A method and device for detecting secret stealing behavior

Abstract

The present invention and its embodiments are intended to provide a method for detecting theft of secrets by black industries and a device using the detection method. First, a blacklist is matched to exclude IPs, domain names or URLs that have been determined to be theft operations; then the direct characteristics of the traffic are detected to determine the request behaviors that meet the conditions; finally, for the requests that still cannot be determined, statistical data are analyzed to determine whether they meet the preset judgment model based on the preset behavior characteristics, and further the judgment results of the model are intersected to finally determine whether the behavior meets the characteristics of theft. The detection process combines feature matching, protocol detection and behavior analysis, and is performed in sequence according to the degree of clarity, which can not only improve the accuracy of the detection, but also ensure the efficiency of the detection, which is of positive significance for forming a true and reliable description of security events.

Description

Technical Field

[0001] The present invention belongs to the technical field of network attack detection, and in particular relates to a method for detecting black industry secret theft behavior and a device applying the detection method. Background Art

[0002] Theft attacks, also known as Trojans, or command and control channels, are a mechanism that violates security policies and transmits information secretly. The attack tool embeds valid data in data messages and transmits it normally in the network through a carrier, thereby achieving the secret transmission of valid data without being discovered. The attacker transmits the data information in the controlled host to the personal host through a specific channel in the network to obtain intelligence. At the same time, the attacker can transmit control commands through this channel to achieve the purpose of long-term control of the controlled host. For example, once a user reads a malicious PDF file or opens a malicious screen saver, a Trojan will be implanted. The Trojan program will change into various forms to reside in the victim's computer and communicate with the attack server. The collected information is usually uploaded to the attack server via HTTP POST. The attacker uses the attack server to issue various instructions to the Trojan and continuously collect sensitive information of the victim company.

[0003] Common methods for detecting Trojan attacks include traffic feature analysis. However, relying solely on traffic analysis cannot effectively analyze network logs, and is poor in terms of accuracy and readability. It cannot clearly describe the content and significance of the event, and it is difficult to form a real, reliable and user-readable security event. Summary of the invention

[0004] In view of the above background, the present invention and its embodiments are intended to provide a method for detecting black market stealing behavior and a device using the detection method.

[0005] On the one hand, a method for detecting secret theft is proposed, which determines whether secret theft occurs based on the analysis results of access data, including: Count system access data, including the total access log volume of the system's network, the log volume of system visitors, and the number of visitors from different sources within a preset period; According to the total access log volume of the network, determine whether the system access volume has a sudden change or a periodic abnormality; according to the system visitor log volume, determine whether there are new visitor IPs or potential visitor IPs; according to the number of visitors from different sources, determine whether there is an abnormality in the number of different visitors; According to the above-mentioned judgment results, it is confirmed whether the theft of secrets occurs.

[0006] Preferably, before the above access data analysis, the traffic characteristics are first detected: If the request meets at least one of the following conditions, it is considered as a theft behavior: Send non-HTTP traffic to the web server default port; The request packet sending time is periodic; The HTTP header in the data packet contains non-standard fields, and the non-standard fields do not belong to the preset non-HTTP message header fields to be counted; The size of request packets sent multiple times in succession in the same session is larger than the response packet, and the ratio of request traffic to response traffic is greater than the first threshold. At the same time, the number of packets in a single session is greater than the second threshold, or the total traffic output within a preset interval is several times the amount of response data.

[0007] Furthermore, before the above-mentioned traffic feature detection, a blacklist match is performed first: if at least one of the IP, domain name or URL of the access request matches the blacklist library, it is determined to be a theft behavior.

[0008] Furthermore, if the current step has been determined to be an act of stealing secrets, the result will be output and no further detection will be performed.

[0009] Preferably, the first threshold includes 10-25, the second threshold includes 1000, the preset interval includes 24 hours, and the multiple includes 5 times.

[0010] Preferably, the above-mentioned confirming whether theft of secrets occurs according to the above-mentioned judgment results specifically includes: Set the total network access log volume as the first feature, the system visitor log volume as the second feature, and the number of visitors from different sources as the third feature; According to the first feature, the sudden abnormality of the system access volume is detected as the first detection model, according to the first feature, the periodic abnormality of the system access volume is detected as the second detection model, according to the second feature, the newly appeared visitor IP is detected as the third detection model, according to the second feature, the potential visitor IP is detected as the fourth detection model, and according to the third feature, the abnormality of different visitor numbers is detected as the fifth detection model; The outputs of the detection models are intersected, and if at least two models detect anomalies, it is confirmed that theft has occurred.

[0011] On the other hand, a device for detecting a stealing behavior is provided, the device comprising: The data statistics module is used to count the system access data, including the total access log volume of the network where the system is located within a preset period, the log volume of system visitors, and the number of visitors from different sources to the system; The data analysis module determines, based on the statistical results of the data statistics module, whether the system visit volume has a sudden change or a periodic abnormality, whether there are new visitor IPs or potential visitor IPs, and whether there is an abnormality in the number of different visitors; The confirmation module performs a traceability and correlation analysis based on the judgment result of the analysis module to confirm whether the theft of secrets occurs and outputs the detection result.

[0012] The device also includes a flow detection module. If the request meets at least one of the following conditions, it is considered as a theft behavior: Send non-HTTP traffic to the web server default port; The request packet sending time is periodic; The HTTP header in the data packet contains non-standard fields, and the non-standard fields do not belong to the preset non-HTTP message header fields to be counted; The size of request packets sent multiple times in succession in the same session is larger than the response packet, and the ratio of request traffic to response traffic is greater than the first threshold. At the same time, the number of packets in a single session is greater than the second threshold, or the total traffic output within a preset interval is several times the amount of response data.

[0013] The device also includes a blacklist matching module. Before the traffic feature detection, a blacklist matching is performed first: if at least one of the IP, domain name or URL of the access request matches the blacklist library, it is determined to be an act of stealing secrets.

[0014] The present invention adopting the above technical solution has at least the following beneficial effects: firstly, matching the blacklist is performed to exclude the IP, domain name or URL that has been determined to be a stealing operation; then the direct characteristics of the traffic are detected to determine the request behavior that meets the conditions; finally, for the requests that still cannot be determined, statistical data is analyzed to determine whether they meet the preset judgment model according to the preset behavior characteristics, and further take the intersection of the judgment results of the model, and finally determine whether the behavior meets the characteristics of stealing. The detection process combines feature matching, protocol detection and behavior analysis, and is performed in sequence according to the degree of clarity, which can not only improve the accuracy of detection, but also ensure the efficiency of detection, which has positive significance for forming a true and reliable description of security events. Implementation

[0015] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be described clearly and completely in combination with the embodiments below. First, the technical terms involved are briefly explained.

[0016] The communication of secret-stealing Trojans is generally divided into three stages: establishing connection, maintaining connection, and interactive connection.

[0017] (1) Connection establishment process: After the Trojan is implanted in the system, the rebound port establishes a connection for communication (the controlled end sends a connection request to the control end). The controlled end sends a DNS request: The controlled end will send a DNS request to resolve the control end IP, and reversely connect to the control end based on the IP returned by DNS. When the control end is online, the controlled end will establish a connection with the returned IP. If the control end is not online, the Trojan will intermittently send DNS requests until the connection is successful or the control end is offline. Or when the controlled end knows the IP of the control end, it will send a large number of SYN packets when establishing a connection.

[0018] Secret-stealing Trojan communications usually have the following characteristics: Best effort connection mechanism: If a normal connection is not established, the controlled end will make repeated DNS requests within a short period of time.

[0019] Silent mode: To prevent the controlled end from sending a large number of requests due to the control end being offline, Trojans usually design a silent mode, that is, setting the DNS domain name resolution address to a special value, so that the controlled end enters a short-term non-communication mode to achieve better communication concealment.

[0020] (2) During the connection maintenance phase, after implanting the Trojan, the attacker needs to get feedback on whether the implantation was successful. Generally speaking, a successfully implanted Trojan will send a data packet carrying specific information (the target host's IP, host name, operating system, language version, and attacker's specific identifier, etc.) to the control end to characterize the Trojan's network survivability. The sending time of these feedback information generally has a certain regularity, which is called a "heartbeat packet." However, the regularity of the heartbeat packets of some Trojans is not so obvious.

[0021] (3) In the interactive connection phase, the attacker (controller) actively sends control commands and the controlled end returns data.

[0022] Common Trojan attack detection technologies include feature matching, protocol anomaly analysis, behavior anomaly analysis, etc. Different detection technologies have different characteristics.

[0023] Based on feature matching, it mainly matches the application layer feature information of the data stream with the "feature database" (such as URL, GET, POST and other related parameters detected by HTTP protocol tunnel). It is more effective for known attacks; however, simple string matching is prone to high false alarm rate, and it cannot detect encrypted data, cannot summarize attack patterns, and is difficult to identify new attacks.

[0024] Based on protocol anomaly analysis, it mainly analyzes the protocol of the data stream and issues an alarm for violations of the protocol specifications (e.g., each "HTTP request" operation in the HTTP protocol corresponds to an "HTTP response" operation, and the host field must be included in the protocol header under HTTP / 1.1, etc. When an abnormal protocol operation occurs in the monitored data stream, an alarm is issued). It has the ability to find any behavior that deviates from the standard or expected value, so it can detect known or unknown attack behaviors; but it seems powerless for proxy service-type and CGI script-type channel tools.

[0025] Based on the analysis of abnormal behavior, the real-time statistical data flow is counted to determine whether it has been attacked by checking whether it exceeds the (flow) model threshold. It not only simply analyzes a single attack event, but also confirms whether an attack has occurred and whether the attack behavior is effective based on the events before and after. The difficulty lies in whether an accurate flow model can be established through pattern recognition and machine learning.

[0026] Analyzing the principles and techniques of Trojan communication and studying Trojan detection technology will help to discover controlled hosts in the network, cut off external control of the controlled hosts, and eliminate network and information security risks, which is of great significance to improving network security.

[0027] Based on the above, the present invention proposes a technical solution for detecting black market theft activities. Embodiment 1

[0028] An embodiment of a method for detecting a stealing behavior comprises the following steps: First, perform blacklist matching: If at least one of the IP, domain name or URL of the access request matches the blacklist library, it is determined to be a theft behavior; otherwise, proceed to the next step.

[0029] Then the traffic characteristics are checked. If the request meets at least one of the following conditions, it is determined to be a theft behavior; otherwise, proceed to the next step: Send non-HTTP traffic to the web server default port; The request packet sending time is periodic; The HTTP header in the data packet contains non-standard fields, and the non-standard fields do not belong to the preset non-HTTP message header fields to be counted; The size of request packets sent multiple times in succession in the same session is larger than the response packet, and the ratio of request traffic to response traffic is greater than the first threshold. At the same time, the number of packets in a single session is greater than the second threshold, or the total traffic output within a preset interval is several times the amount of response data.

[0030] Finally, the analysis results of the access data are used to determine whether theft has occurred. Specifically: Count system access data, including the total access log volume of the system's network, the log volume of system visitors, and the number of visitors from different sources within a preset period; According to the total access log volume of the network, determine whether the system access volume has a sudden change or a periodic abnormality; according to the system visitor log volume, determine whether there are new visitor IPs or potential visitor IPs; according to the number of visitors from different sources, determine whether there is an abnormality in the number of different visitors; According to the above-mentioned judgment results, it is confirmed whether the theft of secrets occurs.

[0031] As a preferred implementation, the first threshold includes 10-25, the second threshold includes 1000, the preset interval includes 24 hours, and the multiple includes 5 times.

[0032] As a preferred implementation, the above-mentioned confirmation of whether theft occurs according to each judgment result specifically includes: Set the total network access log volume as the first feature, the system visitor log volume as the second feature, and the number of visitors from different sources as the third feature; According to the first feature, the sudden abnormality of the system access volume is detected as the first detection model, according to the first feature, the periodic abnormality of the system access volume is detected as the second detection model, according to the second feature, the newly appeared visitor IP is detected as the third detection model, according to the second feature, the potential visitor IP is detected as the fourth detection model, and according to the third feature, the abnormality of different visitor numbers is detected as the fifth detection model; The outputs of the detection models are intersected, and if at least two models detect anomalies, it is confirmed that theft has occurred. Embodiment 2

[0033] An embodiment of a device for detecting a secret stealing behavior, the device comprising: The data statistics module is used to count the system access data, including the total access log volume of the network where the system is located within a preset period, the log volume of system visitors, and the number of visitors from different sources to the system; The data analysis module determines, based on the statistical results of the data statistics module, whether the system visit volume has a sudden change or a periodic abnormality, whether there are new visitor IPs or potential visitor IPs, and whether there is an abnormality in the number of different visitors; The confirmation module performs a traceability and correlation analysis based on the judgment result of the analysis module to confirm whether the theft of secrets occurs and outputs the detection result.

[0034] As a preferred embodiment, the device also includes a flow detection module. If the request meets at least one of the following conditions, it is considered as a theft behavior: Send non-HTTP traffic to the web server default port; The request packet sending time is periodic; The HTTP header in the data packet contains non-standard fields, and the non-standard fields do not belong to the preset non-HTTP message header fields to be counted; The size of request packets sent multiple times in succession in the same session is larger than the response packet, and the ratio of request traffic to response traffic is greater than the first threshold. At the same time, the number of packets in a single session is greater than the second threshold, or the total traffic output within a preset interval is several times the amount of response data.

[0035] As a preferred implementation, the device also includes a blacklist matching module. Before the traffic feature detection, a blacklist matching is performed first: if at least one of the IP, domain name or URL of the access request matches the blacklist library, it is determined to be an act of stealing secrets.

[0036] The technical solutions of the present invention and its embodiments described above are First, match the blacklist to exclude IP, domain name or URL that has been determined to be stealing operations; then detect the direct characteristics of the traffic to determine the request behavior that meets the conditions; finally, for the requests that still cannot be determined, analyze the statistical data, determine whether they meet the preset judgment model based on the preset behavior characteristics, and further take the intersection of the judgment results of the model to finally determine whether the behavior meets the characteristics of stealing. This detection process combines feature matching, protocol detection and behavior analysis, and is carried out in sequence according to the degree of clarity, which can not only improve the accuracy of detection, but also ensure the efficiency of detection, which is of positive significance for forming a true and reliable description of security events.

[0037] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.

[0038] The above description of the above disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the broadest scope consistent with the principles disclosed herein.

Claims

1. A method for detecting espionage behavior, characterized in that: Determine whether theft has occurred based on the analysis results of access data, including: Count system access data, including the total access log volume of the system's network, the log volume of system visitors, and the number of visitors from different sources within a preset period; According to the total access log volume of the network, determine whether the system access volume has a sudden change or a periodic abnormality; according to the system visitor log volume, determine whether there are new visitor IPs or potential visitor IPs; according to the number of visitors from different sources, determine whether there is an abnormality in the number of different visitors; According to the above-mentioned judgment results, it is confirmed whether the theft of secrets occurs.

2. The method for detecting theft of secrets according to claim 1, characterized in that: Before analyzing the access data, the traffic characteristics are first detected: If the request meets at least one of the following conditions, it is considered as a theft behavior: Send non-HTTP traffic to the web server default port; The request packet sending time is periodic; The HTTP header in the data packet contains non-standard fields, and the non-standard fields do not belong to the preset non-HTTP message header fields to be counted; The size of request packets sent multiple times in succession in the same session is larger than the response packet, and the ratio of request traffic to response traffic is greater than the first threshold. At the same time, the number of packets in a single session is greater than the second threshold, or the total traffic output within a preset interval is several times the amount of response data.

3. The method for detecting theft of secrets according to claim 2, characterized in that: Before the traffic feature detection, a blacklist match is performed first: if at least one of the IP, domain name or URL of the access request matches the blacklist library, it is determined to be a theft behavior.

4. The method for detecting theft of secrets according to any one of claims 1 to 3, characterized in that: If it has been determined to be a theft behavior, the result will be output and no further detection will be performed.

5. The method for detecting theft of secrets according to claim 2, characterized in that: The first threshold includes 10-25; the second threshold includes 1000; the preset interval includes 24 hours; and the multiple includes 5 times.

6. The method for detecting theft of secrets according to claim 1, characterized in that: The determining whether the theft of secrets occurs according to the judgment results specifically includes: Set the total network access log volume as the first feature, the system visitor log volume as the second feature, and the number of visitors from different sources as the third feature; According to the first feature, the sudden abnormality of the system access volume is detected as the first detection model, according to the first feature, the periodic abnormality of the system access volume is detected as the second detection model, according to the second feature, the newly appeared visitor IP is detected as the third detection model, according to the second feature, the potential visitor IP is detected as the fourth detection model, and according to the third feature, the abnormality of different visitor numbers is detected as the fifth detection model; The outputs of the detection models are intersected, and if at least two models detect anomalies, it is confirmed that theft has occurred.

7. A device for detecting espionage behavior, characterized in that: The device comprises: The data statistics module is used to count the system access data, including the total access log volume of the network where the system is located within a preset period, the log volume of system visitors, and the number of visitors from different sources to the system; The data analysis module determines, based on the statistical results of the data statistics module, whether the system visit volume has a sudden change or a periodic abnormality, whether there are new visitor IPs or potential visitor IPs, and whether there is an abnormality in the number of different visitors; The confirmation module performs a traceability and correlation analysis based on the judgment result of the analysis module to confirm whether the theft of secrets occurs and outputs the detection result.

8. The behavior detection device according to claim 7, characterized in that: The device also includes a flow detection module, If the request meets at least one of the following conditions, it is considered as a theft behavior: Send non-HTTP traffic to the web server default port; The request packet sending time is periodic; The HTTP header in the data packet contains non-standard fields, and the non-standard fields do not belong to the preset non-HTTP message header fields to be counted; The size of request packets sent multiple times in succession in the same session is larger than the response packet, and the ratio of request traffic to response traffic is greater than the first threshold. At the same time, the number of packets in a single session is greater than the second threshold, or the total traffic output within a preset interval is several times the amount of response data.

9. The behavior detection device according to claim 7 or 8, characterized in that: The device also includes a blacklist matching module. Before the traffic feature detection, a blacklist matching is performed first: if at least one of the IP, domain name or URL of the access request matches the blacklist library, it is determined to be an act of stealing secrets.