APT attack behavior detection method and device and electronic equipment

Abstract

The invention relates to the technical field of Internet, in particular to an APT attack behavior detection method and device and electronic equipment, and the method comprises the steps: calling a detection tool to obtain to-be-detected data corresponding to the detection tool, and determining the detection tool based on the event type of target equipment; determining low-frequency data of which the occurrence frequency is lower than a preset frequency threshold value within a preset duration from the to-be-detected data; performing feature matching on the low-frequency data and the APT reference attack data, and if matching succeeds, determining that the target equipment is subjected to the APT attack; according to the method provided by the invention, different detection tools can be called to obtain different to-be-detected data when abnormal events of different event types are generated for the target equipment, so that the overall packaging of the operation data of the target equipment is avoided, and the data volume needing to be processed is reduced; meanwhile, by screening the low-frequency data, the data volume for subsequent feature matching is further reduced, and the detection efficiency of the APT attack behavior is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an APT attack behavior detection method, device and electronic device. Background Art

[0002] In the field of cybersecurity, digital forensics and incident response are two important components. Digital forensics refers to the process of preserving, identifying, extracting and recording computer evidence from various types of electronic devices, and incident response refers to the process of taking necessary measures to respond to network threats, security violations or cyber attacks.

[0003] In the related art, when detecting advanced persistent threats (APT) of electronic devices, the operating data of the electronic device to be detected is usually packaged as a whole, and then the packaged data is detected and analyzed through manual analysis or fixed processing scripts and tools to determine suspicious APT attack behaviors, resulting in poor efficiency and accuracy of APT attack detection. Summary of the invention

[0004] In view of this, the embodiments of the present application propose an APT attack behavior detection method, device and electronic device, which can call different detection tools for abnormal events of different event types generated by the target device, so as to obtain the data to be detected corresponding to the detection tool for detection, thereby reducing the amount of data that needs to be detected and improving detection efficiency.

[0005] The embodiment of the present application is implemented by adopting the following technical solutions:

[0006] In the first aspect, an embodiment of the present application provides an attack behavior detection method, the method comprising: determining a corresponding detection tool based on an event type in a preset event work order of a target device; calling the detection tool to obtain data to be detected corresponding to the detection tool from the operating data of the target device; determining low-frequency data whose number of occurrences within a preset time length is lower than a preset number threshold from the data to be detected; performing feature matching on the low-frequency data with APT reference attack data, and if the match is successful, determining that the target device is under an APT attack.

[0007] In the second aspect, an embodiment of the present application provides an attack behavior detection device, which includes: a tool determination module, which is used to determine the corresponding detection tool based on the event type in the preset event work order of the target device; an acquisition module, which is used to call the detection tool to obtain the data to be detected corresponding to the detection tool from the operation data of the target device; a screening module, which is used to determine low-frequency data whose number of occurrences within a preset time length is lower than a preset number threshold from the data to be detected; and an output module, which is used to perform feature matching on the low-frequency data with the APT reference attack data. If the match is successful, it is determined that the target device is attacked by APT.

[0008] In some implementations, the detection tool corresponds to path information, and the acquisition module is specifically used to call the detection tool to obtain the data to be detected under the target path from the operating data of the target device, and the target path is the path indicated by the path information corresponding to the detection tool.

[0009] In some implementations, the detection tool corresponds to a target data type, and the acquisition module is further used to call the detection tool to acquire the to-be-detected data of the target data type from the operating data of the target device.

[0010] In some implementations, the tool determination module is specifically used to obtain a preset event work order for a target device; determine tool information corresponding to the target device based on an event type in the preset event work order; and determine a tool indicated by the tool information as a detection tool.

[0011] In some embodiments, the attack behavior detection device also includes a cloud detection module, which is used to send the data to be detected to a cloud detection center so that the cloud detection center can filter out candidate detection data from the data to be detected; receive the candidate detection data returned by the cloud detection center; and perform feature matching on the candidate detection data with the APT reference attack data. If the match is successful, it is determined that the target device is attacked by APT.

[0012] In some embodiments, the cloud detection module includes an identification unit, which is used to determine the detection requirements for the target device based on a preset event work order for the target device; if it is determined based on the detection requirements that the data to be detected allows the cloud detection center to detect, the data to be detected is sent to the cloud detection center.

[0013] In some embodiments, the low-frequency data includes time information, the APT reference attack data corresponds to an APT attack behavior, there are multiple low-frequency data matching the APT reference attack data, and the attack behavior detection device also includes a statistical module, which is used to determine the attack timeline corresponding to the APT attack behavior based on the time information of each low-frequency data corresponding to the same APT attack behavior; determine the attack range corresponding to the APT attack behavior based on the APT attack behavior and the attack timeline corresponding to the APT attack behavior.

[0014] In some implementations, the attack behavior detection device further includes a report generation module, which is used to generate an attack behavior detection report based on the target data and the attack behavior of the target data; and send the attack behavior detection report to the target client.

[0015] In some embodiments, the output module is specifically used to determine that the low-frequency data matches the APT reference attack data if the target information in the low-frequency data matches the target information in the APT reference attack data; wherein the target information includes one or more of network protocol address information, domain name information, program hash value, and memory execution traces.

[0016] In a third aspect, an embodiment of the present application provides an electronic device, which includes one or more processors; a memory; and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the above method.

[0017] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores program code, and the program code can be called by a processor to execute the above method.

[0018] An APT attack behavior detection method, device and electronic device provided by an embodiment of the present application include: calling a detection tool to obtain data to be detected corresponding to the detection tool from the operation data of a target device, the detection tool being determined based on the event type in a preset event work order in the target device; determining low-frequency data whose occurrence times within a preset time period are lower than a preset number threshold from the data to be detected; performing feature matching on the low-frequency data and APT reference attack data, and if the match is successful, determining that the target device is under an APT attack; through the method provided by the present application, since the detection tool is determined based on the event type of the preset event work order of the target device, when an abnormal event of different event types is generated by the target device, different detection tools can be called to obtain different data to be detected from the operation data of the target device, thereby avoiding the overall packaging of the operation data of the target device and reducing the amount of data to be processed; at the same time, since the APT attack has the characteristic of low frequency, by screening the low-frequency data whose occurrence times in the data to be detected are lower than the preset number threshold, the amount of data for subsequent feature matching is further reduced, thereby improving the detection efficiency of APT attack behavior.

[0019] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A first flow chart of the APT attack behavior detection method provided in an embodiment of the present application is shown.

[0022] Figure 2 The embodiment of the present application provides Figure 1 Schematic diagram of the process of step S110.

[0023] Figure 3 The embodiment of the present application provides Figure 1 Schematic diagram of the process of step S120.

[0024] Figure 4 A second flow chart of the APT attack behavior detection method provided in an embodiment of the present application is shown.

[0025] Figure 5 A third flow chart of the APT attack behavior detection method provided in an embodiment of the present application is shown.

[0026] Figure 6 The embodiment of the present application provides Figure 5 Schematic diagram of the process of step S310.

[0027] Figure 7 A schematic diagram of an application scenario involved in an embodiment of the present application is shown.

[0028] Figure 8 The embodiment of the present application provides Figure 7 Flowchart for the application scenario shown.

[0029] Fig. 9 A schematic diagram of an APT attack behavior detection device provided in an embodiment of the present application is shown.

[0030] Fig.10 A schematic diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0031] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be understood as limiting the present application.

[0032] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative work are within the scope of protection of the present application.

[0033] In the following description, the terms "first\second" and the like are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It is understandable that "first\second" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein.

[0034] The term "multiple" as used herein refers to two or more than two. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the related objects are in an "or" relationship.

[0035] In the field of cybersecurity, digital forensics and incident response are two important components. Digital forensics refers to the process of preserving, identifying, extracting and recording computer evidence from various types of electronic devices, and incident response refers to the process of taking necessary measures to respond to network threats, security violations or cyber attacks.

[0036] In the related art, when detecting advanced persistent threats (APT) of electronic devices, the operating data of the electronic devices to be detected is usually packaged as a whole, and then the packaged data is detected and analyzed through manual analysis or fixed processing scripts and tools to determine suspicious attack behaviors, resulting in poor efficiency and accuracy of attack detection.

[0037] In order to solve the above problems, the present application proposes an APT attack behavior detection method, device and electronic device, the method comprising: calling a detection tool to obtain data to be detected corresponding to the detection tool from the operation data of the target device, the detection tool is determined based on the event type in the preset event work order in the target device; determining low-frequency data whose occurrence times are lower than the preset number threshold from the data to be detected; performing feature matching on the low-frequency data and the APT reference attack data, if the match is successful, it is determined that the target device is attacked by APT; through the method provided by the present application, since the detection tool is determined based on the event type of the preset event work order of the target device, when an abnormal event of different event types is generated by the target device, different detection tools can be called to obtain different data to be detected from the operation data of the target device, thereby avoiding the overall packaging of the operation data of the target device and reducing the amount of data to be processed; at the same time, since the APT attack has the characteristic of low frequency, by screening the low-frequency data whose occurrence times in the data to be detected are lower than the preset number threshold, the amount of data for subsequent feature matching is further reduced, thereby improving the detection efficiency of APT attack behavior.

[0038] The embodiments provided in this application will be described in detail below with reference to the accompanying drawings.

[0039] See also Figure 1 , Figure 1 A first flow chart of the APT attack behavior detection method provided in an embodiment of the present application is provided. The attack behavior detection method includes steps S110-S140:

[0040] S110 . Determine a corresponding detection tool based on an event type in a preset event work order of a target device.

[0041] Among them, the preset event work order of the target device can be uploaded in advance by the detection personnel; the preset event work order can include the event type, such as the hardware attack type, vulnerability exploitation type, malware type, etc. in the APT attack.

[0042] It is understandable that the data required for detection of different event types is different. Therefore, it is necessary to obtain the corresponding data by calling different detection tools. Among them, the data that need to be detected usually includes regular system items, including but not limited to: system information, scheduled tasks, system startup items, system logs, MFT logs, users, external network IPs, browser records, program history running records, commonly used software logs, historical document access records, etc.; BYOVD traces, including but not limited to: suspicious driver file detection data, suspicious service detection data; Rootkit traces, including: suspicious kernel module loading data, suspicious hidden kernel module detection data, suspicious kernel hijacking behavior data; APT organization's attack compromise indicators (IOC) data, such as IP, domain name, malicious program hash, malicious program memory execution traces, etc.

[0043] It is worth mentioning that the event type can be determined based on the description of the abnormal event for the target device; in some embodiments, the detection personnel can make a judgment and manually select it based on the description of the abnormal event for the target device. For example, if the description of the abnormal event is that the memory usage of the target device is abnormal, the event type can be selected as a malware type; if the description of the abnormal event is that the memory access of the target device is abnormal, the event type can be selected as a hardware attack type, etc.

[0044] In other embodiments, the detection personnel may input a description of an abnormal event for the target device, and a pre-trained neural network model may determine the event type based on the description of the abnormal event. Alternatively, a correspondence between pre-defined keywords and event types may be used to extract keywords from the input abnormal event description, and the corresponding event type may be determined based on the extracted keywords.

[0045] It should be noted that the target device may refer to a single device or multiple devices running in association (such as multiple hosts running in association); the event types included in the preset event work order of a target device may be one or more.

[0046] It is worth mentioning that the preset event work order can also include relevant information such as equipment type, customer name, detection validity period, etc.; the content included in the preset event work order can be configured according to actual needs.

[0047] S120: Calling a detection tool to obtain to-be-detected data corresponding to the detection tool from the operation data of the target device.

[0048] Among them, the detection tool refers to a plug-in with data acquisition capabilities. The data that can be acquired by different detection tools can be the same or different; further, different detection tools can process the acquired data in the same or different ways. For example, the detection tool can directly determine the extracted data as the data to be detected, or it can perform secondary processing after extracting the required data, such as data packaging, format conversion, etc., and use the processed data as the data to be detected.

[0049] The detection tool may obtain the data to be detected from the running data of the target device by calling other binary programs in the database, such as Autoruns, or by directly running script commands on the target device. The specific method is not limited here.

[0050] In some implementations, in order to facilitate the expansion of the data acquisition capability of the detection tool, the YAML (Ain't Markup Language) language format may be used to write the corresponding detection tool.

[0051] It can be understood that the detection tool is pre-configured. For example, data under a specified path can be obtained by configuring path information, data of a specified type can be obtained by configuring a data type, data with a target field can be obtained by configuring a target field, data can be obtained through a calling interface by configuring the interface, and so on.

[0052] For example, in order to detect BYOVD (Bring Your Own Vulnerable Driver) traces, the corresponding BYOVD detection tool may be a pre-configured system call interface, which sends a program for detecting suspicious driver files through the system call interface and packages the data obtained from running the program into a specified directory.

[0053] In some implementations, the detection tool corresponds to path information, and step S110 may specifically include: calling the detection tool to obtain the data to be detected under the target path from the operating data of the target device, where the target path is the path indicated by the path information corresponding to the detection tool.

[0054] In some implementations, the detection tool corresponds to a target data type, and step S110 may include: calling the detection tool to obtain data to be detected of the target data type from operating data of the target device.

[0055] Of course, the detection tool can also correspond to path information and target data type at the same time to obtain the data to be detected of the target data class under the specified path; exemplarily, the detection tool is a system log plug-in, and its configured path information is C:\Windows\System32\winevt\Logs, and the target data type is "login log". Then, the system log plug-in can directly read the host directory C:\Windows\System32\winevt\Logs, and the log type is login log.

[0056] See also Figure 2 , Figure 2 The embodiment of the present application provides Figure 1 Schematic diagram of the process of step S110, step S110 also includes steps S111-S113:

[0057] S111. Obtain a preset event work order for the target device.

[0058] As mentioned in the above-mentioned embodiment, the preset event work order for the target device is uploaded in advance by the inspection personnel; taking into account that there may be multiple preset event work orders for target devices at the same time, the preset event work order may include the identification information of the target device, so that the preset event work order for the target device can be obtained from multiple preset event work orders through the identification information of the target device.

[0059] S112: Determine tool information corresponding to the target device based on the event type in the preset event work order.

[0060] In some implementations, a correspondence between event types and tool information is preset. By reading the event type in a preset event work order and searching in the preset correspondence, the tool information corresponding to the event type can be determined.

[0061] The tool information may include a tool identifier, a tool calling path, etc., as long as it can uniquely indicate the tool.

[0062] S113. Determine the tool indicated by the tool information as the detection tool.

[0063] It can be understood that through the method provided in the embodiment of the present application, after the detection personnel upload the preset event work order of the target device, the detection tool that needs to be called can be automatically determined without the need for manual configuration by the detection personnel, thereby further improving the detection efficiency of attack behavior detection.

[0064] See also Figure 3 , Figure 3 The embodiment of the present application provides Figure 1 The flowchart of step S120 in FIG. 1 is a schematic diagram of the flowchart of step S120, where step S120 may include steps S121-S122:

[0065] S121. Obtain load information of the target device.

[0066] The load information is used to describe the resource occupancy status of the target device, such as memory occupancy, CPU occupancy, GPU occupancy, etc.

[0067] S122: If it is determined based on the load information that the load of the target device is less than a preset load threshold, a detection tool is called to obtain data to be detected corresponding to the detection tool from the operating data of the target device.

[0068] It can be understood that if the load of the target device is less than the preset load threshold, it means that the program currently running on the target device occupies fewer resources, and the remaining resources of the target device are likely to meet the operation of the detection tool. At this time, running the detection tool will not affect the normal operation of other programs, thereby ensuring the stability of other running programs on the target device; if the load of the target device is not less than the preset load threshold, it means that the program currently running on the target device occupies more resources, and the remaining resources of the target device are likely to be insufficient to meet the operation of the detection tool. At this time, running the detection tool will occupy the running resources of other programs, thereby affecting the normal operation of other programs on the target device.

[0069] Exemplarily, when the CPU usage of the target device is higher than 80%, calling the detection tool is stopped, and when it is lower than 80%, calling the detection tool is restarted.

[0070] In another embodiment, the corresponding preset load threshold can also be determined based on the number of detection tools called; the number of detection tools called and the preset load threshold are negatively correlated, that is, the more detection tools are called, the smaller the preset load threshold; it can be understood that the more detection tools are called, the more resources are required to run the detection tools. Therefore, by setting a smaller preset load threshold, it is ensured that the operation of the detection tools will not affect the normal operation of the target device.

[0071] Through the method provided in the embodiment of the present application, the detection tool is called to obtain the data to be detected from the operating data of the target device only when the load of the target device is less than the preset load threshold, thereby ensuring the stable operation of the target device.

[0072] S130 , determining low-frequency data whose occurrence times within a preset time length are lower than a preset number threshold from the data to be detected.

[0073] It can be understood that the preset duration is pre-set and can be understood as a data cycle for data acquisition; when the detection tool obtains the corresponding data to be detected from the operating data of the target device, the data cycle of the data that it can obtain is certain. Therefore, within the preset duration, the number of occurrences of the data can represent the frequency of occurrence of the data to a certain extent; for example, the detection tool can obtain the corresponding data to be detected from the operating data of the target device within one month. If the number of occurrences of data a is greater, it means that its frequency of occurrence is higher.

[0074] It should be noted that since APT (advanced persistent threat) attack behavior is low-frequency, long-term and hidden, low-frequency data with a frequency lower than the preset threshold in the data to be detected is suspicious data that may be generated by APT attack behavior.

[0075] In some embodiments, considering that there may be multiple different data to be detected, different data may correspond to the same preset number threshold or different preset number thresholds; for example, for data a, the corresponding preset number threshold may be 10 times, for data b, the corresponding preset number threshold may be 5 times, and so on.

[0076] In some other implementations, the low-frequency data may be determined by sorting the data to be detected from large to small according to the number of occurrences, and determining the last k data to be detected as low-frequency data.

[0077] It should be noted that, in the case where the target device is a plurality of associated devices, the low-frequency data having an occurrence count lower than a preset threshold count actually means that the sum of the occurrence counts in the plurality of devices is lower than the preset threshold count.

[0078] Obviously, by determining low-frequency data whose occurrence times are lower than a preset threshold from the data to be detected, the amount of data for subsequent feature matching is further reduced, thereby improving the efficiency of attack behavior detection.

[0079] S140: Perform feature matching on the low-frequency data and the APT reference attack data. If the match is successful, it is determined that the target device is under an APT attack.

[0080] Among them, APT reference attack data refers to data that can prove the existence of APT attack behavior, and can also be understood as attack defect indicators (Indicators of Compromise, IOC) of APT attack behavior. Exemplarily, APT reference attack data may include information such as IP, domain name, malicious program hash, malicious program, memory execution traces, etc.

[0081] In some implementations, step S140 may specifically include:

[0082] If the target information in the low-frequency data matches the target information in the APT reference attack data, it is determined that the low-frequency data matches the APT reference attack data; wherein the target information includes one or more of network protocol address information, domain name information, program hash value, and memory execution traces.

[0083] In some implementations, each low-frequency data may be feature matched with all APT reference attack data; or the APT reference attack data may be grouped and feature matched with the corresponding APT reference attack data.

[0084] It is worth mentioning that the matching of target information between low-frequency data and APT reference attack data can be a direct match between target information of the same type or an indirect match between target information of different types. Taking APT attack as an example, the feature matching of IP in reference attack data may include the following scenarios: First, the IP contained in the low-frequency data directly matches the IP in the APT reference attack data. Second, since the strings in the process memory contained in the low-frequency data may contain IP addresses, and the included files may also contain IP addresses, there is also an indirect match between the process memory in the low-frequency data and the IP in the APT reference attack data, as well as an indirect match between the files in the low-frequency data and the IP in the APT reference attack data.

[0085] For ease of description, the low-frequency data that matches the APT reference attack data is described as target data; it should be noted that the target data determined by feature matching can be one or more; the APT reference attack data corresponding to different target data can belong to the same APT attack behavior or different APT attack behaviors.

[0086] It is understandable that, since there may be multiple target data, the multiple target data may correspond to the same APT attack behavior or may correspond to different APT attack behaviors.

[0087] In some embodiments, see Figure 4 , Figure 4 A second flow chart of the APT attack behavior detection method provided by an embodiment of the present application is provided. The low-frequency data includes time information. The APT reference attack data corresponds to the APT attack behavior. When there are multiple low-frequency data matching the APT reference attack data, after step S140, the attack behavior detection method may further include S150-S160:

[0088] S150: Determine an attack timeline corresponding to the APT attack behavior based on time information of multiple low-frequency data corresponding to the same APT attack behavior.

[0089] Among them, the attack timeline can be obtained by sorting the low-frequency data corresponding to the same APT attack behavior according to the corresponding time information; obviously, the attack timeline can at least obtain the duration of the attack behavior, so that the loss can be estimated according to the duration of the attack behavior.

[0090] S160: Determine an attack scope corresponding to the APT attack behavior based on the APT attack behavior and the attack timeline corresponding to the APT attack behavior.

[0091] Among them, the attack scope can be used to describe the severity of the attack; illustratively, when the attack timeline of an attack behavior is greater than a time threshold (such as one month), the attack scope can be considered large; when the attack timeline of an attack behavior is not greater than the time threshold, the attack scope can be considered small; of course, for different attack behaviors, the time threshold for judging the attack scope may be different.

[0092] The attack scope can also be used to describe the specific changes in the attack location, that is, to perform source tracing analysis. For example, according to the attack timeline of the attack behavior, it is determined that the attack behavior first occurs on host a and then on host c, but host a and host c are associated through host b. Therefore, it can be determined that the attack scope includes hosts a, b, and c, and the attack path is from host a to host c.

[0093] Through the method provided in the embodiment of the present application, since the detection tool is determined based on the event type of the preset event work order of the target device, when an abnormal event of different event types is generated by the target device, different detection tools can be called to obtain different data to be detected from the operating data of the target device, thereby avoiding the overall packaging of the operating data of the target device and reducing the amount of data that needs to be processed; at the same time, when facing APT attacks, since APT attacks have the characteristics of low frequency, by screening low-frequency data whose number of occurrences in the data to be detected is lower than the preset number threshold, the amount of data for subsequent feature matching is further reduced, thereby improving the detection efficiency of attack behaviors.

[0094] In some implementations, after step S140, the attack behavior detection method may further include: generating an attack behavior detection report based on the APT attack behavior and the low-frequency data corresponding to the APT attack; and sending the attack behavior detection report to the target client.

[0095] Sending attack behavior detection reports through the target client makes it easier for security personnel to respond to incidents based on the attack behavior detection reports, thereby reducing the security risks of the target device.

[0096] See also Figure 5 , Figure 5A third flow chart of the attack behavior detection method provided in the embodiment of the present application is provided. After step S110, the attack behavior detection method further includes steps S310-S340:

[0097] S310: Send the data to be detected to the cloud detection center, so that the cloud detection center can filter out candidate detection data from the data to be detected.

[0098] Among them, there are many ways for the cloud testing center to screen out candidate testing data from the data to be tested, such as data matching, manual analysis, etc.

[0099] It should be noted that the cloud testing center has a large amount of computing resources to perform massive data testing. At the same time, the cloud testing center can also improve the data detection capabilities through the human intervention of cloud technical experts, so that other suspicious data other than low-frequency data can be quickly discovered from the data to be tested, that is, candidate detection data.

[0100] It is understandable that the cloud detection center can only detect the data to be detected whose occurrence times are not less than a preset threshold, so as to avoid repeated detection of candidate detection data and low-frequency data.

[0101] In some embodiments, see Figure 6 , Figure 6 The embodiment of the present application provides Figure 5 Schematic diagram of the process of step S310, step S310 includes steps S311-S32:

[0102] S311. Determine the detection requirements for the target device based on the preset event work order of the target device.

[0103] Among them, the detection requirements may include whether the cloud-based detection center is allowed to conduct detection; if the cloud-based detection center is allowed to conduct detection, the detection scope and time limits, etc.

[0104] S312: If it is determined based on the detection requirements that the data to be detected allows the cloud detection center to detect it, the data to be detected is sent to the cloud detection center.

[0105] Obviously, the prerequisite for the cloud detection center to conduct detection is that the target device needs to upload data to the cloud; if the operating data of the target device is confidential data, the risk of data leakage is increased during the cloud upload process. Therefore, through detection requirements, target devices that need to upload data and target devices that do not need to upload data are distinguished, thereby improving the data security of the target device in attack behavior detection.

[0106] S320: Receive candidate detection data returned by the cloud detection center.

[0107] S330: Feature matching is performed on the candidate detection data and the APT reference attack data. If the match is successful, it is determined that the target device is under APT attack.

[0108] Among them, step S330 is similar to step S140 in the aforementioned embodiment. Therefore, the specific description of step S330 can refer to the specific description of step S140 in the aforementioned embodiment, which will not be repeated here.

[0109] Through the method provided in the embodiment of the present application, for target devices involving confidential data, the cloud detection center can be prohibited from detection in the detection requirements, thereby avoiding the process of uploading data to the cloud and reducing the risk of data leakage; for target devices that allow the cloud detection center to perform detection, further detection can be performed through the cloud detection center to achieve online and offline synchronous detection, thereby improving the detection capability of attack behaviors.

[0110] For easier understanding, please participate Figure 7 , Figure 7 A schematic diagram of an application scenario involved in an embodiment of the present application is provided, including a user layer, an analysis layer, and a data layer. The method provided in the present application is mainly performed by the user layer and the analysis layer, which will be described in detail below:

[0111] User layer: After discovering an abnormality in the target device, the user reports the abnormal event by logging in to the specified website and filling out a preset event ticket. According to the event type in the preset event ticket filled out by the user, the corresponding detection tool can be called. Figure 7 Detection tool A and detection tool B are given as examples.

[0112] Analysis layer: Call detection tool A and detection tool B to obtain the data to be detected from the operating data of the target device. Specifically, detection tool A and detection tool B can access the target device through an API, and perform data analysis through the detection method provided in this application (including determining low-frequency data from the data to be detected, and performing feature matching based on the low-frequency data and reference attack data to obtain target data). Finally, a detection report is generated based on the attack behavior of the target data obtained from the data analysis.

[0113] Data layer: When analyzing data at the analysis layer, you can obtain reference attack data from the data through the API for feature matching; after the analysis is completed, you can also store the target data in the database through the API. Figure 7 Database 1, database 2 and database 3 are given as examples, and the three databases can be interconnected through APIs.

[0114] In some embodiments, after performing data analysis, the analysis layer may generate a test report in response to the test personnel's user interaction on a graphical user interface (GUI); at the same time, the test personnel may also view the test report through the graphical user interface; in addition, the test personnel may also perform operations on the database through the graphical user interface, such as database parameter configuration, modification and deletion of erroneous data, and import of new data.

[0115] In some implementations, database 1, database 2, and database 3 may be Elasticsearch, Logstash, and Kibana, respectively.

[0116] For further information, see Figure 8 , Figure 8 The embodiment of the present application provides Figure 7 The flowchart under the application scenario shown includes the user side, the platform side and the cloud side. The method provided by this application is mainly executed by the platform side, which will be described in detail below:

[0117] The user side includes a graphical user interface. After the user fills in the event ticket of the target device through the graphical user interface on the user side, the platform side calls the corresponding detection tool based on the event type recorded in the event ticket. If there are multiple detection tools, the multiple detection tools are integrated and displayed on the graphical user interface; then, the user runs the corresponding detection tool through interactive operations of the graphical user interface and determines to start data collection. Among them, the detection tools are pre-developed and maintained by the detection personnel in the cloud. The platform side can download the corresponding detection tools from the cloud according to the event ticket, or it can pre-download all the detection tools and then select the tools through the event ticket.

[0118] After receiving the data to be detected collected by the detection tool, the platform performs a series of processing on the data to be detected, including: data analysis, feature matching, timeline analysis, historical sample association, traceability analysis, etc.; among them, data analysis is the process of determining low-frequency data from the data to be detected; feature matching is the process of matching low-frequency data with reference attack data to determine the target data; timeline analysis is the process of determining the attack scope and assessing the loss based on the time information of the target data; historical sample association is the process of determining the attack organization based on historical attack information; traceability analysis is the process of determining the source of the attack and restoring the attack path; after the platform performs the above processing on the data to be detected, it can automatically generate a report by connecting to artificial intelligence. Among them, after the historical samples are associated, the associated historical samples can also be sent to the cloud for in-depth analysis and mining to obtain an analysis report on the attack organization.

[0119] The user can view the test report generated by the platform side through the graphical user interface on the user side, and confirm the completion of the test through interactive operations in the graphical user interface.

[0120] Of course, the attack behavior detection method provided in this application can also be applied to other different application scenarios, such as EDR (Endpoint Detection and Response) and XDR (Extended Detection and Response) scenarios.

[0121] See also Fig. 9 , Fig. 9 A schematic diagram of an APT attack behavior detection device provided in an embodiment of the present application is provided. The attack behavior detection device 400 includes:

[0122] The tool determination module 410 is used to determine a corresponding detection tool based on an event type in a preset event work order of a target device.

[0123] The acquisition module 420 is used to call the detection tool to obtain the to-be-detected data corresponding to the detection tool from the operation data of the target device, and the detection tool is determined based on the event type in the preset event work order in the target device.

[0124] The screening module 430 is used to determine low-frequency data whose occurrence times are lower than a preset threshold from the data to be detected.

[0125] The output module 440 is used to perform feature matching between the low-frequency data and the APT reference attack data. If the match is successful, it is determined that the target device is under APT attack.

[0126] In some implementations, the detection tool corresponds to path information, and the acquisition module 420 is specifically used to call the detection tool to obtain the data to be detected under the target path from the operating data of the target device, and the target path is the path indicated by the path information corresponding to the detection tool.

[0127] In some implementations, the detection tool corresponds to a target data type, and the acquisition module 420 is further used to call the detection tool to obtain the to-be-detected data of the target data type from the operating data of the target device.

[0128] In some implementations, the tool determination module 410 is specifically used to obtain a preset event work order for the target device; determine tool information corresponding to the target device based on the event type in the preset event work order; and determine the tool indicated by the tool information as a detection tool.

[0129] In some embodiments, the attack behavior detection device 400 also includes a cloud detection module, which is used to send the data to be detected to a cloud detection center so that the cloud detection center can filter out candidate detection data from the data to be detected; receive the candidate detection data returned by the cloud detection center; and perform feature matching on the candidate detection data with the APT reference attack data. If the match is successful, it is determined that the target device is attacked by APT.

[0130] In some embodiments, the cloud detection module includes an identification unit, which is used to determine the detection requirements for the target device based on the preset event work order of the target device; if it is determined based on the detection requirements that the data to be detected allows the cloud detection center to detect, the data to be detected is sent to the cloud detection center.

[0131] In some embodiments, the low-frequency data includes time information, and there are multiple low-frequency data matching the APT reference attack data. The attack behavior detection device 400 also includes a statistical module, which is used to determine the attack timeline corresponding to the APT attack behavior based on the time information of each low-frequency data corresponding to the same APT attack behavior; determine the attack range corresponding to the APT attack behavior based on the APT attack behavior and the attack timeline corresponding to the APT attack behavior.

[0132] In some implementations, the attack behavior detection device 400 further includes a report generation module, which is used to generate an attack behavior detection report based on the target data and the attack behavior of the target data; and send the attack behavior detection report to the target client.

[0133] In some embodiments, the output module 440 is specifically used to determine that the low-frequency data matches the APT reference attack data if the target information in the low-frequency data matches the target information in the APT reference attack data; wherein the target information includes one or more of network protocol address information, domain name information, program hash value, and memory execution traces.

[0134] In some implementations, based on the APT attack behavior detection method provided in the above embodiments, the present application also provides an electronic device, such as Fig.10 , Fig.10 A structural block diagram of an electronic device provided in an embodiment of the present application is given, where the electronic device 500 includes one or more processors 510; a memory 520; and one or more programs, wherein the one or more programs are stored in the memory 520 and configured to be executed by the one or more processors 510, and the one or more programs are configured to execute the above method.

[0135] The electronic device 500 may be a terminal device, and the terminal device may be a computer, a tablet computer, a vehicle-mounted terminal, etc.

[0136] The processor 510 may include one or more processing cores. The processor 510 uses various interfaces and lines to connect various parts of the entire wearable device, and executes various functions of the wearable device and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 520, and calling data stored in the memory 520. Optionally, the processor 510 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 510 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing the content to be displayed; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor, but may be implemented separately through a communication chip.

[0137] The memory 520 may include a random access memory (RAM) or a read-only memory (ROM). The memory 520 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 520 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data created by the electronic device during use.

[0138] In some embodiments, the present application further provides a computer-readable storage medium, which stores program code, and the program code can be called by a processor to execute the above method.

[0139] The computer readable storage medium may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer readable storage medium includes a non-transitory computer-readable storage medium. The computer readable storage medium has storage space for program codes that execute any of the method steps in the above method. These program codes may be read from or written to one or more computer program products. The program code may be compressed in an appropriate form.

[0140] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be a part of the overall module or unit of the module or unit function.

[0141] The above are only preferred embodiments of the present application, and are not intended to limit the present application in any form. Although the present application has been disclosed as above with preferred embodiments, it is not intended to limit the present application. Any technical personnel in the field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present application. However, any brief modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present application without departing from the content of the technical solution of the present application are still within the scope of the technical solution of the present application.

Claims

1. A method for detecting APT attack behavior, characterized in that: include: Determine the corresponding detection tool based on the event type in the preset event work order of the target device; Calling the detection tool to obtain the to-be-detected data corresponding to the detection tool from the operation data of the target device; Determine, from the data to be detected, low-frequency data whose occurrence times within a preset time period are lower than a preset number threshold; The low-frequency data is feature matched with the APT reference attack data, and if the match is successful, it is determined that the target device is under an APT attack.

2. The method according to claim 1, characterized in that The detection tool corresponds to path information, and the calling of the detection tool to obtain the to-be-detected data corresponding to the detection tool from the operation data of the target device includes: The detection tool is called to obtain the data to be detected under the target path from the operation data of the target device, and the target path is the path indicated by the path information corresponding to the detection tool.

3. The method according to claim 1, characterized in that The detection tool corresponds to a target data type, and the calling of the detection tool to obtain the to-be-detected data corresponding to the detection tool from the operation data of the target device includes: The detection tool is called to obtain the data to be detected of the target data type from the operating data of the target device.

4. The method according to claim 1, characterized in that: The method further comprises: determining a corresponding detection tool based on an event type in a preset event work order of the target device; Get the preset event ticket for the target device; Determining tool information corresponding to the target device based on the event type in the preset event work order; The tool indicated by the tool information is determined as the detection tool.

5. The method according to claim 1, characterized in that After calling the detection tool to obtain the to-be-detected data corresponding to the detection tool from the operation data of the target device, the method includes: Sending the data to be detected to a cloud detection center so that the cloud detection center can filter out candidate detection data from the data to be detected; Receiving candidate detection data returned by the cloud detection center; The candidate detection data is feature matched with the APT reference attack data, and if the match is successful, it is determined that the target device is under APT attack.

6. The method according to claim 5, characterized in that The sending of the to-be-detected data to a cloud-based detection center includes: Determining a detection requirement for the target device based on a preset event work order for the target device; If it is determined based on the detection requirement that the data to be detected allows detection by the cloud detection center, the data to be detected is sent to the cloud detection center.

7. The method according to claim 1, characterized in that The calling of the detection tool to obtain the to-be-detected data corresponding to the detection tool from the operation data of the target device includes: Obtaining load information of the target device; If it is determined based on the load information that the load of the target device is less than a preset load threshold, the detection tool is called to obtain the data to be detected corresponding to the detection tool from the operation data of the target device.

8. The method according to claim 1, characterized in that The low-frequency data includes time information, the APT reference attack data corresponds to an APT attack behavior, there are multiple low-frequency data matching the APT reference attack data, and after determining that the target device is attacked by the APT, the method further includes: Determine an attack timeline corresponding to the APT attack behavior based on time information of a plurality of the low-frequency data corresponding to the same APT attack behavior; An attack scope corresponding to the APT attack behavior is determined based on the APT attack behavior and an attack timeline corresponding to the APT attack behavior.

9. The method according to claim 1, characterized in that: After determining that the target device is attacked by APT, the method further includes: Generate an attack behavior detection report based on the APT attack behavior and the low-frequency data corresponding to the APT attack behavior; Send the attack behavior detection report to the target client.

10. The method according to claim 1, characterized in that The feature matching of the low-frequency data with the APT reference attack data includes: If the target information in the low-frequency data matches the target information in the APT reference attack data, it is determined that the low-frequency data matches the APT reference attack data; wherein the target information includes one or more of network protocol address information, domain name information, program hash value, and memory execution traces.

11. An APT attack behavior detection device, characterized in that: include: A tool determination module, used to determine a corresponding detection tool based on an event type in a preset event work order of a target device; An acquisition module, used for calling the detection tool to acquire the to-be-detected data corresponding to the detection tool from the operation data of the target device; A screening module, used to determine, from the data to be detected, low-frequency data whose occurrence times within a preset time period are lower than a preset number threshold; The output module is used to perform feature matching on the low-frequency data and the APT reference attack data. If the match is successful, it is determined that the target device is attacked by APT.

12. An electronic device, characterized in that: include: one or more processors; Memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs are configured to execute the method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: include: The computer-readable storage medium stores program codes, and the program codes can be called by a processor to execute the method according to any one of claims 1 to 10.

Images