Malicious software evidence obtaining system and method and electronic equipment

Abstract

The invention relates to the technical field of network security, in particular to a malicious software evidence obtaining system and method and electronic equipment. The system comprises a data acquisition module, a data processing module, a result generation module and an automatic response module. The data acquisition module is used for acquiring software samples, flow data and log data; the data processing module is used for performing analysis based on the software sample, the flow data and the log data to obtain a feature analysis result, and determining a static scoring result, a dynamic scoring result and a model scoring result based on the feature analysis result; the result generation module is used for determining a software comprehensive score based on the static scoring result, the dynamic scoring result, the model scoring result and a preset scoring standard, and integrating and displaying the feature analysis result and the software comprehensive score; and the automatic response module is used for triggering safety response measures according to the feature analysis result and the software comprehensive score. According to the method, the malicious software identification efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a malware evidence collection system, method and electronic device. Background Art

[0002] As cyber attacks continue to escalate, malware has become one of the most important threats in the field of cybersecurity. There are many types of malware, and the means of attack are endless. Attackers use increasingly complex techniques to evade detection and hide their malicious behavior. In order to deal with these threats, cybersecurity experts need to conduct in-depth analysis and evidence collection on the behavior of malware, track the source of the attack, reveal the attack path, and collect evidence. Malware forensics is not only crucial for timely response to cyber attacks, but also an important basis for future attack defense and legal accountability.

[0003] The relevant technologies mainly rely on two methods: static analysis and dynamic analysis. Static analysis focuses on directly reviewing the code structure of malware, aiming to reveal its malicious behavior by identifying code features. However, due to the encryption and obfuscation of malware, static analysis often cannot efficiently and accurately identify complex malicious behaviors. Dynamic analysis executes malware in a sandbox environment and monitors its behavior for analysis. Although it can obtain a more realistic execution path, it also faces performance bottlenecks, such as sandbox environment detection and analysis delays, making it difficult to obtain comprehensive forensic data in a short period of time.

[0004] Existing malware forensics systems often require highly specialized knowledge and manual operations. Not only are the analysis speeds slow, but they are also susceptible to human errors. The lack of automated and standardized analysis processes makes traditional methods extremely challenging when faced with large-scale malware samples. Summary of the invention

[0005] In order to solve the problem of low efficiency in identifying malware in the prior art, the present application provides a malware forensics system, method and electronic device.

[0006] In the first aspect, the present application provides a malware forensics system, which adopts the following technical solutions: A malware evidence collection system, comprising: a data acquisition module, a data processing module, a result generation module and an automatic response module; The data acquisition module is used to acquire software samples, flow data and log data; The data processing module is used to analyze the software sample, the traffic data and the log data to obtain feature analysis results, and determine static scoring results, dynamic scoring results and model scoring results based on the feature analysis results; The result generation module is used to determine the software comprehensive score based on the static scoring result, the dynamic scoring result, the model scoring result and the preset scoring standard, and integrate and display the feature analysis result and the software comprehensive score; The automatic response module is used to trigger security response measures according to the feature analysis results and the comprehensive software score.

[0007] By adopting the above technical solution, the data acquisition module collects software samples, traffic data and log data, covering the behavior of the software, network interaction and system-level activities, ensuring the comprehensiveness of the data. The data processing module analyzes the software samples, traffic data and log data to extract representative key features. Based on the feature analysis results, the static scoring results, dynamic scoring results and model scoring results are calculated, which helps to quickly identify high-risk software samples. The result generation module integrates and displays the feature analysis results and the software comprehensive score, so that users can intuitively understand the security status of the software samples. The automatic response module quickly triggers security response measures based on the feature analysis results and the software comprehensive score, effectively preventing the spread and damage of malware. The automatic response measures are dynamically adjusted according to the severity and type of the threat, ensuring the pertinence and effectiveness of the response. Through the collaborative work of various modules, the system realizes comprehensive, real-time and in-depth analysis and response to malware, improves the detection, analysis and response capabilities of security incidents, and provides users with a more secure and reliable network environment.

[0008] In a preferred example, the present application can be further configured as follows: the data processing module includes a static analysis unit, a dynamic analysis unit and a model detection unit; the feature analysis result includes a static matching result, a dynamic behavior log and a model determination result; The static analysis unit is used to analyze the software sample to obtain static features, match the software sample with a known sample library to obtain a sample matching result, and determine a static scoring result based on the static features and the sample matching result; The dynamic analysis unit is used to obtain the dynamic behavior log of the software sample and determine the dynamic scoring result of the software sample based on the dynamic behavior log; The model detection unit is used to input the static features, the dynamic behavior logs, the traffic data and the log data into a preset detection model, obtain the model judgment results, model scoring results and threat scenarios for the software sample output by the preset detection model, and update the model scoring results based on the threat scenarios.

[0009] By adopting the above technical solution, the data processing module realizes a comprehensive and in-depth analysis of software samples through the collaborative work of the static analysis unit, the dynamic analysis unit and the model detection unit. It can accurately extract key information such as static features and dynamic behavior logs, and give static scores, dynamic scores and model scores based on this information, thereby comprehensively evaluating the threat level of software samples and providing an accurate and reliable basis for subsequent response measures.

[0010] In a preferred example, the present application may be further configured as follows: the static features include semantic features and malicious content features; The static analysis unit is used to match the semantic feature and the malicious content feature with a preset malicious rule library, and respectively determine a first matching result between the preset malicious rule library and the semantic feature, and a second matching result between the preset malicious rule library and the malicious content feature, and determine a static scoring result based on the first matching result, the second matching result and the sample matching result.

[0011] By adopting the above technical solution, the static analysis unit determines the static scoring results based on semantic features, malicious content features and a preset malicious rule library, thereby effectively improving the accuracy and efficiency of malware detection, enabling the system to quickly identify and evaluate the potential threats of software samples based on the quantitative indicator of feature ratio.

[0012] In a preferred example, the present application may be further configured as follows: the dynamic analysis unit includes a dynamic analysis subunit and a behavior analysis subunit; the dynamic behavior log includes an operation behavior log and a malicious behavior comparison result; The dynamic analysis subunit is used to run the software sample to obtain the running behavior log of the software sample; The behavior analysis subunit is used to perform behavior clustering analysis on the running behavior log to obtain a behavior clustering result, perform multi-threaded behavior scoring on the running behavior log, and parse the running behavior log to construct a behavior tree of the software sample, compare the behavior tree with a preset malicious behavior chain to obtain a malicious behavior comparison result, and determine a dynamic scoring result based on the behavior clustering result, the multi-threaded behavior score and the malicious behavior comparison result.

[0013] By adopting the above technical solution, the dynamic analysis unit obtains the operation behavior log by running the software sample, and uses the behavior analysis sub-unit to build a behavior tree for comparison with the preset malicious behavior chain, and analyzes the behavior clustering results and multi-threaded behavior scores. It can accurately identify malicious behaviors and determine the dynamic scoring results accordingly. It not only improves the depth of malware detection, but also can effectively identify complex and changeable malicious behavior patterns, significantly enhancing the system's ability to identify and respond to potential threats.

[0014] In a preferred example, the present application may be further configured as follows: the automatic response module includes a security response unit and a repair unit; The security response unit is used to trigger security response measures according to the model determination result and the software comprehensive score; The repair unit is used to determine the malware type according to the feature analysis result, and determine a repair suggestion based on the malware type.

[0015] By adopting the above technical solution, the automatic response module can quickly trigger targeted security response measures based on the model judgment results and software comprehensive scores through the collaborative work of the security response unit and the repair unit, effectively curbing malware threats. At the same time, the repair unit can also accurately identify the malware type based on the feature analysis results and provide corresponding repair suggestions, thereby realizing end-to-end automated processing from threat detection to repair suggestions, significantly improving the system's security protection and recovery capabilities.

[0016] In a preferred example, the present application may be further configured as follows: the security response unit includes a response trigger and an isolation cleaning subunit; The response trigger is used to determine the software threat level according to the comprehensive software score and trigger the security response measures corresponding to the threat level; The isolation and cleaning subunit is used to perform isolation and cleaning operations when the software sample is determined to be malicious.

[0017] By adopting the above technical solution, the security response unit accurately determines the software threat level through the response trigger and instantly triggers the corresponding security response measures, effectively improving the pertinence and timeliness of the response. At the same time, the isolation and cleaning sub-unit quickly performs isolation and cleaning operations when the software sample is judged to be malicious, effectively preventing the further spread and damage of malware, and together forming an efficient and accurate automated security response system.

[0018] In a preferred example, the present application can be further configured as follows: the response trigger is used to trigger isolation and cleanup operations when the threat level is high threat, and send a high threat warning to the administrator; when the threat level is medium threat, send a medium threat warning to the administrator; when the threat level is low threat, record a low threat log.

[0019] By adopting the above technical solution, the response trigger adopts a hierarchical response strategy according to different threat levels. This hierarchical response mechanism effectively improves the pertinence and efficiency of security response.

[0020] In a preferred example, the present application may be further configured as follows: the flow data includes abnormal flow data; The data acquisition module is used to run the software sample and acquire the flow data during the running process, and filter abnormal flow data from the flow data based on preset filtering rules.

[0021] By adopting the above technical solution, the data acquisition module runs software samples and applies preset filtering rules to accurately screen abnormal traffic data during operation, effectively improving the attention paid to abnormal features.

[0022] In the second aspect, the present application provides a malware evidence collection method, which adopts the following technical solution: A malware forensics method, comprising: Obtain software samples, traffic data, and log data; Analyze the software sample, the traffic data, and the log data to obtain feature analysis results, and determine static scoring results, dynamic scoring results, and model scoring results based on the feature analysis results; Determine a comprehensive software score based on the static score result, the dynamic score result, the model score result and a preset score standard, and integrate and display the feature analysis result and the comprehensive software score; A security response measure is triggered according to the feature analysis result and the comprehensive score of the software.

[0023] In a third aspect, the present application provides an electronic device, which adopts the following technical solution: one or more processors; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, and the at least one application is configured to: execute the malware forensics method as described in the second aspect.

[0024] In a fourth aspect, the present application provides a computer-readable storage medium, which adopts the following technical solution: A computer-readable storage medium stores a computer program, which, when executed in a computer, causes the computer to execute the malware evidence collection method as described in the second aspect.

[0025] In summary, this application includes the following beneficial technical effects: The data acquisition module in this system collects software samples, traffic data and log data, covering the behavior of the software, network interaction and system-level activities, ensuring the comprehensiveness of the data. The data processing module can extract representative key features by analyzing software samples, traffic data and log data. The static scoring results, dynamic scoring results and model scoring results are calculated based on the feature analysis results, which helps to quickly identify high-risk software samples. The result generation module integrates and displays the feature analysis results and the software comprehensive score, so that users can intuitively understand the security status of the software samples. The automatic response module quickly triggers security response measures based on the feature analysis results and the software comprehensive score, effectively preventing the spread and damage of malware. The automatic response measures are dynamically adjusted according to the severity and type of the threat, ensuring the pertinence and effectiveness of the response. Through the collaborative work of various modules, the system realizes comprehensive, real-time and in-depth analysis and response to malware, improves the detection, analysis and response capabilities of security incidents, and provides users with a more secure and reliable network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a schematic diagram of the structure of a malware forensics system provided in an embodiment of the present application; Figure 2 is a structural diagram of a malware forensics system provided by another embodiment of the present application; Figure 3 It is a flowchart of a malware evidence collection method provided by an embodiment of the present application; Figure 4 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] The following is combined with Figure 1 -Attached Figure 4 This application is described in further detail.

[0028] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, those skilled in the art may make modifications to the present embodiment without any creative contribution as needed, but such modifications are protected by the patent law as long as they are within the scope of the claims of the present application.

[0029] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0030] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0031] It should be noted that in the optional embodiments of the present application, the object information and other related data involved, when the embodiments in the present application are applied to specific products or technologies, need to obtain the permission or consent of the object, and the collection, use and processing of the relevant data need to comply with the relevant laws, regulations and standards of the relevant countries and regions. In other words, if the embodiments of the present application involve data related to the object, it needs to be obtained with the authorization and consent of the object, the authorization and consent of the relevant departments, and in compliance with the relevant laws, regulations and standards of the country and region. If personal information is involved in the embodiments, the acquisition of all personal information needs to obtain the consent of the individual. If sensitive information is involved, the separate consent of the information subject needs to be obtained. The embodiments also need to be implemented with the authorization and consent of the object.

[0032] The present application embodiment provides a malware forensics system, which is applicable to malware research, digital forensics, network security monitoring, and related security incident response processes, and can automatically capture, analyze, and extract malware activity information, thereby improving the efficiency of malware analysis. Figure 1 As shown, the system includes: a data acquisition module, a data processing module, a result generation module and an automatic response module.

[0033] The data acquisition module is used to obtain software samples, traffic data and log data. Among them, the software samples are input into the system by the user in the form of files. The system database pre-stores the file format size requirements set by the technicians. After receiving the software samples, the system verifies the size of the file format. If the size of the software sample format meets the requirements, the obtained software samples are stored in the distributed file system (such as HDFS). The software samples obtained by the data acquisition module are software samples to be identified as malicious. The traffic data is abnormal traffic data. After receiving the software samples, the system runs the software samples and monitors the network traffic through tools such as tcpdump and Wireshark, and screens the abnormal traffic data during the operation process. The abnormal traffic data is stored in a non-relational database (such as MongoDB) for subsequent analysis. The system can use Logstash to collect logs from multiple system sources (servers, applications, etc.). Logstash cleans and unifies the log data, stores it in a structured format in Elasticsearch, and triggers log collection regularly to ensure the continuity and integrity of the data.

[0034] The data processing module is used to analyze software samples, traffic data and log data to obtain feature analysis results. The feature analysis results include the parsed features and whether the features represent that the software samples are malicious. The data processing module is also used to determine the scoring results of each analysis module based on the feature analysis results, including static scoring results, dynamic scoring results and model scoring results.

[0035] The result generation module is used to integrate the static scoring results, dynamic scoring results and model scoring results based on preset scoring criteria to obtain a comprehensive software score, integrate the feature analysis results and the comprehensive software score and display them on the display interface so that users can intuitively view the evaluation results.

[0036] The automatic response module is used to trigger security response measures based on the feature analysis results and the comprehensive software score. The threat level can be determined based on the comprehensive software score, and different threat levels correspond to different security response measures.

[0037] In this embodiment, the data acquisition module collects software samples, traffic data and log data, covering the behavior of the software, network interaction and system-level activities, ensuring the comprehensiveness of the data. The data processing module analyzes the software samples, traffic data and log data to extract representative key features. The static scoring results, dynamic scoring results and model scoring results are calculated based on the feature analysis results, which helps to quickly identify high-risk software samples. The result generation module integrates and displays the feature analysis results and the software comprehensive score, so that users can intuitively understand the security status of the software samples. The automatic response module quickly triggers security response measures based on the feature analysis results and the software comprehensive score, effectively preventing the spread and damage of malicious software. The automatic response measures are dynamically adjusted according to the severity and type of the threat, ensuring the pertinence and effectiveness of the response. Through the collaborative work of various modules, the system realizes comprehensive, real-time and in-depth analysis and response to malicious software, improves the detection, analysis and response capabilities of security incidents, and provides users with a more secure and reliable network environment.

[0038] In a possible implementation of the embodiment of the present application, the traffic data includes abnormal traffic data; a data acquisition module is used to run the software sample and acquire the traffic data during the operation, and filter the abnormal traffic data from the traffic data based on preset filtering rules.

[0039] Specifically, the preset filtering rules are pre-set by the technicians according to actual experience or needs and stored in the database, including legal IP addresses, ports, protocols, etc. The acquired traffic data is matched with the preset filtering rules. If any item in the traffic data does not meet the requirements in the preset filtering rule library, the data is determined to be abnormal traffic data. For example, if the IP address of a certain data cannot find a legal IP address matching it in the preset filtering rule library, the data is determined to be abnormal traffic data.

[0040] In this embodiment, the data acquisition module runs the software sample and applies preset filtering rules to accurately filter abnormal traffic data during the operation process, thereby effectively increasing the attention paid to abnormal features.

[0041] In a possible implementation of the embodiment of the present application, the data processing module includes a static analysis unit, a dynamic analysis unit and a model detection unit; the feature analysis result includes a static matching result, a dynamic behavior log and a model determination result; A static analysis unit is used to analyze the software sample to obtain static features, match the software sample with a known sample library to obtain a sample matching result, and determine a static scoring result based on the static features and the sample matching result; A dynamic analysis unit, used to obtain a dynamic behavior log of a software sample and determine a dynamic scoring result of the software sample based on the dynamic behavior log; The model detection unit is used to input static features, dynamic behavior logs, traffic data and log data into a preset detection model, obtain the model judgment results, model scoring results and threat scenarios of the software samples output by the preset detection model, and update the model scoring results based on the threat scenarios.

[0042] In this embodiment, the static analysis unit can perform metadata analysis on the software sample through the pefile library to obtain static features. The extracted static features include but are not limited to: file headers, sections, imported DLLs, string information, and data signatures. The preset malicious rule library is a set of malicious features determined by technicians based on historical malicious data. The extracted static features are compared with the preset malicious rule library to determine which of the extracted static features match the malicious features in the preset malicious rule library to obtain static matching results. The static matching results include static features and the matching results of each feature with the malicious features. The static matching results and static scoring results can be stored in the database in the form of a static analysis report.

[0043] The strings command line can be used to extract string information from software samples, and sensitive keywords or suspicious URLs can be effectively identified based on the preset malicious rule library.

[0044] Dynamic analysis includes a dynamic analysis subunit and a behavioral analysis subunit. The dynamic analysis subunit is used to obtain the running behavior log of the software sample, and the behavioral analysis subunit is used to parse the running behavior log to obtain behavior clustering results, multi-threaded behavior scores and malicious behavior comparison results, and determine the dynamic scoring results based on the behavior clustering results, multi-threaded behavior scores and malicious behavior comparison results.

[0045] The model detection unit is used to determine whether the software sample is malware through a preset detection model. The input data of the preset detection model includes the features extracted by each module, including but not limited to system call frequency and network connection features. The preset detection model is a pre-trained classification model, such as random forest, SVM or deep learning. After each prediction by the preset detection model, the model's learning data is updated, and the detection accuracy of the preset detection model is continuously improved through incremental learning. The model training process includes: obtaining historical feature data, annotating the historical feature data, and the annotated content includes "malware" or "normal", as well as the threat context of the historical feature data. For the historical feature data annotated with "malware", the annotated content also includes the model score. The greater the maliciousness of the malware, the greater the model score.

[0046] After the static features, dynamic behavior logs, traffic data and log data related to the current software sample are input into the preset detection model, the preset detection model outputs the model judgment result of "malware" or "normal", the model scoring result for the software sample and the threat scenario. The larger the score in the model scoring result, the greater the probability of the software sample being malicious. The model judgment result is stored in the database in the form of a model analysis report. For different threat scenarios, each threat scenario can be pre-set as a high-risk threat scenario or a normal threat scenario. For example, the financial system can be set as a high-risk threat scenario. If the threat scenario output by the preset detection model corresponding to the current software sample is a normal threat scenario, the model scoring result output by the preset detection model is not updated; if the threat scenario output by the preset detection model corresponding to the current software sample is a high-risk threat scenario, the model scoring result output by the preset detection model is updated, and the update method is to increase the model scoring result. Optionally, the update method can be to add 1 to the model scoring result.

[0047] The possible score ranges of the static score result, the dynamic score result and the model score result in the threat score result are equal. Optionally, the static score result, the dynamic score result and the model score result are all within the score range of 0-10.

[0048] The data processing module in this embodiment realizes a comprehensive and in-depth analysis of software samples through the collaborative work of the static analysis unit, the dynamic analysis unit and the model detection unit. It can accurately extract key information such as static features and dynamic behavior logs, and give static scores, dynamic scores and model scores based on this information, thereby comprehensively evaluating the threat level of software samples and providing an accurate and reliable basis for subsequent response measures.

[0049] In a possible implementation of the embodiment of the present application, the static features include semantic features and malicious content features; A static analysis unit is used to match the semantic features and malicious content features with a preset malicious rule library, and respectively determine a first matching result between the preset malicious rule library and the semantic features, and a second matching result between the preset malicious rule library and the malicious content features, and determine a static scoring result based on the first matching result, the second matching result and the sample matching result.

[0050] Specifically, the semantic feature can be used to extract the function call chain through the code decompilation tool, and analyze the high-risk function as the semantic feature. The malicious content feature includes the file header, section, import DLL, string information and data signature, etc. The first matching result of the preset malicious rule library and the semantic feature includes the result of whether each feature in the semantic feature can be successfully matched in the preset malicious rule library. Based on the first matching result, the ratio of the number of features in the semantic feature that successfully matches the preset malicious rule library to the total number of semantic features can be determined, that is, the first malicious feature probability. The second matching result of the preset malicious rule library and the malicious content feature includes the result of whether each feature in the semantic feature can be successfully matched in the preset malicious rule library. Based on the second matching result, the ratio of the number of features in the malicious content feature that successfully matches the preset malicious rule library to the total number of malicious content features can be determined, that is, the second malicious feature probability. The sample matching result can be achieved by performing fuzzy hash matching on the software sample and the known sample library through the SSDEEP algorithm. By detecting similar code fragments, the matching degree of the software sample and the known sample library is determined as the sample matching result.

[0051] Then, the product of the first malicious feature probability, the second malicious feature probability and the sample matching result and the maximum value of the static scoring result score range is calculated respectively, and the three scores obtained are weighted and summed, and the result of the weighted sum is the static scoring result. Among them, the weights corresponding to each of the three products can be flexibly set according to actual needs, which is not limited in this embodiment, and the sum of the weights of the three products is 1.

[0052] In addition, the static matching score can also be directly determined by specific static features. When the sample matching result is that the matching degree exceeds the threshold (for example, 85%), the static score result is directly increased by 4 points. When malicious strings (such as suspicious IP and URL) are detected in the static features, the static score result is increased by 3. When a UPX compression shell is detected, the static score result is increased by 2. The final static score is obtained after the static score adjustment is completed.

[0053] In this embodiment, the static analysis unit uses semantic features, malicious content features and a preset malicious rule library to determine the static scoring results, thereby effectively improving the accuracy and efficiency of malware detection, allowing the system to quickly identify and evaluate the potential threats of software samples based on the quantitative indicator of feature ratio.

[0054] In a possible implementation of an embodiment of the present application, the dynamic analysis unit includes a dynamic analysis subunit and a behavior analysis subunit; the dynamic behavior log includes an operation behavior log and a malicious behavior comparison result; the dynamic analysis subunit is used to run the software sample to obtain the operation behavior log of the software sample; the behavior analysis subunit is used to parse the operation behavior log to construct a behavior tree of the software sample, compare the behavior tree with a preset malicious behavior chain to obtain a malicious behavior comparison result, and determine a dynamic scoring result based on the malicious behavior comparison result.

[0055] In this embodiment, the dynamic analysis subunit transfers the software sample into an isolated virtual sandbox environment, where the virtual sandbox environment is maliciously Docker or VM, thereby preventing actual impact on the system, and starts tools for monitoring system calls and network behaviors, such as Sysmon or Strace. The sample is run in the sandbox, and network data packets during the sample operation are captured through tcpdump or Wireshark. The connection target, transmission data, etc. are analyzed, and the system calls, file reading and writing, registry operations, network connections and other behaviors are captured, recorded and stored as operation behavior logs, to provide data for subsequent behavior analysis.

[0056] Perform behavioral cluster analysis on the running behavior log. The classes may include file operations, registration page modification, network connection, process startup, and other behaviors. Each behavior class presets a malicious behavior characteristic. When the behavior class corresponding to the software sample analysis meets the corresponding malicious behavior characteristic, the behavior class is assigned the corresponding basic weight, otherwise the behavior class is assigned a weight of 0. Among them, each preset behavior class is assigned a basic weight, and the sum of the weights of each behavior class is 1. The malicious behavior characteristics corresponding to the behavior class are also preset. For example, if the process startup includes the malicious behavior characteristic of modifying the system startup item, the weight of the process startup behavior class is set to its preset basic weight (such as 0.3). Therefore, each behavior class determines the corresponding weight (basic weight or 0), and the sum of the weights of each behavior class is calculated as the clustering result. The product of the clustering result and the maximum value of the dynamic scoring result score range is used as the clustering result score.

[0057] Analyze dynamic behavior logs, divide dynamic behaviors into different dimensions (such as files, networks, processes, escape behaviors, etc.), and score each dimension. Specifically, for each dimension, the behavior characteristics corresponding to the dimension can be matched with the preset malicious behavior characteristics of the dimension. The higher the degree of match, the lower the score of the dimension. The correspondence between the matching degree and the dimension score can be flexibly set, and the sum of the scores of each dimension is used as the multi-threaded behavior score.

[0058] The behavior analysis subunit is used to parse the running behavior log, build a behavior tree of the software sample, record the operation path and system call sequence, and compare the obtained behavior tree with the preset malicious behavior chain to obtain the malicious behavior comparison result. The malicious behavior comparison result includes the matching degree between the behavior tree and the preset malicious behavior chain. If the matching degree exceeds the preset matching degree threshold, the malware is marked as "dynamic malicious". If the matching degree does not exceed the preset matching degree threshold, the malware is marked as "unknown". The marked "dynamic malicious" or "unknown" is used as the dynamic malicious judgment result. The malicious behavior comparison result includes the matching degree and the dynamic malicious judgment result.

[0059] The product of the matching degree between the behavior tree and the preset malicious behavior chain and the maximum value of the dynamic scoring result range is used as the behavior tree score. For example, if the matching degree is 30% and the dynamic scoring result range is 0-10, the behavior tree score is 30%×10=3.

[0060] The clustering result score, multi-threaded behavior score and behavior tree score are weighted and summed to obtain the dynamic score result. The dynamic behavior log and dynamic score result are stored in the database in the form of a dynamic analysis report to form a behavioral feature record of the software sample.

[0061] Specifically, the process of determining the matching degree between the behavior tree and the preset malicious behavior chain includes: setting a weight for each behavior feature in the behavior tree, the sum of the weight values ​​of each behavior feature in the behavior tree is 1, traversing each behavior feature in the behavior tree, checking whether the behavior feature matches a feature in the preset malicious behavior chain, if it matches, recording the weight value of the feature, adding the weight values ​​of all matching behavior features to obtain the total weight value of the matching features, and using the total weight value as the initial matching degree. Furthermore, if the malicious behavior chain defines a specific behavior pattern (such as a series of specific system call sequences), checking whether there is a similar behavior pattern in the behavior tree, and using a sequence alignment algorithm (such as a dynamic programming algorithm) to calculate the similarity score between the behavior tree and the malicious behavior chain, converting the similarity score into a coefficient greater than 1, and using the product of the coefficient and the initial matching degree as the matching degree between the behavior tree and the preset malicious behavior chain.

[0062] The result generation module includes a data integration unit, a threat score calculation unit and a visualization unit.

[0063] Specifically, the data integration unit collects the analysis results of each unit and integrates them into a unified forensic data package, including the static analysis report obtained by the static analysis unit, the dynamic analysis report obtained by the dynamic analysis unit, and the model analysis report obtained by the model detection unit. The forensic data package contains file features, behavior paths, threat scores, etc.

[0064] The threat score calculation unit is used to perform weighted summation of the static score result, the dynamic score result and the model score result to obtain a comprehensive software score, wherein the weights corresponding to the static score result, the dynamic score result and the model score result can be flexibly set and input by the technician, and this embodiment does not limit this. The obtained comprehensive software score is stored in the forensic data package.

[0065] The visualization unit is used to visualize the contents contained in the forensic data packet. It can generate graphical displays of behavior trees and attack paths through front-end visualization libraries such as D3.js, and output analysis data in formats such as PDF and HTML for easy viewing by users. The generated report includes threat scores, analysis details, behavior trees, etc., and supports export and archiving.

[0066] In this embodiment, the dynamic analysis unit obtains the operation behavior log by running the software sample, and uses the behavior analysis sub-unit to build a behavior tree to compare with the preset malicious behavior chain, and analyzes the behavior clustering results and multi-threaded behavior scores. It can accurately identify malicious behaviors and determine the dynamic scoring results accordingly. It not only improves the depth of malware detection, but also can effectively identify complex and changeable malicious behavior patterns, significantly enhancing the system's ability to identify and respond to potential threats.

[0067] In a possible implementation of an embodiment of the present application, the automatic response module includes a security response unit and a repair unit; the security response unit is used to trigger security response measures according to the model judgment results and the software comprehensive score; the repair unit is used to determine the malware type according to the feature analysis results, and determine the repair suggestion based on the malware type.

[0068] In this embodiment, the security response unit includes a response trigger and an isolation and cleaning sub-unit. The response trigger is used to determine the software threat level based on the comprehensive software score and trigger corresponding security measures corresponding to the software threat level; the isolation and cleaning sub-unit is used to perform isolation and cleaning operations when the model judgment result output by the model detection unit is "malware".

[0069] The repair unit is used to match the features included in the feature analysis results with the preset features corresponding to the preset malware types, determine the malware type corresponding to the preset features with the highest matching degree with the feature analysis results, and determine the repair suggestions that should be executed for this software sample based on the correspondence between the preset malware types and the repair suggestions. Optionally, the repair suggestion corresponding to the malware type of ransomware is to restore the backup, and the repair suggestion corresponding to the malware type of Trojan is to change the password. At the same time, the repair suggestions also include the operating steps for clearing malicious files and related security suggestions, and the generated repair suggestions are sent to the administrator or related users in the form of notifications.

[0070] The security response unit also includes an audit log management unit, which is used to record all automatic response operations, including isolation, cleanup, and recommendation generation. The log records include timestamps, operation content, execution results, etc. All audit logs are backed up regularly for subsequent review and analysis.

[0071] In this embodiment, the automatic response module can quickly trigger targeted security response measures based on the model judgment results and the comprehensive software score through the collaborative work of the security response unit and the repair unit, effectively curbing malware threats. At the same time, the repair unit can also accurately identify the malware type based on the feature analysis results and provide corresponding repair suggestions, thereby realizing end-to-end automated processing from threat detection to repair suggestions, significantly improving the system's security protection and recovery capabilities.

[0072] In a possible implementation of an embodiment of the present application, the security response unit includes a response trigger and an isolation and cleaning sub-unit; the response trigger is used to determine the software threat level according to the comprehensive software score and trigger the security response measures corresponding to the threat level; the isolation and cleaning sub-unit is used to perform isolation and cleaning operations when the software sample is determined to be malicious.

[0073] Specifically, the score range of the software comprehensive score is 0-1. The score range of each software threat level can be pre-divided. Optionally, three levels of high threat, medium threat and low threat are set. The score range corresponding to high threat is [7, 10], the score range corresponding to medium threat is [4, 7], and the score range corresponding to low threat is [0, 4).

[0074] The response trigger determines whether to initiate security response measures based on the calculated software comprehensive score. When the software comprehensive score is higher than the set threshold (the minimum value of the medium threat level score range), the automatic response process is activated and the response status is recorded in the log for subsequent tracing and auditing.

[0075] The isolation and cleaning subunit is used to perform isolation operations when a software sample is determined to be malicious, prevent it from spreading in the network, automatically close infected network connections or processes to prevent further infection, clean malicious files and related processes, and record the details of the cleaning operation in the log.

[0076] In this embodiment, the security response unit accurately determines the software threat level by responding to the trigger and immediately triggers the corresponding security response measures, which effectively improves the pertinence and timeliness of the response. At the same time, the isolation and cleaning sub-unit quickly performs isolation and cleaning operations when the software sample is determined to be malicious, effectively preventing the further spread and damage of the malware, and together constitute an efficient and accurate automated security response system.

[0077] In a possible implementation method of an embodiment of the present application, a response trigger is used to trigger isolation and cleanup operations when the threat level is high threat, and send a high threat warning to the administrator; when the threat level is medium threat, a medium threat warning is sent to the administrator; when the threat level is low threat, a low threat log is recorded.

[0078] In this embodiment, the response trigger adopts a hierarchical response strategy according to different threat levels. This hierarchical response mechanism effectively improves the pertinence and efficiency of security response.

[0079] See also Figure 2, which shows a schematic diagram of the structure of a malware forensics system provided by another embodiment of the present application. A malware forensics system provided by this embodiment collects malware samples and associated data from various sources, including malicious sample files, network traffic, and system logs, etc., to ensure that the data sources for forensic analysis are comprehensive and real-time. Through static, dynamic, behavioral analysis, and machine learning models for multi-level analysis, a multi-level malware analysis framework is constructed. This multi-dimensional analysis framework can not only identify known malware, but also detect unknown threats, greatly improving the accuracy and coverage of detection, integrating the analysis results to generate a forensics report, and performing automatic response based on the results, which can provide an end-to-end automated malware analysis process, from data input to threat detection to forensics reporting and response management. And it can automatically integrate the results of multi-level analysis, and quantitatively evaluate the harm of malware through a set of threat scoring algorithms, and automatically generate a forensics report. The report contains detailed analysis data, scores, and visualized behavior paths, which helps users understand the nature and potential impact of threats. The automatic response system based on threat scoring can quickly identify high-risk samples and automatically perform isolation, cleaning, and other measures to prevent the further spread of malware. At the same time, the system can also generate repair suggestions to help users restore affected systems, and has high automation and security protection capabilities.

[0080] The present application embodiment provides a malware evidence collection method, such as Figure 3 As shown, the method provided in the embodiment of the present application is executed by an electronic device, which can be a server or a terminal device, wherein the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The terminal device can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc., but is not limited thereto. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, which is not limited in the embodiment of the present application. The method includes steps S301 to S304, wherein: S301, obtaining software samples, traffic data and log data; S302, analyzing the software samples, traffic data and log data to obtain feature analysis results, and determining static scoring results, dynamic scoring results and model scoring results based on the feature analysis results; S303, determining the software comprehensive score based on the static scoring result, the dynamic scoring result, the model scoring result and the preset scoring standard, and integrating and displaying the feature analysis result and the software comprehensive score; S304. Trigger security response measures based on feature analysis results and software comprehensive scores.

[0081] An electronic device is provided in an embodiment of the present application, such as Figure 4 As shown, Figure 4 The electronic device 400 shown includes: a processor 401 and a memory 403. The processor 401 and the memory 403 are connected, such as through a bus 402. Optionally, the electronic device 400 may also include a transceiver 404. It should be noted that in actual applications, the transceiver 404 is not limited to one, and the structure of the electronic device 400 does not constitute a limitation on the embodiments of the present application.

[0082] Processor 401 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 401 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0083] The bus 402 may include a path to transmit information between the above components. The bus 402 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 402 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the diagram, but it does not mean that there is only one bus or only one type of bus.

[0084] The memory 403 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0085] The memory 403 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 401. The processor 401 is used to execute the application code stored in the memory 403 to implement the contents shown in the above-mentioned malware evidence collection method embodiment.

[0086] Figure 4 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0087] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the contents shown in the aforementioned malware forensics method embodiment.

[0088] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0089] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A malware forensics system, characterized in that: include: Data acquisition module, data processing module, result generation module and automatic response module; The data acquisition module is used to acquire software samples, flow data and log data; The data processing module is used to analyze the software sample, the traffic data and the log data to obtain feature analysis results, and determine static scoring results, dynamic scoring results and model scoring results based on the feature analysis results; The result generation module is used to determine the software comprehensive score based on the static scoring result, the dynamic scoring result, the model scoring result and the preset scoring standard, and integrate and display the feature analysis result and the software comprehensive score; The automatic response module is used to trigger security response measures according to the feature analysis results and the comprehensive software score.

2. The malware forensics system according to claim 1, characterized in that: The data processing module includes a static analysis unit, a dynamic analysis unit and a model detection unit; the feature analysis results include static matching results, dynamic behavior logs and model determination results; The static analysis unit is used to analyze the software sample to obtain static features, match the software sample with a known sample library to obtain a sample matching result, and determine a static scoring result based on the static features and the sample matching result; The dynamic analysis unit is used to obtain the dynamic behavior log of the software sample and determine the dynamic scoring result of the software sample based on the dynamic behavior log; The model detection unit is used to input the static features, the dynamic behavior logs, the traffic data and the log data into a preset detection model, obtain the model judgment results, model scoring results and threat scenarios for the software sample output by the preset detection model, and update the model scoring results based on the threat scenarios.

3. The malware forensics system according to claim 2, characterized in that: The static features include semantic features and malicious content features; The static analysis unit is used to match the semantic feature and the malicious content feature with a preset malicious rule library, and respectively determine a first matching result between the preset malicious rule library and the semantic feature, and a second matching result between the preset malicious rule library and the malicious content feature, and determine a static scoring result based on the first matching result, the second matching result and the sample matching result.

4. The malware forensics system according to claim 2, characterized in that: The dynamic analysis unit includes a dynamic analysis subunit and a behavior analysis subunit; the dynamic behavior log includes an operation behavior log and a malicious behavior comparison result; The dynamic analysis subunit is used to run the software sample to obtain the running behavior log of the software sample; The behavior analysis subunit is used to perform behavior clustering analysis on the running behavior log to obtain a behavior clustering result, perform multi-threaded behavior scoring on the running behavior log, and parse the running behavior log to construct a behavior tree of the software sample, compare the behavior tree with a preset malicious behavior chain to obtain a malicious behavior comparison result, and determine a dynamic scoring result based on the behavior clustering result, the multi-threaded behavior score and the malicious behavior comparison result.

5. The malware forensics system according to claim 2, characterized in that: The automatic response module includes a safety response unit and a repair unit; The security response unit is used to trigger security response measures according to the model determination result and the software comprehensive score; The repair unit is used to determine the malware type according to the feature analysis result, and determine a repair suggestion based on the malware type.

6. The malware forensics system according to claim 5, characterized in that: The security response unit includes a response trigger and an isolation cleaning subunit; The response trigger is used to determine the software threat level according to the comprehensive software score and trigger the security response measures corresponding to the threat level; The isolation and cleaning subunit is used to perform isolation and cleaning operations when the software sample is determined to be malicious.

7. The malware forensics system according to claim 6, characterized in that: The response trigger is used to trigger isolation and cleanup operations when the threat level is high threat, and send a high threat warning to the administrator; when the threat level is medium threat, send a medium threat warning to the administrator; when the threat level is low threat, record a low threat log.

8. The malware forensics system according to claim 1, characterized in that: The flow data includes abnormal flow data; The data acquisition module is used to run the software sample and acquire the flow data during the running process, and filter abnormal flow data from the flow data based on preset filtering rules.

9. A method for collecting evidence of malware, characterized in that: include: Obtain software samples, traffic data, and log data; Analyze the software sample, the traffic data, and the log data to obtain feature analysis results, and determine static scoring results, dynamic scoring results, and model scoring results based on the feature analysis results; Determine a comprehensive software score based on the static score result, the dynamic score result, the model score result and a preset score standard, and integrate and display the feature analysis result and the comprehensive software score; A security response measure is triggered according to the feature analysis result and the comprehensive score of the software.

10. An electronic device, characterized in that: include: at least one processor; Memory; At least one application, wherein the at least one application is stored in a memory and configured to be executed by at least one processor, the at least one application being configured to: execute the malware forensics method of claim 9.

Images