APT (Advanced Persistent Threat) organization homology identification method and device based on encryption elements

Abstract

The invention provides an APT organization homology identification method and device based on encryption elements, and the method comprises the steps: obtaining N encryption elements of to-be-attributed data, inputting each encryption element into a pre-constructed APT encryption element feature library, based on each encryption element, matching with a sample encryption element stored in the APT encryption element feature library to obtain a feature weight value; according to the feature weight value, calculating a score of each encryption element in each APT organization; and obtaining the maximum value in the scores of the encryption elements, determining that the to-be-attributed data is an APT attack under the condition that the maximum value is greater than or equal to a preset threshold value, and outputting the organization name of the APT attack. According to the APT organization homology recognition method and device based on the encryption elements, through homology recognition, the encryption elements of existing clues are extracted, matching is conducted according to a feature library, score adding is conducted according to weights, and finally an attribution result is obtained, so that rapid source tracing of APT attackers is achieved, and the source tracing difficulty is reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and device for identifying APT organization homology based on encryption elements. Background Art

[0002] In recent years, the number of advanced persistent threat (APT) incidents has continued to grow, and APT attacks are becoming a major threat to cyberspace that cannot be ignored. Compared with traditional network intrusion attacks, APT attacks are more concealed, with a long duration and latency, and various APT organizations often update or develop and use new tools to circumvent existing tracing methods, making it more difficult to trace the attackers.

[0003] In view of this, providing a method and device for identifying APT organization homology based on encryption elements to achieve rapid tracing of APT attackers and reduce the difficulty of tracing has become an urgent problem to be solved by those skilled in the art. Summary of the invention

[0004] The present invention provides an APT organization homology identification method and device based on encryption elements. Through homology identification, encryption elements of existing clues are extracted and matched according to a feature library, and points are added according to weights, and finally attribution results are obtained to achieve rapid tracing of APT attackers and reduce the difficulty of tracing.

[0005] The present invention provides an APT organization homology identification method based on encryption elements, the method comprising:

[0006] Obtain N encrypted elements of the data to be attributed, where N is a positive integer;

[0007] Input each of the encryption elements into a pre-built APT encryption element feature library, match each of the encryption elements with sample encryption elements stored in the APT encryption element feature library to obtain a feature weight value, and consider the match successful when each of the encryption elements is consistent with the encryption elements in the APT encryption element feature library;

[0008] According to the feature weight value, the score of each encryption element in each APT organization is calculated, the encryption element of each organization is a pre-built APT feature, and the element to be attributed is an unknown encryption element. By calculating the encryption element score, it is determined which APT organization it belongs to;

[0009] A maximum value among the scores of the encryption elements is obtained. When the maximum value is greater than or equal to a preset threshold, the data to be attributed is determined to be an APT attack, and the name of the organization of the APT attack is output.

[0010] In some embodiments, the APT encryption element feature library is pre-built, specifically including:

[0011] Get sample encrypted elements from historical records;

[0012] Calculating the weight value of each of the sample encryption elements;

[0013] The APT encryption element feature library is constructed based on the sample encryption elements and corresponding weight values.

[0014] In some embodiments, a preset expression is used to calculate the weight value of each sample encryption element, and the preset expression is:

[0015]

[0016] Among them, α is a positive constant that controls the speed at which the weight changes with the number of APT organizations n that hit the feature, that is, the magnitude of the impact of n on the final weight value; n is the number of APT organizations that contain encryption element features, and n is not 0; N is the total number of APT organizations in the APT encryption element feature library.

[0017] In some embodiments, obtaining N encrypted elements of the data to be attributed specifically includes:

[0018] When there is an unknown malicious executable program, it directly runs to obtain communication traffic and extracts encryption elements;

[0019] When there are IOCs such as IP or domain names, obtain server-side encryption elements through mapping technology;

[0020] When there is existing network traffic, the encryption elements in the existing network traffic are extracted.

[0021] In some embodiments, calculating the score of each encryption element in each organization specifically includes:

[0022] Target organization A[1]+target organization A[2]+…+target organization A[N]=target organization A score;

[0023] Target organization B[1]+target organization B[2]+…+target organization B[N]=target organization B score;

[0024] …

[0025] Target organization M[1]+target organization M[2]+…+target organization M[N]=target organization M score;

[0026] Among them, 1, 2, ..., N refers to the serial number of the feature, and A, B, ..., M refers to the serial number of the target organization.

[0027] In some embodiments, the encryption elements include TLS features and certificate features.

[0028] The present invention also provides an APT organization homology identification device based on encryption elements, the device comprising:

[0029] A data acquisition unit, used to acquire N encrypted elements of the data to be attributed, where N is a positive integer;

[0030] A weight calculation unit, used for inputting each of the encryption elements into a pre-built APT encryption element feature library, matching each of the encryption elements with sample encryption elements stored in the APT encryption element feature library to obtain a feature weight value, and considering that the matching is successful when each of the encryption elements is consistent with the encryption elements in the APT encryption element feature library;

[0031] A score calculation unit, used to calculate the score of each encryption element in each APT organization according to the feature weight value, the encryption element of each organization is a pre-built APT feature, and the element to be attributed is an unknown encryption element, and the APT organization to which the encryption element belongs is determined by calculating the encryption element score;

[0032] The result generating unit is used to obtain the maximum value among the scores of each encryption element, and when the maximum value is greater than or equal to a preset threshold, determine that the data to be attributed is an APT attack, and output the name of the organization of the APT attack.

[0033] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described above when executing the program.

[0034] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the method described above when executed by a processor.

[0035] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method described above is implemented.

[0036] The APT organization homology identification method based on encryption elements provided by the present invention obtains N encryption elements of the data to be attributed, inputs each of the encryption elements into a pre-constructed APT encryption element feature library, matches each of the encryption elements with the sample encryption elements stored in the APT encryption element feature library to obtain a feature weight value; calculates the score of each of the encryption elements in each APT organization according to the feature weight value; obtains the maximum value of the scores of each of the encryption elements, and determines that the data to be attributed is an APT attack when the maximum value is greater than or equal to a preset threshold, and outputs the organization name of the APT attack. In this way, the APT organization homology identification method and device based on encryption elements, through homology identification, extracts encryption elements of existing clues for matching according to the feature library, and adds points according to the weight, and finally obtains the attribution result, so as to realize the rapid tracing of APT attackers and reduce the difficulty of tracing. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 It is a flow chart of the APT organization homology identification method based on encryption elements provided by the present invention;

[0039] Figure 2 It is a structural block diagram of the APT organization homology identification device based on encryption elements provided by the present invention;

[0040] Figure 3 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0042] The present invention proposes an APT organization homology identification method based on encryption elements. According to the attack traffic captured by each organization in the existing network, the traffic obtained by the attack weapon execution, and the encryption element information obtained by mapping the existing IOC, the encryption elements belonging to each organization are extracted to build a feature library, which includes TLS features and certificate features; the weights are calculated according to the repeatability of the features and directly assigned according to expert experience; homology analysis is performed in actual applications, the encryption elements of the existing clues are extracted and matched according to the feature library, and points are added according to the weights, and finally the attribution results are obtained.

[0043] In a specific embodiment, the APT organization homology identification method based on encryption elements provided by the present invention comprises the following steps:

[0044] S110: Obtain N encryption elements of the data to be attributed, where N is a positive integer; specifically, when there is an unknown malicious executable program, directly run to obtain the communication traffic and extract the encryption elements; when there are IOCs such as IP or domain names, obtain the server-side encryption elements through surveying and mapping technology; when there is existing network traffic, extract the encryption elements in the existing network traffic.

[0045] S120: Input each of the encryption elements into a pre-built APT encryption element feature library, match each of the encryption elements with sample encryption elements stored in the APT encryption element feature library to obtain a feature weight value, and when each of the encryption elements is consistent with the encryption elements in the APT encryption element feature library, the match is deemed to be successful;

[0046] S130: Calculate the score of each encryption element in each APT organization according to the feature weight value. The encryption element of each organization is a pre-built APT feature, and the element to be attributed is an unknown encryption element. The APT organization to which the encryption element belongs is determined by calculating the encryption element score. The specific calculation method is:

[0047] Target organization A[1]+target organization A[2]+…+target organization A[N]=target organization A score;

[0048] Target organization B[1]+target organization B[2]+…+target organization B[N]=target organization B score;

[0049] …

[0050] Target organization M[1]+target organization M[2]+…+target organization M[N]=target organization M score;

[0051] Among them, 1, 2, ..., N refers to the sequence number of the feature, A, B, ..., M refers to the sequence number of the target organization; the target organization A[1] represents the weight value of feature 1 in organization A.

[0052] S140: Get the maximum value among the scores of each of the encryption elements. When the maximum value is greater than or equal to a preset threshold, determine that the data to be attributed is an APT attack, and output the name of the organization of the APT attack. According to the score of each of the encryption elements, output and judge whether max[organization A score, organization B score, ... organization M score] reaches the preset threshold. If the maximum score does not reach the preset threshold, output a non-APT attack; if it exceeds the preset threshold, output the name of the organization with the highest score. The preset threshold can be, for example, inputting 1,000 malicious Trojan test traffic, including 100 APT attack traffic, counting the lowest score of the APT attack traffic and the highest score of other malicious Trojan traffic, and taking the larger of the two scores as the APT alarm expected threshold.

[0053] In some embodiments, the APT encryption element feature library is pre-built, specifically including:

[0054] Obtain sample encryption elements from historical records, the encryption elements comprising TLS features and certificate features;

[0055] Calculating the weight value of each of the sample encryption elements;

[0056] The APT encryption element feature library is constructed based on the sample encryption elements and corresponding weight values.

[0057] Specifically, when constructing the encryption element feature library, the encryption elements can be extracted from three channels: historically accumulated attack traffic captured from the existing network, traffic acquired through attack weapon execution, and spatial mapping. The encryption elements to be extracted are shown in Table 1 below:

[0058] Table 1 Encryption element value description table

[0059]

[0060]

[0061] After constructing the encryption element feature library based on the extracted encryption elements, the weight of each encryption element accumulated by each APT organization is calculated according to the following formula. α is a positive constant that controls the speed at which the weight changes with the number of APT organizations n that hit the feature, that is, the magnitude of the impact of n on the final weight value; n is the number of APT organizations that contain encryption element features, and n is not 0; N is the total number of APT organizations in the library, and the weight value is calculated as follows:

[0062]

[0063] Among them, the value of α is 100 average values ​​between 0 and 1 (0.01, 0.02, ... 0.99), N is 20, n is an integer between 1 and 10, the impact of each α value on the final weight value is calculated, a curve graph is drawn, and the value of α corresponding to the case where the curve is in the middle is taken.

[0064] In the above specific implementation, the APT organization homology identification method based on encryption elements provided by the present invention obtains N encryption elements of the data to be attributed, inputs each of the encryption elements into a pre-constructed APT encryption element feature library, matches each of the encryption elements with the sample encryption elements stored in the APT encryption element feature library to obtain a feature weight value; according to the feature weight value, calculates the score of each of the encryption elements in each APT organization; obtains the maximum value of the scores of each of the encryption elements, and when the maximum value is greater than or equal to a preset threshold, determines that the data to be attributed is an APT attack, and outputs the organization name of the APT attack. In this way, the APT organization homology identification method and device based on encryption elements, through homology identification, extracts the encryption elements of the existing clues for matching according to the feature library, and adds points according to the weight, and finally obtains the attribution result, so as to realize the rapid tracing of APT attackers and reduce the difficulty of tracing.

[0065] In addition to the above method, the present invention also provides an APT organization homology identification device based on encryption elements, such as Figure 2 As shown, the device comprises:

[0066] The data acquisition unit 210 is used to acquire N encrypted elements of the data to be attributed, where N is a positive integer;

[0067] The weight calculation unit 220 is used to input each of the encryption elements into a pre-built APT encryption element feature library, and match each of the encryption elements with sample encryption elements stored in the APT encryption element feature library to obtain a feature weight value, and the matching is deemed to be successful when each of the encryption elements is consistent with the encryption elements in the APT encryption element feature library;

[0068] The score calculation unit 230 is used to calculate the score of each encryption element in each organization according to the feature weight value, the encryption element of each organization is a pre-built APT feature, and the element to be attributed is an unknown encryption element. By calculating the encryption element score, it is determined to which APT organization it belongs;

[0069] The result generating unit 240 is used to obtain the maximum value among the scores of each of the encryption elements, and when the maximum value is greater than or equal to a preset threshold, determine that the data to be attributed is an APT attack, and output the name of the organization of the APT attack.

[0070] In some embodiments, the APT encryption element feature library is pre-built, specifically including:

[0071] Get sample encrypted elements from historical records;

[0072] Calculating the weight value of each of the sample encryption elements;

[0073] The APT encryption element feature library is constructed based on the sample encryption elements and corresponding weight values.

[0074] In some embodiments, a preset expression is used to calculate the weight value of each sample encryption element, and the preset expression is:

[0075]

[0076] Among them, α is a positive constant that controls the speed at which the weight changes with the number of APT organizations n that hit the feature, that is, the magnitude of the impact of n on the final weight value; n is the number of APT organizations that contain encryption element features, and n is not 0; N is the total number of APT organizations in the APT encryption element feature library.

[0077] In some embodiments, obtaining N encrypted elements of the data to be attributed specifically includes:

[0078] When there is an unknown malicious executable program, it directly runs to obtain communication traffic and extracts encryption elements;

[0079] When there are IOCs such as IP or domain names, obtain server-side encryption elements through mapping technology;

[0080] When there is existing network traffic, the encryption elements in the existing network traffic are extracted.

[0081] In some embodiments, calculating the score of each encryption element in each organization specifically includes:

[0082] Target organization A[1]+target organization A[2]+…+target organization A[N]=target organization A score;

[0083] Target organization B[1]+target organization B[2]+…+target organization B[N]=target organization B score;

[0084] …

[0085] Target organization M[1]+target organization M[2]+…+target organization M[N]=target organization M score;

[0086] Among them, 1, 2, ..., N refers to the serial number of the feature, and A, B, ..., M refers to the serial number of the target organization.

[0087] In some embodiments, the encryption elements include TLS features and certificate features.

[0088] In the above specific implementation, the APT organization homology identification device based on encryption elements provided by the present invention obtains N encryption elements of the data to be attributed, inputs each of the encryption elements into a pre-constructed APT encryption element feature library, matches each of the encryption elements with the sample encryption elements stored in the APT encryption element feature library to obtain a feature weight value; calculates the score of each of the encryption elements in each APT organization according to the feature weight value; obtains the maximum value of the scores of each of the encryption elements, and determines that the data to be attributed is an APT attack when the maximum value is greater than or equal to a preset threshold, and outputs the organization name of the APT attack. In this way, the APT organization homology identification method and device based on encryption elements, through homology identification, extracts the encryption elements of the existing clues for matching according to the feature library, and adds points according to the weight, and finally obtains the attribution result, so as to realize the rapid tracing of APT attackers and reduce the difficulty of tracing.

[0089] Figure 3 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 3 As shown, the electronic device may include: a processor 310, a communication interface 320, a memory 330 and a communication bus 340, wherein the processor 310, the communication interface 320 and the memory 330 communicate with each other through the communication bus 340. The processor 310 may call the logic instructions in the memory 330 to execute the above method.

[0090] In addition, the logic instructions in the above-mentioned memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0091] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the above method.

[0092] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0093] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0094] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying homology of APT organizations based on encryption elements, characterized in that: The method comprises: Obtain N encrypted elements of the data to be attributed, where N is a positive integer; Input each of the encryption elements into a pre-built APT encryption element feature library, match each of the encryption elements with sample encryption elements stored in the APT encryption element feature library to obtain a feature weight value, and consider the match successful when each of the encryption elements is consistent with the encryption elements in the APT encryption element feature library; According to the feature weight value, the score of each encryption element in each APT organization is calculated, the encryption element of each organization is a pre-built APT feature, and the element to be attributed is an unknown encryption element. By calculating the encryption element score, it is determined which APT organization it belongs to; A maximum value among the scores of the encryption elements is obtained. When the maximum value is greater than or equal to a preset threshold, the data to be attributed is determined to be an APT attack, and the name of the organization of the APT attack is output.

2. The APT organization homology identification method based on encryption elements according to claim 1 is characterized in that: The APT encryption element feature library is pre-built, specifically including: Get sample encrypted elements from historical records; Calculating the weight value of each of the sample encryption elements; The APT encryption element feature library is constructed based on the sample encryption elements and corresponding weight values.

3. The APT organization homology identification method based on encryption elements according to claim 2 is characterized in that: The weight value of each sample encryption element is calculated using a preset expression, and the preset expression is: Among them, α is a positive constant that controls the speed at which the weight changes with the number of APT organizations n that hit the feature, that is, the magnitude of the impact of n on the final weight value; n is the number of APT organizations that contain encryption element features, and n is not 0; N is the total number of APT organizations in the APT encryption element feature library.

4. The APT organization homology identification method based on encryption elements according to claim 1 is characterized in that: Obtain N encrypted elements of the data to be attributed, including: When there is an unknown malicious executable program, it directly runs to obtain communication traffic and extracts encryption elements; When there are IOCs such as IP or domain names, obtain server-side encryption elements through mapping technology; When there is existing network traffic, the encryption elements in the existing network traffic are extracted.

5. The APT organization homology identification method based on encryption elements according to claim 1 is characterized in that: Scores are calculated for each organization for each of the cryptographic elements described, including: Target organization A[1]+target organization A[2]+…+target organization A[N]=target organization A score; Target organization B[1]+target organization B[2]+…+target organization B[N]=target organization B score; …… Target organization M[1]+target organization M[2]+…+target organization M[N]=target organization M score; Among them, 1, 2, ..., N refers to the serial number of the feature, and A, B, ..., M refers to the serial number of the target organization.

6. The APT organization homology identification method based on encryption elements according to claim 1 is characterized in that: The encryption elements include TLS features and certificate features.

7. A device for identifying homology of APT organizations based on encryption elements, characterized in that: The device comprises: A data acquisition unit, used to acquire N encrypted elements of the data to be attributed, where N is a positive integer; A weight calculation unit, used for inputting each of the encryption elements into a pre-built APT encryption element feature library, matching each of the encryption elements with sample encryption elements stored in the APT encryption element feature library to obtain a feature weight value, and considering that the matching is successful when each of the encryption elements is consistent with the encryption elements in the APT encryption element feature library; A score calculation unit, used to calculate the score of each encryption element in each APT organization according to the feature weight value, the encryption element of each organization is a pre-built APT feature, and the element to be attributed is an unknown encryption element, and the APT organization to which the encryption element belongs is determined by calculating the encryption element score; The result generating unit is used to obtain the maximum value among the scores of each encryption element, and when the maximum value is greater than or equal to a preset threshold, determine that the data to be attributed is an APT attack, and output the name of the organization of the APT attack.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the method according to any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images