Mining Trojan identification method and related equipment

Abstract

The invention provides a mining Trojan identification method and related equipment, which are used for improving the mining Trojan identification accuracy. The method comprises the steps of obtaining a target CPU instruction corresponding to target software, wherein the target CPU instruction represents a behavior related to the mining Trojan horse; if the number of the target CPU instructions is larger than a first threshold value, collected data corresponding to the target CPU instructions are determined, and the collected data comprise process type event data corresponding to the target CPU instructions and domain name system DNS type event data corresponding to the target CPU instructions. And according to the collected data, identifying a mining Trojan behavior corresponding to the target software.

Description

Technical Field

[0001] The present application relates to the computer field, and in particular to a method for identifying a mining Trojan and related equipment. Background Art

[0002] With the development of technology, cryptocurrencies including Bitcoin, Litecoin, and Monero can also bring income to users. At the same time, mining Trojans have also appeared. Mining Trojans use various means to implant mining programs into the victim's computer. Without the user's knowledge, they use the victim's computer's computing power to mine, thereby obtaining illegal income. How to detect mining Trojans has become an urgent problem to be solved.

[0003] In a mining Trojan identification method, the mining Trojan is detected by antivirus software. Specifically, the antivirus software identifies and removes malicious software, that is, identifies and removes the mining Trojan program, by comparing the feature code (such as signature or hash value) of the known mining Trojan.

[0004] In this method, the detection method relies on the signature code of the mining trojan. However, in reality, the mining trojan may use obfuscation, packaging, encryption and other technologies to change its signature code to avoid signature matching, resulting in reduced accuracy in mining trojan identification. Summary of the invention

[0005] The present application provides a mining Trojan identification method and related equipment for improving the accuracy of identifying mining Trojans.

[0006] The first aspect of the present application provides a method for identifying a mining Trojan, comprising:

[0007] During the operation of the target software, the communication device can obtain the target processor (central processing unit, CPU) instructions corresponding to the target software, and the target CPU instructions represent behaviors related to mining Trojans. If the number of target CPU instructions is greater than the first threshold, it means that the behavior corresponding to the target CPU instructions belongs to mining Trojan behavior. At this time, the communication device will also obtain the collected data corresponding to the target CPU instructions, and the collected data includes the process event data corresponding to the target CPU instructions and the domain name system (domain name system, DNS) event data corresponding to the target CPU instructions. The process event data corresponding to the target CPU instructions can reflect the process corresponding to the target CPU instructions, including the start, pause, and termination stages of the process. The DNS event data corresponding to the target CPU instructions can be used to analyze the DNS request corresponding to the target CPU instructions. The communication device processes the collected data to identify the mining Trojan behavior corresponding to the target software.

[0008] It can be seen from the above technical solutions that this application has the following advantages:

[0009] The communication device detects the target CPU instructions of the behavior related to the mining Trojan, and when the number of the target CPU instructions is greater than the first threshold, the collected data reflecting the target CPU instructions in multiple aspects is processed, including the processing process event data and the DNS event data, so as to identify the mining Trojan behavior corresponding to the target software. Since the collected data is multi-dimensional, the communication device can identify the mining Trojan behavior in multiple dimensions. That is to say, in the identification method of the mining Trojan provided in the present application, the communication device realizes the all-round detection of the mining Trojan through multi-dimensional data collection, and improves the accuracy of identifying the mining Trojan. In addition, in the present application, the target CPU instructions and collected data obtained by the communication device are the underlying behaviors and will not be affected by the false CPU occupancy rate disguised by the common mining Trojan. In other words, the identification method of the mining Trojan provided in the present application can quickly identify potential mining Trojan attacks based on real-time analysis, and is also suitable for the scene where the mining Trojan hides the CPU occupancy. While improving the accuracy of identifying the mining Trojan, it enriches the application scenarios and increases the practicality of the solution.

[0010] In some optional implementations of the first aspect, the target CPU instruction includes at least one of the following:

[0011] 1. Instructions for the CPU to perform division or square root operations (ARITH.DIVIDER_ACTIVE). This instruction is used the most during mining. 2. Counting instructions (UOPS_RETIRED) used by complex instruction sets. Complex instructions include at least one of repeat instructions, floating-point transcendental instructions, or auxiliary instructions. Complex instructions are commonly used during mining. 3. Instructions for floating-point arithmetic technology (FP_ARITH_INST_RETIRED). Floating-point arithmetic technology is also a commonly used technology during mining. Accordingly, this instruction also appears frequently. 4. Instructions for branch prediction failure rate (BR_INST_RETIRED.ALL_BRANCHES). In order to evaluate the hardware performance of mining, this instruction is used during mining to invalidate branch prediction. 5. Instructions that cause cache invalidation (CYCLE_ACTIVITY.CYCLES_L1D_MISS, or CYCLE_ACTIVITY.STALLS_L1D_MISS: L1 cache miss). This instruction will be used to invalidate the cache during mining.

[0012] In the present application, there are multiple possibilities for the target CPU instructions collected by the communication device, and possible Trojan attack behaviors can be detected from different dimensions, further improving the accuracy of mining Trojan identification in the present application.

[0013] In some optional implementations of the first aspect, the target CPU instructions include different specific contents, and there are multiple possibilities that the number of target CPU instructions is greater than the first threshold. Optionally, the first threshold includes a preset threshold corresponding to each CPU instruction. In this scheme, whether the target CPU instructions include a single or multiple CPU instructions, the number of target CPU instructions is greater than the first threshold, which means that the number of each CPU instruction in the target CPU instructions is greater than the preset threshold corresponding to each CPU instruction. Optionally, in a scheme where the target CPU instructions include multiple CPU instructions, the number of target CPU instructions is greater than the first threshold, which means that the number of multiple CPU instructions is greater than the preset threshold of multiple CPU instructions, and the preset threshold of multiple CPU instructions is the weighted result of the preset number of multiple CPU instructions or the sum of the preset numbers. Among them, the specific value of the first threshold can be determined according to the needs of the actual application, and can also be determined according to historical experience, and is not specifically limited here.

[0014] In the present application, there are multiple possibilities for the first threshold value, which can be flexibly selected according to the needs of actual applications, enriching the implementation methods of the technical solutions of the present application.

[0015] In some optional implementations of the first aspect, the collected data also includes but is not limited to at least one of the following: file type event data corresponding to the target CPU instruction, network communication event corresponding to the target CPU instruction, process injection event data corresponding to the target CPU instruction, planned task creation event data corresponding to the target CPU instruction, or registry operation event data corresponding to the target CPU instruction.

[0016] In the present application, the data collected by the communication device may have multiple possibilities, and possible Trojan attack behaviors can be tracked from more dimensions, further improving the accuracy of mining Trojan identification in the present application.

[0017] In some optional implementations of the first aspect, based on the collected data, identifying the mining Trojan behavior corresponding to the target software includes: the communication device abstracts and extracts the collected data, that is, constructs a knowledge graph corresponding to the collected data. The knowledge graph is used to represent the association between entities attacked by the mining Trojan, and can reflect the attack path or infection path of the mining Trojan. Based on the knowledge graph, the communication device identifies the specific behavior of the mining Trojan.

[0018] In this application, by constructing a knowledge graph for the collected data, the behavior of the mining Trojan can be identified at a deeper level, which is conducive to more in-depth elimination of the attack Trojan and the adverse effects caused by the attack Trojan.

[0019] In some optional implementations of the first aspect, the communication device may also obtain a risk score for the target software operation. When the number of target CPU instructions is greater than the first threshold, and the risk score for the target software operation is greater than the second threshold, it is determined that the target software operation risk is too high, and there is a situation where it is attacked by a mining Trojan. Based on this, the collected data is obtained, and the behavior analysis of the mining Trojan is performed. Among them, the risk score for the target software operation is greater than the second threshold. In addition, the specific value of the second threshold can be determined according to the needs of the actual application, or it can be determined according to historical experience, and is not specifically limited here.

[0020] In this application, when the target software has a high risk of running and the number of target CPU instructions corresponding to the target software is greater than the first threshold, the behavior analysis of the mining Trojan is started. Setting a double judgment standard can not only reduce misjudgment, further improve the accuracy of mining Trojan identification, but also avoid unnecessary waste of resources.

[0021] A second aspect of the present application provides a communication device, including:

[0022] The acquisition unit is used to acquire the target processor CPU instructions corresponding to the target software, where the target CPU instructions represent behaviors related to the mining trojan. If the number of target CPU instructions is greater than a first threshold, the collected data corresponding to the target CPU instructions is acquired, where the collected data includes process event data corresponding to the target CPU instructions and domain name system DNS event data corresponding to the target CPU instructions.

[0023] The processing unit is used to identify the mining Trojan behavior corresponding to the target software based on the collected data.

[0024] The communication device is used to implement the method for identifying a mining Trojan as shown in the aforementioned first aspect, or any possible implementation of the first aspect, which will not be described in detail here.

[0025] A third aspect of the present application provides a communication device, including a processor and a memory, wherein the processor stores instructions. When the instructions stored in the memory are executed on the processor, the method shown in the first aspect or any possible implementation of the first aspect is implemented.

[0026] A fourth aspect of the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a processor, the method shown in the first aspect or any possible implementation of the first aspect is implemented.

[0027] A fifth aspect of the present application provides a computer program product. When the computer program product is executed on a processor, it implements the method shown in the first aspect or any possible implementation of the first aspect.

[0028] The beneficial effects shown in any one of the second to fifth aspects are similar to those of the first aspect or any possible implementation method of the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 A schematic diagram of the system architecture provided for an embodiment of the present application;

[0030] Figure 2 A schematic diagram of a flow chart of a method for identifying a mining Trojan provided in an embodiment of the present application;

[0031] Figure 3 Another flowchart of the method for identifying a mining Trojan provided in an embodiment of the present application;

[0032] Figure 4 A schematic diagram of a knowledge graph provided in an embodiment of the present application;

[0033] Figure 5 A schematic diagram of the infection path of the mining Trojan provided in the embodiment of the present application;

[0034] Figure 6 Another schematic diagram of the infection path of the mining Trojan provided in the embodiment of the present application;

[0035] Figure 7 Another flowchart of the method for identifying a mining Trojan provided in an embodiment of the present application;

[0036] Figure 8 A schematic diagram of the structure of a communication device provided in an embodiment of the present application;

[0037] Fig. 9 Another structural diagram of a communication device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0038] The embodiments of the present application provide a method for identifying a mining Trojan and related devices, which are used to improve the accuracy of Trojan detection.

[0039] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0040] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchanged in appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attribute in the embodiments of the present application when describing. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment containing a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment. In addition, "at least one" refers to one or more, and "multiple" refers to two or more. "And / or", describes the association relationship of associated objects, indicating that three relationships can exist, for example, A and / or B, can represent: A exists alone, A and B exist simultaneously, and B exists alone, wherein A, B can be singular or plural. The character " / " generally represents that the associated objects before and after are a kind of "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or plural.

[0041] First, see Figure 1 , Figure 1 A schematic diagram of the system architecture provided for an embodiment of the present application.

[0042] like Figure 1 As shown, a user can access or log in to a feature library publishing website through a communication device. The feature library publishing website provides a variety of detection algorithms or detection models. The user can download the detection model to the local communication device or update the local model of the communication device. The detection algorithm feature library on the communication device can be run on the communication device through software.

[0043] Before the detection algorithm feature library is released, the provider of the feature library will first create the detection algorithm feature library, and then test the detection algorithm feature library to ensure that the feature library can operate normally and achieve the desired effect. It will be released only after the detection is completed, that is, the detection algorithm feature library after the detection is uploaded to the feature library website for users to download and use. Among them, the providers of the feature library include producers, maintainers, or managers, etc., which are not limited here.

[0044] like Figure 1As shown, for a solution where a detection algorithm model already exists locally in a communication device, the communication device can upgrade the local feature library by online or offline updating. During the updating process, the signature of the feature library is verified to ensure that the detection algorithm model is not tampered with.

[0045] Figure 1 The detection algorithm model or detection algorithm feature library shown is used to detect mining Trojans running on communication devices. For the specific process, please refer to Figure 2 , Figure 2 A flowchart of a method for identifying a mining Trojan provided in an embodiment of the present application.

[0046] like Figure 2 As shown, when an unknown file runs on a communication device, the communication device extracts the behavior features of the file when it runs, and then processes the behavior features through a detection model to detect whether there is a mining Trojan, thereby obtaining a detection result. Figure 2 The detection model shown includes a model before updating or a model after updating, which is not specifically limited here.

[0047] It should be noted that the mining trojan identification method provided in the embodiment of the present application is applied to a security product, or a communication device in which a security product is installed. The embodiment of the present application does not limit the specific types of security products and communication devices. The security product may be an endpoint detection and response (EDR), a firewall, a sandbox, etc., which is not specifically limited here. The communication device may be a terminal device, a network device, etc., which is not specifically limited here.

[0048] See below. Figure 3 , Figure 3 A schematic diagram of a method for identifying a mining Trojan provided in an embodiment of the present application includes:

[0049] 301. Obtain the target CPU instructions corresponding to the target software, where the target CPU instructions represent behaviors related to the mining Trojan.

[0050] During the operation of the target software, the communication device can detect and collect the operation behavior of the target software, mainly to obtain the target CPU instructions corresponding to the target software. The target CPU instructions refer to the instructions related to the mining trojan among the CPU instructions triggered or used during the operation of the target software. By collecting the target CPU instructions, it is determined whether the target software is attacked by the mining trojan during its operation.

[0051] There are multiple possibilities for the target CPU instruction, specifically, at least one of the following:

[0052] Instruction 1: The CPU performs division or square root operations (for example, ARITH.DIVIDER_ACTIVE). Usually, this instruction is used the most during the mining process.

[0053] Instruction 2: A counting instruction (e.g., UOPS_RETIRED) used by a complex instruction set, where the complex instruction set includes at least one of a repeat instruction, a floating point transcendental instruction, or an auxiliary instruction. Complex instructions are commonly used in the mining process, so technical instructions representing complex instructions often appear in the mining process.

[0054] Instruction 3: Instructions for floating-point arithmetic technology (for example, FP_ARITH_INST_RETIRED). Floating-point arithmetic technology is also a commonly used technology in the mining process, so this instruction often appears in the mining process.

[0055] Instruction 4: Instruction indicating the branch prediction failure rate (for example, BR_INST_RETIRED.ALL_BRANCHES). In order to implement the hardware performance evaluation of mining, this instruction will be used in the mining process to make branch prediction invalid.

[0056] Instruction 5: Instructions that cause cache invalidation (for example, CYCLE_ACTIVITY.CYCLES_L1D_MISS, or CYCLE_ACTIVITY.STALLS_L1D_MISS: L1 cache miss). This instruction is often used to invalidate the cache during mining.

[0057] In the embodiment of the present application, there are multiple possibilities for the target CPU instructions collected by the communication device, and possible Trojan attack behaviors can be detected from different dimensions, further improving the accuracy of mining Trojan identification in the present application.

[0058] 302. If the number of target CPU instructions is greater than a first threshold, acquire collected data corresponding to the target CPU instructions, where the collected data includes process event data corresponding to the target CPU instructions and DNS event data corresponding to the target CPU instructions.

[0059] By comparing the target CPU instruction and the first threshold, it is possible to determine whether a mining Trojan appears during the operation of the target software. Since there are multiple possibilities for the target CPU instruction, there are also multiple possibilities for the value of the first threshold. In general, the first threshold may include a preset threshold corresponding to each CPU instruction, or a preset threshold for multiple CPU instructions. The following are explained separately:

[0060] In some optional implementations, the first threshold includes a preset threshold corresponding to each CPU instruction. In this solution, regardless of whether the target CPU instructions include a single CPU instruction or multiple CPU instructions, the number of the target CPU instructions is greater than the first threshold, which means that the number of each CPU instruction in the target CPU instructions is greater than the preset threshold corresponding to each CPU instruction.

[0061] Exemplarily, it is assumed that the target CPU instruction includes a single CPU instruction, and the single instruction is instruction 1 introduced in the aforementioned step 301. At this time, the number of each CPU instruction is greater than the preset threshold corresponding to each CPU instruction, which means that the number of instructions 1 obtained by the communication device is greater than the preset threshold corresponding to instruction 1.

[0062] Exemplarily, it is assumed that the target CPU instruction includes multiple CPU instructions, and the multiple instructions are instructions 1 to 5 introduced in the aforementioned step 301. At this time, the number of each CPU instruction is greater than the preset threshold corresponding to each CPU instruction, which means that the number of instructions 1 acquired by the communication device is greater than the preset threshold corresponding to instruction 1, and the number of instructions 2 acquired by the communication device is greater than the preset threshold corresponding to instruction 2, and the number of instructions 3 acquired by the communication device is greater than the preset threshold corresponding to instruction 3, and the number of instructions 4 acquired by the communication device is greater than the preset threshold corresponding to instruction 4, and the number of instructions 5 acquired by the communication device is greater than the preset threshold corresponding to instruction 5.

[0063] It should be noted that, in the embodiments of the present application, the preset thresholds of various CPU instructions are not limited and can be determined according to the needs of the actual application. For example, in some optional implementations, the preset threshold of instruction 1 can be set as the highest, the preset thresholds of instruction 4 and instruction 5 are second, and the preset thresholds of instruction 2 and instruction 3 are the lowest.

[0064] In some optional implementations, the first threshold includes a preset threshold of a plurality of CPU instructions. The preset threshold of a plurality of CPU instructions includes a weighted result of a preset number of the plurality of CPU instructions or a summed result of a preset number. In this solution, the target CPU instruction is a plurality of CPU instructions, and the number of the target CPU instructions is greater than the first threshold, which means that the number of the plurality of CPU instructions included in the target CPU instruction is greater than the preset threshold of the plurality of CPU instructions.

[0065] Exemplarily, it is assumed that the target CPU instructions include the multiple CPU instructions 1 to 5 introduced in the aforementioned step 301. At this time, the number of the multiple CPU instructions is greater than the preset threshold of the multiple CPU instructions, which means that the number of instructions 1 to 5 obtained by the communication device is greater than the preset threshold corresponding to instructions 1 to 5.

[0066] It should be noted that, in the scheme where the target CPU instruction includes multiple CPU instructions, the embodiments of the present application do not limit the preset weights or preset thresholds of each CPU instruction. Exemplarily, in some optional implementations, in the scheme where the preset thresholds corresponding to instructions 1 to 5 are the weighted results of the number of these multiple instructions, the weight of instruction 1 can be set to be the highest, the weights of instructions 4 and 5 are similar and both lower than the weight of instruction 1, and the weights of instructions 2 and 3 are similar and both lower than the weights of instructions 4 and 5. In some optional implementations, in the scheme where the preset thresholds corresponding to instructions 1 to 5 are the sum of the number of these multiple instructions, the preset threshold of instruction 1 can be set to be the highest, the preset thresholds of instructions 4 and 5 are the second, and the preset thresholds of instructions 2 and 3 are the smallest.

[0067] In the present application, there are multiple possibilities for the first threshold value, which can be flexibly selected according to the needs of actual applications, enriching the implementation methods of the technical solutions of the present application.

[0068] When the number of target CPU instructions is greater than the first threshold, it means that the target software is under attack by a mining Trojan, and the communication device can identify the specific behavior of the mining Trojan. At this time, the communication device can obtain collected data, which reflects the specific behavior of the mining Trojan from different dimensions. Among them, the communication device can obtain the collected data through a collection tool. The type of collection tool is related to the specific model of the communication device, the operating environment and other factors, which are not specifically limited here. For example, the collection tool can be Intel's VTune TM profiler tool.

[0069] In some optional implementations, the collected data includes process event data corresponding to the target CPU instruction and DNS event data corresponding to the target CPU instruction. The process event data corresponding to the target CPU instruction can reflect the process corresponding to the target CPU instruction, including the start, pause, and termination stages of the process. This is used to identify the process attacked by the mining trojan, as well as the development process and stage of the process. The DNS event data corresponding to the target CPU instruction can be used to analyze the DNS request corresponding to the target CPU instruction, thereby helping to identify the mining server or mining pool.

[0070] In some optional embodiments, the collected data further includes at least one of the following:

[0071] File event data corresponding to the target CPU instructions. File events cover operations such as file creation, modification, and deletion. They can be used to track file activities related to mining trojans, thereby identifying files infected by mining trojans and the file change process.

[0072] Network communication events corresponding to target CPU instructions: Network communication events include workstations or hosts connected during the communication process, or data links, which can be used to identify the transmission links of mining trojans.

[0073] Process injection event data corresponding to the target CPU instructions: Process injection refers to the transmission of a piece of data from one process to another. It can be used to identify the transmission process of mining trojans between different processes, thereby helping to determine the infection path of mining trojans.

[0074] Scheduled task creation event data corresponding to the target CPU instruction: Scheduled task creation is used to specify a plan, including the start / end time of the plan, the content of the plan, the execution method of the plan, etc. By identifying the plan of the mining trojan, the effective time and operation process of the mining trojan can be determined.

[0075] Registry operation event data corresponding to the target CPU instruction: The registry is used to store the configuration information of the system and application in the communication device. Registry operations include modifying, deleting, and creating new information in the registry. It can be used to identify the configuration information tampered by the mining trojan, which helps to correct the configuration information of the registry and eliminate the adverse effects of the mining trojan.

[0076] In the embodiment of the present application, the data collected by the communication device may have multiple possibilities, and possible Trojan attack behaviors can be tracked from more dimensions, further improving the accuracy of mining Trojan identification in the present application.

[0077] 303. Based on the collected data, identify the mining Trojan behavior corresponding to the target software.

[0078] After acquiring the collected data, the communication device will process the collected data, mainly to construct a knowledge graph corresponding to the collected data. The knowledge graph is used to represent the association between entities attacked by mining trojans. According to the knowledge graph, the mining trojan behavior is identified. Among them, entities refer to objects that can be operated, such as: Internet protocol (IP) addresses, accounts (including user names and passwords), processes, files, registry tables, etc., which are not specifically limited here.

[0079] The following diagram and examples illustrate the process of building a knowledge graph. Figures 4 to 6 , Figure 4 A schematic diagram of a knowledge graph provided in an embodiment of the present application, Figure 5 and Figure 6 These are schematic diagrams of the infection path of the mining Trojan provided in the embodiments of the present application.

[0080] like Figure 4As shown, when the number of target CPU instructions is greater than the first threshold, it is determined that a security incident occurs during the operation of the target software, that is, an attack behavior of a mining trojan occurs. The collected data is abstracted into a knowledge graph by using a security knowledge base (for example, a structured list built through the ATT&CK framework) and combining security-related information (such as assets corresponding to security incidents, or possible vulnerabilities in communication devices, etc.). The knowledge graph represents the relationship between different entities as the relationship between different security incidents, and also represents the attribute value of an entity as the security-related information of the entity, thereby reflecting the attack behavior and infection path of the mining trojan.

[0081] For example, Figure 5 It shows the installation of mining Trojans through attachments sent via email, as well as the possible infection process of mining Trojans. Figure 5 As shown, the communication device uses the email address and Windows key value through the user account to use the email function, including receiving and sending emails. If the attachment in the received email carries a mining Trojan, the mining Trojan will establish or enter the process that is already running on the communication device when the user clicks or uses the attachment. The process may have a parent process or child process associated with it, and the mining Trojan can infect the parent process or the child process. In addition, the mining Trojan can also read or write files on the communication device through the process. Furthermore, the mining Trojan can also use the network traffic of the communication device to further infect other communication devices. Specifically, the source address and destination address of the new communication link are constructed through network traffic. In the embodiment of the present application, the types of the source address and the destination address are not limited, that is, the communication protocol between the source address and the destination address is not limited. Figure 5 In the illustrated embodiment, the source address or the destination address is an IPv4 address or an IPv6 address. In this process, the communication device can determine that a security incident has occurred, that is, there is a mining trojan, and can extract the relationship between different entities.

[0082] In the embodiment of the present application, corresponding to Figure 5In the embodiment shown, the knowledge graph can reflect the following information: The infection source of entity 1 (user account) is entity 2 (email address), specifically the attachment in the mailbox. The infection source of entity 3 (process) is entity 1 (user account), and entity 3 (process) is also the infection source of its parent / child process. In addition, entity 3 (process) further infected entity 4 (source address) and entity 5 (destination address) in the process of using the traffic network. In general, the infection path of the mining trojan includes email address → user account → process → source address / destination address.

[0083] For example, Figure 6 It shows the installation of mining Trojans through website vulnerabilities and the possible infection process of mining Trojans. Figure 6 Take the weblogic vulnerability as an example. Figure 6 As shown, the website weblogic obtains a network access request (http_request) from the attack IP (attack IP), which is used to upload the malicious file minging to the website. When the website weblogic executes (execute) the command of the malicious file, a command shell program (powershell.exe) is started. powershell.exe can not only create scheduled tasks (schtasks.exe) to achieve the purpose of long-term holding of communication devices and performing mining tasks, but also run mining Trojans (xming.exe). The mining Trojan initiates a DNS communication request to an unknown website (unknown.com), which may be a mining pool or a website connected to a mining pool, thereby realizing mining (that is, producing virtual currency).

[0084] In the embodiment of the present application, corresponding to Figure 6 In the embodiment shown, the knowledge graph can reflect the following information: the infection source of entity 1 (weblogic website) is entity 2 (malicious file minging_xml). Entity 1 (weblogic website) creates entity 4 (schtasks.exe) and entity 5 (xming.exe) by executing entity 3 (powershell.exe) to allow the mining trojan to run in the communication device for a long time.

[0085] In actual applications, there are many types of mining Trojan behaviors, including at least one of reading machine configuration, creating scheduled tasks, or communicating with the mining pool. It can also include stopping other tasks to achieve CPU monopoly, stopping the operation of anti-virus software, or using process injection to evade detection. In addition, it can also include other behaviors that use the computing resources of communication devices to mine, which are not limited here.

[0086] In the embodiment of the present application, by constructing a knowledge graph for the collected data, the behavior of the mining Trojan can be identified at a deeper level, which is conducive to more in-depth elimination of the attack Trojan and the adverse effects caused by the attack Trojan.

[0087] In summary, in the embodiment of the present application, the communication device detects the target CPU instructions of the behavior related to the mining Trojan, and when the number of the target CPU instructions is greater than the first threshold, the collected data reflecting the target CPU instructions in multiple aspects is processed, including processing process event data and DNS event data, so as to identify the mining Trojan behavior corresponding to the target software. Since the collected data is multi-dimensional, the communication device can identify the mining Trojan behavior of multiple dimensions. That is to say, in the identification method of the mining Trojan provided in the present application, the communication device realizes the all-round detection of the mining Trojan through multi-dimensional data collection, and improves the accuracy of identifying the mining Trojan. In addition, in the present application, the target CPU instructions and collected data obtained by the communication device are the underlying behaviors and will not be affected by the false CPU occupancy rate disguised by the common mining Trojan. In other words, the identification method of the mining Trojan provided in the present application can quickly identify potential mining Trojan attacks based on real-time analysis, and is also suitable for the scene where the mining Trojan hides the CPU occupancy. While improving the accuracy of identifying the mining Trojan, it enriches the application scenarios and increases the practicality of the solution.

[0088] In the embodiment shown above, when the number of target CPU instructions is greater than the first threshold, it is determined that the target software is attacked by a mining Trojan, and the specific behavior of the mining Trojan is analyzed. In some optional implementations, a dual judgment standard can also be used to determine whether a mining Trojan exists. Specifically, the communication device can use a risk assessment algorithm to score the risk of the target software when it is running to obtain a risk score for the target software. It is understandable that the risk assessment algorithm is an algorithm commonly used by antivirus software or Trojan detection software, that is, in this technical solution, the communication device can also combine the number of target CPU instructions with the existing software to further identify the mining Trojan.

[0089] If the risk score is greater than the second threshold and the number of target CPU instructions is greater than the first threshold, it is determined that the target software is attacked by a mining Trojan. In other words, in this optional technical solution, the target CPU instructions corresponding to the target software are obtained in the aforementioned step 301, including obtaining the target CPU instructions corresponding to the target software when the risk score is greater than the second threshold and the number of target CPU instructions is greater than the first threshold. The specific value of the second threshold can be determined according to the needs of the actual application or based on historical experience, and is not specifically limited here.

[0090] For example, assuming that Figure 6In the illustrated embodiment, if the risk scores of step ① and step ② are both greater than the second threshold, and the number of target CPU instructions corresponding to the website weblogic is greater than the first threshold, then the communication device determines that the website weblogic is attacked by a mining trojan. Further, the collected data corresponding to the target CPU instructions is obtained, and the behavior of the mining trojan is analyzed.

[0091] In the embodiment of the present application, when the target software operation risk is too high and the number of target CPU instructions corresponding to the target software is greater than the first threshold, the behavior analysis of the mining Trojan is started. The dual judgment standard is set, which can not only reduce misjudgment, further improve the accuracy of mining Trojan identification, but also avoid unnecessary waste of resources.

[0092] See next Figure 7 , Figure 7 A flowchart of a method for identifying a mining Trojan provided in an embodiment of the present application.

[0093] like Figure 7 As shown, in an embodiment of the present application, the communication device can perform data collection, and the collected data includes the target CPU instruction, and a series of data corresponding to the target CPU instruction, specifically including the process event and DNS event corresponding to the target CPU instruction. Optionally, it can also include at least one of the file event and other events corresponding to the target CPU instruction, wherein the other events corresponding to the target CPU instruction include but are not limited to: the network communication event corresponding to the target CPU instruction, the process injection event data corresponding to the target CPU instruction, the scheduled task creation event data corresponding to the target CPU instruction, or the registry operation event data corresponding to the target CPU instruction, which is not specifically limited here.

[0094] The communication device can determine whether there is a mining Trojan based on the collected target CPU instructions, or determine whether there is a mining Trojan based on the collected target CPU instructions and the risk score obtained by the risk assessment. When it is determined that there is a mining Trojan, the mining Trojan behavior analysis is performed in combination with the collected data. During the behavior analysis, the context attacked by the mining Trojan is identified (including processes, files, DNS, networks, registries, etc.), and the entity association between the contexts is constructed using the knowledge graph to further determine the infection path of the attacking Trojan.

[0095] The following is a description of the related devices of the embodiment of the present application. Figure 8 , Figure 8 A schematic diagram of the structure of a communication device provided in an embodiment of the present application. Figure 8 As shown, the communication device 800 includes an acquisition unit 801 and a processing unit 802 .

[0096] In some optional implementations, the acquisition unit 801 is used to acquire the target CPU instructions corresponding to the target software, where the target CPU instructions represent behaviors related to the mining trojan. If the number of target CPU instructions is greater than a first threshold, acquisition data corresponding to the target CPU instructions is acquired, where the acquisition data includes process event data corresponding to the target CPU instructions and domain name system DNS event data corresponding to the target CPU instructions.

[0097] The processing unit 802 is used to: identify the mining Trojan behavior corresponding to the target software according to the collected data.

[0098] In some optional embodiments, the target CPU instruction includes at least one of the following: an instruction for the CPU to perform division or square root operations, a counting instruction used by a complex instruction set, an instruction for floating-point operation technology, an instruction for branch prediction failure rate, or an instruction for causing cache invalidation.

[0099] In some optional implementations, the number of target CPU instructions is greater than a first threshold, including:

[0100] The number of each CPU instruction in the target CPU instruction is greater than a preset threshold corresponding to each CPU instruction; or, if the target CPU instruction is a plurality of CPU instructions, the number of the plurality of CPU instructions is greater than a preset threshold of the plurality of CPU instructions, and the preset threshold of the plurality of CPU instructions is a weighted result of the preset numbers of the plurality of CPU instructions or a summed result of the preset numbers. The first threshold includes a preset threshold corresponding to each CPU instruction or a preset threshold of the plurality of CPU instructions.

[0101] In some optional embodiments, the collected data also includes at least one of the following: file type event data corresponding to the target CPU instruction, network communication event data corresponding to the target CPU instruction, process injection event data corresponding to the target CPU instruction, planned task creation event data corresponding to the target CPU instruction, or registry operation event data corresponding to the target CPU instruction.

[0102] In some optional implementations, the processing unit 802 is specifically configured to: construct a knowledge graph corresponding to the collected data, the knowledge graph being used to represent the association relationship between entities attacked by the mining trojan, and identify the mining trojan behavior according to the knowledge graph.

[0103] In some optional implementations, the acquisition unit 801 is further configured to: acquire a risk score of the target software operation. If the number of target CPU instructions is greater than a first threshold and the risk score is greater than a second threshold, acquire the target CPU instructions corresponding to the target software.

[0104] The communication device 800 is used to execute the operations performed by the communication device in the aforementioned embodiment to implement the method for identifying the mining Trojan provided in the embodiment of the present application, which will not be described in detail here.

[0105] See also Fig. 9 , Fig. 9 A schematic diagram of the structure of a communication device provided in an embodiment of the present application.

[0106] like Fig. 9 As shown, the communication device 900 includes: a memory 903, a bus 904, a processor 905 and a communication interface 906. The processor 905, the memory 903 and the communication interface 906 communicate with each other through the bus 904. It should be understood that the present invention does not limit the number of processors and memories in the communication device 900.

[0107] The bus 904 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 The bus 904 is represented by only one line, but it does not mean that there is only one bus or one type of bus. The bus 904 may include a path for transmitting information between various components of the communication device 900 (for example, the memory 903, the processor 905, and the communication interface 906).

[0108] The processor 905 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0109] The memory 903 may include a volatile memory, such as a random access memory (RAM). The processor 905 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD) or a solid state drive (SSD).

[0110] The memory 903 stores executable program codes, and the processor 905 executes the executable program codes to respectively implement the functions of the acquisition unit 901 (corresponding to the aforementioned acquisition unit 801) and the processing unit 902 (corresponding to the aforementioned processing unit 802), thereby implementing the screen sharing method. That is, the memory 903 stores instructions for the cloud service platform to execute the screen sharing method provided in the embodiment of the present application.

[0111] The communication interface 906 uses a transceiver unit such as, but not limited to, a network interface card or a transceiver to implement communication between the communication device 900 and other devices or a communication network.

[0112] The communication device 900 is used to execute the operations performed by the communication device in the aforementioned embodiment to implement the method for identifying the mining Trojan provided in the embodiment of the present application, and the details will not be repeated here.

[0113] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0114] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0115] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0116] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0117] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a communication device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.

Claims

1. A method for identifying mining Trojans, characterized in that: include: Obtaining a target processor CPU instruction corresponding to the target software, wherein the target CPU instruction indicates a behavior related to the mining Trojan; If the number of the target CPU instructions is greater than a first threshold, acquiring collected data corresponding to the target CPU instructions, the collected data including process event data corresponding to the target CPU instructions and domain name system DNS event data corresponding to the target CPU instructions; According to the collected data, the mining Trojan behavior corresponding to the target software is identified.

2. The method according to claim 1, characterized in that The target CPU instruction includes at least one of the following: The CPU executes instructions for division or square root operations, counting instructions used by complex instruction sets, instructions for floating-point arithmetic techniques, instructions that cause branch prediction errors, or instructions that cause cache invalidations.

3. The method according to claim 2, characterized in that The number of the target CPU instructions is greater than a first threshold, including: The number of each CPU instruction in the target CPU instructions is greater than a preset threshold corresponding to each CPU instruction; or, If the target CPU instruction is a plurality of CPU instructions, the number of the plurality of CPU instructions is greater than a preset threshold of the plurality of CPU instructions, and the preset threshold of the plurality of CPU instructions is a weighted result of a preset number of the plurality of CPU instructions or a summed result of a preset number; The first threshold includes a preset threshold corresponding to each CPU instruction, or a preset threshold of multiple CPU instructions.

4. The method according to any one of claims 1 to 3, characterized in that The collected data also includes at least one of the following: The file event data corresponding to the target CPU instruction, the network communication event corresponding to the target CPU instruction, the process injection event data corresponding to the target CPU instruction, the planned task creation event data corresponding to the target CPU instruction, or the registry operation event data corresponding to the target CPU instruction.

5. The method according to any one of claims 1 to 4, characterized in that The identifying, based on the collected data, mining Trojan behavior corresponding to the target software includes: Constructing a knowledge graph corresponding to the collected data, wherein the knowledge graph is used to represent associations between entities attacked by the mining trojan; According to the knowledge graph, the mining Trojan behavior is identified.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: obtaining a risk score for the target software operation; If the number of the target CPU instructions is greater than a first threshold, obtaining the collected data corresponding to the target CPU instructions includes: If the number of the target CPU instructions is greater than the first threshold, and the risk score is greater than a second threshold, the target CPU instructions corresponding to the target software are obtained.

7. A communication device, characterized in that: include: An acquisition unit, configured to acquire a target processor CPU instruction corresponding to the target software, wherein the target CPU instruction represents a behavior related to the mining Trojan; The acquisition unit is further configured to acquire, if the number of the target CPU instructions is greater than a first threshold, collected data corresponding to the target CPU instructions, the collected data including process event data corresponding to the target CPU instructions and domain name system DNS event data corresponding to the target CPU instructions; A processing unit is used to identify the mining Trojan behavior corresponding to the target software based on the collected data.

8. The device according to claim 7, characterized in that The target CPU instruction includes at least one of the following: The CPU executes instructions for division or square root operations, counting instructions used by complex instruction sets, instructions for floating-point arithmetic techniques, instructions that cause branch prediction errors, or instructions that cause cache invalidations.

9. The device according to claim 8, characterized in that The number of the target CPU instructions is greater than a first threshold, including: The number of each CPU instruction in the target CPU instructions is greater than a preset threshold corresponding to each CPU instruction; or, If the target CPU instruction is a plurality of CPU instructions, the number of the plurality of CPU instructions is greater than a preset threshold of the plurality of CPU instructions, and the preset threshold of the plurality of CPU instructions is a weighted result of a preset number of the plurality of CPU instructions or a summed result of a preset number.

10. The device according to any one of claims 7 to 9, characterized in that The collected data also includes at least one of the following: The file event data corresponding to the target CPU instruction, the network communication event corresponding to the target CPU instruction, the process injection event data corresponding to the target CPU instruction, the planned task creation event data corresponding to the target CPU instruction, or the registry operation event data corresponding to the target CPU instruction.

11. The device according to any one of claims 7 to 10, characterized in that The processing unit is specifically used for: Constructing a knowledge graph corresponding to the collected data, wherein the knowledge graph is used to represent associations between entities attacked by the mining trojan; According to the knowledge graph, the mining Trojan behavior is identified.

12. The device according to any one of claims 7 to 11, characterized in that The acquisition unit is further used for: Obtaining a risk score for the target software operation; If the number of the target CPU instructions is greater than the first threshold, and the risk score is greater than a second threshold, the target CPU instructions corresponding to the target software are obtained.

13. A communication device, characterized in that: include: Memory and processor; The processor stores instructions, and when the instructions are executed on the processor, the method according to any one of claims 1 to 6 is implemented.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a processor, the method according to any one of claims 1 to 6 is implemented.

15. A computer program product, characterized in that When the computer program product is executed on a computer, the computer performs the method according to any one of claims 1 to 6.

Images