A remote command execution vulnerability exploitation behavior detection method and device

Abstract

The present invention discloses a detection method and device for remote command execution vulnerability exploitation behavior, which relates to the field of computer security technology. The method includes: scanning computer survival processes to generate a network service process list; real-time monitoring of process creation and destruction; if the newly created process is a subprocess of the network service process, then the subprocess behavior pattern is identified; in the learning mode, the behavior pattern of the subprocess that does not exist in the known behavior pattern is added to the known behavior pattern of the network service; in the detection mode, if the subprocess behavior pattern is not in the known behavior pattern, but in the behavior pattern of the existing alarm, then a new subprocess record is added to the alarm details of the same behavior pattern, and a new alarm is generated if it is not in the behavior pattern of the existing alarm. The present invention overcomes the problems of the traditional method that the granularity is too coarse and easy to bypass and the granularity is too fine and easy to misreport, is non-invasive, generates only a small number of alarms, and avoids the real attack alarm being drowned in a large number of alarms.

Description

Technical Field

[0001] The present invention relates to the field of computer security technology, and in particular to a detection method and device for remote command execution vulnerability exploitation behavior. Background Art

[0002] With the rapid development of information technology, the information security issues of computer systems have become increasingly prominent, especially the use of remote command execution vulnerabilities, which has brought huge security risks to enterprises. Remote command execution vulnerabilities refer to vulnerabilities in which attackers take advantage of coding defects in network services and send carefully constructed data packets through the network to make network services execute commands. By using remote command execution vulnerabilities, attackers can execute arbitrary commands on the target computer and often control the target computer, which is extremely harmful.

[0003] Existing host-side security products have a certain ability to detect remote command execution vulnerability exploits, but there are some defects. For example, traditional HIDS detects by detecting whether the child process created by the network service is a common malicious command. Many malicious commands frequently executed by attackers are the same as the system commands that the network service executes for business needs. This detection method often has many false positives. On the other hand, there are many executable commands that can achieve the same effect. For example, you can execute the command "cat / etc / passwd" to read a file, and you can also execute "head / etc / passwd" and "echo $(< / etc / passwd)", etc. It is difficult for malicious command detection rules to cover them comprehensively, and this detection method is often easy to bypass; or, based on learning whitelist detection, first run in learning mode, learn the sub-processes that the network service will create for a period of time, record them to form a whitelist, and then enter detection mode. If the network service is monitored to create a sub-process that is not in the whitelist, it is considered that the exploitation of the remote command execution vulnerability has been detected. Among them, the specific content of the whitelist is usually implemented in two ways. One is to record the process executable file path. This implementation method is too coarse and easy to bypass. The other is to record the process command line parameters. This implementation method is too fine and easy to false positives; for example, RASP products perform detection by analyzing the call stack of the system command execution function, etc. However, they are generally only applicable to network services written in Java, with a narrow scope of use and are invasive, which will have a negative impact on the stability of network services. Summary of the invention

[0004] In view of the above-mentioned defects or deficiencies in the prior art, the present invention provides a method and device for detecting remote command execution vulnerability exploitation behavior, which summarizes multiple fields of a comprehensive process into a behavior pattern, and then detects remote command execution vulnerabilities based on behavior pattern learning, so as to solve the problems of high false alarm rate, easy bypass, narrow scope of application, and invasiveness in the prior art of detecting remote command execution vulnerability exploitation behavior.

[0005] One aspect of the present invention provides a method for detecting remote command execution vulnerability exploitation behavior, comprising:

[0006] Scan the computer's surviving processes through the agent, identify the network service processes and generate a list of network service processes, monitor the creation and destruction of processes in real time, and update the list of network service processes;

[0007] Determine whether the newly created process is a child process of the network service process, if yes, obtain information of the child process to identify the behavior mode of the child process, otherwise ignore the newly created process;

[0008] When the network service is in learning mode, determining whether there is a behavior pattern identical to that of the subprocess in the known behavior patterns of the network service, and if not, adding the behavior pattern of the subprocess to the known behavior patterns of the network service;

[0009] When the network service is in detection mode, determine whether there is a behavior pattern identical to that of the sub-process among the known behavior patterns of the network service. If so, determine that the sub-process is normal and do not generate an alarm. Otherwise, further determine whether there is a behavior pattern identical to that of the sub-process among the behavior patterns of the network service that have already issued an alarm. If so, attach a new sub-process record to the alarm details of the same behavior pattern, otherwise generate a new alarm.

[0010] Furthermore, the steps of scanning the computer's surviving processes through an agent, identifying the network service processes therein and generating a list of network service processes include:

[0011] Traverse each surviving process, check whether each process listens to the port, if so, determine that the process is a network service process, calculate the ID of the network service to which the network service process belongs and add it to the network service process list.

[0012] Furthermore, the steps of real-time monitoring the creation and destruction of processes and updating the network service process list include:

[0013] When a process destruction event is monitored, check whether the process is in the network service process list, and if so, delete the process from the list;

[0014] When a process creation event is monitored, check whether the process is a network service process. If so, calculate the ID of the network service to which the network service process belongs and add it to the network service process list.

[0015] Furthermore, the step of calculating the ID of the network service to which the network service process belongs includes:

[0016] Concatenate the information fields of the network service process into a character string, and calculate a hash value of the character string as the ID of the network service to which the network service process belongs;

[0017] If the parent process of the network service process is also a network service process, and the executable file path of the network service process is exactly the same as that of the parent process, then the network service ID of the network service process is the same as that of its parent process.

[0018] Furthermore, it also includes:

[0019] After monitoring the subprocess generated by the network service, extract the fields of the subprocess, including: user name, executable path, current working directory and command line parameters;

[0020] Parse the command line parameters to obtain commands, subcommands, options, option values ​​and action objects;

[0021] The user name, executable file path, current working directory, command, subcommand, and keys of all options are used as behavior patterns; the keys of all options are arranged in order;

[0022] Similar commands that are repeatedly executed with different command line parameters are grouped as having the same behavior pattern.

[0023] Furthermore, the step of parsing the command line parameters to obtain commands, subcommands, options, option values ​​and action objects includes:

[0024] Iterate over each item in the string array of command line parameters;

[0025] If the current item is the first item of the string array, determine whether the current item is a file path, if so, only retain the file part of the file path, and set the command equal to the first item;

[0026] If the current item begins with a half-width minus sign, the current item is determined to be an option, and the key and value of the option are added to the option array;

[0027] If the current item is not the first item and does not start with a half-width minus sign, the following judgment is made: if the command is not in the command list without sub-commands, and the sub-command is not assigned a value, and the current item starts with a letter, and the current item is a string that includes at least one of letters, numbers, and minus signs, then the current item is considered to be a sub-command; otherwise, the current item is considered to be an action object and is added to the action object list.

[0028] Furthermore, the method further includes: when a new network service is identified, the new network service is in a learning mode by default, and when a mode conversion condition is met, the learning mode is converted to a detection mode;

[0029] The mode conversion condition is as follows: the difference between the current time and the network service discovery time exceeds the preset minimum learning time, and the learning time of the last new behavior mode is more than one third of the shortest learning time from the current time.

[0030] Furthermore, the step of determining whether the newly created process is a subprocess of the network service process includes:

[0031] Obtain the parent process information of the newly created process. If the parent process is a shell process, continue to obtain the parent process information of the parent process until the most recently obtained parent process is not a shell process, query the network service process list, and determine whether the most recently obtained parent process is a network service process. If so, determine that the newly created process is a child process of the network service process.

[0032] Furthermore, it also includes:

[0033] In detection mode, for a newly generated sub-process of a network service, if the network service has never created a sub-process with the same behavior pattern, an alarm will be generated. If the alarm is a false alarm, the behavior pattern of the newly generated sub-process will be added to the known behavior pattern of the network service to avoid the same false alarm from being generated again in the future.

[0034] Another aspect of the present invention provides a detection device for remote command execution vulnerability exploitation behavior, comprising:

[0035] The first module is used to scan the computer's surviving processes through the agent, identify the network service processes therein and generate a list of network service processes, monitor the creation and destruction of processes in real time, and update the list of network service processes;

[0036] The second module is used to determine whether the newly created process is a subprocess of the network service process, and if so, obtain the information of the subprocess to identify the behavior mode of the subprocess, otherwise, ignore the newly created process;

[0037] The third module is used for determining whether there is a behavior pattern identical to that of the subprocess in the known behavior pattern of the network service when the network service is in the learning mode, and if not, adding the behavior pattern of the subprocess to the known behavior pattern of the network service;

[0038] The fourth module is used to determine whether there is a behavior pattern identical to that of the sub-process in the known behavior patterns of the network service when the network service is in detection mode. If so, the sub-process is determined to be normal and no alarm is generated. Otherwise, it is further determined whether there is a behavior pattern identical to that of the sub-process in the behavior patterns of the network service that have already issued an alarm. If so, a new sub-process record is attached to the alarm details of the same behavior pattern, otherwise a new alarm is generated.

[0039] The present invention provides a method and device for detecting remote command execution vulnerability exploitation behavior, which has the following beneficial effects:

[0040] (1) The present invention learns the normal behavior of network services creating child processes, summarizes it into a behavior pattern, and then enters a detection mode, so as to effectively detect abnormal child processes generated by attack behaviors such as remote command execution vulnerability exploitation behaviors. The present invention does not simply learn the process executable file path with a coarse granularity, nor does it simply learn the process command line parameters with a fine granularity. Instead, it integrates multiple fields of the process, summarizes and learns the behavior pattern, thus overcoming the problems of traditional methods that are easy to bypass due to coarse granularity and easy to report false alarms due to fine granularity.

[0041] (2) When the present invention detects an abnormal sub-process, it will not immediately generate an alarm, but will determine whether the behavior pattern of the sub-process is the same as that of an existing alarm. If the behavior pattern is the same, the sub-process will be added to the details of the existing alarm. Only when the behavior pattern of the sub-process is different from that of any existing alarm will a new alarm be generated. The present invention only generates a small number of alarms, thus avoiding the situation where real attack alarms are drowned in a large number of false alarms and alarms, making it impossible for security operation and maintenance personnel to handle them.

[0042] (3) The present invention does not rely on malicious command detection rules, and does not have the problem of many false positives and easy bypass of detection rules; the present invention only uses the mechanism provided by the operating system to monitor the process, which is non-invasive and will not have a negative impact on the stability of network services. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0044] Figure 1 It is a flowchart of a method for detecting remote command execution vulnerability exploitation behavior provided by an embodiment of the present application;

[0045] Figure 2 It is a flowchart of a method for detecting remote command execution vulnerability exploitation behavior provided by an embodiment of the present application;

[0046] Figure 3 It is a structural diagram of a detection device for remote command execution vulnerability exploitation behavior provided by an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings.

[0049] It should be understood that although the terms first, second, third, etc. may be used to describe the acquisition modules in the embodiments of the present invention, the acquisition modules should not be limited to these terms. These terms are only used to distinguish the acquisition modules from each other.

[0050] The word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.

[0051] It should be noted that the directional words such as "upper", "lower", "left", and "right" described in the embodiments of the present invention are described at the angles shown in the drawings and should not be understood as limiting the embodiments of the present invention. In addition, in the context, it should also be understood that when it is mentioned that an element is formed "on" or "under" another element, it can not only be formed directly "on" or "under" another element, but also be formed "on" or "under" another element indirectly through an intermediate element.

[0052] See also Figure 1 , 2 An embodiment of the present invention provides a method for detecting remote command execution vulnerability exploitation behavior, comprising:

[0053] Step S101, scanning the computer's surviving processes through an agent, identifying the network service processes therein and generating a network service process list, monitoring the creation and destruction of processes in real time, and updating the network service process list;

[0054] Specifically, this embodiment deploys an agent on the computer where the remote command execution vulnerability exploit behavior needs to be detected, and performs live process scanning, port monitoring scanning, real-time process monitoring, etc. through the agent, and collects the required information for subsequent detection of remote command execution vulnerability exploit behavior. Since only network service processes can generate remote command execution vulnerabilities, this embodiment only detects subprocesses created by network service processes, which can save system resources and improve detection efficiency.

[0055] When the agent starts, it initially scans all live processes on the computer, identifies the network service processes and generates a list of network service processes, including:

[0056] Traverse each surviving process;

[0057] Check whether each process listens on a port, including TCP port, UDP port, or Unix DomainSocket (Unix domain socket) to cover CGI (Common Gateway Interface) service;

[0058] If yes, the process is determined to be a network service process, the ID of the network service to which the network service process belongs is calculated, and the ID is added to the network service process list.

[0059] The calculation of the ID of the network service to which the network service process belongs includes:

[0060] The information fields of the network service process, including the user name, executable file path, current working directory, and command line parameters, are concatenated into a string using the symbol “|”, and the hash value of the string is calculated as the ID of the network service to which the network service process belongs;

[0061] If the parent process of the network service process is also a network service process, and the executable file path of the network service process is exactly the same as that of its parent process, then the network service to which the network service process and its parent process belong is the same, that is, the network service ID is the same.

[0062] Each network service is assigned a unique ID. The reason for not using the network service process PID as the unique ID is that the network service may be restarted, and the PID will change after the restart, but the network service behavior pattern should still be valid after the restart; some network services may have multiple processes, such as a master process and several worker processes, and the behavior of these different processes should be regarded as the behavior of the same network service.

[0063] After completing the initial scan, the agent generates a list of network service processes. Since network services may be started, shut down, or restarted at any time, the agent monitors the processes in real time and updates the list of network service processes in a timely manner:

[0064] When a process destruction event is detected, check whether the process is in the network service process list, and if so, delete the process from the list;

[0065] When a process creation event is monitored, check whether the process is a network service process. If so, calculate the ID of the network service to which it belongs and add it to the network service process list.

[0066] In this embodiment, the network service is set to two modes: learning mode and detection mode. Before detecting the remote command execution vulnerability exploitation behavior, the behavior of the network service to create a child process under normal circumstances is learned in advance, and multiple fields of the comprehensive process are summarized into behavior modes, including:

[0067] After monitoring the child process generated by the network service, extract the child process's username (username), executable path (exepath), current working directory (cwd), and command line parameters (cmdline) and other fields;

[0068] Parse the command line parameters to obtain fields such as command, sub-command, options, option values, and objects.

[0069] The user name, executable file path, current working directory, command, subcommand, and keys of all options are used as the behavior pattern, where the keys of the options are arranged in order; therefore, if the following fields of two processes are the same: user name, executable file path, current working directory, command, subcommand, keys of all options and the order of the keys, then the two processes can be determined to have the same behavior pattern, where the option value and the object field can be different;

[0070] Network services usually execute system commands due to business needs, but the executed commands are relatively limited. They usually repeatedly execute several identical commands or repeatedly execute similar commands with different command line parameters. Behavioral pattern recognition is performed on the sub-processes generated by the network services, and similar commands with different command line parameters that are repeatedly executed are classified as the same behavioral pattern.

[0071] Exemplarily, this embodiment is applied to a Linux server including two network services, nginx and php-fpm, and the content of the generated network service process list is as follows:

[0072] {"network_services": [

[0073] { "id": "355d61d599892d04b94972cb1139408c",

[0074] "username": "root",

[0075] "exepath": " / usr / sbin / nginx",

[0076] "cwd": " / var / www / html / ",

[0077] "mode": "study",

[0078] "discovery_time": 1728377895,

[0079] "processes": [

[0080] { "pid": 2111,

[0081] "ppid": 1,

[0082] "cmdline": "nginx: master process / usr / sbin / nginx"},

[0083] { "pid": 2112,

[0084] "ppid": 2111,

[0085] "cmdline": "nginx: worker process"},

[0086] { "pid": 2113,

[0087] "ppid": 2111,

[0088] "cmdline": "nginx: worker process"}],

[0089] "behaviors": [], / / known behavior patterns of this network service

[0090] "alarms": [] / / Existing alarms for this network application},

[0091] { "id": "1fffb099cbc03b5f9b9817e9116094a3",

[0092] "username": "www-data",

[0093] "exepath": " / usr / sbin / php-fpm",

[0094] "cwd": " / ",

[0095] "mode": "study",

[0096] "discovery_time": 1728377899,

[0097] "processes": [

[0098] { "pid": 904,

[0099] "ppid": 1,

[0100] "cmdline": "php-fpm: master process ( / etc / php-fpm.conf)"},

[0101] { "pid": 1012,

[0102] "ppid": 904,

[0103] "cmdline": "php-fpm: pool www"},

[0104] { "pid": 1013,

[0105] "ppid": 904,

[0106] "cmdline": "php-fpm: pool www"}],

[0107] "behaviors": [], / / known behavior patterns of this network service

[0108] "alarms": [] / / Existing alarms for this network application}]}.

[0109] Step S102, determining whether the newly created process is a subprocess of the network service process, if yes, obtaining information of the subprocess to identify the behavior pattern of the subprocess, otherwise ignoring the newly created process;

[0110] Specifically, when a newly created process is monitored, it is determined whether the process is a child process generated by a network service process, and the steps include:

[0111] Get the parent process information of the newly created process, including PID, executable file path, etc.;

[0112] If the parent process of the newly created process is a shell process, continue to obtain the parent process information of the parent process until the parent process obtained at the latest level is not a shell process;

[0113] If the parent process obtained at the latest level is not a shell process, query the network service process list to determine whether the parent process obtained at the latest level is in the network service process list, that is, whether it is a network service process. If so, determine that the newly created process is a child process generated by a certain network service, and further inspection is required.

[0114] Exemplarily, the newly created processes monitored are as follows:

[0115] { "pid": 1234,

[0116] "ppid": 1233,

[0117] "username": "www-data",

[0118] "exepath": " / bin / ping",

[0119] "cwd": " / ",

[0120] "cmdline": "ping -4 -W 5 -c 5 127.0.0.1 -v"},

[0121] To determine whether the process "1234" is a child process of a network service, obtain the information of the parent process "1233" of the process:

[0122] { "pid": 1233,

[0123] "ppid": 1013,

[0124] "username": "www-data",

[0125] "exepath": " / bin / sh",

[0126] "cwd": " / ",

[0127] "cmdline": "sh -c ping -4 -W 5 -c 5 127.0.0.1 -v"},

[0128] The executable file path of process "1233" is " / bin / sh", and the process is judged to be a shell process, so the information of the parent process "1013" of process "1233" is continued to be obtained until the latest parent process is not a shell process. If the parent process "1013" is not a shell process, it can be known that it is a network service process by querying the network service list as shown in step S101. Therefore, it is determined that process "1234" is a child process of the network service process, and belongs to the network service with ID "1fffb099cbc03b5f9b9817e9116094a3".

[0129] Among them, the shell process is a special type of process. When a network service usually executes a system command for business needs, a subprocess with a command line parameter of " / bin / sh -"normal business command"" is generally generated. The executable file path of the subprocess is " / bin / sh", which is not the executable file of the business command actually executed by the network service. If the behavior pattern analysis is directly performed on " / bin / sh-"normal business command"", the behavior pattern will be learned as " / bin / sh -c "any command"", leaving an opportunity for attackers to bypass detection. Therefore, this embodiment does not directly learn the behavior pattern of the shell process.

[0130] After determining that the newly created process is a child process of a network service process, the user name, executable file path, current working directory, command line parameters and other fields of the child process are obtained, and the command line parameters of the child process are parsed to further identify the behavior pattern of the child process.

[0131] The steps of parsing the command line parameters include:

[0132] Iterate over each item in the string array of command line parameters;

[0133] If the current item is the first item in the string array, determine whether the current item is a file path. If it is, only retain the file part of the file path. For example, if the first item is " / usr / sbin / nginx", only retain "nginx" and set the command equal to the first item.

[0134] If the current item starts with a half-width minus sign, the current item is determined to be an option. A single half-width minus sign "-" indicates a short format option, and a double half-width minus sign "--" indicates a long format option. Add the option key and value to the option array. The judgment of the option key and value includes: the option value usually follows the option key, separated by a space or connected with a half-width equal sign. If the option key does not have the next item separated by a space or connected with a half-width equal sign, the option only has a key and no value, which is a Boolean option.

[0135] If the current item is not the first item and does not start with a half-width minus sign, the following judgment is made: if the command is not in the command list without sub-commands, and the sub-command is not assigned a value, and the current item starts with a letter, and the current item is a string that includes at least one of letters, numbers, and minus signs, then the current item is considered to be a sub-command; otherwise, the current item is considered to be an action object and is added to the action object list.

[0136] Among them, the command list without subcommands is a pre-collected list of many commands without subcommands in the Linux system, including: cat, ls, ps, pwd, echo, date, nano, etc., in order to more accurately distinguish subcommands and their objects of action.

[0137] For example, the command line parameter of the child process "1234" is "ping -4 -W 5 -c 5 127.0.0.1 -v". By parsing the command line parameter, we can get:

[0138] {"command": "ping",

[0139] "sub-command": null,

[0140] "options":[{ "key": "-4"},{"key": "-W","value": "5"},{"key": "-c","value": "5"},{"key": "-v"}],

[0141] "objects": ["127.0.0.1"]}.

[0142] Further identify the behavior pattern of the subprocess:

[0143] {"username": "www-data",

[0144] "exepath": " / bin / ping",

[0145] "cwd": " / ",

[0146] "command": "ping",

[0147] "sub-command": null,

[0148] "option_keys": ["-4", "-W", "-c", "-v"]}.

[0149] Step S103, when the network service is in learning mode, it is determined whether there is a behavior pattern identical to that of the subprocess in the known behavior patterns of the network service, and if not, the behavior pattern of the subprocess is added to the known behavior patterns of the network service;

[0150] Specifically, detect whether the network service is in a learning mode or a detection mode. When the network service is in the learning mode, determine whether there is a behavior pattern that is the same as the sub-process in the known behavior pattern of the network service. If so, ignore the sub-process; otherwise, add the behavior pattern of the sub-process to the known behavior pattern of the network service.

[0151] For example, when the network service "1fffb099cbc03b5f9b9817e9116094a3" is in learning mode, it is detected that there is no behavior pattern identical to the subprocess "1234" in the known behavior pattern of the network service, so the behavior pattern of the subprocess "1234" is added to the known behavior pattern of the network service:

[0152] {"behaviors": [

[0153] {

[0154] / / Timestamp when the behavior pattern was learned

[0155] "time": 1728393377,

[0156] / / Learned behavior patterns

[0157] "pattern": {

[0158] "username": "www-data",

[0159] "exepath": " / bin / ping",

[0160] "cwd": " / ",

[0161] "command": "ping",

[0162] "sub-command": null,

[0163] "option_keys": ["-4", "-W", "-c", "-v"]},

[0164] / / Information about the first process that learned this behavior pattern

[0165] / / To help users understand the behavior mode

[0166] "process": {

[0167] "pid": 1234,

[0168] "ppid": 1233,

[0169] "username": "www-data",

[0170] "exepath": " / bin / ping",

[0171] "cwd": " / ",

[0172] "cmdline": "ping -4 -W 5 -c 5 127.0.0.1 -v"}}]}.

[0173] In this embodiment, it is determined whether a new network service is identified based on the network service ID. When a new network service is identified, the new network service is in learning mode by default. When the mode conversion condition is met, the learning mode is converted to detection mode.

[0174] The mode conversion condition is set as: the difference between the current time and the network service discovery time exceeds the preset minimum learning time, and the learning time of the last new behavior mode is more than one third of the shortest learning time from the current time.

[0175] The setting of the second condition can better avoid the situation where complex network services create a large number of different sub-processes due to business needs, cannot complete learning within the shortest learning time, and immediately end learning when the shortest learning time is reached, which is easy to generate a large number of false alarms.

[0176] Step S104, when the network service is in detection mode, determine whether there is a behavior pattern identical to that of the sub-process in the known behavior patterns of the network service. If so, determine that the sub-process is normal and do not generate an alarm. Otherwise, further determine whether there is a behavior pattern identical to that of the sub-process in the behavior patterns of the network service that have already generated an alarm. If so, append a new sub-process record to the alarm details of the same behavior pattern, otherwise generate a new alarm.

[0177] For example, a network service is exploited by a remote proxy execution vulnerability, and an abnormal subprocess is created, such as a subprocess with pid "2234". According to the method described in step S102, the subprocess "2234" is determined to be a subprocess generated by a network service process, and the behavior pattern of the subprocess is further identified. When the network service is in detection mode, it is detected that there is no behavior pattern identical to the subprocess "2234" in the known behavior patterns of the network service, and it is further detected that there is no behavior pattern identical to the subprocess in the behavior patterns of the network service's existing alarms, then a new alarm will be generated:

[0178] { "alarms": [

[0179] { / / The time when the alarm first appeared

[0180] "time": 1728393377,

[0181] / / The behavior mode of this alarm

[0182] "pattern": {

[0183] "username": "www-data",

[0184] ……},

[0185] / / The process that generated the alarm

[0186] "processes": [

[0187] {"pid": 2234,

[0188] …}]}]}.

[0189] If the network service is exploited again by the remote code execution vulnerability, an abnormal child process with pid "3234" is created. After the previous steps, it is detected that the child process is not in the known behavior pattern of the network service. However, in the existing alarm of the network service, no new alarm is generated. Instead, the information of the child process "3234" is added to the existing alarm details. The alarm details after adding the information of the child process "3234" are as follows:

[0190] {"alarms": [

[0191] { / / The time when the alarm first appeared

[0192] "time": 1728393377,

[0193] / / The behavior mode of this alarm

[0194] "pattern": {

[0195] "username": "www-data",

[0196] ……},

[0197] / / The process that generated the alarm

[0198] "processes": [

[0199] { "time": 1728393377,

[0200] "pid": 2234,

[0201] ……},

[0202] { "time": 1728393397,

[0203] "pid": 3234,

[0204] …}]}]}.

[0205] Among them, for the newly generated sub-process of the network service, if the network service has never created a sub-process with the same behavior pattern, an alarm will be generated. If the alarm is a false alarm, the behavior pattern of the newly generated sub-process will be added to the known behavior pattern of the network service to avoid the same false alarm from being generated again in the future.

[0206] The present embodiment provides a method for detecting remote command execution vulnerability exploitation behavior. By learning the normal behavior of network service to create child processes, the behavior is summarized into a behavior pattern, and then the detection mode is entered. The method can effectively detect abnormal child processes generated by attack behaviors such as remote command execution vulnerability exploitation behavior. The method does not simply learn the process executable file path with too coarse granularity, nor does it simply learn the process command line parameters with too fine granularity. Instead, multiple fields of the process are integrated and summarized into a behavior pattern for learning. The problems of traditional methods that the granularity is too coarse and easy to bypass and the granularity is too fine and easy to report false alarms are overcome. The method does not rely on malicious command detection rules, and there is no problem that the detection rules have many false alarms and are easy to bypass. The method only uses the mechanism provided by the operating system to monitor the process, which is non-invasive and will not have a negative impact on the stability of the network service. In addition, the present embodiment only generates a small number of alarms, which avoids the situation where real attack alarms are drowned in massive false alarms and a large number of alarms, making it impossible for security operation and maintenance personnel to handle them.

[0207] See also Figure 3 Another embodiment of the present application further provides a remote command execution vulnerability exploitation behavior detection device 200, comprising:

[0208] The first module 201 is used to scan the computer's surviving processes through an agent, identify the network service processes therein and generate a network service process list, monitor the creation and destruction of processes in real time, and update the network service process list;

[0209] The second module 202 is used to determine whether the newly created process is a subprocess of the network service process, and if so, obtain information of the subprocess to identify the behavior pattern of the subprocess, otherwise ignore the newly created process;

[0210] The third module 203 is used to determine whether there is a behavior pattern identical to that of the subprocess in the known behavior pattern of the network service when the network service is in the learning mode, and if not, add the behavior pattern of the subprocess to the known behavior pattern of the network service;

[0211] The fourth module 204 is used to determine whether there is a behavior pattern identical to that of the sub-process in the known behavior patterns of the network service when the network service is in detection mode. If so, the sub-process is determined to be normal and no alarm is generated. Otherwise, it is further determined whether there is a behavior pattern identical to that of the sub-process in the behavior patterns of the network service that have already issued an alarm. If so, a new sub-process record is attached to the alarm details of the same behavior pattern, otherwise a new alarm is generated.

[0212] It should be noted that the detection device 200 for remote command execution vulnerability exploitation behavior provided in this embodiment corresponds to a technical solution that can be used to execute the above-mentioned method embodiment. Its implementation principle and technical effect are similar to the method and will not be repeated here.

[0213] The above description is only a preferred embodiment of the present invention. Those skilled in the art should understand that the scope of disclosure involved in the present invention is not limited to the technical solution formed by a specific combination of the above technical features, but also should cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present invention (but not limited to) to form a technical solution.

Claims

1. A method for detecting remote command execution vulnerability exploitation behavior, characterized in that: include: Scan the computer's surviving processes through the agent, identify the network service processes and generate a list of network service processes, monitor the creation and destruction of processes in real time, and update the list of network service processes; Determine whether the newly created process is a child process of the network service process, if yes, obtain information of the child process to identify the behavior mode of the child process, otherwise ignore the newly created process; After monitoring the subprocess generated by the network service, extract the fields of the subprocess, including: user name, executable path, current working directory and command line parameters; parse the command line parameters to obtain commands, subcommands, options, option values ​​and action objects; use the user name, executable file path, current working directory, command, subcommand, and keys of all options as behavior patterns; arrange the keys of all options in order; and classify similar commands with different command line parameters that are repeatedly executed into the same behavior pattern; When the network service is in learning mode, determining whether there is a behavior pattern identical to that of the subprocess in the known behavior patterns of the network service, and if not, adding the behavior pattern of the subprocess to the known behavior patterns of the network service; When the network service is in detection mode, determine whether there is a behavior pattern identical to that of the sub-process among the known behavior patterns of the network service. If so, determine that the sub-process is normal and do not generate an alarm. Otherwise, further determine whether there is a behavior pattern identical to that of the sub-process among the behavior patterns of the network service that have already issued an alarm. If so, attach a new sub-process record to the alarm details of the same behavior pattern, otherwise generate a new alarm.

2. According to claim 1, a method for detecting remote command execution vulnerability exploitation behavior is characterized in that: The steps of scanning the computer's surviving processes through the proxy, identifying the network service processes therein and generating a list of network service processes include: Traverse each surviving process, check whether each process listens to the port, if so, determine that the process is a network service process, calculate the ID of the network service to which the network service process belongs and add it to the network service process list.

3. According to claim 1, a method for detecting remote command execution vulnerability exploitation behavior is characterized in that: The steps of real-time monitoring the creation and destruction of processes and updating the network service process list include: When a process destruction event is monitored, check whether the process is in the network service process list, and if so, delete the process from the list; When a process creation event is monitored, check whether the process is a network service process. If so, calculate the ID of the network service to which the network service process belongs and add it to the network service process list.

4. A method for detecting remote command execution vulnerability exploitation behavior according to claim 2 or 3, characterized in that: The step of calculating the ID of the network service to which the network service process belongs comprises: Concatenate the information fields of the network service process into a character string, and calculate a hash value of the character string as the ID of the network service to which the network service process belongs; If the parent process of the network service process is also a network service process, and the executable file path of the network service process is exactly the same as that of the parent process, then the network service ID of the network service process is the same as that of its parent process.

5. According to claim 1, a method for detecting remote command execution vulnerability exploitation behavior is characterized in that: The step of parsing the command line parameters to obtain commands, subcommands, options, option values ​​and action objects comprises: Iterate over each item in the string array of command line parameters; If the current item is the first item of the string array, determine whether the current item is a file path, if so, only retain the file part of the file path, and set the command equal to the first item; If the current item begins with a half-width minus sign, the current item is determined to be an option, and the key and value of the option are added to the option array; If the current item is not the first item and does not start with a half-width minus sign, the following judgment is made: if the command is not in the command list without sub-commands, and the sub-command is not assigned a value, and the current item starts with a letter, and the current item is a string that includes at least one of letters, numbers, and minus signs, then the current item is considered to be a sub-command; otherwise, the current item is considered to be an action object and is added to the action object list.

6. A method for detecting remote command execution vulnerability exploitation behavior according to claim 1, characterized in that: Also includes: When a new network service is identified, the new network service is in a learning mode by default, and when a mode switching condition is met, the learning mode is switched to a detection mode; The mode conversion condition is as follows: the difference between the current time and the network service discovery time exceeds the preset minimum learning time, and the learning time of the last new behavior mode is more than one third of the shortest learning time from the current time.

7. A method for detecting remote command execution vulnerability exploitation behavior according to claim 1, characterized in that: The step of determining whether the newly created process is a subprocess of the network service process comprises: Obtain the parent process information of the newly created process. If the parent process is a shell process, continue to obtain the parent process information of the parent process until the most recently obtained parent process is not a shell process, query the network service process list, and determine whether the most recently obtained parent process is a network service process. If so, determine that the newly created process is a child process of the network service process.

8. A method for detecting remote command execution vulnerability exploitation behavior according to claim 1, characterized in that: Also includes: In detection mode, for a newly generated sub-process of a network service, if the network service has never created a sub-process with the same behavior pattern, an alarm will be generated. If the alarm is a false alarm, the behavior pattern of the newly generated sub-process will be added to the known behavior pattern of the network service to avoid the same false alarm from being generated again in the future.

9. A detection device for remote command execution vulnerability exploitation behavior, characterized in that: include: The first module is used to scan the computer's surviving processes through the agent, identify the network service processes therein and generate a list of network service processes, monitor the creation and destruction of processes in real time, and update the list of network service processes; The second module is used to determine whether the newly created process is a subprocess of the network service process, and if so, obtain the information of the subprocess to identify the behavior mode of the subprocess, otherwise, ignore the newly created process; After monitoring the subprocess generated by the network service, extract the fields of the subprocess, including: user name, executable path, current working directory and command line parameters; parse the command line parameters to obtain commands, subcommands, options, option values ​​and action objects; use the user name, executable file path, current working directory, command, subcommand, and keys of all options as behavior patterns; arrange the keys of all options in order; and classify similar commands with different command line parameters that are repeatedly executed into the same behavior pattern; The third module is used for determining whether there is a behavior pattern identical to that of the subprocess in the known behavior pattern of the network service when the network service is in the learning mode, and if not, adding the behavior pattern of the subprocess to the known behavior pattern of the network service; The fourth module is used to determine whether there is a behavior pattern identical to that of the sub-process in the known behavior patterns of the network service when the network service is in detection mode. If so, the sub-process is determined to be normal and no alarm is generated. Otherwise, it is further determined whether there is a behavior pattern identical to that of the sub-process in the behavior patterns of the network service that have already issued an alarm. If so, a new sub-process record is attached to the alarm details of the same behavior pattern, otherwise a new alarm is generated.

Images