Detection method and device for rebound shell process, chip and equipment

Abstract

The invention discloses a detection method and device for a rebound shell process, a chip and equipment, and belongs to the technical field of communication. According to the method, the network event, the pipeline event and the process event triggered by the process are queried from the network event, the anonymous pipeline event and the process event occurring in the terminal, and the essence of the rebound shell triggering process is that the rebound shell process triggers the network event, the anonymous pipeline event and the process event according to a certain event occurrence process. If it is queried that the network event, the pipeline event and the event generation flow formed by the process event triggered by the process accord with the rebound shell triggering process, the process is determined as the rebound shell process, so that the rebound shell process is detected from the essence of the rebound shell triggering process, context panoramic detection of the rebound shell process is realized, and the detection efficiency of the rebound shell process is improved. And the accuracy of detecting the rebound shell process is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method, device, chip and equipment for detecting a rebound shell process. Background Art

[0002] When hackers exploit vulnerabilities to invade a host, it is a very common method to control the invaded host through a rebound shell. Therefore, in order to prevent the host from being remotely controlled due to the rebound shell process, it is necessary to detect the rebound shell process in the host.

[0003] In the related art, the detection method of the rebound shell process, for example, collects the behavior log and traffic log of the controlled host, and uses the collected behavior log and traffic log to match the characteristics of the rebound shell command (such as the characteristic string in the rebound shell command line) according to the regular matching method. If the behavior log and traffic log have the characteristics of the rebound shell command, the process to which the command log and traffic log belong is determined to be the rebound shell process.

[0004] However, regular matching cannot cover endless text confrontations. For example, hackers can constantly find new deformation methods to bypass the above regular matching to reduce the accuracy of detecting rebound shells. Summary of the invention

[0005] The embodiments of the present application provide a method, device, chip and equipment for detecting a rebound shell process, which can improve the accuracy of detecting a rebound shell process. The technical solution is as follows:

[0006] In a first aspect, a method for detecting a rebound shell process is provided, in which events occurring in a network entity, an anonymous pipe, and a process of a terminal are respectively referred to as network events, anonymous pipe events, and process events. Based on this, in the method, the network events, anonymous pipe events, and process events of the terminal are first determined; then, the first network event, the first anonymous pipe event, and the first process event triggered by the first process are queried from the network events, anonymous pipe events, and process events of the terminal; if the first network event, the first anonymous pipe event, and the first process event are queried, and the event occurrence process formed by the first network event, the first anonymous pipe event, and the first process event conforms to the rebound shell triggering process, the first process is determined to be a rebound shell process.

[0007] The method queries the network events, pipe events and process events triggered by the process from the network events, anonymous pipe events and process events occurring in the terminal. Since the essence of the rebound shell triggering process is that the rebound shell process triggers the network events, anonymous pipe events and process events according to a certain event occurrence flow, if it is found that the event occurrence flow formed by the network events, pipe events and process events triggered by the process conforms to the rebound shell triggering process, the process is determined to be a rebound shell process, thereby realizing the detection of the rebound shell process from the essence of the rebound shell triggering process, realizing the contextual panoramic detection of the rebound shell process, and improving the accuracy of detecting the rebound shell process.

[0008] In a possible implementation, the rebound shell triggering process is represented by a rebound shell knowledge graph, which includes a rebound shell process node, a shell network node, a shell pipe node and a shell sub-process node. The rebound shell process node represents the rebound shell process, the shell network node represents the network entity controlled by the rebound shell process, the shell pipe node represents the anonymous pipe controlled by the rebound shell process, and the shell sub-process node represents the shell sub-process of the rebound shell process; any node among the shell network node, the shell pipe node and the shell sub-process node is connected to the rebound shell process node through an edge, and the edge is used to represent the event triggered by the entity represented by the rebound shell process at any node during the rebound shell triggering process.

[0009] Based on the above possible implementation methods, by abstracting the rebound shell triggering process into a rebound shell knowledge graph, the control role of the rebound shell process in the rebound shell triggering process is reflected through the connection method between the nodes in the rebound shell knowledge graph, so as to reflect the essence of the rebound shell triggering process. Therefore, the method of detecting the shell process based on the rebound shell knowledge graph can realize the detection of the shell process from the essence of the rebound shell triggering process, so as to improve the accuracy of detecting the shell process.

[0010] In one possible implementation, the time attribute of the shell network node is smaller than the event attribute of the shell pipeline node, and the time attribute of the shell network node is smaller than the time attribute of the shell subprocess node, and the time attribute of any node is used to indicate the time when an event occurs in the represented entity.

[0011] During the rebound shell triggering process, the rebound shell process first triggers the network connection event, and then triggers the anonymous pipe event and the process event of the shell subprocess. Based on the above possible implementation methods, the rebound shell knowledge graph can more accurately represent the rebound shell triggering process.

[0012] In a possible implementation, the shell pipeline node includes a first shell pipeline node and a second shell pipeline node, the first shell pipeline node represents a first anonymous pipeline, the second shell pipeline node represents a second anonymous pipeline, the first anonymous pipeline is an anonymous pipeline for the rebound shell process to send information to the shell child process, and the second anonymous pipeline is an anonymous pipeline for the shell child process to send information to the rebound shell process.

[0013] Since the rebound shell process triggers the pipe creation event of the first anonymous pipe and the pipe creation event of the second anonymous pipe in the redirection stage of the rebound shell triggering process, based on the above possible implementation method, the redirection stage of the rebound shell triggering process is represented by the connection relationship between the first shell pipe node, the second shell pipe node and the rebound shell process node, so that the rebound shell knowledge graph can more accurately represent the rebound shell triggering process.

[0014] In a possible implementation, the querying of the first network event, the first anonymous pipe event and the first process event triggered by the first process from the network events, the anonymous pipe events and the process events of the terminal includes the following steps: generating a global knowledge graph based on the network events, the pipe events and the process events of the terminal; matching the global knowledge graph with the rebound shell knowledge graph to obtain a matching result, the matching result indicating whether the first node in the global knowledge graph matches the rebound shell process node, and the first node is an entity node representing the first process.

[0015] Based on the above possible implementation methods, by matching the global knowledge graph of the terminal with the rebound shell knowledge graph, network events, anonymous pipe events and process events triggered by the process are queried. There is no need to query these events triggered by the process based on event information, which improves the event query efficiency and thus improves the detection efficiency of the rebound shell process.

[0016] In a possible implementation, before matching the global knowledge graph with the rebound shell knowledge graph, the method also includes the following steps: determining candidate rebound shell processes, candidate network entities, candidate anonymous pipes, and candidate shell subprocesses of the rebound shell process based on the terminal's network events, anonymous pipe events, and process events; determining entity nodes representing candidate rebound shell processes, candidate network entities, candidate anonymous pipes, and candidate shell subprocesses in the global knowledge graph as candidate nodes; and deleting entity nodes other than candidate nodes in the global knowledge graph.

[0017] Based on the above possible implementation methods, the global knowledge graph is pruned by deleting entity nodes other than candidate nodes in the global knowledge graph, so that only candidate nodes are retained in the pruned global knowledge graph, reducing the number of nodes in the global knowledge graph, which facilitates the subsequent matching of the global knowledge graph with the rebound shell knowledge graph.

[0018] In a possible implementation, the rebound shell process is any rebound shell process supported by the Windows operating system.

[0019] Based on the above possible implementation methods, the method is suitable for detecting various rebound shell processes in the Windows system, so that various rebound shell processes in the Windows system can be detected by the method, and rebound shell process detection based on anonymous pipes in the Windows system is realized.

[0020] In a second aspect, a rebound shell process detection device is provided, which is used to execute the method provided by the first aspect or any optional manner of the first aspect.

[0021] According to a third aspect, a chip is provided, comprising a logic circuit, wherein the logic circuit is used to execute the method provided in the first aspect or any optional manner of the first aspect.

[0022] According to a fourth aspect, a computer-readable storage medium is provided, wherein at least one program code is stored in the storage medium, and the program code is read by a processor to enable an electronic device to execute a method provided in the first aspect or any optional manner of the first aspect.

[0023] In a fifth aspect, a computer program product or a computer program is provided, which includes a program code, and the program code is stored in a computer-readable storage medium. A processor reads the program code from the computer-readable storage medium, and the processor executes the program code, so that the electronic device executes the method provided in the above-mentioned first aspect or various optional implementations of the first aspect.

[0024] Based on the implementations provided in the above aspects, the present application can also be further combined to provide more implementations. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a schematic diagram of an application environment of a method for detecting a rebound shell process provided by an embodiment of the present application;

[0026] Figure 2 This is a rebound shell triggering flow chart provided in an embodiment of the present application;

[0027] Figure 3 This is a flow chart of a method for detecting a rebound shell process provided by an embodiment of the present application;

[0028] Figure 4 This is a schematic diagram of the detection principle of a rebound shell process provided by an embodiment of the present application;

[0029] Figure 5 It is a schematic diagram of a rebound shell knowledge graph provided in an embodiment of the present application;

[0030] Figure 6 This is another rebound shell knowledge graph schematic diagram provided in an embodiment of the present application;

[0031] Figure 7 is a module interaction diagram of a detection device provided in an embodiment of the present application;

[0032] Figure 8 It is a schematic diagram of matching a local knowledge graph of a global knowledge graph and a rebound shell knowledge graph provided in an embodiment of the present application;

[0033] Fig. 9 It is a schematic diagram of matching a local knowledge graph of another global knowledge graph and a rebound shell knowledge graph provided in an embodiment of the present application;

[0034] Fig.10 It is a schematic diagram of matching a local knowledge graph of another full local knowledge graph and a rebound shell knowledge graph provided in an embodiment of the present application;

[0035] Fig.11 It is a structural schematic diagram of a detection device for a rebound shell process provided by an embodiment of the present application;

[0036] Fig.12 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0037] In order to facilitate understanding of the specific implementation of the present application, some nouns involved in the specific implementation are introduced as follows.

[0038] Shell: Also known as shell or outer shell, it is part of the operating system (OS). OS includes kernel and shell. Shell is the main interface between OS and the outside world. It is located in the outer layer of OS and provides users with a way to communicate with the OS core. Shell refers to the software that provides an operating interface for users. It is a command parser. Shell can receive user commands and then call the corresponding application. Simply put, users access the services of the operating system kernel through the shell, that is, from the shell to the kernel, and execute system commands.

[0039] Shell process: It is the running process of a shell program written by the user according to the programming syntax specified by the shell.

[0040] Rebound shell process: is a process used to implement a rebound shell.

[0041] Rebound shell: refers to the control end listening on a certain port, the controlled end actively initiates a request to the port, and transfers the input and output of the controlled end's command line to the control end. In layman's terms, rebound shell is a kind of intrusion behavior, which is mainly manifested in the invaded host (i.e. the controlled end) actively connecting to the remote invading host (i.e. the control end), so that the remote invading host can obtain the execution environment of the invaded host and can execute commands at will.

[0042] Next, the application environment of the rebound shell process detection method provided by the present application is introduced in conjunction with the accompanying drawings.

[0043] Figure 1 : is a schematic diagram of an application environment of a method for detecting a rebound shell process provided by an embodiment of the present application, such as Figure 1 As shown, the application environment includes a first terminal 101 and a second terminal 102, wherein any of the first terminal 101 and the second terminal 102 is a server or a user device, the server may be a cloud server or a non-cloud server, and the user device may be a portable terminal, a laptop terminal, a desktop terminal, etc.

[0044] The first terminal 101 and the second terminal 102 are located in different networks. For the first terminal 101, the network where the first terminal 101 is located is the intranet, and the network where the second terminal 102 is located is the extranet. The first terminal 101 is any terminal in the intranet, and the second terminal 102 is any terminal in the extranet. A firewall 103 is arranged in the intranet where the first terminal 101 is located, wherein the firewall 103 is a device used for network security in the network infrastructure, and is the first line of defense for network security. The firewall 103 can be composed of hardware, software, or hardware and software. The hardware firewall can be integrated in a router or a gateway, and the router analyzes and monitors the data packets flowing through by using the routing function of the network. The software firewall can be installed in a terminal in the intranet (such as the first terminal 101). The function of the firewall 103 is to check the data packets passing through the firewall 103 and determine the flow direction of the data packets according to the preset security policy. Its main purpose is to prevent the devices in the intranet from being accessed by unauthorized extranet devices.

[0045] The second terminal 102 is any terminal in the external network that does not have the access rights of the first terminal 101. The second terminal 102 is connected to the port of the first terminal 101 through a forward connection, and accesses the first terminal 101 through the port to invade the first terminal 101. However, in some cases, the second terminal 102 cannot invade the first terminal 101 through a forward connection. For example, the first terminal 101 can only send requests but cannot receive requests from the external network due to the restriction of the firewall 103, or the port of the first terminal 101 that the second terminal 102 expects to connect to is occupied, or the network where the first terminal 101 is located is a local area network or the Internet Protocol (IP) address changes dynamically, resulting in the second terminal 102 being unable to connect to the port of the first terminal 101 through a forward connection.

[0046] Based on this, the second terminal 102 controls the first terminal 101 to reversely connect to the second terminal 102 through the rebound shell process, so as to achieve the purpose of controlling the first terminal 101. For example, the second terminal 102 implants the rebound shell process in the first terminal 101, and during the operation of the rebound shell process, controls the first terminal 101 to actively connect to the second terminal 102 through the firewall 103 to achieve reverse connection, and then the second terminal 102 can build a data channel between the first terminal 101 through the rebound shell process, and the second terminal 102 can use this data channel to issue instructions to control the first terminal 101. Among them, the first terminal 101 actively reversely connects to the second terminal 102 and communicates with the second terminal 102, that is, the first terminal 101 has a rebound shell, the first terminal 101 is the controlled end of the rebound shell, and the second terminal 102 is the control end of the rebound shell.

[0047] Rebound shell is generally the last step of external network penetration and the first step of intranet penetration. It is a crucial step in the process of enhancing the authority of the intruding device (such as the second terminal 102). It is very critical to the security of the invaded device (such as the first terminal 101) and even the intranet where the invaded device is located. The rebound shell is triggered by the rebound shell process. Therefore, detecting the rebound shell process is a relatively important aspect of protecting the security of the intranet. However, the method of detecting the rebound shell process by regular matching in the related art cannot guarantee the detection accuracy of the rebound shell process, and in order to avoid the regular matching used being bypassed, in some embodiments, complex regular matching is designed and used to detect the rebound shell process, but in actual business scenarios, too many complex regular matching will bring greater performance pressure, and regular matching with wider universality cannot guarantee the detection accuracy of the rebound shell process.

[0048] Based on this, the present application provides a method for detecting a rebound shell process, which can be executed by the detection device 104, such as Figure 1 As shown, the detection device 104 can be located in the first terminal 101. The detection device 104 detects the rebound shell process in the first terminal 101 by executing the detection method, and sends a rebound shell alarm information to the cloud 105 to notify the cloud 105 of the detected rebound shell process, so that the alarm information acquisition device (referred to as the third terminal) obtains the rebound shell alarm information from the cloud 105, and determines the rebound shell process in the first terminal 101 according to the rebound shell alarm information, and blocks the rebound shell process. The third terminal can be any electronic device that provides security protection services for the user's terminal. Here, this application does not limit the third terminal. In another possible implementation, Figure 1 The application environment shown does not include the cloud 105 , and the detection device 104 sends a rebound shell alarm information to the third terminal without the help of the cloud 105 .

[0049] The detection device 104 can be a sub-device (or subsystem) in the intranet protection platform, or a device or system independent of the intranet protection product or the intranet protection platform, wherein the intranet protection platform is such as endpoint detection and response (EDR), extended threat detection and response (XDR) or intranet protection products, etc., and the present application does not limit the intranet protection platform. The detection device 104 can be implemented by hardware, or it can be implemented by software, or it can be implemented by a combination of hardware and software. The present application does not limit the implementation method of the detection device 104.

[0050] The Windows operating system supports multiple rebound shells, such as mshta rebound shell, rundll32 rebound shell, regsve32 rebound shell, certutil rebound shell, msiexec rebound shell, netcat (nc) rebound shell, vbs rebound shell, powercat rebound shell, msf rebound shell, etc. The triggering process of these multiple rebound shells in the Windows system is similar, or the implementation method is similar. Assuming that the operating system used by the first terminal is the Windows system, the following is combined with Figure 2 The rebound shell triggering process shown takes any rebound shell of the multiple rebound shells as an example to introduce the process of triggering the rebound shell in the Windows system as follows.

[0051] 201. The second terminal creates a rebound shell process in the first terminal, so that the rebound shell process runs in the first terminal.

[0052] The first terminal may be Figure 1 The first terminal 101 in the example, the second terminal may be Figure 1 The second terminal 102 in.

[0053] 202. The rebound shell process executes the network communication command of the second terminal to control the first terminal to actively connect to the external network port through the internal network port.

[0054] Among them, the network communication command is used to instruct the first terminal to actively connect to the external network port, the internal network interface can be any network port of the internal network gateway where the first terminal is located or any network port locally of the first terminal, the external network port is specified by the second terminal, the external network port is any port monitored by the second terminal, and the external network port can be any port of the external network gateway where the second terminal is located or any port locally of the second terminal.

[0055] For example, the rebound shell process actively initiates a network connection to the external network port through the internal network port in a reverse connection manner, so that network communication can be performed between the internal network port and the external network port.

[0056] 203. The rebound shell process creates a first anonymous pipe, a second anonymous pipe, and a shell subprocess in the first terminal, and connects the rebound shell process and the shell subprocess to the first anonymous pipe and the second anonymous pipe.

[0057] The shell subprocess is a subprocess of the rebound shell process, and the subprocess is a shell process. The first anonymous pipe is an anonymous pipe through which the rebound shell process sends information to the shell subprocess. The second anonymous pipe is an anonymous pipe through which the rebound shell process receives information returned by the shell subprocess.

[0058] The rebound shell process may first create one of the first anonymous pipe and the second anonymous pipe, then create a shell subprocess, and then create the other of the first anonymous pipe and the second anonymous pipe; or, first create the first anonymous pipe and the second anonymous pipe, then create the shell subprocess; or, first create the shell subprocess, then create the first anonymous pipe and the second anonymous pipe. Here, the embodiment of the present application does not limit the order of creating the first anonymous pipe, the second anonymous pipe, and the shell subprocess.

[0059] When both the rebound shell process and the shell subprocess are connected to the first anonymous pipe, the rebound shell process is configured as the information sending end (or information writing end) of the first anonymous channel, and the shell subprocess is configured as the information receiving end (or information reading end) of the first anonymous channel, so that the rebound shell process actively communicates with the shell subprocess through the first anonymous pipe.

[0060] When both the rebound shell process and the shell subprocess are connected to the second anonymous pipe, the rebound shell process is configured as the information receiving end (or information reading end) of the second anonymous channel, and the shell subprocess is configured as the information sending end (or information writing end) of the second anonymous channel, so that the shell subprocess actively communicates with the rebound shell process through the second anonymous pipe.

[0061] 204. The rebound shell process sends a control command to the shell subprocess through the first anonymous pipe. The shell subprocess executes the control command and returns an execution result of the control command to the rebound shell process through the second anonymous pipe.

[0062] Among them, the control command is used to instruct to perform a target action on the first terminal, and the target action is specified by the second terminal, such as a target action information collection action to collect terminal information of the first terminal. At this time, the control command is an information collection command (such as a whoami command), and the execution result is the collected terminal information of the first terminal, such as the device information of the first terminal, the information of the internal operating environment of the first terminal, the information of the application running in the first terminal, the information of the network connected to the first terminal, etc., and the terminal information is not limited here. Of course, the target action may also be other actions besides the information collection action. Here, the target action and the control command are not limited.

[0063] The rebound shell process writes the control command to the first anonymous pipe, and the shell subprocess reads the control command from the first anonymous pipe. After reading the control command, the shell subprocess executes the control command at the first terminal, obtains the execution result of the control command, writes the execution result to the second anonymous pipe, and the rebound shell process reads the execution result from the second anonymous pipe.

[0064] 205. The rebound shell process sends the execution result to the external network interface through the internal network interface.

[0065] 206. The second terminal monitors the execution result from the external network interface.

[0066] In another possible implementation, the shell subprocess only needs to execute the control command issued by the rebound shell process without returning the execution result. Based on this, the shell subprocess does not need to return the execution result of the control command to the rebound shell process through the second anonymous pipe. Accordingly, there is no need to execute steps 205 and 206.

[0067] The above steps 202 to 205 are the process of the rebound shell process triggering the first terminal to perform a rebound shell, which can also be called a rebound shell triggering process in the Windows system. In the rebound shell triggering process, the standard input and standard output of the rebound shell process are redirected through an anonymous pipe (such as a first anonymous pipe, or a first anonymous pipe and a second anonymous pipe), so the rebound shell triggering process is also a rebound shell triggering process based on an anonymous pipe. In addition, in the rebound shell triggering process, the network communication between the first terminal and the second terminal is also realized through the reverse connection, and the first terminal is controlled by executing the command through the shell subprocess. Based on this, from the perspective of detection, the rebound shell triggering process mainly includes the network connection stage of actively connecting to the external network, the redirection stage based on the anonymous pipe, and the command execution stage based on the shell subprocess. In terms of timing, the network connection stage is entered first, and then the redirection stage and the command execution stage are entered. Since the creation order of the first anonymous pipe, the second anonymous pipe and the shell subprocess is not unique, the redirection stage and the command execution stage are not unique in timing, and may enter the redirection stage first, or may enter the command execution stage first. Among them, through network communication, a data channel is established between the first terminal and the second terminal, and the network communication and command execution are connected through redirection. Therefore, command execution and network communication can construct a flowing data channel with the help of redirection, and the second terminal can use this data channel to issue instructions to control the first terminal. Different implementation methods are combined together to form a variety of rebound shells at the first terminal.

[0068] Based on this rebound shell triggering process, the present application provides a method for detecting a rebound shell process to detect a rebound shell process in a terminal. The method is used to detect any rebound shell process supported by the Windows system. Therefore, when the operating system of any terminal is a Windows system, the rebound shell process in the terminal is detected by this method.

[0069] Next, combine Figure 3 The flowchart of a method for detecting a rebound shell process provided by an embodiment of the present application is shown in the figure, and the method is described in detail. The method is executed by a detection device in a terminal to be detected, and the terminal to be detected is any terminal, such as the terminal to be detected is Figure 1 The first terminal 101 in the embodiment of the present invention is Figure 1 The detection device 104 in.

[0070] 301. A detection device determines a network event, an anonymous pipe event, and a process event of a terminal, wherein a network event refers to an event occurring in a network entity, an anonymous pipe event refers to an event occurring in an anonymous pipe, and a process event refers to an event occurring in a process.

[0071] Wherein, the terminal is a terminal to be detected, and the network entity refers to the network interface of the intranet where the terminal is located, such as any network port of the intranet gateway or any network port of the first terminal. Network events include network connection events and / or network communication events, wherein a network connection event refers to an event of connecting to any network or a network device of any network through the network entity, and the any network may be the intranet where the terminal is located or a network outside the intranet (i.e., an extranet). If the any network is an intranet, the network connection event is also called an intranet connection event, and if the any network is an extranet, the network connection event is also called an extranet connection event. A network communication event refers to an event of information interaction between the network entity and the any network or the network device of the any network, such as sending and receiving data streams from the any network or the network device of the any network, and the any network may be the intranet where the terminal is located or a network outside the intranet (i.e., an extranet). In the present application, pipe events include anonymous pipe events and named pipe events, wherein anonymous pipe events are events that affect the state of anonymous pipes during the life cycle of anonymous pipes, and named pipe events are events that affect the state of named pipes during the life cycle of named pipes. For any of the anonymous pipe events and named pipe events, the pipe events include pipe creation events and / or pipe connection events, wherein pipe creation events refer to events that create pipes (anonymous pipes or named pipes), and pipe connection events refer to events that connect the pipes. Process events are events that affect the state of a process during its life cycle, for example, process events include process creation events and process termination events, and process creation events refer to events that create a process. Process termination events refer to events that terminate a process.

[0072] In a possible implementation, the detection device has a data collection function, and the detection device collects event information of various basic events related to network security and / or device security in the terminal, and determines the network events, anonymous pipe events and process events in the terminal based on the event information of various basic events collected. Among them, the various basic events include process events, network events and pipe events. Optionally, the various basic events also include file events, registry events and at least one of other events, wherein the file event refers to an event that affects the file status during the life cycle of the file, for example, at least one of a file creation event, a file deletion event, a file modification event and a file read and write event, a file creation event refers to an event that creates a file, a file deletion event refers to an event that deletes a file, a file modification event refers to an event that modifies data in a file, and a file read and write event refers to an event used to read or write data in a file. Other events are events related to network security and / or device security, and other events are not limited here.

[0073] The event information of any basic event includes at least one of the time sub-information of the basic event, the event source identification (identity, ID), the event ID, the event type ID and the event detailed sub-information, wherein the time sub-information indicates the time when the basic event occurs, the event source ID indicates the operating environment (such as OS) of the basic event, and the event ID is used to indicate a basic event collected. The event IDs of different basic events collected are different. For example, the event ID is the number of a basic event collected. Assuming that 10 basic events are collected, the IDs of these 10 basic events are 1-10 respectively. These 10 basic events may be basic events of the same type or different types. The event type ID is the identifier of the event type, and the event type is such as process creation, pipeline creation, pipeline connection, network connection, etc. The event detailed sub-information is used to describe the basic event in detail. For example, the event detailed sub-information includes the event occurrence entity ID of the basic event, the event triggering entity ID of the basic event, the entity type ID of the event occurrence entity, the entity type ID of the event triggering entity, the parameters involved when the basic event occurs, and at least one of the commands, wherein the event occurrence entity refers to the entity that occurs the basic event, the event triggering entity refers to the entity that triggers the basic event, the event occurrence entity is the child entity of the event triggering entity, and the event triggering entity is the parent entity of the event occurrence entity. The entity type ID of any entity in the event occurrence entity and the time triggering entity, that is, the ID of the entity type, the entity type is such as a process, a network entity, a pipe, a file, a registry, or other entities. If the entity ID of any entity can represent the entity type of any entity, the entity type ID of any entity may not be included in the event detailed sub-information.

[0074] Taking the basic event as a process creation event as an example, the event detailed sub-information of the process creation event includes at least one of the process ID of the created process and the parent process ID, wherein the parent process is the parent process of the process and is the event triggering entity of the process creation event. Assuming that a process with a process ID of 3876 (referred to as process 3876) is created, the event information is shown in Table 1 below. From Table 1, it can be seen that in the Windows system, process xxx created process 3876 at 2022 / 11 / 15 17:40.

[0075] Table 1

[0076]

[0077] Assume that the process creation event is that process 3876 creates a child process with process ID 5016. The event information is shown in Table 2 below. From Table 2, it can be seen that in the Windows system, at 2022 / 11 / 15 17:40, process 3876 created process 5016, and process 3876 is the parent process of process 5016.

[0078] Table 2

[0079]

[0080] In another possible implementation, the event detailed sub-information of the process creation event also includes the command executed by the entity where the event occurred. Taking the event information of the process creation event shown in Table 3 as an example, it can be seen from Table 3 that in the Windows system, at 2022 / 11 / 15 17:40, process 3876 created child process 5016, and the child process 5016 executed the whoami command.

[0081] Table 3

[0082]

[0083] Taking the basic event as a pipe creation event as an example, the event detailed sub-information of the pipe creation event includes at least one of the ID of the created pipe, the identifier of the type of the pipe (i.e., the pipe type identifier), and the ID of the parent process of the pipe, i.e., the process that created the pipe, i.e., the parent entity of the pipe. Assuming that an anonymous pipe with a pipe ID of 100 is created, the event information is shown in Table 4 below. From Table 4, it can be seen that in the Windows system, at 2022 / 11 / 15 17:40, process 3876 created anonymous pipe 100.

[0084] Table 4

[0085]

[0086] Taking the basic event as a pipe connection event as an example, the event detailed sub-information of the pipe connection event includes at least one of the pipe ID of the connected pipe, the pipe type ID of the pipe, and the process ID of the process connected to the pipe, and the process is the event triggering entity of the pipe connection event. Assuming that anonymous pipe 101 is connected, the event information is shown in Table 5 below. From Table 5, it can be seen that in the Windows system, at 2022 / 11 / 15 17:40, process 3876 connected to anonymous pipe 101.

[0087] Table 5

[0088]

[0089] Taking the basic event as an example of a network connection event, the event detailed sub-information of the network connection event includes at least one of the source IP address, the target IP address, and the parent process ID. The source IP address refers to the IP address of the network entity that initiates the network connection (i.e., the source network entity), the source network entity is the event occurrence entity of the network connection event, the destination IP address is the IP address of the destination network entity to which the source network entity is connected, and the parent process ID refers to the ID of the process that triggers the network connection event, which is the event triggering entity of the network connection event. Assuming that the source IP address is 192.168.203.128 and the target IP address is 192.168.203.130, the event information is shown in Table 6 below. From Table 6, it can be seen that in the Windows system, at 2022 / 11 / 15 17:40, process 3876 controls the source network entity with an IP address of 192.168.203.128 to connect to the destination network entity with an IP address of 192.168.203.130.

[0090] Table 6

[0091]

[0092] In another possible implementation, the event detailed sub-information of the network connection event further includes the port number of the source network entity and the port number of the target network entity, so as to determine the source network entity and the target network entity. In another possible implementation, the event detailed sub-information of the network connection event further includes a network protocol identifier, which is used to indicate the network protocol used by the network connection event.

[0093] Exemplarily, the detection device collects event information of multiple basic events in the terminal, and each event information is event information of a basic event occurring in the terminal. In a possible implementation, the detection device includes an event collector, which is used to collect event information of the terminal. Figure 4The schematic diagram of the detection principle of a rebound shell process provided by the embodiment of the present application shown, for any of the multiple basic events, if the basic event is triggered or executed by the non-kernel part of the OS system, the event collector in the detection device collects event information of the basic event from the non-kernel environment of the OS system through Windows event tracing (event tracing for Windows, ETW), and obtains at least one event information of the basic event, and one event information indicates that the basic event has occurred once. If the basic event is triggered or executed by the kernel part of the OS system, the event collector collects event information of the basic event from the kernel driver of the OS system through the kernel collection function, and obtains at least one event information of the basic event, so that the event information of the multiple basic events can be collected, wherein each basic event has at least one event information. After collecting multiple event information, the detection device determines the network event, anonymous pipe event and process event of the terminal based on the event type identifier in the multiple event information, wherein the network event of the terminal refers to at least one network event occurring in the collection cycle, the anonymous pipe event of the terminal refers to at least one anonymous pipe event occurring in the collection cycle, and the process event of the terminal refers to at least one process event occurring in the collection cycle.

[0094] A method for determining the network events of the terminal, for example, for any event information collected, if the event type indicated by the event type ID in the event information is a network event, or the event occurrence entity indicated by the event detailed sub-information in the event information is a network entity, then the detection device determines the event indicated by the event information as a network event. A method for determining the anonymous pipe events of the terminal, for example, for any event information collected, if the event type indicated by the event type ID in the event information is a pipe event, and the pipe type indicated by the pipe type ID of the event occurrence entity is an anonymous pipe, then the detection device determines the event indicated by the event information as an anonymous pipe event. A method for determining the process events of the terminal, for any event information collected, if the event type indicated by the event type ID in the event information is a process event, or the event occurrence entity indicated by the event information is a process, then the detection device determines the event indicated by the event information as a process event. In one possible implementation, if Figure 4As shown, after the event collector obtains the event information of the various basic events collected, it sends the collected event information of the various basic events to the correlation analysis engine in the detection device, and the correlation analysis engine executes the above-mentioned event type identification based on the various event information to determine the network event, pipeline event and process event steps of the terminal. In another possible implementation, the correlation analysis engine is deployed in the cloud, and the event information of the various basic events collected periodically by the event collector is uploaded to the correlation analysis engine in the cloud in each collection cycle, and the correlation analysis engine in the cloud executes the following steps 302 and 303 based on the uploaded event information.

[0095] In the above manner, the detection device can screen out candidate network events, anonymous pipe events and process events from the basic events occurring in the terminal, so as to subsequently determine the rebound shell process in the terminal by performing correlation analysis on the screened network events, anonymous pipe events and process events.

[0096] 302. The detection device queries a first network event, a first anonymous pipe event, and a first process event triggered by a first process from network events, anonymous pipe events, and process events of a terminal.

[0097] Among them, the first process is any process run by the terminal, for example, the first process is the event occurrence entity of a process event among various process events of the terminal. The first network event is an external network connection event triggered by the first process, and the first anonymous pipe event refers to the anonymous pipe event triggered by the first process. For the convenience of description, the anonymous pipe event that creates the first anonymous pipe in the rebound shell triggering process is called the first pipe event, and the anonymous pipe event that creates the second anonymous pipe in the rebound shell triggering process is called the second pipe event. If the redirection stage of the rebound shell triggering process is represented by the first pipe event and the second pipe event, the first anonymous pipe event includes the first pipe event and the second pipe event triggered by the first process. If the redirection stage of the rebound shell triggering process is represented by the first pipe event, the first anonymous pipe event is the first pipe event triggered by the first process. The first process event refers to the process creation event triggered by the first process, and the event occurrence entity of the first process event is the subprocess of the first process. The first process event is also called the subprocess event triggered by the first process.

[0098] For any process event among the process events of the terminal, if the event occurrence entity of any process event is a shell process, the event occurrence entity of any process event is taken as the first process, and the detection device determines the first network event, the first anonymous pipe event and the first process event triggered by the first process through the following method 1 or method 2.

[0099] Mode 1: The detection device determines the first network event, the first anonymous pipe event and the first process event triggered by the first process by performing context association analysis (ie, correlation analysis) on the network event, the anonymous pipe event and the process event of the terminal.

[0100] Exemplarily, the detection device queries the event type ID, parent process ID and destination IP address of each network event from the event information of each network event of the terminal. If the event type indicated by the event type ID of any network event is a network connection, the parent process ID is the process ID of the first process and the destination IP address does not belong to the intranet where the terminal is located, then the network event is an extranet connection event triggered by the first process, and the detection device determines the network event as the first network event. The detection device queries the parent process ID of each anonymous pipe event from the event information of each anonymous pipe event of the terminal. If the parent process ID of any anonymous pipe event is the process ID of the first process, the detection device determines the anonymous pipe event as the first anonymous pipe event. The detection device queries the parent process ID of each process event from the event information of each process event of the terminal. If the parent process ID of any process event is the ID of the first process, and the event occurrence entity of any process event is a shell process, the detection device determines any process event as the first process event.

[0101] Taking process 3876 shown in Table 1 as the first process as an example, in the event information of the process creation event shown in Table 2, it is found that the parent process ID of the process creation event is 3876, and the process creation event is the first process event of process 3876. In the event information of the pipe creation event of the anonymous pipe shown in Table 4, it is found that the parent process ID of the pipe creation event is 3876, and the pipe creation event is the first anonymous pipe event of process 3876. In the event information of the network connection event shown in Table 6, it is found that the parent process ID of the network connection event is 3876, and the destination IP address does not belong to the intranet, and the network connection event is the first network event of process 3876.

[0102] In another possible implementation, if the redirection phase of the rebound shell triggering process is represented by any event of the pipe creation event and the pipe connection event of the anonymous pipe, then the first anonymous pipe event is the any event. When determining the first anonymous pipe event, the event type of the anonymous pipe is also considered. For example, if the redirection phase of the rebound shell triggering process is represented by the pipe creation event of the anonymous pipe, if the parent process ID of any anonymous pipe event is the process ID of the first process, and the any anonymous pipe event is a pipe creation event, then the any anonymous pipe event is determined as the first anonymous pipe event.

[0103] Mode 2: The detection device queries the first network event, the first anonymous pipe event and the second process event from the network event, pipe event and process event of the terminal based on the abstract model of the rebound shell triggering process, such as the process shown in the following steps A1 to A3.

[0104] Step A1: The detection device obtains a rebound shell knowledge graph of a rebound shell triggering process, where the rebound shell knowledge graph represents the rebound shell triggering process.

[0105] Among them, the rebound shell knowledge graph is an abstract model of the rebound shell triggering process. Figure 5 The rebound shell knowledge graph schematic diagram shown, the rebound shell knowledge graph includes a rebound shell process node, a shell network node, a shell pipeline node and a shell sub-process node, wherein the rebound shell process node, the shell network node, the shell pipeline node and the shell sub-process node are entity nodes representing different entities in the rebound shell knowledge graph, for example, the rebound shell process node represents a rebound shell process, the shell network node represents a network entity controlled by the rebound shell process, the shell pipeline node represents an anonymous pipeline (such as a first anonymous pipeline and / or a second anonymous pipeline) controlled by the rebound shell process, and the shell sub-process node represents a shell sub-process of the rebound shell process. The rebound shell process node is connected to the shell network node, the shell pipeline node and the shell sub-process node respectively through different edges, that is, any node in the shell network node, the shell pipeline node and the shell sub-process node is connected to the rebound shell process node through an edge, and the edge of any node is used to represent the event triggered by the entity represented by the rebound shell process at any node in the rebound shell triggering process, and the edge is pointed to the any node by the rebound shell process node to indicate that the entity represented by the any node is an event occurrence entity, and the rebound shell process is an event triggering entity. For example, the edge between the rebound shell process node and the shell network node represents: the external network connection event triggered by the rebound shell process in the network entity during the rebound shell triggering process. The edge between the rebound shell process node and the shell pipeline node represents: the anonymous pipeline event (such as the first pipeline event or the second pipeline event) triggered by the rebound shell process node in the anonymous pipeline during the rebound shell triggering process. The edge between the rebound shell process node and the shell subprocess node represents: the process creation event triggered by the rebound shell process in the shell subprocess during the rebound shell triggering process.

[0106] In the rebound shell knowledge graph, the network connection phase of the rebound shell triggering process is represented by the shell network node and the edge between the rebound shell process node and the shell network node, and the redirection phase of the rebound shell triggering process is represented by the shell pipeline node and the edge between the rebound shell process node and the shell pipeline node. Since the purpose of creating a process is to execute the name through the created process, in a certain sense, the process creation event is also the event of the process executing the command. Based on this, the process creation event of creating a shell subprocess can be used to represent the command execution phase of the rebound shell triggering process. Therefore, in the rebound shell knowledge graph, the shell subprocess node and the edge between the rebound shell process node and the shell subprocess node are used to represent the command execution phase.

[0107] In a possible implementation, each entity node in the rebound shell knowledge graph also has a time attribute, which is used to indicate the time when the event occurs in the corresponding event triggering entity (i.e., the event occurrence time). Since in the rebound shell triggering process, the rebound shell process first triggers the external network connection event, and then triggers the anonymous pipe event and the process creation event of the shell subprocess, therefore, the time attribute of the shell network node is less than the time attribute of the shell pipe node, and the time attribute of the shell network node is less than the time attribute of the shell subprocess node, that is, the event occurrence time indicated by the time attribute of the shell network node is earlier than the event occurrence time indicated by the time attribute of the shell pipe node, and the event occurrence time indicated by the time attribute of the shell network node is earlier than the event occurrence time indicated by the time attribute of the shell subprocess, so that the rebound shell knowledge graph can more accurately represent the rebound shell triggering process. The time attribute of the shell pipeline node may be less than or equal to the time attribute of the shell subprocess node, or it may be greater than the time attribute of the shell subprocess node. If the time attribute of the shell pipeline node is less than or equal to the time attribute of the shell subprocess node, the event occurrence time indicated by the time attribute of the shell pipeline node is earlier than the event occurrence time indicated by the time attribute of the shell subprocess node. If the time attribute of the shell pipeline node is greater than the time attribute of the shell subprocess node, the event occurrence time indicated by the time attribute of the shell pipeline node is later than the event occurrence time indicated by the time attribute of the shell subprocess node.

[0108] Due to the redirection stage of the rebound shell triggering process, the rebound shell process will trigger the first pipeline event and the second pipeline event, such as Figure 6Another rebound shell knowledge graph shown, the shell pipeline node in the rebound shell knowledge graph includes a first shell pipeline node and a second shell pipeline node, the first shell pipeline node represents the first anonymous pipeline controlled by the rebound shell process, and the second shell pipeline node represents the second anonymous pipeline controlled by the rebound shell process. For ease of description, the edge between the first shell pipeline node and the rebound shell process node is called the first edge, and the edge between the second shell pipeline node and the rebound shell process node is called the second edge. The first edge is used to represent the event (i.e., the first pipeline event) that the rebound shell process creates the first anonymous pipeline, and the second edge is used to represent the event (i.e., the second pipeline event) that the rebound shell process creates the second anonymous pipeline. Thus, the redirection stage of the rebound shell triggering process is represented by the connection relationship between the first shell pipeline node, the second shell pipeline node, and the rebound shell process node, so that the rebound shell knowledge graph can more accurately represent the rebound shell triggering process. Since the first pipeline event, the second pipeline event, and the process creation event of the shell subprocess in the rebound shell triggering process are not fixed in order, here, the embodiment of the present application does not limit the size relationship between the time attributes of the first shell pipeline node, the second shell pipeline node, and the rebound shell process node.

[0109] Since the rebound shell process does not necessarily trigger the second pipeline event during the redirection phase of the rebound shell triggering process, in another possible implementation, the rebound shell knowledge graph includes a shell pipeline node, which is the first shell pipeline node, to simplify the rebound shell knowledge graph.

[0110] For the rebound shell knowledge graph introduced above, the detection device can construct any of the rebound shell knowledge graphs introduced above based on the rebound shell triggering process, such as Figure 5 or Figure 6 Any rebound shell knowledge graph shown is used to implement this step A1. Alternatively, the rebound shell knowledge graph is constructed by another device other than the detection device, and the detection device locally stores the rebound shell knowledge graph, and the detection device obtains the stored rebound shell knowledge graph locally to implement this step A1.

[0111] In this step A1, the rebound shell triggering process is abstracted into a rebound shell knowledge graph, and the control role of the rebound shell process in the rebound shell triggering process is reflected through the connection method between the nodes in the rebound shell knowledge graph, so as to reflect the essence of the rebound shell triggering process. Therefore, the method of detecting the shell process based on the rebound shell knowledge graph can realize the detection of the shell process from the essence of the rebound shell triggering process, so as to improve the accuracy of detecting the shell process.

[0112] Step A2: The detection device generates a global knowledge graph based on network events, anonymous pipe events, and process events in the terminal. The global knowledge graph includes multiple entity nodes, which are connected by edges. The entity nodes represent any entity in the network entity, anonymous pipe, and process, and the edges connecting the entity nodes represent events occurring in any entity.

[0113] Each entity node also has a time attribute, which indicates the time of occurrence of an event occurring at the represented entity. The entity node representing an anonymous pipe is called an anonymous pipe node, the entity node representing a network entity is called a network node, and the entity node representing a process is called a process node, that is, the global knowledge graph includes at least the first process node, at least one anonymous pipe node, and at least one network node. For an edge connecting any two entity nodes in the global knowledge graph, the edge is pointed from one entity node of the arbitrary two entity nodes to another entity node, and the pointing of the edge indicates the parent-child relationship between the two entity nodes, wherein the entity node pointed to by the edge is the child node of the other entity node, and the other entity node is the parent node of the entity node pointed to by the edge, so that the edge indicates an event triggered by the entity indicated by the parent node at the entity indicated by the child node.

[0114] For any two events among the network events, pipeline events, and process events of the terminal, the two events are referred to as the first event and the second event, respectively, wherein the first event and the second event may be the same event, such as the first event and the second event are two network events, or the first event and the second event may be different events, such as the first event and the second event are a network event and a pipeline event, respectively. The event occurrence entity of the first event and the event occurrence entity of the second event are referred to as the first entity and the second entity, respectively. The detection device determines the first entity node and the second entity node based on the first event and the second event, wherein the first entity node represents the first entity and the second entity node represents the second entity. The detection device obtains the ID of the first entity of the first event and the ID of the event triggering entity from the event information of the first event, and obtains the ID of the second entity of the second event and the ID of the event triggering entity from the event information of the second event. If the ID of the first entity is the ID of the event triggering entity of the second event, the detection device connects the first entity node to the second entity node through an edge pointing to the second entity node, and indicates that the first entity triggers the second event at the second entity through the edge. If the ID of the event triggering entity of the first event is the ID of the second entity, the detection device connects the second entity node to the first entity node through an edge pointing to the first entity node, and indicates that the second entity triggers the first event at the first entity through the edge. If the ID of the first entity is not the ID of the event triggering entity of the second event, or the ID of the event triggering entity of the first event is not the ID of the second entity, it means that the first entity and the second entity are not associated, and the first event and the second event are not associated, and there is no need to connect an edge between the first entity node and the second entity node. In this way, the entity nodes of the event occurrence entities of each network event, each pipeline event, and each process event in the terminal and the edges between the entity nodes form the global knowledge graph of the terminal, so that the association relationship between each network event, each pipeline event, and each process event in the terminal is represented by the global knowledge graph.

[0115] In addition, for any entity node in the global knowledge graph, the detection device also obtains time sub-information from the event information of the entity represented by the entity node, and associates the time sub-information with the entity node, so that the time sub-information serves as the time attribute of the entity node.

[0116] In another possible implementation, after obtaining the global knowledge graph, the detection device may also prune the global knowledge graph, such as the following steps B1 to B3.

[0117] Step B1, the detection device determines a candidate rebound shell process, a candidate network entity, a candidate anonymous pipe, and a candidate shell subprocess of the rebound shell process based on the network event, the anonymous pipe event, and the process event of the terminal.

[0118] Among them, the candidate rebound shell process refers to a process suspected to be a rebound shell process, the candidate network entity refers to a network entity suspected to be controlled by the rebound shell process, the candidate anonymous pipe refers to an anonymous pipe suspected to be controlled by the rebound shell process, the candidate shell subprocess is a process suspected to be a subprocess of the rebound shell process, and the subprocess of the rebound shell process is the rebound shell subprocess.

[0119] In a possible implementation, the candidate rebound shell process, the candidate network entity, the candidate anonymous pipe, and the candidate shell subprocess correspond to the first screening strategy, the second screening strategy, the third screening strategy, and the fourth screening strategy, respectively. The first screening strategy is used to screen out the candidate rebound shell process from the process event of the terminal, the second screening strategy is used to screen out the candidate network entity from the network event of the terminal, the third screening strategy is used to screen out the candidate network entity from the anonymous pipe event of the terminal, and the fourth screening strategy is used to screen out the candidate shell subprocess from the process event of the terminal. The detection device determines the candidate rebound shell process, the candidate network entity, the candidate anonymous pipe, and the candidate shell subprocess based on the first screening strategy, the second screening strategy, the third screening strategy, the fourth screening strategy, the network event of the terminal, the anonymous pipe event, and the process event.

[0120] Taking the determination of candidate rebound shell processes based on the first screening strategy and various process events of the terminal as an example, the first screening strategy includes that the file entity corresponding to the candidate rebound shell process is a file dropped on disk within the first time period, wherein the first time period is such as the last two hours or the last hour, and here, the embodiment of the present application does not limit the first time period. Based on this, the process of determining the candidate rebound shell process, such as the detection device monitoring all process creation events and the file drop time corresponding to the process creation event, wherein the file drop time refers to the drop time of the file entity of the process created by the process creation event. If the file drop time corresponding to any process creation event is less than the first time period from the current moment, the process created by the process creation event satisfies the first screening strategy, and the detection device determines the process created by the process creation event as a candidate rebound shell process, so that the detection device can determine one or more candidate rebound shell processes from the various process creation events of the terminal.

[0121] Taking the determination of candidate network entities based on the second screening strategy and various network events of the terminal as an example, since the network event occurring in the network connection stage during the rebound shell triggering process is an external network connection event, the second screening strategy includes that the network event occurring in the candidate network entity is an external network connection event. For any network event of the terminal, if the network event is an event connected to the external network, then the network event satisfies the second screening strategy, and the detection device determines the event occurrence entity of the network event as the candidate network entity. For example, the detection device queries the target IP address and event type ID of the network event from the event information of the network event. If the event type indicated by the event type ID is a network connection, and the target IP address does not belong to the IP address of the intranet, then the network event is an external network connection event that satisfies the second screening strategy, and the network entity indicated by the event information is determined as a candidate network entity. In this way, the detection device can determine one or more candidate network entities from various network events in the terminal.

[0122] Taking the determination of candidate anonymous pipes based on the third screening strategy and various anonymous events of the terminal as an example, the third screening strategy includes anonymous pipe events occurring in candidate anonymous pipes, and the event occurrence entities of various anonymous pipe events of the terminal all satisfy the third screening strategy, and the event occurrence entities of various anonymous pipe events of the detection device terminal are determined as candidate anonymous pipes.

[0123] Taking the determination of candidate shell subprocesses based on the fourth screening strategy and various process events of the terminal as an example, the fourth screening strategy includes that the parent process of the candidate shell subprocess is an unconventional parent process, wherein the unconventional parent process refers to a parent process not recorded in the parent process whitelist, and the parent process whitelist is used to record multiple conventional parent processes, and the conventional parent process refers to a process that creates a shell subprocess to achieve normal functions of the system during normal system operation. The parent process whitelist includes indication information of multiple conventional parent processes, and the indication information of any conventional parent process is used to indicate the conventional parent process, and the indication information is such as the process path, process name or message digest algorithm 5 (MD5) of the conventional parent process. For any process event of the terminal, if the event triggering entity (i.e., the parent process) of the process event is not a regular parent process recorded in the whitelist, then the parent process of the process event is an unconventional parent process. If the event occurrence entity of the process event is a shell process, and the parent process of the process event is an unconventional parent process, then the process event satisfies the fourth screening strategy. Based on this, a process of determining candidate shell sub-processes is performed. For example, the detection device monitors the process creation events of all shell processes. If the event triggering entity of any process creation event is an unconventional parent process, then the process creation event is an abnormal shell sub-process call event, which satisfies the first screening strategy. The detection device determines the shell process created by the process creation event as a candidate rebound shell process. In this way, the detection device can determine one or more candidate shell sub-processes from each process event of the terminal.

[0124] In another possible implementation, the first screening strategy to the fourth screening strategy may be implemented by regular matching rules, and this step B2 is executed by a rule matching engine in the detection device, such as Figure 4 and Figure 7 In the module interaction diagram of the detection device shown, the event collector collects event information of various basic events in the terminal and sends the collected event information of various basic events to the rule matching engine. In the rule matching engine, corresponding regular matching rules are respectively set for candidate rebound shell processes, candidate network entities, candidate anonymous pipes and candidate shell subprocesses, that is, if the event represented by any event information obtained satisfies the regular matching rule corresponding to the candidate rebound shell process, the event occurrence entity of the event is determined to be the candidate rebound shell process, if the event satisfies the regular matching rule corresponding to the candidate anonymous pipe, the event occurrence entity of the event is determined to be the candidate anonymous pipe, and if the event satisfies the regular matching rule corresponding to the candidate shell subprocess, the event occurrence entity of the event is determined to be the candidate shell subprocess.

[0125] Step B2: The detection device determines the entity nodes representing the candidate rebound shell process, the candidate network entity, the candidate anonymous pipe, and the candidate shell subprocess in the global knowledge graph as candidate nodes.

[0126] For any entity among the determined candidate rebound shell processes, each candidate network entity, each candidate anonymous pipe, and each candidate shell subprocess, the detection device determines the entity node representing the any entity in the global knowledge graph as a candidate node, so that the detection device can determine multiple candidate nodes from the global knowledge graph.

[0127] Step B3: The detection device deletes entity nodes other than candidate nodes in the global knowledge graph to obtain a pruned global knowledge graph.

[0128] In a possible implementation, step B2 and step B3 are performed by a correlation analysis engine in the detection device. Figure 4 and Figure 7 For example, after the rule matching engine determines the candidate rebound shell process, candidate network entity, candidate anonymous pipe and candidate shell sub-process of the rebound shell process based on the above regular matching rules, it generates candidate entity notification information, and the candidate entity notification information is used to notify the candidate rebound shell process, candidate network entity, candidate anonymous pipe and candidate shell sub-process of the rebound shell process. After receiving the candidate entity notification information, the association analysis engine determines the corresponding entity nodes in the global knowledge graph of the candidate rebound shell process, candidate network entity, candidate anonymous pipe and candidate shell sub-process notified by the candidate entity notification information as candidate nodes, and deletes each entity node in the global knowledge graph except the candidate nodes. In another possible implementation method, such as Figure 4 As shown, the rule matching engine can also send candidate entity notification information to the cloud through the network (Net) port of the terminal so that the third terminal can receive the candidate entity notification information from the cloud, and can also display the candidate entity notification information to remind the user that a candidate rebound shell process, a candidate network entity, a candidate anonymous pipe, and a candidate shell subprocess have been detected.

[0129] By deleting entity nodes except candidate nodes in the global knowledge graph, the global knowledge graph is pruned so that only candidate nodes are retained in the pruned global knowledge graph, reducing the number of nodes in the global knowledge graph and facilitating the subsequent matching of the global knowledge graph with the rebound shell knowledge graph.

[0130] In another possible implementation, the detection device may first determine at least one candidate rebound shell process, at least one candidate network entity, at least one candidate anonymous pipe, and at least one candidate shell subprocess based on the network events, anonymous pipe events, and process events of the terminal, and then generate a global knowledge graph based on the events occurring in each candidate rebound shell process, each candidate network entity, each candidate anonymous pipe, and each candidate shell subprocess, wherein the entity nodes in the global knowledge graph include candidate nodes corresponding to each candidate rebound shell process, candidate nodes corresponding to each candidate network entity, candidate nodes corresponding to each candidate anonymous pipe, and candidate nodes corresponding to each candidate shell subprocess. There is no need to prune the global knowledge graph.

[0131] In another possible implementation, the detection device generates a global knowledge graph based on the event information of multiple basic events collected, and each entity node in the global knowledge graph corresponds to an event occurrence entity indicated by the event information (such as a file, anonymous pipe, named pipe, registry, network entity, process or other entity). Afterwards, the detection device deletes non-candidate nodes in the global knowledge graph based on the above-mentioned pruning method.

[0132] In the global knowledge graph, the entity nodes of the event occurrence entities of multiple basic events are included. The detection device can also prune the global knowledge graph according to other pruning strategies. For example, for any entity node in the global knowledge graph, if the entities represented by the entity nodes of the first number of the entity node in the forward direction are not the candidate nodes introduced above, and the entities represented by the entity nodes of the second number of the entity node in the backward direction are not the candidate nodes introduced above, delete all the entity nodes in the backward direction of the entity node to delete the entity nodes and edges that are not related to the rebound shell in the global knowledge graph, and improve the matching efficiency of the subsequent rebound shell knowledge graph. Among them, the entity node of the first number in the forward direction refers to the entity node of the first number connected forward in sequence with the entity node as the starting point. Taking the first number as 2 as an example, the parent node of the entity node and the parent node of the parent node are the entity nodes of the first number in the forward direction. Of course, the first number may also have other values, such as the first number is 5. Here, the embodiment of the present application does not limit the first number. The entity node of the second number in the backward direction refers to the entity node of the first number connected backward in sequence with the entity node as the end point. Taking the second number 2 as an example, the child nodes of the entity node and the child nodes of the child nodes are the entity nodes of the second number in the backward direction. Of course, the second number may also have other values, such as the second number is 5. Here, the embodiment of the present application does not limit the second number.

[0133] In another possible implementation, after determining at least one candidate rebound shell process, at least one candidate network entity, at least one candidate anonymous pipe and at least one candidate shell subprocess by executing step B1, the detection device determines each process event occurring in at least one candidate rebound shell process and each process event occurring in at least one candidate rebound shell process as process events to be queried by the terminal, determines each network event occurring in at least one candidate network entity as a network event to be queried by the terminal, determines each anonymous pipe event occurring in at least one candidate anonymous pipe as an anonymous pipe event to be queried by the terminal, and queries the first network event, the first anonymous pipe event and the first process event triggered by the first process from the network events, anonymous pipe events and process events to be queried by the terminal.

[0134] Step A3: The detection device matches the global knowledge graph with the rebound shell knowledge graph and the rebound shell knowledge graph to obtain a matching result, which indicates whether the first node in the global knowledge graph matches the rebound shell process node, and the first node is an entity node representing the first process.

[0135] The global knowledge graph may be a global knowledge graph that has not been pruned, or a global knowledge graph that has been pruned. The rebound shell knowledge graph may be any of the rebound shell knowledge graphs described above.

[0136] Exemplarily, the detection device matches the global knowledge graph with the rebound shell knowledge graph and the rebound shell knowledge graph through the following steps A31 to A33.

[0137] Step A31: The detection device determines each candidate node in the global knowledge graph.

[0138] Among them, the candidate nodes are divided into candidate rebound shell process nodes, candidate network nodes, candidate pipeline nodes, and candidate subprocess nodes. The candidate rebound shell process node is an entity node representing the candidate rebound shell process in the global knowledge graph, that is, a candidate node of the rebound shell process node of the rebound shell knowledge graph. The candidate network node is an entity node representing the candidate network entity in the global knowledge graph, that is, a candidate node of the shell network node of the rebound shell knowledge graph. The candidate pipeline node is an entity node representing the candidate pipeline in the global knowledge graph, that is, a candidate node of the shell pipeline node of the rebound shell knowledge graph. The candidate subprocess node is an entity node representing the candidate shell subprocess in the global knowledge graph, that is, a candidate node of the shell subprocess node of the rebound shell knowledge graph.

[0139] If the global knowledge graph is a global knowledge graph pruned according to the above steps B1 to B3, then each entity node in the global knowledge graph is a candidate node, and the detection device does not need to perform this step A31. If the global knowledge graph is not a global knowledge graph pruned according to the above steps B1 to B3, then the global knowledge graph includes other nodes in addition to the candidate nodes, and the detection device determines each candidate node in the global knowledge graph by performing the above steps B1 and B2.

[0140] Step A32: In the case where the rebound shell knowledge graph includes a shell pipeline node, for any candidate network node, any candidate pipeline node, and any candidate sub-process node in the global knowledge graph, if the event triggering entity of any candidate network node, any candidate pipeline node, and any candidate sub-process node is the same candidate rebound shell process node, the detection device takes the event triggering entity as the first process and the candidate rebound shell process node as the first node, and obtains a first matching result for the first node, and the first matching result indicates that the first node matches the rebound shell process node.

[0141] In other words, if the parent node of any candidate network node, any candidate pipeline node and any candidate child process node is the same, and the parent node is a candidate rebound shell process node, then the parent node is taken as the first node, the process entity represented by the parent node is taken as the first process, and the first matching result of the first node is obtained.

[0142] Alternatively, for the first node representing the first process, if the child nodes of the first node in the global knowledge graph include candidate network nodes, candidate pipeline nodes, and candidate sub-process nodes, the first node matches the rebound shell process node, and the detection device obtains a first matching result of the first node; if the child nodes of the first node in the global knowledge graph do not include at least one of the candidate network nodes, candidate pipeline nodes, and candidate sub-process nodes, the first node does not match the rebound shell process node, and the detection device obtains a second matching result of the first node, and the second matching result indicates that the first node does not match the rebound shell process node.

[0143] Among them, if the first node matches the rebound shell process node, the event represented by the edge between the first node and the candidate network node is the first network event, the event represented by the edge between the first node and the candidate pipeline node is the first anonymous pipeline event, and the event represented by the edge between the first node and the candidate sub-process node is the first process event, thereby realizing the query of the first network event, the first anonymous pipeline event and the first process event triggered by the first process. At this time, the first node, the candidate network node, the candidate pipeline node and the candidate sub-process node are respectively matched with the rebound shell process node, the shell network node, the shell pipeline node and the shell sub-process node in the rebound shell knowledge graph.

[0144] Step A33, in the case where the rebound shell knowledge graph includes two shell pipeline nodes, for any candidate network node, any two candidate pipeline nodes and any candidate sub-process node in the global knowledge graph, if the event triggering entity of any candidate network node, any two candidate pipeline nodes and any candidate sub-process node is represented by the same candidate rebound shell process node, and the anonymous pipelines represented by the any two candidate pipeline nodes are different, the detection device takes the event triggering entity as the first process and the candidate rebound shell process node as the first node to obtain a first matching result of the first node.

[0145] In other words, if the parent node of any candidate network node, any two candidate pipeline nodes and any candidate child process node is the same, the parent node is a candidate rebound shell process node, and the anonymous pipes represented by any two candidate pipeline nodes are different, the detection device takes the parent node as the first node and the process entity represented by the parent node as the first process, and obtains the first matching result of the first node.

[0146] Alternatively, for a first node representing a first process, if the child nodes of the first node in the global knowledge graph include a candidate network node, two candidate pipeline nodes, and a candidate subprocess node, and the anonymous pipelines represented by the two candidate pipeline nodes are different, then the first node matches the rebound shell process node, and the detection device obtains a first matching result for the first node. If the child nodes of the first node in the global knowledge graph do not include at least one of the candidate network node, the candidate pipeline node, and the candidate subprocess node, or if there are no two candidate pipeline nodes representing different anonymous pipelines in the child nodes of the first node, then the first node does not match the rebound shell process node, and the detection device obtains a second matching result for the first node.

[0147] Among them, if the first node matches the rebound shell process node, the event represented by the edge between the first node and the candidate network node is the first network event, the events represented by the edges between the first node and the two candidate pipeline nodes are all first anonymous pipeline events, and the event represented by the edge between the first node and the candidate sub-process node is the first process event, thereby realizing the query of the first network event, the first anonymous pipeline event and the first process event triggered by the first process. At this time, the first node, the candidate network node, the two candidate pipeline nodes and the candidate sub-process node are respectively matched with the rebound shell process node, the shell network node, the first shell pipeline node, the second shell pipeline node and the shell sub-process node in the rebound shell knowledge graph.

[0148] by Figure 8 Taking a local knowledge graph in the global knowledge graph shown in FIG. 1 as an example, the entities represented by entity nodes 1 to 7 are: process 1, process 3876, network entity 1 with IP address 192.168.206.130:777, anonymous pipe 100, anonymous pipe 101, process 5016, process 2, among which process 1 is the parent process of process 3876. The edge between entity node 1 and entity node 2 represents the process creation event of process 1 creating process 3876. Process 3876 is the parent process of network entity 1, anonymous pipe 100 and process 5016. Entity node 0 represents the process creation event of process 1 creating process 3876. Process 3876 is the parent process of network entity 1, anonymous pipe 100 and process 5016. The edge between point 2 and entity node 3 represents the network event triggered by process 3876 at network entity 1. The edge between entity node 2 and entity node 4 represents the pipe creation event of process 3876 creating anonymous pipe 100. The edge between entity node 2 and entity node 5 represents the pipe connection event of process 3876 connecting anonymous pipe 100. The edge between entity node 2 and entity node 6 represents the process creation event of process 3876 creating process 5016. Process 5016 is the parent node of process 2. Process 2 is used to complete the control command (such as whoami command) issued by process 5016. Figure 8 As shown, entity nodes 2 to 6 are all candidate nodes, and entity nodes 2 to 6 are respectively Figure 6 The rebound shell process node, shell network node, first shell pipeline node and second shell pipeline node in the rebound shell knowledge graph shown are matched.

[0149] By matching the global knowledge graph of the terminal with the rebound shell knowledge graph, we can query the network events, anonymous pipe events and process events triggered by the process. There is no need to query these events triggered by the process based on event information, which improves the event query efficiency and thus improves the detection efficiency of the rebound shell process.

[0150] 303. If the first network event, the first anonymous pipe event, and the first process event are found, and the event occurrence flow formed by the first network event, the first anonymous pipe event, and the first process event conforms to the rebound shell triggering process, the detection device determines the first process as a rebound shell process.

[0151] Among them, the event occurrence flow formed by the first network event, the first anonymous pipe event and the first process event is represented by the event occurrence time sequence of the first network event, the first anonymous pipe event and the first process event. If the event occurrence time of the first network event is earlier than the event occurrence time of the first anonymous pipe event, and the event occurrence time of the first network event is earlier than the event occurrence time of the first process event, then the event occurrence flow complies with the rebound shell triggering process. Otherwise, the event occurrence flow does not comply with the rebound shell triggering process, and the detection device does not determine the first process as a rebound shell process.

[0152] Exemplarily, if the first network event, the first anonymous pipe event, and the first process event are determined by the above method 1, the detection device obtains the time sub-information of the first network event from the event information of the first network event, obtains the time sub-information of the first anonymous pipe event from the event information of the first anonymous pipe event, and obtains the time sub-information of the first process event from the event information of the first process event. If the time indicated by the time sub-information of the first network event is earlier than the time indicated by the time sub-information of the first anonymous pipe event, and the time indicated by the time sub-information of the first network event is earlier than the time indicated by the time sub-information of the first process event, then the event occurrence process conforms to the rebound shell triggering process, and the detection device determines the first process as a rebound shell process. If the time indicated by the time sub-information of the first network event is later than the time indicated by the time sub-information of the first anonymous pipe event, or the time indicated by the time sub-information of the first network event is later than the time indicated by the time sub-information of the first process event, then the event occurrence process conforms to the non-rebound shell triggering process, and the detection device does not determine the first process as a rebound shell process.

[0153] If the first network event, the first anonymous pipe event and the first process event are determined by the above method 2, the detection device obtains the time attribute of the second node, the time attribute of the third node and the time attribute of the fourth node in the global knowledge graph, wherein the second node, the third node and the fourth node are respectively: entity nodes representing the event occurrence entities of the first network event, the first anonymous pipe event and the first process event. If the time attribute of the second node is less than the time attribute of the third node, and the time attribute of the second node is less than the time attribute of the fourth node, then the event occurrence process conforms to the rebound shell triggering process, and the detection device determines the first process as a rebound shell process. If the time attribute of the second node is greater than or equal to the time attribute of the third node, or the time attribute of the second node is greater than or equal to the time attribute of the fourth node, then the event occurrence process conforms to the non-rebound shell triggering process, and the detection device does not determine the first process as a rebound shell process.

[0154] Among them, if there are second nodes, third nodes and fourth nodes in the child nodes of the first node, and the time attribute of the second node is less than the time attribute of the third node, and the time attribute of the second node is less than the time attribute of the fourth node, then the first node, the second node, the third node and the fourth node are matched with the rebound shell knowledge graph in terms of connection relationship and time attribute, then the event occurrence process formed by the first network event, the first anonymous pipe event and the first process event conforms to the rebound shell triggering process represented by the rebound shell knowledge graph. Figure 8 For example, entity nodes 2 to 6 are respectively Figure 6 The rebound shell process node, shell network node, first shell pipeline node and second shell pipeline node in the rebound shell knowledge graph shown are matched, and the time attributes of entity nodes 3 to 6 increase successively. The event occurrence process formed by entity nodes 2 to 6 conforms to the rebound shell triggering process, and the process 3876 represented by entity node 2 is a rebound shell process.

[0155] The above-mentioned rebound shell knowledge graph is applicable to any rebound shell process supported by Windows system, such as Fig. 9 and Fig.10A total of 9 local knowledge graphs of rebound shell processes supported by Windows system are shown, including mshta rebound shell, rundll32 rebound shell, regsvr32 rebound shell process, certutil rebound shell process, msiexec rebound shell process, nc rebound shell process, powercat rebound shell process, Msf rebound shell process and vbs rebound shell process. Figure 8 The local knowledge graph shown is similar to Figure 6 In the matching process of the rebound shell knowledge graph shown in the figure, the local knowledge graphs of the 9 rebound shell processes are all matched with the rebound shell knowledge graph, so that the 9 rebound shell processes can be identified.

[0156] In another possible implementation, if the first process is a rebound shell process, the detection device sends a first rebound shell alarm information to the third terminal, and the first rebound shell alarm information is used to indicate that the first process is a rebound shell process. Optionally, the first rebound shell alarm information includes a detection report of the first process, and the detection report includes the process ID of the first process. Optionally, the detection report also includes at least one of the event information of the first network event, the event information of the first anonymous pipe event, and the event information of the first process event, so as to provide an analysis basis for the first process to be a rebound shell process. Alternatively, after determining the various rebound shell processes of the terminal in a collection cycle, the detection device sends a second rebound shell alarm information to the third terminal, and the second rebound shell alarm information is used to indicate the various rebound shell processes determined. Optionally, the second rebound shell alarm information includes the detection report of the various rebound shell processes determined, and the detection report of any rebound process is similar to the detection report of the first process, which will not be repeated. After receiving any of the first rebound shell alarm information and the second rebound shell alarm information, the third terminal displays the rebound shell alarm information for the user to prompt the user to detect the rebound shell process running in the terminal.

[0157] In another possible implementation, the above steps 302 and 303 are performed by the correlation analysis engine in the detection device, still in the Figure 4 For example, the correlation analysis engine implements context analysis of the correlation event by executing steps 302 and 303, analyzes the rebound shell process of the terminal, and sends the rebound shell alarm information (such as the first rebound shell alarm information or the second rebound shell alarm information) to the cloud platform through the Net interface of the terminal to implement the correlation alarm based on the correlation event. Figure 7 For example, the association analysis engine uses the rebound shell knowledge graph to identify the network nodes, anonymous pipe nodes, and process nodes under the same target parent node in the global knowledge graph, and the network nodes, anonymous pipe nodes, and process nodes are associated in time sequence, such as the time attributes of the network nodes, anonymous pipe nodes, and process nodes increase in sequence, and sends a rebound shell alarm message to the cloud platform to indicate that the process represented by the target parent node is a rebound shell process. Among them, the cloud platform can run on the third terminal introduced above.

[0158] Figure 3 The detection method of the rebound shell process provided by the present application shown, by querying the network events, pipe events and process events triggered by the process from the network events, anonymous pipe events and process events occurring in the terminal, since the essence of the rebound shell triggering process is that the rebound shell process triggers the network events, anonymous pipe events and process events according to a certain event occurrence flow, if the event occurrence flow formed by the network events, pipe events and process events triggered by the process is found to conform to the rebound shell triggering process, the process is determined as the rebound shell process, thereby realizing the detection of the rebound shell process from the essence of the rebound shell triggering process, realizing the contextual panoramic detection of the rebound shell process, and improving the accuracy of detecting the rebound shell process. Since the above-mentioned rebound shell triggering process is a common triggering process for various rebound shell processes in the Windows system, the method is suitable for detecting various rebound shell processes in the Windows system, so that various rebound shell processes in the Windows system can be detected by the method, and rebound shell process detection based on anonymous pipes in the Windows system is realized.

[0159] The above describes the method of the embodiment of the present application, and the following describes the device and equipment of the embodiment of the present application. It should be understood that the device and equipment described below have any function of the detection device in the above method. Figures 3 to 10 The detection method of the rebound shell process provided by the present application is described in detail. Based on the same inventive concept, the following will be combined with Fig.11 and Fig.12 The apparatus and device according to the embodiments of the present application are described respectively. It should be understood that the technical features described in the method embodiment are also applicable to the following apparatus embodiment and device embodiment.

[0160] See also Fig.11 , a schematic diagram of the structure of a detection device for a rebound shell process provided by an embodiment of the present application, Fig.11 The illustrated apparatus 1100 comprises:

[0161] The first determining module 1101 is used to determine the network events, anonymous pipe events and process events of the terminal, wherein the network events refer to events occurring in the network entity, the anonymous pipe events refer to events occurring in the anonymous pipe, and the process events refer to events occurring in the process;

[0162] A query module 1102, configured to query a first network event, a first anonymous pipe event, and a first process event triggered by a first process from the network events, the anonymous pipe events, and the process events of the terminal;

[0163] The second determination module 1103 is used to determine the first process as a rebound shell process if the first network event, the first anonymous pipe event and the first process event are queried, and the event occurrence flow formed by the first network event, the first anonymous pipe event and the first process event conforms to the rebound shell triggering process.

[0164] In a possible implementation, the rebound shell triggering process is represented by a rebound shell knowledge graph, and the rebound shell knowledge graph includes a rebound shell process node, a shell network node, a shell pipeline node, and a shell sub-process node. The rebound shell process node represents a rebound shell process, the shell network node represents a network entity controlled by the rebound shell process, the shell pipeline node represents an anonymous pipeline controlled by the rebound shell process, and the shell sub-process node represents a shell sub-process of the rebound shell process;

[0165] Any of the shell network node, the shell pipeline node and the shell subprocess node is connected to the rebound shell process node through an edge, and the edge is used to represent an event triggered by the rebound shell process at the entity represented by any node during the rebound shell triggering process.

[0166] In one possible implementation, the time attribute of the shell network node is smaller than the event attribute of the shell pipeline node, and the time attribute of the shell network node is smaller than the time attribute of the shell child process node, and the time attribute of any node is used to indicate the time when an event occurs in the represented entity.

[0167] In a possible implementation, the shell pipeline node includes a first shell pipeline node and a second shell pipeline node, the first shell pipeline node represents a first anonymous pipeline, the second shell pipeline node represents a second anonymous pipeline, the first anonymous pipeline is an anonymous pipeline for the rebound shell process to send information to the shell sub-process, and the second anonymous pipeline is an anonymous pipeline for the shell sub-process to send information to the rebound shell process.

[0168] In a possible implementation, the query module 1102 is used to:

[0169] Generate a global knowledge graph based on the network event, the pipeline event and the process event of the terminal, wherein the global knowledge graph includes a plurality of entity nodes, the plurality of entity nodes are connected by edges, and the entity node represents any entity in the network entity, the anonymous pipeline and the process;

[0170] The global knowledge graph is matched with the rebound shell knowledge graph to obtain a matching result, where the matching result indicates whether a first node in the global knowledge graph matches a rebound shell process node, and the first node is an entity node representing a first process.

[0171] In a possible implementation, the apparatus 1100 further includes:

[0172] A third determination module is used to determine a candidate rebound shell process, a candidate network entity, a candidate anonymous pipe, and a candidate shell subprocess of the rebound shell process based on the network event, the anonymous pipe event, and the process event of the terminal;

[0173] The third determination module is further used to determine the entity nodes representing the candidate rebound shell process, the candidate network entity, the candidate anonymous pipe and the candidate shell subprocess in the global knowledge graph as candidate nodes;

[0174] A deletion module is used to delete entity nodes other than the candidate nodes in the global knowledge graph.

[0175] In a possible implementation, the rebound shell process is any rebound shell process supported by the Windows operating system.

[0176] It should be understood that device 1100 corresponds to the detection device in the above-mentioned method embodiment, and the various modules in device 1100 and the above-mentioned other operations and / or functions are respectively for realizing the various steps and methods implemented by the detection device in the method embodiment. The specific details can be found in the above-mentioned method embodiment. For the sake of brevity, they will not be repeated here.

[0177] It should be understood that when the device 1100 determines the rebound shell process, it only uses the division of the above-mentioned functional modules as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device 1100 is divided into different functional modules to complete all or part of the functions described above. In addition, the device 1100 provided in the above embodiment and the above method embodiment belong to the same concept, and the specific implementation process is detailed in the above method embodiment, which will not be repeated here.

[0178] Fig.12 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application, such as Fig.12 As shown, the electronic device 1200 includes: a bus 1202, a processor 1204, a memory 1206, a communication interface 1208 and a detection device 1210. The processor 1204, the memory 1206, the communication interface 1208 and the detection device 1210 communicate through the bus 1202. The bus 1202 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig.12Only one line is used to represent it, but it does not mean that there is only one bus or one type of bus. Bus 1202 may include a path for transmitting information between various components of electronic device 1200 (for example, memory 1206, processor 1204, communication interface 1208). Processor 1204 may include any one or more of processors such as CPU, graphics processing unit (GPU), microprocessor (MP) or digital signal processor (DSP). Memory 1206 can be used as the internal memory or external memory of electronic device 1200. Memory 1206 may include volatile memory, such as random access memory (RAM). Memory 1206 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD) or solid state drive (SSD).

[0179] The detection device 1210 is used to execute the detection method of the rebound shell process provided by the present application. The detection device 1210 can be implemented by a chip, a CPU, an ASIC, or the PLD introduced above. The present application does not limit the implementation of the detection device 1210. In the case where the detection device 1210 is implemented by a processor, the implementation of the detection device 1210 can refer to the above-mentioned processor 1204, and the memory 1206 stores an executable program code. The detection device 1210 reads and executes the executable program code, so that the electronic device 1200 implements the above-mentioned detection method of the rebound shell process.

[0180] The present application also provides a chip, which includes a logic circuit, and the logic circuit is used to execute the above-mentioned rebound shell process detection method. In a possible implementation, the chip also includes a power supply circuit, the logic circuit is coupled to the power supply circuit, and the functional circuit is used to power the logic circuit so that the logic circuit executes the above-mentioned memory access statistics information transmission method. Exemplarily, the logic circuit is composed of a digital signal processor (digital signal processing, DSP), ASIC, PLD, FPGA or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, etc.

[0181] The present application also provides a computer-readable storage medium, such as a memory including a program code, and the program code can be executed by a processor to enable a device (such as an electronic device or a chip) where the processor is located to complete the above-mentioned rebound shell process detection method.

[0182] The present application also provides a computer program product or a computer program, which includes a program code, and the program code is stored in a computer-readable storage medium. A processor reads the program code from the computer-readable storage medium, and the processor executes the program code, so that a device (such as an electronic device or a chip) where the processor is located executes the above-mentioned rebound shell process detection method.

[0183] In addition, the present application also provides a device, which can be a chip, component or module, and the device may include a connected processor and memory; wherein the memory is used to store computer-executable instructions, and when the device is running, the processor can execute the computer-executable instructions stored in the memory, so that the device executes the above-mentioned rebound shell process detection method.

[0184] Among them, the devices, equipment, computer-readable storage media, computer program products or chips provided in this application are all used to execute the corresponding methods provided above. Therefore, the beneficial effects that can be achieved can refer to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0185] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD) or a semiconductor medium. The semiconductor medium may be a solid state disk (SSD).

[0186] The information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the access requests involved in this application are all obtained with full authorization.

[0187] The above is only a specific implementation of the present application. Those skilled in the art may conceive of changes or substitutions based on the specific implementation provided by the present application, which should all be included in the protection scope of the present application.

Claims

1. A method for detecting a rebound shell process, characterized in that: The method comprises: Determine network events, anonymous pipe events, and process events of the terminal, wherein the network events refer to events occurring in a network entity, the anonymous pipe events refer to events occurring in an anonymous pipe, and the process events refer to events occurring in a process; From the network events, the anonymous pipe events and the process events of the terminal, query a first network event, a first anonymous pipe event and a first process event triggered by a first process; If the first network event, the first anonymous pipe event, and the first process event are queried, and the event occurrence flow formed by the first network event, the first anonymous pipe event, and the first process event conforms to the rebound shell triggering process, the first process is determined to be a rebound shell process.

2. The method according to claim 1, characterized in that The rebound shell triggering process is represented by a rebound shell knowledge graph, which includes a rebound shell process node, a shell network node, a shell pipeline node and a shell sub-process node. The rebound shell process node represents a rebound shell process, the shell network node represents a network entity controlled by the rebound shell process, the shell pipeline node represents an anonymous pipeline controlled by the rebound shell process, and the shell sub-process node represents a shell sub-process of the rebound shell process; Any of the shell network node, the shell pipeline node and the shell subprocess node is connected to the rebound shell process node through an edge, and the edge is used to represent an event triggered by the rebound shell process at the entity represented by any node during the rebound shell triggering process.

3. The method according to claim 2, characterized in that The time attribute of the shell network node is smaller than the event attribute of the shell pipeline node, and the time attribute of the shell network node is smaller than the time attribute of the shell subprocess node. The time attribute of the shell network node or any node is used to indicate the time when an event occurs in the represented entity.

4. The method according to claim 2 or 3, characterized in that: The shell pipeline node includes a first shell pipeline node and a second shell pipeline node, the first shell pipeline node represents a first anonymous pipeline, the second shell pipeline node represents a second anonymous pipeline, the first anonymous pipeline is an anonymous pipeline for the rebound shell process to send information to the shell child process, and the second anonymous pipeline is an anonymous pipeline for the shell child process to send information to the rebound shell process.

5. The method according to any one of claims 2 to 4, characterized in that: The querying, from the network events, the anonymous pipe events and the process events of the terminal, of a first network event, a first anonymous pipe event and a first process event triggered by a first process comprises: Generate a global knowledge graph based on the network event, the anonymous pipe event and the process event of the terminal, wherein the global knowledge graph includes a plurality of entity nodes, the plurality of entity nodes are connected by edges, and the entity node represents any entity in the network entity, the anonymous pipe and the process; The global knowledge graph is matched with the rebound shell knowledge graph to obtain a matching result, where the matching result indicates whether a first node in the global knowledge graph matches a rebound shell process node, and the first node is an entity node representing a first process.

6. The method according to claim 5, characterized in that Before matching the global knowledge graph with the rebound shell knowledge graph, the method further includes: Determine a candidate rebound shell process, a candidate network entity, a candidate anonymous pipe, and a candidate shell subprocess of the rebound shell process based on the network event, the anonymous pipe event, and the process event of the terminal; Determine the entity nodes representing the candidate rebound shell process, the candidate network entity, the candidate anonymous pipeline, and the candidate shell subprocess in the global knowledge graph as candidate nodes; Delete entity nodes other than the candidate nodes in the global knowledge graph.

7. The method according to any one of claims 1 to 6, characterized in that The rebound shell process is any rebound shell process supported by the Windows operating system.

8. A detection device for a rebound shell process, characterized in that: The device comprises: A first determination module is used to determine a network event, an anonymous pipe event, and a process event of a terminal, wherein the network event refers to an event occurring in a network entity, the anonymous pipe event refers to an event occurring in an anonymous pipe, and the process event refers to an event occurring in a process; A query module, configured to query a first network event, a first anonymous pipe event, and a first process event triggered by a first process from the network events, the anonymous pipe events, and the process events of the terminal; The second determination module is used to determine the first process as a rebound shell process if the first network event, the first anonymous pipe event and the first process event are queried, and the event occurrence flow formed by the first network event, the first anonymous pipe event and the first process event conforms to the rebound shell triggering process.

9. The device according to claim 8, characterized in that The rebound shell triggering process is represented by a rebound shell knowledge graph, which includes a rebound shell process node, a shell network node, a shell pipeline node and a shell sub-process node. The rebound shell process node represents a rebound shell process, the shell network node represents a network entity controlled by the rebound shell process, the shell pipeline node represents an anonymous pipeline controlled by the rebound shell process, and the shell sub-process node represents a shell sub-process of the rebound shell process; Any of the shell network node, the shell pipeline node and the shell subprocess node is connected to the rebound shell process node through an edge, and the edge is used to represent an event triggered by the rebound shell process at the entity represented by any node during the rebound shell triggering process.

10. The device according to claim 9, characterized in that The time attribute of the shell network node is smaller than the event attribute of the shell pipeline node, and the time attribute of the shell network node is smaller than the time attribute of the shell child process node. The time attribute of any node is used to indicate the time when an event occurs in the represented entity.

11. The device according to claim 9 or 10, characterized in that The shell pipeline node includes a first shell pipeline node and a second shell pipeline node, the first shell pipeline node represents a first anonymous pipeline, the second shell pipeline node represents a second anonymous pipeline, the first anonymous pipeline is an anonymous pipeline for the rebound shell process to send information to the shell child process, and the second anonymous pipeline is an anonymous pipeline for the shell child process to send information to the rebound shell process.

12. The device according to any one of claims 9 to 11, characterized in that The query module is used to: Generate a global knowledge graph based on the network event, the pipeline event and the process event of the terminal, wherein the global knowledge graph includes a plurality of entity nodes, the plurality of entity nodes are connected by edges, and the entity node represents any entity in the network entity, the anonymous pipeline and the process; The global knowledge graph is matched with the rebound shell knowledge graph to obtain a matching result, where the matching result indicates whether a first node in the global knowledge graph matches a rebound shell process node, and the first node is an entity node representing a first process.

13. The device according to claim 12, characterized in that The device also includes: A third determination module is used to determine a candidate rebound shell process, a candidate network entity, a candidate anonymous pipe, and a candidate shell subprocess of the rebound shell process based on the network event, the anonymous pipe event, and the process event of the terminal; The third determination module is further used to determine the entity nodes representing the candidate rebound shell process, the candidate network entity, the candidate anonymous pipe and the candidate shell subprocess in the global knowledge graph as candidate nodes; A deletion module is used to delete entity nodes other than the candidate nodes in the global knowledge graph.

14. The device according to any one of claims 8 to 13, characterized in that The rebound shell process is any rebound shell process supported by the Windows operating system.

15. A chip, characterized in that: The chip comprises a logic circuit, and the logic circuit is used to execute the method according to any one of claims 1 to 7.

16. An electronic device, characterized in that: The electronic device comprises a processor, and the processor is used to execute program code, so that the electronic device performs the method according to any one of claims 1 to 7.

17. A computer-readable storage medium, characterized in that: At least one program code is stored in the storage medium, and the at least one program code is read by the processor to enable the electronic device to execute the method according to any one of claims 1 to 7.

Images