Attack protection method and device, equipment, storage medium and program product

Abstract

The invention discloses an attack protection method and device, equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: acquiring to-be-tested data; according to the to-be-tested data and a preset malicious sample attack process, determining a to-be-attacked process corresponding to the to-be-tested data; wherein the preset malicious sample attack process comprises an attack chain corresponding to a malicious sample and attack techniques corresponding to different attack stages in the attack chain; and performing attack protection based on the attack chain and the attack technique corresponding to the to-be-attacked process. Complete protection deployment is carried out based on an attack chain and an attack technique, and the attack protection capability is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an attack protection method, device, equipment, storage medium and program product. Background Art

[0002] A network security solution refers to a series of measures and strategies designed to protect network systems and data from unauthorized access, use, disclosure, destruction, modification or loss. How to improve attack protection capabilities and ensure network security is an urgent problem that needs to be solved. Summary of the invention

[0003] In view of this, the purpose of the present invention is to provide an attack protection method, device, equipment and storage medium, which can restore the attack chain to simulate the real attack, restore the real attack and defense scenario, and improve the accuracy of security solution evaluation. The specific scheme is as follows:

[0004] In a first aspect, the present application discloses an attack protection method, comprising:

[0005] Get the data to be tested;

[0006] Determine the attack process to be attacked corresponding to the data to be tested according to the data to be tested and the preset malicious sample attack process; wherein the preset malicious sample attack process includes the attack chain corresponding to the malicious sample and the attack methods corresponding to different attack stages in the attack chain;

[0007] Attack protection is performed based on the attack chain and attack method corresponding to the process to be attacked.

[0008] Optionally, the process of determining the preset malicious sample attack process includes:

[0009] Determine the attack process of the malicious sample based on the crawling results of the threat report;

[0010] and / or, determining the attack process of the malicious sample according to the sample behavior characteristics obtained during the execution of the malicious sample by the sandbox;

[0011] And / or, obtaining the malicious sample attack process set by security personnel;

[0012] And / or, determining the attack process of the malicious sample using an artificial intelligence model based on the malicious sample;

[0013] The malicious samples include one or more of advanced persistent threat attack samples, attack samples included in historical attack cases, and attack samples included in security reports.

[0014] Optionally, the obtaining of the data to be tested includes:

[0015] Acquire the data to be tested sent by a preset service; wherein the preset service is a simulated command and control server established based on a command and control server communication environment.

[0016] Optionally, the preset service is generated based on an image file of the simulated command and control server.

[0017] Optionally, after performing attack protection based on the attack chain and attack method corresponding to the process to be attacked, the method further includes:

[0018] Obtaining protection results; the protection results include undetected attack types;

[0019] The attack protection capability is updated according to the undetected attack type.

[0020] Optionally, the data to be tested includes multiple samples to be tested, and determining the attack process corresponding to the data to be tested based on the data to be tested and a preset malicious sample attack process includes: determining the attack process corresponding to the data to be tested based on each sample to be tested and a preset malicious sample attack process.

[0021] In a second aspect, the present application discloses an attack protection device, comprising:

[0022] A test data acquisition module is used to acquire the test data;

[0023] A module for determining a process to be attacked, used to determine the process to be attacked corresponding to the data to be tested according to the data to be tested and a preset malicious sample attack process; wherein the preset malicious sample attack process includes an attack chain corresponding to the malicious sample and attack methods corresponding to different attack stages in the attack chain;

[0024] The attack protection update module is used to perform attack protection based on the attack chain and attack method corresponding to the process to be attacked.

[0025] In a third aspect, the present application discloses an electronic device, comprising:

[0026] Memory, used to store computer programs;

[0027] The processor is used to execute the computer program to implement the aforementioned attack protection method.

[0028] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program implements the aforementioned attack protection method when executed by a processor.

[0029] In a fifth aspect, the present application discloses a computer program product, comprising computer instructions; wherein the computer instructions implement the aforementioned attack protection method when executed by a processor.

[0030] In the present application, the data to be tested is obtained; the attack process corresponding to the data to be tested is determined based on the data to be tested and the preset malicious sample attack process; wherein the preset malicious sample attack process includes the attack chain corresponding to the malicious sample and the attack methods corresponding to different attack stages in the attack chain; attack protection is performed based on the attack chain and attack methods corresponding to the attack process to be attacked. It can be seen that according to the preset malicious sample attack process, the attack process corresponding to the data to be tested is determined by comparison, that is, the attack chain corresponding to the data to be tested and the attack methods corresponding to different attack stages in the attack chain are specifically determined, and then attack protection is performed based on the attack chain and attack methods corresponding to the data to be tested, and a complete protection deployment is performed based on the attack chain and attack methods to improve the attack protection capability. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0032] FIG1 is a flow chart of an attack protection method provided by the present application;

[0033] FIG2 is a schematic diagram of a specific malicious sample attack chain provided by this application;

[0034] FIG3 is a schematic diagram of the structure of an attack protection device provided by the present application;

[0035] FIG4 is a structural diagram of an electronic device provided in this application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] This application proposes an attack protection method that can restore the attack chain to simulate a real attack, restore the real attack and defense scenario, and improve the accuracy of security solution evaluation.

[0038] The embodiment of the present application discloses an attack protection method. Referring to FIG1 , the method may include the following steps:

[0039] Step S11: Acquire the data to be tested.

[0040] First, the security product receives the data to be tested, which may be a malicious attack sample, and if it is a malicious sample, the data to be tested contains a complete attack chain.

[0041] Step S12: determining the attack process corresponding to the test data according to the test data and the preset malicious sample attack process; wherein the preset malicious sample attack process includes the attack chain corresponding to the malicious sample and the attack methods corresponding to different attack stages in the attack chain.

[0042] The process of determining the above-mentioned preset malicious sample attack process includes: determining the malicious sample attack process based on the crawling results of the threat report; and / or determining the malicious sample attack process based on the sample behavior characteristics obtained during the sandbox execution of the malicious sample; and / or obtaining the malicious sample attack process set by security personnel; and / or determining the malicious sample attack process based on the malicious sample using an artificial intelligence model; the malicious sample includes one or more of the advanced persistent threat attack samples, attack samples included in historical attack cases, and attack samples included in security reports.

[0043] The specific determination steps of the malicious sample attack process may include the following methods: based on the attack means library, using the web crawler script to extract the attack tactics and attack techniques used in the attack from the attack sample information through character matching to obtain the attack chain of various attacks; and / or, inputting the attack sample information into the target neural network model, using the target neural network to extract the attack tactics and attack techniques used in the attack, to obtain the attack chain of various attacks; and / or, running the attack sample through the sandbox and recording the sample features, extracting the attack tactics and attack techniques used in the attack based on the sample features, to obtain the attack chain of various attacks. That is, various analysis methods can be used to restore the sequential execution process of the attack chain, and analyze and record the attack methods involved in each execution stage. Specifically, the analysis report can be formatted, and the attack methods of each stage in the analysis report can be automatically extracted using the web crawler script; the sandbox system can also be used to execute the complete attack chain, and the attack methods of the attack chain can be restored through the dynamic behavior characteristics of the malicious samples recorded in the sandbox; the security analyst can also manually analyze the workflow and attack methods used by the malicious sample execution to completely restore the entire attack chain; and the neural network model can also be used for automatic analysis. Finally, the complete attack chain is restored. A specific restored attack chain is shown in Figure 2. From left to right in the figure, the first column is the name of the attack chain, the second column is the name of the attack technology / attack tactic, the third column is the unique number of the attack technology / tactic in ATT&CK, and the fourth column is the description of each attack technology / tactic.

[0044] The process of acquiring attack samples can specifically include: collecting advanced persistent threat attacks, attack samples included in historical attack cases, and attack samples included in security reports, and collecting attack samples on the Internet according to classification labels to obtain attack sample information. That is, malicious samples used by APT attacks and popular threat organizations in historical attack cases can be collected as completely as possible through various channels. Specific attack sample collection channels may include: extracting malicious samples from APT and popular threat organization analysis reports published by security vendors; extracting malicious samples from desensitized digital forensics and incident emergency response reports of internal security incidents of organizations or customers; extracting malicious samples from source tracing reports of specific malware families published on the Internet by individual security researchers; and collecting malicious samples with label classifications from the Internet through automated crawler programs.

[0045] Wherein, the above-mentioned acquisition of the data to be tested includes: acquiring the data to be tested sent by the preset service; wherein, the preset service is a simulated command and control server established based on the command and control server communication environment. The process of building the simulated command and control server includes: extracting the attack payload of the attack chain corresponding to the malicious sample at each stage; building an automated response script according to the communication mechanism and operation action adopted by the attack chain corresponding to the malicious sample; the automated response script is used to send the attack payload; building an initial command and control server, and deploying the attack payload and the automated response script to the initial command and control server to obtain the simulated command and control server. Deploy security products in the test environment, and build a simulated command and control server in the test environment. Run the attack chain through the simulated command and control server to simulate the attack, that is, send the data to be tested to the device where the security product is located.

[0046] It is understandable that the attack means of malicious samples are analyzed, and attack chains of various attacks are generated based on the analysis results and the target description framework; a simulated command and control server is built based on the attack chain. That is, by obtaining a large number of attack samples, the attack means are analyzed for each attack sample, and the attack tactics and attack techniques involved in the attack sample are obtained to generate the attack chain of the attack. Attack Chain, also known as Cyber ​​Kill Chain, from the attacker's perspective, a complete Cyber ​​Kill Chain is usually divided into seven stages: reconnaissance target, load development, load delivery, load triggering, load installation, command control, and target achievement. The above target description framework can be the ATT&CK framework. The ATT&CK framework is open source and based on the attacker's perspective. It is used to describe the attack tactics and attack technical behaviors used during the attack. It aims to help the defender better understand and analyze the attacker's intentions, the next attack behavior, etc., so as to help the defender make security decisions. The ATT&CK framework is often used as a common standard. The framework can be used to enhance network security through defense gap analysis, endpoint security product evaluation, building and adjusting behavioral analysis for specific environments, and performing defense validation against common threat models using red teams that simulate known adversary behaviors. ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is an open source framework developed by MITRE to describe and classify tactics, techniques, and common knowledge of hacker attacks.

[0047] The above-mentioned preset service is generated based on the image file of the simulated command and control server. It is understandable that, considering that the command and control server (C&C) deployed by the attacker will be shut down after the attack activity ends, in order to avoid interruption of the attack chain execution, a simulated command and control server is established to ensure that the multi-stage attack payload can be sent, and finally ensure that the attack chain can be fully simulated and executed. In order to simulate the communication logic of the command and control server and solidify the attack chain process, this embodiment performs the following operations: 1. For the attack chain sent by the multi-stage attack payload (Payload), the C&C communication mechanism and stage process used are analyzed, including communication protocol, data packet parameters, Payload encryption and decryption, file upload / download, etc.; 2. The multi-stage attack payload involved in the attack chain is deployed on the simulated C&C server, so that the malicious sample can pull the Payload from the simulated C&C server to the test environment; 3. According to the analysis results of the C&C communication mechanism and stage process, a simulated C&C communication automatic response script is written to automatically send the multi-stage Payload to the test environment in a specific order and data format; 4. The simulated C&C server is built and run, which is specifically achieved by building a simulated C&C server virtual machine, deploying the automatic response script and the multi-stage Payload file on the virtual machine, and turning on the monitoring mode to wait for the attack chain to run; 5. The deployed simulated C&C server virtual machine is snapshotted to generate an image file, so that it can be used for rapid deployment and rollback of snapshots in different test environments in the future, and supports repeated testing.

[0048] The data to be tested includes multiple samples to be tested, and the process to be attacked corresponding to the data to be tested is determined based on the data to be tested and the preset malicious sample attack process, including: determining the process to be attacked corresponding to the data to be tested based on each sample to be tested and the preset malicious sample attack process. That is, the process to be attacked is determined based on multiple samples to be tested, so as to avoid the problem of low protection capability caused by attack protection based on a single attack. The process to be attacked is determined by multiple samples to be tested, that is, the attack chain and the attack means involved in the attack chain are determined, and the attack means include attack techniques and attack tactics. It is also possible to obtain multiple data to be tested at the same time, that is, to receive attacks from multiple attack chains at the same time.

[0049] Step S13: Perform attack protection based on the attack chain and attack method corresponding to the process to be attacked.

[0050] That is, by comparing the data to be tested with the preset malicious sample attack process, the attack chain and attack method corresponding to the process to be attacked can be determined, so as to carry out targeted attack protection, thereby improving the attack protection capability.

[0051] In this embodiment, after the attack protection is performed based on the attack chain and attack method corresponding to the process to be attacked, it can also include: obtaining protection results; the protection results include undetected attack types; updating attack protection capabilities according to the undetected attack types. The detected attack techniques and attack tactics can be obtained according to the detection report, so by comparing the detection report with the process to be attacked corresponding to the data to be tested, it is possible to determine the attack tactics and attack techniques that the security product has not detected, and then query the attack means library based on the undetected attack tactics and attack techniques, and generate evaluation results and improvement suggestions for the security solutions currently used by the security product.

[0052] Specifically verify the detection of attack techniques and tactics used in each attack chain through automated log analysis scripts or manual statistics. The rules in the security solution may include precise rules and general rules. It is necessary to screen out all attack techniques and tactics that are not precisely detected (only general rules are detected) and not detected; further, analyze the reasons for inaccurate detection, such as the security solution does not contain the rules of the attack technique / tactic, or contains the rule but does not detect it, mark each item and format it into a table. Further automate the table parsing, map each ATT&CK technique and tactic detection in the table to the ATT&CK matrix of the attack chain, so as to clearly show the weak points covered by the attack method detection capability, and then the security experts will give specific suggestions on how to improve and enhance the protection capability of the proposed security solution.

[0053] By receiving the test data sent by the simulated C&C server built based on the virtual machine snapshot, and pre-configuring the malicious sample attack process, that is, pre-clarifying the attack chain corresponding to the malicious sample and the attack methods corresponding to different attack stages in the attack chain, the corresponding attack chain and attack methods of the test data are determined by comparison, and attack protection is performed; after the attack chain is completed, the detection and interception of multiple ATT&CK techniques and tactics involved in the attack chain are retrieved in the attack report; for each ATT&CK technique and tactic, the reasons for detection or non-detection are analyzed, and security solution evaluation results and improvement suggestions are generated, so as to improve and enhance the protection capabilities of existing security solutions based on the evaluation results.

[0054] As can be seen from the above, in this embodiment, the data to be tested is obtained; the attack process corresponding to the data to be tested is determined according to the data to be tested and the preset malicious sample attack process; wherein the preset malicious sample attack process includes the attack chain corresponding to the malicious sample and the attack methods corresponding to different attack stages in the attack chain; attack protection is performed based on the attack chain and attack methods corresponding to the attack process to be attacked. It can be seen that according to the preset malicious sample attack process, the attack process corresponding to the data to be tested is determined by comparison, that is, the attack chain corresponding to the data to be tested and the attack methods corresponding to different attack stages in the attack chain are specifically determined, and then attack protection is performed according to the attack chain and attack methods corresponding to the data to be tested, and a complete protection deployment is performed based on the attack chain and attack methods to improve the attack protection capability.

[0055] Accordingly, the embodiment of the present application also discloses an attack protection device, as shown in FIG3 , which includes:

[0056] The test data acquisition module 11 is used to acquire the test data;

[0057] The attack process determination module 12 is used to determine the attack process corresponding to the test data according to the test data and the preset malicious sample attack process; wherein the preset malicious sample attack process includes the attack chain corresponding to the malicious sample and the attack methods corresponding to different attack stages in the attack chain;

[0058] The attack protection update module 13 is used to perform attack protection based on the attack chain and attack method corresponding to the process to be attacked.

[0059] As can be seen from the above, in this embodiment, the data to be tested is obtained; the attack process corresponding to the data to be tested is determined according to the data to be tested and the preset malicious sample attack process; wherein the preset malicious sample attack process includes the attack chain corresponding to the malicious sample and the attack methods corresponding to different attack stages in the attack chain; attack protection is performed based on the attack chain and attack methods corresponding to the attack process to be attacked. It can be seen that according to the preset malicious sample attack process, the attack process corresponding to the data to be tested is determined by comparison, that is, the attack chain corresponding to the data to be tested and the attack methods corresponding to different attack stages in the attack chain are specifically determined, and then attack protection is performed according to the attack chain and attack methods corresponding to the data to be tested, and a complete protection deployment is performed based on the attack chain and attack methods to improve the attack protection capability.

[0060] In some specific embodiments, the attack protection device may specifically include:

[0061] A first malicious sample attack process determination unit, configured to determine the malicious sample attack process according to a crawling result of the threat report;

[0062] and / or, a second malicious sample attack process determination unit, configured to determine the malicious sample attack process according to sample behavior characteristics obtained during the execution of the malicious sample by the sandbox;

[0063] and / or, a third malicious sample attack process determination unit, used to obtain the malicious sample attack process set by security personnel;

[0064] and / or, a fourth malicious sample attack process determination unit, configured to determine the malicious sample attack process based on the malicious sample using an artificial intelligence model;

[0065] The malicious samples include one or more of advanced persistent threat attack samples, attack samples included in historical attack cases, and attack samples included in security reports.

[0066] In some specific embodiments, the test data acquisition module 11 may specifically include:

[0067] The test data acquisition unit is used to acquire the test data sent by the preset service; wherein the preset service is a simulated command and control server established based on the command and control server communication environment.

[0068] In some specific embodiments, the preset service may be generated based on an image file of the simulated command and control server.

[0069] In some specific embodiments, the attack protection device may specifically include:

[0070] A protection result acquisition unit, configured to acquire a protection result after performing attack protection based on the attack chain and attack method corresponding to the process to be attacked; the protection result includes an undetected attack type;

[0071] An attack protection updating unit is used to update the attack protection capability according to the undetected attack type.

[0072] In some specific embodiments, the data to be tested includes multiple samples to be tested, and the module 12 for determining the process to be attacked may specifically include:

[0073] The unit for determining the process to be attacked is used to determine the process to be attacked corresponding to the data to be tested according to each of the samples to be tested and the preset malicious sample attack process.

[0074] Furthermore, an embodiment of the present application also discloses an electronic device, as shown in FIG4 . The content in the figure cannot be regarded as any limitation on the scope of use of the present application.

[0075] FIG4 is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the attack protection method disclosed in any of the aforementioned embodiments.

[0076] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0077] In addition, the memory 22, as a carrier for storing resources, may be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon include an operating system 221, a computer program 222, and data 223 including an attack chain, etc. The storage method may be temporary storage or permanent storage.

[0078] The operating system 221 is used to manage and control the hardware devices and computer programs 222 on the electronic device 20, so as to realize the operation and processing of the massive data 223 in the memory 22 by the processor 21, and it can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the attack protection method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0079] Furthermore, an embodiment of the present application also discloses a computer storage medium, in which computer executable instructions are stored. When the computer executable instructions are loaded and executed by a processor, the attack protection method steps disclosed in any of the aforementioned embodiments are implemented.

[0080] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0081] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0082] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0083] The above is a detailed introduction to an attack protection method, device, equipment and storage medium provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for a general technician in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. An attack protection method, characterized in that: include: Get the data to be tested; Determine the attack process to be attacked corresponding to the data to be tested according to the data to be tested and the preset malicious sample attack process; wherein the preset malicious sample attack process includes the attack chain corresponding to the malicious sample and the attack methods corresponding to different attack stages in the attack chain; Attack protection is performed based on the attack chain and attack method corresponding to the process to be attacked.

2. The attack protection method according to claim 1, characterized in that: The process of determining the preset malicious sample attack process includes: Determine the attack process of the malicious sample based on the crawling results of the threat report; and / or, determining the attack process of the malicious sample according to the sample behavior characteristics obtained during the execution of the malicious sample by the sandbox; And / or, obtaining the malicious sample attack process set by security personnel; And / or, determining the attack process of the malicious sample using an artificial intelligence model based on the malicious sample; The malicious samples include one or more of advanced persistent threat attack samples, attack samples included in historical attack cases, and attack samples included in security reports.

3. The attack protection method according to claim 1, characterized in that: The obtaining of the data to be tested comprises: Acquire the data to be tested sent by a preset service; wherein the preset service is a simulated command and control server established based on a command and control server communication environment.

4. The attack protection method according to claim 3, characterized in that: The pre-configured service is generated based on the image file of the simulated command and control server.

5. The attack protection method according to claim 3, characterized in that: After performing attack protection based on the attack chain and attack method corresponding to the process to be attacked, the method further includes: Obtaining protection results; the protection results include undetected attack types; The attack protection capability is updated according to the undetected attack type.

6. The attack protection method according to claim 1, characterized in that: The data to be tested includes multiple samples to be tested, and determining the attack process corresponding to the data to be tested based on the data to be tested and a preset malicious sample attack process includes: determining the attack process corresponding to the data to be tested based on each sample to be tested and a preset malicious sample attack process.

7. An attack protection device, characterized in that: include: A test data acquisition module is used to acquire the test data; A module for determining a process to be attacked, used to determine the process to be attacked corresponding to the data to be tested according to the data to be tested and a preset malicious sample attack process; wherein the preset malicious sample attack process includes an attack chain corresponding to the malicious sample and attack methods corresponding to different attack stages in the attack chain; The attack protection update module is used to perform attack protection based on the attack chain and attack method corresponding to the process to be attacked.

8. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor, configured to execute the computer program to implement the attack protection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: Used to store computer programs; wherein when the computer programs are executed by a processor, the attack protection method according to any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that Contains computer instructions; wherein when the computer instructions are executed by a processor, the attack protection method as described in any one of claims 1 to 6 is implemented.

Images