[0028] Furthermore, the present invention has the following improvements: after mining the newly associated suspicious target, if the suspicious target has not yet delivered an appropriate payload, the appropriate payload is determined, the appropriate payload is delivered, and a cross-host tracing graph is constructed; if there is no new suspicious target in the cross-host tracing graph, the cross-host tracing graph is output to complete the attack tracing process.

[0029] (3) Beneficial effects

[0030] Compared with the existing technology, the present invention provides a real-time cross-host traceability graph construction method and system based on dynamic payload delivery, which has the following beneficial effects: there is no need to deploy terminal detection programs on the device to be traced in advance, but various information of suspicious devices is collected through payload delivery, thereby completing the construction of the traceability graph related to the suspicious device. The cross-host traceability graph construction is divided into multiple stages. By analyzing the sub-traceability graphs at different stages, new suspicious devices are discovered, and the traceability graph construction process is iterated. The dependency relationship between the traceability graphs of different hosts is naturally established, and finally a cross-host traceability graph containing the complete attack process is constructed, which has strong real-time performance and the correctness of the cross-host dependency relationship. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a structural diagram of a real-time cross-host traceability graph construction system based on dynamic payload delivery of the present invention;

[0032] Figure 2 It is a flow chart of a method for constructing a real-time cross-host traceability graph based on dynamic payload delivery according to the present invention. DETAILED DESCRIPTION

[0033] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0034] See also Figure 1 ,The present invention is a real-time cross-host traceability graph construction system based on dynamic payload delivery, ,including a payload library, a payload delivery module, a payload,data receiving module, a traceability graph construction module and a decision module;

[0035] Payload Library: The Payload Library contains payloads for different platforms, operating systems, and file types. The Payload Library selects appropriate payloads based on the system version and platform information of the suspicious device output by the decision module. These payloads are then delivered to the Payload Delivery Module via Web Services, SMB, RDP, AFP, AirDrop, NFS, SFTP, FTP, and WebDAV. More specifically, the Payload Library selects appropriate payloads based on the system version and platform information of the suspicious device output by the decision module. The method for selecting different payload types based on the system version and platform information is as follows: This primarily takes into account the executable file / script support of different devices. Specifically:

[0036] Linux:

[0037] ELF format: Executable and linking format (ELF) for Linux operating systems, suitable for different architectures such as x86, x86_64, and ARM;

[0038] Shell scripts: Scripts executed by command-line interpreters such as bash and sh, which can be run on most Unix / Linux systems;

[0039] macOS:

[0040] Mach-O format: The executable file format used on macOS and iOS operating systems, suitable for x86_64 and ARM64 (Apple Silicon) architectures;

[0041] AppleScript: Scripts that automate tasks on macOS.

[0042] Windows:

[0043] PE format executable file: the standard executable file format of Windows, suitable for x86 and x64 architectures;

[0044] Script file: Batch file (.bat or .cmd): A script executed using the Windows command line interpreter (cmd.exe) that can execute commands, call programs, etc.

[0045] PowerShell scripts (.ps1): Scripts executed through Windows PowerShell, which are powerful and suitable for automating tasks;

[0046] Appropriate payloads are delivered to the payload delivery module via Web services, SMB, RDP, AFP, AirDrop, NFS, SFTP, FTP, and WebDAV. The specific selection method is as follows: The selection of the above protocols / channels mainly takes into account the different platforms based on their supported and open protocols, and the more suitable delivery channel is selected as follows:

[0047] 1. Web service (HTTP / HTTPS protocol):

[0048] Applicable platform: cross-platform (Windows, Linux, macOS, etc.)

[0049] Transmission method: The payload file can be hosted on a web server using HTTP or HTTPS protocols and then downloaded via a URL. Common methods include using the curl or wget commands to directly download the payload file, or embedding it in a web page and downloading and executing it through the user's browser. HTTPS provides encrypted transmission for increased security.

[0050] 2.SMB (Server Message Block)

[0051] Applicable platforms: mainly Windows, some Linux systems are supported (through Samba);

[0052] Transfer method: The SMB protocol allows file sharing and remote file system access. On a Windows network, you can place the payload file in a shared path accessible to the target device using a shared folder. The target device can then retrieve the file using the net use command or by directly accessing the shared path.

[0053] 3.RDP (Remote Desktop Protocol)

[0054] Applicable platforms: mainly Windows;

[0055] Transfer Methods: RDP is not only used for remote desktop connections, but can also be used for file transfers. Through an RDP session, users can copy and paste files directly between the local and remote computers, or map local drives to the remote session for easier file transfers. Within an RDP session, files can be transferred to the remote system using "Map Drive."

[0056] 4.AFP (Apple Filing Protocol)

[0057] Applicable platforms: mainly macOS;

[0058] Transfer method: The AFP protocol is used for file sharing between Apple devices. Users can set up AFP file sharing in macOS, upload payload files to a shared directory, and then access the remote shared folder using Finder to download the payload files.

[0059] 5. AirDrop

[0060] Applicable platforms: macOS, iOS;

[0061] Transfer method: AirDrop is a near-field file transfer protocol based on Bluetooth and Wi-Fi. Users can use AirDrop to send payload files directly to nearby Apple devices. The receiving device will pop up a confirmation box to ask the user to accept the file transfer. On a macOS or iOS device, select the payload file and send it to the target device via AirDrop. The target device will confirm and receive the file.

[0062] 6. NFS (Network File System)

[0063] Applicable platforms: mainly Linux and Unix systems, macOS is also supported;

[0064] Transmission method: NFS is used to share file systems across a network. In Linux / Unix environments, you can mount an NFS share directory and place the payload file there. The target device can then access and download the file by mounting the NFS share.

[0065] 7.SFTP (SSH File Transfer Protocol)

[0066] Applicable platform: cross-platform (Windows, Linux, macOS, etc.);

[0067] Transfer method: SFTP is a file transfer protocol based on SSH that provides an encrypted transmission channel. You can use an SFTP client (such as the scp command or a GUI tool) to upload and download payload files to a remote server.

[0068] 8.FTP (File Transfer Protocol)

[0069] Applicable platform: cross-platform (Windows, Linux, macOS, etc.);

[0070] Transfer Method: FTP is a classic file transfer protocol that provides file upload and download capabilities. You can use an FTP client (such as the ftp command or FileZilla) to upload and download payload files to and from an FTP server. FTP is unencrypted by default, while FTPS uses TLS for encrypted transmission.

[0071] 9.WebDAV (Web Distributed Authoring and Versioning)

[0072] Applicable platform: cross-platform (Windows, Linux, macOS, etc.)

[0073] Transfer method: WebDAV is an extension of the HTTP protocol that allows users to manage files on a web server. Through WebDAV, payload files can be uploaded to the server or downloaded using a WebDAV client (such as Windows network drive mapping or Linux's davfs2 tool).

[0074] Payload delivery module: used to receive appropriate payloads from the payload library and deliver appropriate payloads from the payload library to suspicious devices;

[0075] Payload: used to collect information about suspicious devices that can be used to construct a traceability map;

[0076] Data receiving module: used to receive information from the payload that can be used to build the traceability graph and transmit it to the traceability graph construction module. The information that can be used to build the traceability graph includes the device's hardware information, operating system, application information, user name, user identity, application operation and security logs;

[0077] The traceability graph construction module is used to process the information collected by the payload on the suspicious device that can be used to construct the traceability graph, and generate a cross-host traceability graph. The module includes the following steps: based on the causal relationship between the various behavioral entities within a single host, it mines the dependency relationships between processes, files, file names, and network interfaces; it performs dependency analysis based on the IP address and device information of the network data packet and the network environment and device information of the suspicious device; it also conducts correlation analysis on the data exchange, remote login, and remote code execution behaviors between multiple hosts; and it mines the dependency relationships between the various behavioral entities across different hosts.

[0078] Decision module: Based on the alarm information of the user device or the cross-host traceability graph from the traceability graph construction module, select suspicious targets that have not yet delivered appropriate payloads and record them as devices to be delivered. Based on the information of the devices to be delivered, notify the payload library to prepare appropriate payloads for subsequent delivery processes, analyze the cross-host traceability graph output by the traceability graph construction module, and mine newly associated suspicious targets; the newly associated suspicious targets are processed as follows: if the suspicious target has not yet delivered appropriate payloads, notify the payload library and payload delivery module to deliver appropriate payloads and collect information that can be used for traceability graph construction; if there are no new suspicious targets in the cross-host traceability graph, output the cross-host traceability graph to complete the attack tracing process.

[0079] In the above system, by delivering a payload to a suspicious device, the payload directly collects security logs and system logs, running processes and services, open ports, network environment and other information on the suspicious device, and transmits the relevant information back to the traceability system. The traceability graph is constructed by analyzing the collected information; the construction of the cross-host traceability graph is divided into multiple stages. The newly discovered suspicious devices in the traceability graph constructed in the previous stage are analyzed, and the process of payload delivery, information collection, and traceability graph construction is iterated again to continuously improve the traceability process and finally construct a cross-host traceability graph that includes the complete attack process.

[0080] like Figure 2 As shown, a method for constructing a real-time cross-host traceability graph based on dynamic payload delivery of the present invention includes the following steps:

[0081] Receive alarm information from user devices and identify suspicious devices based on the alarm information;

[0082] Extract information from suspicious devices and determine appropriate payloads;

[0083] Deliver the determined appropriate payload to the suspicious device;

[0084] Appropriate payloads collect information on suspicious devices that can be used to construct a traceability map. The collected information is used to construct a cross-host traceability map.

[0085] Based on the alarm information of the user device or the cross-host traceability map, suspicious devices that have not yet delivered the appropriate payload are selected and recorded as the devices to be delivered. Based on the information of the devices to be delivered, appropriate payloads are prepared for the subsequent delivery process;

[0086] Analyze the cross-host traceability graph and mine newly associated suspicious targets. If the suspicious target has not yet delivered an appropriate payload, determine the appropriate payload, deliver the appropriate payload, and build a cross-host traceability graph. If there is no new suspicious target in the cross-host traceability graph, output the cross-host traceability graph to complete the attack tracing process.

[0087] The following example uses an external user trying to log in to a device using the SSH service to illustrate the operation process of the traceability system as follows:

[0088] ① Device alarm - The user device detects suspicious login behavior from external device A, and the security protection software of the user device reports this behavior to the traceability system;

[0089] ② Payload selection: The decision module of the traceability system informs the payload library to select an appropriate payload based on the IP address of the external suspicious device A and the system information when it establishes the SSH connection;

[0090] ③ Payload delivery: The payload delivery module delivers the appropriate payload selected by the payload library to the suspicious device through the SMB service;

[0091] ④ Information collection and feedback: The payload runs on suspicious device A, collects various types of information about the suspicious device, and transmits it back to the traceability system;

[0092] ⑤ Source Map Construction: The source traceability system analyzes the returned information and finds that CobaltStrike Beacon is running on suspicious device A. It also discovers suspicious file upload behavior through system logs. The file upload behavior comes from suspicious device B. Based on this clue, the source traceability system constructs a source map, which includes suspicious device A and its network and device information, CobaltStrike Beacon process, connections established by the SSH service, suspicious device B and its network and device information, and uploaded suspicious files.

[0093] ⑥ Whether a suspicious device is found: The decision module analyzes the first-stage traceability graph and finds a newly discovered suspicious device B. It then iterates steps ② to ⑤, delivering a new payload to suspicious device B, collecting information, and constructing a traceability graph until no new suspicious devices are found. The module then outputs a cross-host traceability graph that contains the complete attack process.

[0094] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A real-time cross-host traceability graph construction system based on dynamic payload delivery, characterized by: It includes payload library, payload delivery module, payload,data receiving module, traceability graph construction module and decision module; Payload library: used to select appropriate payloads based on the suspicious device information output by the decision module and pass the appropriate payloads to the payload delivery module; Payload delivery module: used to receive appropriate payloads from the payload library and deliver appropriate payloads from the payload library to suspicious devices; Payload: used to collect information about suspicious devices that can be used to construct a traceability map; Data receiving module: used to receive information from the payload that can be used to construct the traceability graph and transmit it to the traceability graph construction module; The traceability graph construction module processes the information collected by the payload on the suspicious device and generates a cross-host traceability graph. Decision module: Based on the alarm information of the user device or the cross-host traceability graph from the traceability graph construction module, select suspicious targets that have not yet delivered appropriate payloads and record them as devices to be delivered. Based on the information of the devices to be delivered, notify the payload library to prepare appropriate payloads, analyze the cross-host traceability graph output by the traceability graph construction module, and mine newly associated suspicious targets.

2. A real-time cross-host traceability graph construction system based on dynamic payload delivery according to claim 1, characterized in that: The payload library contains payloads for different platforms, different operating systems, and different file types.

3. A real-time cross-host traceability graph construction system based on dynamic payload delivery according to claim 1, characterized in that: The methods of delivering the payload from the payload library to the suspicious device include: Web service, SMB, RDP, AFP, AirDrop, NFS, SFTP, FTP and WebDAV.

4. A real-time cross-host traceability graph construction system based on dynamic payload delivery according to claim 1, characterized in that: The information that can be used to construct the traceability graph includes the device's hardware information, operating system, application information, user name, user identity, application operation and security logs.

5. A real-time cross-host traceability graph construction system based on dynamic payload delivery according to claim 1, characterized in that: The method for generating a cross-host traceability graph by processing information collected by the load on a suspicious device and used for constructing a traceability graph includes the following steps: mining the dependency relationships between processes, files, file names, and network interfaces based on the causal relationships between various behavioral entities within a single host; performing dependency analysis based on the IP address and device information of the network data packet and the network environment and device information of the suspicious device; performing correlation analysis on data exchange, remote login, and remote code execution behaviors between multiple hosts; and mining the dependency relationships between various behavioral entities between different hosts.

6. A real-time cross-host traceability graph construction system based on dynamic payload delivery according to claim 1, characterized in that: The newly associated suspicious target is processed as follows: if the suspicious target has not delivered an appropriate payload, the payload library and payload delivery module are notified to deliver the appropriate payload and collect information that can be used to construct the traceability graph; if there is no new suspicious target in the cross-host traceability graph, the cross-host traceability graph is output.

7. A method for constructing a real-time cross-host traceability graph based on dynamic payload delivery, characterized in that: The following steps are involved: Receive alarm information from user devices and identify suspicious devices based on the alarm information; Extract information from suspicious devices and determine appropriate payloads; Deliver the determined appropriate payload to the suspicious device; Appropriate payloads collect information on suspicious devices that can be used to construct a traceability map. The collected information is used to construct a cross-host traceability map. Based on the alarm information of the user device or the cross-host traceability map, suspicious devices that have not yet delivered the appropriate payload are selected and recorded as the devices to be delivered. Based on the information of the devices to be delivered, appropriate payloads are prepared for the subsequent delivery process; Analyze cross-host traceability graphs and discover newly associated suspicious targets.

8. A method for constructing a real-time cross-host traceability graph based on dynamic payload delivery according to claim 7, characterized in that: After mining the newly associated suspicious target, if the suspicious target has not yet delivered an appropriate payload, the appropriate payload is determined, the appropriate payload is delivered, and a cross-host tracing graph is constructed; if there is no new suspicious target in the cross-host tracing graph, the cross-host tracing graph is output to complete the attack tracing process.

Images