External connection behavior processing method and device, terminal equipment and storage medium

Abstract

The invention provides an external connection behavior processing method and device, terminal equipment and a storage medium. The method comprises the following steps: monitoring outbound traffic sent by each host in real time; performing flow analysis on the outbound flow, and generating application program external connection data in the outbound flow; wherein the application program external connection data comprises a first application program with an external connection behavior and an external connection address; when the external connection data of the application program is in the preset security list, responding to an external connection request of the first application program according to a processing specification corresponding to the preset security list; and when the external connection data of the application program is not in the preset security list, performing multi-dimensional security detection on the external connection data of the application program, updating the first application program to the preset security list according to a multi-dimensional security detection result, and responding to the external connection request of the first application program according to the processing specification. According to the invention, the security and flexibility of monitoring the external connection behavior of the application program on the host can be improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method, device, terminal equipment and storage medium for processing external connection behavior. Background Art

[0002] A host refers to a computer or server connected to a network. By hosting and running various applications, it can provide various services and resources to other devices or users. Users access the application download source or third-party download platform through the Internet to download the application installation package. Some options or authorization permissions may need to be configured during the installation process. However, some uncertified applications may send data or receive commands to external servers without authorization, resulting in data leakage or information loss. These applications will connect to malicious servers, causing the host to be infected with malware or suffer network attacks. Insecure applications can also exploit system or application vulnerabilities to attack, causing system crashes or other security issues. Therefore, it is necessary to conduct certain security detection and control of applications installed on the host, especially for scenarios such as corporate office networks that have certain requirements for information security.

[0003] In the prior art, the blacklist and whitelist libraries of applications are manually collected, analyzed, and maintained, and verified applications are included in the whitelist and unsafe applications are included in the blacklist. This method controls security risks by restricting applications that are not in the whitelist. However, as the number of applications increases, the blacklist and whitelist libraries will become large and difficult to manage, and the cost and complexity of maintenance will also increase. In addition, applications are frequently updated and new applications continue to emerge, making it difficult to update the blacklist and whitelist libraries in a timely manner, resulting in low detection efficiency. Blacklist and whitelist management relies on static lists and cannot cope with emerging security threats that are not included in the list. Existing security detection methods still have certain limitations when facing a large number of applications and ever-changing security threats. Summary of the invention

[0004] The present invention aims to provide a method, apparatus, terminal device and storage medium for processing external connection behavior, so as to solve the above-mentioned technical problems and improve the security and flexibility of monitoring the external connection behavior of application programs on the host.

[0005] In order to solve the above technical problems, the present invention provides a method for processing external contact behavior, comprising:

[0006] Monitor outbound traffic sent by each host in real time;

[0007] Performing traffic analysis on the outbound traffic to generate application external connection data in the outbound traffic; wherein the application external connection data includes a first application with external connection behavior and an external connection address;

[0008] When the application external connection data is in a preset safety list, responding to the first application's external connection request according to a processing specification corresponding to the preset safety list;

[0009] When the application external connection data is not in the preset security list, a multi-dimensional security check is performed on the application external connection data, and the first application is updated to the preset security list according to the multi-dimensional security check result and the external connection request of the first application is responded to according to the processing specification.

[0010] In the above solution, by real-time monitoring of the outbound traffic of each host, new applications and their external connection behaviors can be quickly captured. Compared with static black and white lists, it is updated faster and potential security threats can be discovered in a timely manner. According to the processing specifications corresponding to the preset safe list, it can quickly respond to external connection requests of known safe applications. This standardized processing helps to ensure the security and stability of the system. For applications that are not on the safe list, after judging their security through multi-dimensional security detection, it can effectively prevent potential security threats and continue to respond to external connection requests after the list is updated. This method avoids the security risks caused by the lag of black and white lists, shows better adaptability and flexibility in a dynamically changing network environment, and can provide stronger security protection.

[0011] In one implementation, the real-time monitoring of outbound traffic sent by each host specifically includes:

[0012] An outbound filter layer function is pre-registered, and outbound traffic sent by the host is intercepted based on the outbound filter layer function.

[0013] In one implementation, the performing traffic analysis on the outbound traffic to generate application external connection data in the outbound traffic specifically includes:

[0014] Extracting an IP header from the outbound traffic and identifying the IP header to obtain a first IP header of a non-local network;

[0015] Passing the first IP header to a callback function, and extracting first outbound traffic corresponding to the first IP header based on the callback function;

[0016] Traffic analysis is performed on the first outbound traffic according to a traffic analysis function to generate application external connection data in the first outbound traffic.

[0017] In one implementation, performing traffic analysis on the first outbound traffic according to a traffic analysis function to generate application external connection data in the first outbound traffic specifically includes:

[0018] Acquire a process file of the first outbound traffic based on the traffic analysis function;

[0019] Encrypt the process file according to a hash algorithm, obtain an MD5 value of the process file and use the MD5 value as the first application;

[0020] The application external connection data is generated based on the MD5 value and the external connection address in the first outbound traffic.

[0021] In one implementation, responding to the external connection request of the first application according to the processing specification corresponding to the preset security list specifically includes:

[0022] When the application external connection data is in the white list or the gray list, the external connection request of the first application is released; wherein the preset security list includes a white list, a gray list and a black list;

[0023] When the external connection data of the application is in the blacklist, the external connection request of the first application is intercepted.

[0024] In one implementation, performing a multi-dimensional security check on the external connection data of the application and updating the first application to the preset security list according to the multi-dimensional security check result specifically includes:

[0025] Performing multi-dimensional security detection on the external data of the application; wherein the multi-dimensional security detection includes: sandbox detection, anti-virus software scanning and threat intelligence collision;

[0026] Obtaining a first process file corresponding to the application external connection data and performing sandbox detection and antivirus software scanning on the process file to obtain a sandbox detection result and an antivirus detection result;

[0027] Performing threat intelligence collision on the external data of the application to obtain a threat detection result;

[0028] The first application is added to a corresponding safe list according to the sandbox detection result, the antivirus detection result and the threat detection result.

[0029] In a second aspect, the present application further provides an outreach behavior processing device, including: a flow monitoring module, a flow analysis module, a first processing module, and a second processing module;

[0030] The traffic monitoring module is used to monitor the outbound traffic sent by each host in real time;

[0031] The traffic analysis module is used to perform traffic analysis on the outbound traffic to generate application external connection data in the outbound traffic; wherein the application external connection data includes the first application with external connection behavior and the external connection address;

[0032] The first processing module is used for responding to the first application's external connection request according to the processing specification corresponding to the preset safety list when the application's external connection data is in the preset safety list;

[0033] The second processing module is used to perform multi-dimensional security detection on the application external connection data when the application external connection data is not in the preset security list, update the first application to the preset security list according to the multi-dimensional security detection result, and respond to the external connection request of the first application according to the processing specification.

[0034] In the above solution, by real-time monitoring of the outbound traffic of each host, new applications and their external connection behaviors can be quickly captured. Compared with static black and white lists, it is updated faster and potential security threats can be discovered in a timely manner. According to the processing specifications corresponding to the preset safe list, it can quickly respond to external connection requests of known safe applications. This standardized processing helps to ensure the security and stability of the system. For applications that are not on the safe list, after judging their security through multi-dimensional security detection, it can effectively prevent potential security threats and continue to respond to external connection requests after the list is updated. This method avoids the security risks caused by the lag of black and white lists, shows better adaptability and flexibility in a dynamically changing network environment, and can provide stronger security protection.

[0035] In one implementation, the traffic monitoring module is used to monitor the outbound traffic sent by each host in real time, specifically including:

[0036] An outbound filter layer function is pre-registered, and outbound traffic sent by the host is intercepted based on the outbound filter layer function.

[0037] In one implementation, the performing traffic analysis on the outbound traffic to generate application external connection data in the outbound traffic specifically includes:

[0038] Extracting an IP header from the outbound traffic and identifying the IP header to obtain a first IP header of a non-local network;

[0039] Passing the first IP header to a callback function, and extracting first outbound traffic corresponding to the first IP header based on the callback function;

[0040] Traffic analysis is performed on the first outbound traffic according to a traffic analysis function to generate application external connection data in the first outbound traffic.

[0041] In one implementation, performing traffic analysis on the first outbound traffic according to a traffic analysis function to generate application external connection data in the first outbound traffic specifically includes:

[0042] Acquire a process file of the first outbound traffic based on the traffic analysis function;

[0043] Encrypt the process file according to a hash algorithm, obtain an MD5 value of the process file and use the MD5 value as the first application;

[0044] The application external connection data is generated based on the MD5 value and the external connection address in the first outbound traffic.

[0045] In one implementation, responding to the external connection request of the first application according to the processing specification corresponding to the preset security list specifically includes:

[0046] When the application external connection data is in the white list or the gray list, the external connection request of the first application is released; wherein the preset security list includes a white list, a gray list and a black list;

[0047] When the external connection data of the application is in the blacklist, the external connection request of the first application is intercepted.

[0048] In one implementation, performing a multi-dimensional security check on the external connection data of the application and updating the first application to the preset security list according to the multi-dimensional security check result specifically includes:

[0049] Performing multi-dimensional security detection on the external data of the application; wherein the multi-dimensional security detection includes: sandbox detection, anti-virus software scanning and threat intelligence collision;

[0050] Obtaining a first process file corresponding to the application external connection data and performing sandbox detection and antivirus software scanning on the process file to obtain a sandbox detection result and an antivirus detection result;

[0051] Performing threat intelligence collision on the external data of the application to obtain a threat detection result;

[0052] The first application is added to a corresponding safe list according to the sandbox detection result, the antivirus detection result and the threat detection result.

[0053] In a third aspect, the present application also provides a terminal device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, it implements the external connection behavior processing method as described above.

[0054] In a fourth aspect, the present application further provides a computer-readable storage medium, the computer-readable storage medium including a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the external connection behavior processing method as described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A schematic diagram of a flow chart of a method for processing external contact behavior provided in one embodiment of the present invention;

[0056] Figure 2 A schematic diagram of a multi-dimensional security detection process provided in one embodiment of the present invention;

[0057] Figure 3 The module diagram of an external connection behavior processing device provided in one embodiment of the present invention. DETAILED DESCRIPTION

[0058] The specific implementation of the present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0059] The terms "first" and "second" and the like in the specification, claims and drawings of this application are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products or devices.

[0060] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0061] Example 1

[0062] See also Figure 1 , Figure 1 The flowchart of a method for processing external connection behavior provided in an embodiment of the present invention is as follows. The embodiment of the present invention provides a method for processing external connection behavior, including steps 101 to 104, and each step is specifically as follows:

[0063] Step 101: Monitor the outbound traffic sent by each host in real time.

[0064] In one embodiment, the real-time monitoring of the outbound traffic sent by each host specifically includes: pre-registering an outbound filter layer function, and intercepting the outbound traffic sent by the host based on the outbound filter layer function.

[0065] In an embodiment of the present invention, a host protection client is pre-installed on the host of the intranet, and the client is used as a host monitoring program to perform security monitoring on the host to be monitored. Preferably, the host monitoring program registers the outbound filter layer function (FWPMLAYER OUTBOUND IPPACKET V4 / V6) in the Filtering Layer Identifiers filter by calling the FWPS_CALLOUT1 entry function, and the host monitoring program can intercept and process the network traffic when it passes through a specific filtering layer. These layers correspond to the outbound IP data packet layer (IPv4 and IPv6), which means that the monitoring program can access all IP data packets sent from the host and intercept and process them, which involves checking the IP header of the data packet and analyzing the content therein, such as source IP, destination IP, protocol and other information. Among them, FWPS_CALLOUT1 refers to the callback entry point, which is a function pointer used to register the callback function to a specific monitoring point of Windows Filtering Platform (WFP). When the network data packet reaches the monitoring point, the registered callback function will be called. Filtering LayerIdentifiers are filtering layer identifiers, which define different monitoring layers in WFP, such as TCP / IP, HTTP, etc. Registering to which layer determines what type of network traffic the monitoring program can monitor.

[0066] Step 102: Perform traffic analysis on the outbound traffic to generate application external connection data in the outbound traffic; wherein the application external connection data includes a first application with external connection behavior and an external connection address.

[0067] In one embodiment, the outbound traffic is subjected to traffic analysis to identify application external connection data in the outbound traffic, specifically including: extracting an IP header in the outbound traffic and identifying the IP header to obtain a first IP header of a non-local network; passing the first IP header to a callback function, and extracting a first outbound traffic corresponding to the first IP header based on the callback function; and performing traffic analysis on the first outbound traffic according to a traffic analysis function to extract application external connection data in the first outbound traffic.

[0068] In the embodiment of the present invention, the IP header in the outbound traffic is extracted and identified, and it is determined whether it is an external network IP header and the processing result is fed back to the callback function FWPS_CALLOUT_CLASSIFY_FN1. ​​This callback function is responsible for receiving the processed data and performing further classification and processing operations. Through the callback function, the monitoring program can insert custom logic in the key link of data packet processing to achieve fine-grained control and analysis of traffic. After the callback function, the process traffic analysis function FWPS_INCOMING_METADATA_VALUES0 is also called to analyze the IP header processing result. This function can help the monitoring program obtain traffic-related metadata (such as process ID, application path, etc.), further identify the source and destination of the traffic, and thus determine which applications or processes generated the traffic. The process traffic analysis function can be used to obtain metadata related to the data packet. This function provides detailed information about the data packet, including: (1) process ID (PID): the unique identifier of the process that generates the data packet; (2) application path: the path of the application that executes the process; (3) other metadata: may include session ID, user ID, etc.

[0069] In one embodiment, the traffic analysis is performed on the first outbound traffic according to the traffic analysis function to generate application external connection data in the first outbound traffic, which specifically includes: obtaining the process file of the first outbound traffic based on the traffic analysis function; encrypting the process file according to a hash algorithm to obtain the MD5 value of the process file and using the MD5 value as the first application; and generating the application external connection data based on the MD5 value and the external connection address in the first outbound traffic.

[0070] In an embodiment of the present invention, the monitoring program can determine the specific application and process that initiated the network connection by using the acquired process ID and application path through the process traffic analysis function. The acquired process file is encrypted using a hash algorithm. A 128-bit (16-byte) MD5 value (hash value), also known as a "message digest", is generated. By calculating the MD5 hash value of a file or data, it is possible to verify whether the data has been tampered with after data transmission or storage. For example, when downloading a file, the website may provide the MD5 value of the file for the user to verify whether the downloaded file is complete. Then, based on the generated MD5 value and the corresponding external URL, the application external data can be generated.

[0071] Step 103: When the first application is in a preset safety list, respond to the external connection request of the first application according to the processing specification corresponding to the preset safety list.

[0072] In one embodiment, responding to the external connection request of the first application according to the processing specification corresponding to the preset security list specifically includes: when the external connection data of the application is in the white list or the gray list, releasing the external connection request of the first application; wherein the preset security list includes a white list, a gray list and a black list; when the external connection data of the application is in the black list, intercepting the external connection request of the first application.

[0073] In an embodiment of the present invention, the outbound request is released or intercepted according to the different lists where the first application is located, and the filter layer function can be set to control and block the outbound network traffic. Preferably, the data packet discard function FWPM_LAYER_OUTBOUND_IPPACKET_V4_DISCARD or FWPM_LAYER_OUTBOUND_IPPACKET_V6_DISCARD is registered in the WFP filter. Registering these filter layers means that the specified outbound IP data packets will be discarded when passing through these layers and will not continue to reach the network. The host monitoring program can realize the discarding of outbound IP data packets. This control mechanism can effectively block the specified application or traffic and improve the security and controllability of the network.

[0074] Step 104: When the application external connection data is not in the preset security list, perform a multi-dimensional security check on the application external connection data, update the first application to the preset security list according to the multi-dimensional security check result, and respond to the external connection request of the first application according to the processing specification.

[0075] In one embodiment, the multi-dimensional security detection is performed on the external data of the application, and the first application is updated to the preset security list according to the multi-dimensional security detection result, specifically including: performing multi-dimensional security detection on the external data of the application; wherein the multi-dimensional security detection includes: sandbox detection, anti-virus software scanning and threat intelligence collision; obtaining the first process file corresponding to the external data of the application and performing sandbox detection and anti-virus software scanning on the process file to obtain sandbox detection results and anti-virus detection results; performing threat intelligence collision on the external data of the application to obtain threat detection results; adding the first application to the corresponding security list according to the sandbox detection results, the anti-virus detection results and the threat detection results.

[0076] In the embodiment of the present invention, multiple aspects of security detection are performed on the external data of the application. Figure 2 , Figure 2The present invention is a flowchart of a multi-dimensional security detection process provided in an embodiment of the present invention. The process file corresponding to the external data of the application is sent to the security sandbox for sandbox detection. The security sandbox is an isolated environment for running and analyzing the behavior of the application to determine whether there is malicious behavior. The process of sandbox detection is: uploading the application file to the security sandbox system and then performing behavior analysis, which includes: (1) file behavior: monitoring file creation, modification, deletion and other operations; (2) registry behavior: detecting the application's read and write operations on the system registry; (3) network behavior: analyzing the application's network connection behavior, including the requests sent and the data received; (4) program behavior: observing the application's startup, process creation, system call and other operations. The security sandbox detects file behavior, registry behavior, network behavior, program behavior, etc., scores these behaviors, and determines whether the file behavior is harmful based on the scoring results. Similarly, the process file is sent to the multi-engine antivirus software, and the multi-engine antivirus software (multi-engine virus scanning) detects the file through multiple virus engines to determine whether it contains known viruses or malware. The process of antivirus detection is as follows: upload the application file to the multi-engine antivirus software, and each virus engine will perform signature detection on the file to identify known virus features. Some advanced antivirus software will also analyze the behavior of the file to detect whether there is malicious activity. The antivirus software scans to determine whether there is a virus in the process file. Furthermore, the application external connection data is sent to the threat intelligence library, which is used to compare the IP, domain name, MD5 and other information in the file behavior with known malicious data. The process of threat detection is as follows: extract the relevant IP address, domain name and MD5 value of the file from the first application and perform data query. The data query includes the following: (1) Malicious URL: check whether the extracted domain name matches the known malicious URL list; (2) Malicious domain name: compare whether the domain name is in the malicious domain name database; (3) Malicious IP address: check whether the IP address matches the information in the malicious IP address database; (4) Malicious file: use the file's MD5 value to query whether it exists in the known malicious file database; (5) Result analysis: based on the query results, determine whether there is a malicious IP, domain name or file. If a match is found, it means that the data may be related to malicious behavior. Combine the detection results from the security sandbox, Multi-Engine antivirus software, and threat intelligence library to comprehensively evaluate the security of the application: The behavior analysis results of the security sandbox provide the operating behavior of the application in the actual environment. The virus detection results of Multi-Engine antivirus software indicate whether the application contains known malicious code. The comparison results of the threat intelligence library help identify malicious network activities or known malicious files that the application may be involved in.When all three detection results show no risk, the corresponding first application is added to the whitelist; if all three detection results show risk, the first application is added to the blacklist; if individual detection results show risk, the first application is added to different safe lists based on the user's security requirements. Furthermore, for uncertain suspicious files, the manual process can be transferred to reverse analysis, and the first application is added to the corresponding safe list based on the reverse analysis results.

[0077] In an embodiment of the present invention, there is also provided an external connection behavior processing device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the above-mentioned external connection behavior processing method when executing the computer program.

[0078] In an embodiment of the present invention, a computer-readable storage medium is further provided. The computer-readable storage medium includes a stored computer program. When the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned external connection behavior processing method.

[0079] Exemplarily, the computer program can be divided into one or more modules, one or more modules are stored in the memory and executed by the processor to complete the present invention. One or more modules can be a series of computer program instruction segments that can complete specific functions, and the instruction segments are used to describe the execution process of the computer program in the outreach behavior processing device.

[0080] The external connection behavior processing device may be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The external connection behavior processing device may include, but is not limited to, a processor, a memory, and a display. Those skilled in the art will appreciate that the above components are merely examples of the external connection behavior processing device and do not constitute a limitation on the external connection behavior processing device. The external connection behavior processing device may include more or fewer components than the components, or may combine certain components, or different components. For example, the external connection behavior processing device may also include input and output devices, network access devices, buses, etc.

[0081] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the external connection behavior processing device, and uses various interfaces and lines to connect the various parts of the entire external connection behavior processing device.

[0082] The memory can be used to store computer programs and / or modules. The processor realizes various functions of the external connection behavior processing device by running or executing the computer programs and / or modules stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function (such as a sound playback function, a text conversion function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, text message data, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0083] Among them, if the module for processing external connection behavior is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. Computer-readable media may include: any entity or device that can carry computer program code, recording medium, U disk, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0084] An embodiment of the present invention provides a method for processing external connection behavior, which can quickly capture new applications and their external connection behaviors by monitoring the outbound traffic of each host in real time. Compared with static black and white lists, it is updated faster and can detect potential security threats in a timely manner. According to the processing specifications corresponding to the preset safe list, it can quickly respond to external connection requests of known safe applications. This standardized processing helps to ensure the security and stability of the system. For applications that are not on the safe list, after judging their safety through multi-dimensional security detection, it can effectively prevent potential security threats and continue to respond to external connection requests after the list is updated. This method avoids the security risks caused by the lag of black and white lists, shows better adaptability and flexibility in a dynamically changing network environment, and can provide stronger security protection.

[0085] Example 2

[0086] See also Figure 3 , Figure 3 Schematic diagram of a module of an external connection behavior processing device provided in an embodiment of the present invention. The embodiment of the present invention provides an external connection behavior processing device, including: a flow monitoring module 201, a flow analysis module 202, a first processing module 203 and a second processing module 204;

[0087] The traffic monitoring module 201 is used to monitor the outbound traffic sent by each host in real time;

[0088] The traffic analysis module 202 is used to perform traffic analysis on the outbound traffic to generate application external connection data in the outbound traffic; wherein the application external connection data includes the first application with external connection behavior and the external connection address;

[0089] The first processing module 203 is used to respond to the first application's external connection request according to the processing specification corresponding to the preset safety list when the application's external connection data is in the preset safety list;

[0090] The second processing module 204 is used to perform multi-dimensional security detection on the application external connection data when the application external connection data is not in the preset security list, update the first application to the preset security list according to the multi-dimensional security detection result, and respond to the external connection request of the first application according to the processing specification.

[0091] In one embodiment, the traffic monitoring module 201 is used to monitor the outbound traffic sent by each host in real time, specifically including: pre-registering an outbound filter layer function, and intercepting the outbound traffic sent by the host based on the outbound filter layer function.

[0092] In one embodiment, the outbound traffic is subjected to traffic analysis to generate application external connection data in the outbound traffic, specifically including: extracting the IP header in the outbound traffic and identifying the IP header to obtain a first IP header of a non-local network; passing the first IP header to a callback function, and extracting the first outbound traffic corresponding to the first IP header based on the callback function; and performing traffic analysis on the first outbound traffic according to a traffic analysis function to generate application external connection data in the first outbound traffic.

[0093] In one embodiment, the traffic analysis is performed on the first outbound traffic according to the traffic analysis function to generate application external connection data in the first outbound traffic, which specifically includes: obtaining the process file of the first outbound traffic based on the traffic analysis function; encrypting the process file according to a hash algorithm to obtain the MD5 value of the process file and using the MD5 value as the first application; and generating the application external connection data based on the MD5 value and the external connection address in the first outbound traffic.

[0094] In one embodiment, responding to the external connection request of the first application according to the processing specification corresponding to the preset security list specifically includes: when the external connection data of the application is in the white list or the gray list, releasing the external connection request of the first application; wherein the preset security list includes a white list, a gray list and a black list; when the external connection data of the application is in the black list, intercepting the external connection request of the first application.

[0095] In one embodiment, the multi-dimensional security detection is performed on the external data of the application, and the first application is updated to the preset security list according to the multi-dimensional security detection result, specifically including: performing multi-dimensional security detection on the external data of the application; wherein the multi-dimensional security detection includes: sandbox detection, anti-virus software scanning and threat intelligence collision; obtaining the first process file corresponding to the external data of the application and performing sandbox detection and anti-virus software scanning on the process file to obtain sandbox detection results and anti-virus detection results; performing threat intelligence collision on the external data of the application to obtain threat detection results; adding the first application to the corresponding security list according to the sandbox detection results, the anti-virus detection results and the threat detection results.

[0096] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0097] An embodiment of the present invention provides an external connection behavior processing device, which can quickly capture new applications and their external connection behaviors by monitoring the outbound traffic of each host in real time. Compared with static black and white lists, it is updated faster and can detect potential security threats in a timely manner. According to the processing specifications corresponding to the preset safe list, it can quickly respond to external connection requests of known safe applications. This standardized processing helps to ensure the security and stability of the system. For applications that are not on the safe list, after judging their safety through multi-dimensional security detection, it can effectively prevent potential security threats and continue to respond to external connection requests after the list is updated. This method avoids the security risks caused by the lag of black and white lists, shows better adaptability and flexibility in a dynamically changing network environment, and can provide stronger security protection.

[0098] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and substitutions can be made without departing from the technical principles of the present invention. These improvements and substitutions should also be regarded as the scope of protection of the present invention.

Claims

1. A method for processing external contact behavior, characterized in that: include: Monitor outbound traffic sent by each host in real time; Performing traffic analysis on the outbound traffic to generate application external connection data in the outbound traffic; wherein the application external connection data includes a first application with external connection behavior and an external connection address; When the application external connection data is in a preset safety list, responding to the first application's external connection request according to a processing specification corresponding to the preset safety list; When the application external connection data is not in the preset security list, a multi-dimensional security check is performed on the application external connection data, and the first application is updated to the preset security list according to the multi-dimensional security check result and the external connection request of the first application is responded to according to the processing specification.

2. A method for processing external contact behavior as claimed in claim 1, characterized in that: The real-time monitoring of the outbound traffic sent by each host specifically includes: An outbound filter layer function is pre-registered, and outbound traffic sent by the host is intercepted based on the outbound filter layer function.

3. A method for processing external contact behavior as claimed in claim 1, characterized in that: The performing flow analysis on the outbound flow to generate application external connection data in the outbound flow specifically includes: Extracting an IP header from the outbound traffic and identifying the IP header to obtain a first IP header of a non-local network; Passing the first IP header to a callback function, and extracting first outbound traffic corresponding to the first IP header based on the callback function; Traffic analysis is performed on the first outbound traffic according to a traffic analysis function to generate application external connection data in the first outbound traffic.

4. A method for processing external contact behavior as claimed in claim 3, characterized in that: The performing traffic analysis on the first outbound traffic according to the traffic analysis function to generate application external connection data in the first outbound traffic specifically includes: Acquire a process file of the first outbound traffic based on the traffic analysis function; Encrypt the process file according to a hash algorithm, obtain an MD5 value of the process file and use the MD5 value as the first application; The application external connection data is generated based on the MD5 value and the external connection address in the first outbound traffic.

5. The method for processing external contact behavior according to claim 1, characterized in that: The responding to the external connection request of the first application according to the processing specification corresponding to the preset security list specifically includes: When the application external connection data is in the white list or the gray list, the external connection request of the first application is released; wherein the preset security list includes a white list, a gray list and a black list; When the external connection data of the application is in the blacklist, the external connection request of the first application is intercepted.

6. A method for processing external contact behavior as claimed in claim 4, characterized in that: The performing multi-dimensional security detection on the external connection data of the application program, and updating the first application program to the preset security list according to the multi-dimensional security detection result, specifically includes: Performing multi-dimensional security detection on the external data of the application; wherein the multi-dimensional security detection includes: sandbox detection, anti-virus software scanning and threat intelligence collision; Obtaining a first process file corresponding to the application external connection data and performing sandbox detection and antivirus software scanning on the process file to obtain a sandbox detection result and an antivirus detection result; Performing threat intelligence collision on the external data of the application to obtain a threat detection result; The first application is added to a corresponding safe list according to the sandbox detection result, the antivirus detection result and the threat detection result.

7. An external contact behavior processing device, characterized in that: include: A flow monitoring module, a flow analysis module, a first processing module and a second processing module; The traffic monitoring module is used to monitor the outbound traffic sent by each host in real time; The traffic analysis module is used to perform traffic analysis on the outbound traffic to generate application external connection data in the outbound traffic; wherein the application external connection data includes the first application with external connection behavior and the external connection address; The first processing module is used for responding to the first application's external connection request according to the processing specification corresponding to the preset safety list when the application's external connection data is in the preset safety list; The second processing module is used to perform multi-dimensional security detection on the application external connection data when the application external connection data is not in the preset security list, update the first application to the preset security list according to the multi-dimensional security detection result, and respond to the external connection request of the first application according to the processing specification.

8. The device for processing external contact behavior according to claim 7, characterized in that: The traffic monitoring module is used to monitor the outbound traffic sent by each host in real time, specifically including: An outbound filter layer function is pre-registered, and outbound traffic sent by the host is intercepted based on the outbound filter layer function.

9. A terminal device, characterized in that: The method comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and when the processor executes the computer program, the method for processing external contact behavior as described in any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the external connection behavior processing method as described in any one of claims 1 to 6.

Images