End-network cooperative measurement method and device for advanced persistent threats

Abstract

The invention discloses an advanced persistent threat-oriented end-network collaborative measurement method and device. The method comprises the following steps: creating a virtual network and a plurality of virtual machines through a virtual machine manager; the actual environment of the external internet is simulated through the network simulation virtual machine; running the target advanced persistent threat virus sample through the virus execution virtual machine; collecting end-side system calling behavior data through the virus execution virtual machine, and collecting network-side communication behavior data through the network simulation virtual machine; and transmitting the end-side system calling behavior data and the network-side communication behavior data to a physical machine through the controller. According to the method, a controlled virtual environment can be provided to analyze virus behaviors, so that the virus samples are only executed in the virus execution virtual machine, the risks of virus spreading and infection of other systems are reduced, the collected data on the two sides of the end network provides comprehensive information for analyzing behavior characteristics of the viruses, the efficiency and accuracy of virus sample analysis can be improved, and the method is suitable for popularization and application. The method can be widely applied to the information security technology field.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an end-to-network collaborative measurement method and device for advanced persistent threats. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly prominent, and various network attack methods have emerged one after another. Among them, advanced persistent threat attacks are a very harmful network attack method. However, related defense technologies cannot effectively and quickly detect advanced persistent threat attacks. Therefore, it is necessary to measure and analyze the behavioral data of advanced persistent threat attacks to help detect advanced persistent threat attacks. However, the virus behavior measurement method in the related technology is only for individual specific virus samples, and its application in actual scenarios is relatively limited. In addition, the data collected by the virus behavior measurement method in the related technology is single, and it is impossible to comprehensively analyze the virus behavior characteristics.

[0003] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the invention

[0004] The embodiments of the present application aim to solve at least one of the technical problems in the related art to a certain extent. To this end, the main purpose of the embodiments of the present application is to propose an end-to-end collaborative measurement method and device for advanced persistent threats, which can provide a controlled virtual environment to analyze virus behavior, so that virus samples are only executed in the virus execution virtual machine, reducing the risk of virus transmission and infection of other systems. The data collected on both sides of the end-to-end network provide comprehensive information for analyzing the behavioral characteristics of the virus, which can improve the efficiency and accuracy of virus sample analysis.

[0005] To achieve the above purpose, an embodiment of the present application provides a method for end-to-end collaborative measurement of advanced persistent threats, the method comprising the following steps:

[0006] Sending the virtual machine configuration data to the virtual machine manager on the physical machine through a controller on the physical machine;

[0007] Creating a virtual network and several virtual machines according to the virtual machine configuration data through the virtual machine manager; wherein the virtual machines include a file transfer virtual machine, a virus execution virtual machine and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data;

[0008] The actual environment of the external Internet is simulated in the virtual network by the network simulation virtual machine to construct an external Internet simulation environment;

[0009] In the external Internet simulation environment, the virus execution virtual machine is controlled by the controller to run the target advanced persistent threat virus sample;

[0010] When the virus execution virtual machine is running the target advanced persistent threat virus sample, the terminal-side system call behavior data is collected through the virus execution virtual machine, and the network-side communication behavior data is collected through the network simulation virtual machine;

[0011] The terminal-side system call behavior data and the network-side communication behavior data are transmitted to the physical machine through the controller.

[0012] In some embodiments, before simulating the external Internet actual environment in the virtual network through the network simulation virtual machine to construct the external Internet simulation environment, the method further includes:

[0013] Uploading the network simulation configuration data to the file transfer virtual machine through the controller;

[0014] The controller controls the network simulation virtual machine to download the network simulation configuration data from the file transfer virtual machine.

[0015] In some embodiments, the simulating an actual external Internet environment in the virtual network through the network simulation virtual machine to construct an external Internet simulation environment includes:

[0016] In the virtual network, the actual external Internet environment is simulated according to the network simulation configuration data through the network simulation virtual machine to construct the external Internet simulation environment; wherein, the external Internet simulation environment includes a virtual external server, and the virtual external server is used to communicate data with the target advanced persistent threat virus sample running on the virus execution virtual machine.

[0017] In some embodiments, before controlling the virus execution virtual machine to run the target advanced persistent threat virus sample through the controller, the method further includes:

[0018] Uploading the initial advanced persistent threat virus sample to the file transfer virtual machine through the controller; wherein the initial advanced persistent threat virus sample is an encrypted and compressed virus sample;

[0019] Controlling the virus execution virtual machine to download the initial advanced persistent threat virus sample from the file transfer virtual machine through the controller;

[0020] The controller controls the virus execution virtual machine to perform decryption and decompression processing on the initial advanced persistent threat virus sample to obtain the target advanced persistent threat virus sample.

[0021] In some embodiments, when the virus execution virtual machine is running the target advanced persistent threat virus sample, collecting the terminal-side system call behavior data through the virus execution virtual machine, and collecting the network-side communication behavior data through the network simulation virtual machine, includes:

[0022] When the virus execution virtual machine is running the target advanced persistent threat virus sample, the terminal-side system call behavior data is collected through a system call log monitoring tool configured in the virus execution virtual machine;

[0023] The network-side communication behavior data is collected through a network traffic monitoring tool configured in the network simulation virtual machine.

[0024] In some embodiments, when the virus execution virtual machine is running the target advanced persistent threat virus sample, after collecting the terminal-side system call behavior data through the virus execution virtual machine and collecting the network-side communication behavior data through the network simulation virtual machine, the method further includes:

[0025] Sending the terminal-side system call behavior data to the network simulation virtual machine through the virus execution virtual machine;

[0026] The terminal-side system call behavior data and the network-side communication behavior data are uploaded to the file transfer virtual machine through the network simulation virtual machine.

[0027] In some embodiments, transmitting the terminal-side system call behavior data and the network-side communication behavior data to the physical machine through the controller includes:

[0028] The controller downloads the terminal-side system call behavior data and the network-side communication behavior data from the file transfer virtual machine to the physical machine.

[0029] To achieve the above purpose, another aspect of the embodiment of the present application provides a device for end-to-end collaborative measurement of advanced persistent threats, the device comprising the following modules:

[0030] A virtual machine configuration data sending module, used to send the virtual machine configuration data to the virtual machine manager on the physical machine through a controller on the physical machine;

[0031] A virtualized operating environment creation module, used to create a virtual network and several virtual machines according to the virtual machine configuration data through the virtual machine manager; wherein the virtual machines include a file transfer virtual machine, a virus execution virtual machine and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data;

[0032] An external Internet environment simulation module, used to simulate the actual external Internet environment in the virtual network through the network simulation virtual machine to construct an external Internet simulation environment;

[0033] A virus sample running module, used to control the virus execution virtual machine to run a target advanced persistent threat virus sample through the controller in the external Internet simulation environment;

[0034] A behavior data collection module, configured to collect terminal-side system call behavior data through the virus execution virtual machine when the virus execution virtual machine is running the target advanced persistent threat virus sample, and collect network-side communication behavior data through the network simulation virtual machine;

[0035] A behavior data transmission module is used to transmit the terminal-side system call behavior data and the network-side communication behavior data to the physical machine through the controller.

[0036] To achieve the above-mentioned purpose, another aspect of an embodiment of the present application provides an electronic device, the electronic device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the above-mentioned method when executing the computer program.

[0037] To achieve the above objective, another aspect of an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described above is implemented.

[0038] The embodiments of the present application include at least the following beneficial effects: The present application provides an end-network collaborative measurement method and device for advanced persistent threats, which sends virtual machine configuration data to a virtual machine manager on a physical machine through a controller on the physical machine; creates a virtual network and several virtual machines according to the virtual machine configuration data through the virtual machine manager; wherein the virtual machine includes a file transit virtual machine, a virus execution virtual machine and a network simulation virtual machine, and the file transit virtual machine is used to manage log file data; the actual environment of the external Internet is simulated in the virtual network through the network simulation virtual machine to build an external Internet simulation environment; in the external Internet simulation environment, the virus execution virtual machine is controlled by the controller to run the target advanced persistent threat virus sample; when the virus execution virtual machine is running the target advanced persistent threat virus sample, the end-side system call behavior data is collected through the virus execution virtual machine, and the network-side communication behavior data is collected through the network simulation virtual machine; the end-side system call behavior data and the network-side communication behavior data are transmitted to the physical machine through the controller. The embodiment of the present application creates a virtual network corresponding to a physical machine for simulating and testing advanced persistent threat virus samples, and simulates the actual external Internet environment to build an external Internet simulation environment, which can prevent virus samples from causing harm to the physical network, provide a controlled environment to observe and analyze virus behavior, reduce the impact of the experiment on the actual network environment, enhance the security of the system, and provide a general or customizable isolation environment for different advanced persistent threat virus behavior samples; the virus execution virtual machine is controlled by a controller to run the virus sample, so that the virus sample is only executed in the virus execution virtual machine, reducing the risk of virus transmission and infection of other systems, and ensuring the safety of the physical machine; by automatically collecting terminal-side system call behavior data and network-side communication behavior data, detailed and comprehensive information is provided for analyzing the behavioral characteristics of advanced persistent threat viruses, improving the efficiency and accuracy of virus sample analysis, providing a scientific basis for the formulation and implementation of defense strategies, and providing a theoretical basis for the subsequent rapid identification and response to advanced persistent threats, thereby further protecting network and information security. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 It is a flowchart of the steps of the end-network collaborative measurement method for advanced persistent threats provided by an embodiment of the present application;

[0040] Figure 2 It is a schematic diagram of the process of controlling the end-network collaborative measurement system provided in an embodiment of the present application;

[0041] Figure 3 It is a schematic diagram of the connection structure between a physical machine and a virtual network provided in an embodiment of the present application;

[0042] Figure 4 is a schematic diagram of a network module provided in an embodiment of the present application;

[0043] Figure 5 It is a schematic diagram of the process of executing a virus sample provided in an embodiment of the present application;

[0044] Figure 6 It is a flowchart of the end-network collaborative measurement method for advanced persistent threats;

[0045] Figure 7 It is a structural diagram of a terminal-network collaborative measurement device for advanced persistent threats provided by an embodiment of the present application;

[0046] Figure 8 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are only examples of devices and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

[0048] It is understood that the terms "first", "second", etc. used in this application can be used to describe various concepts in this article, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiment of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0049] The terms "at least one", "multiple", "each", "any", etc. used in this application, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0051] With the rapid development of the Internet, network security issues have become increasingly prominent, and various network attack methods have emerged one after another. Among them, advanced persistent threat attacks are a very harmful network attack method. Advanced means that the execution of advanced persistent threat attacks requires a higher degree of customization and complexity than traditional attacks, and it takes a lot of time and resources to study and determine the vulnerabilities within the system; the long-term purpose is to achieve a specific purpose, continuously monitor the target, and maintain long-term access to the target; the threat emphasizes attacks planned by human participation, and the target of the attack is a high-value organization. Once the attack is successful, it often causes huge losses to the target. Advanced persistent threat attacks are long-term and continuous network attacks against certain specific attack targets using advanced attack methods. They are usually a combination of various attack methods. Therefore, multi-level and multi-faceted detection and defense are also required in defense. However, the characteristics of advanced persistent threat attacks are that the attackers' behavior patterns are complex and changeable, and the means of attack are highly concealed. Traditional security defense methods are difficult to detect. Security systems with manual participation often generate thousands of alarms every day, and the attacks of advanced persistent threat attacks are usually hidden in them and are not easy to detect. New machine learning-based security defense technologies lack large-scale, high-quality data sets on the behavior of advanced persistent threat viruses and cannot effectively detect advanced persistent threat attacks. Therefore, it is necessary to measure and analyze the behavioral data of advanced persistent threat attacks to help detect advanced persistent threat attacks. However, in the virus behavior feature measurement scheme in the related technology, although automated monitoring and analysis are achieved, there are two main limitations: first, the behavioral data measurement during the operation of the advanced persistent threat attack virus is single; second, it is only for individual specific virus samples, which has great limitations in practical applications.

[0052] In view of this, an embodiment of the present application provides an end-network collaborative measurement method and device for advanced persistent threats. The solution sends virtual machine configuration data to a virtual machine manager on the physical machine through a controller on the physical machine; a virtual network and several virtual machines are created according to the virtual machine configuration data through the virtual machine manager; wherein the virtual machines include a file transfer virtual machine, a virus execution virtual machine and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data; the actual environment of the external Internet is simulated in the virtual network through the network simulation virtual machine to build an external Internet simulation environment; in the external Internet simulation environment, the virus execution virtual machine is controlled by the controller to run the target advanced persistent threat virus sample; when the virus execution virtual machine is running the target advanced persistent threat virus sample, the end-side system call behavior data is collected through the virus execution virtual machine, and the network-side communication behavior data is collected through the network simulation virtual machine; the end-side system call behavior data and the network-side communication behavior data are transmitted to the physical machine through the controller. The embodiment of the present application creates a virtual network corresponding to a physical machine for simulating and testing advanced persistent threat virus samples, and simulates the actual external Internet environment to build an external Internet simulation environment, which can prevent virus samples from causing harm to the physical network, provide a controlled environment to observe and analyze virus behavior, reduce the impact of the experiment on the actual network environment, enhance the security of the system, and provide a general or customizable isolation environment for different advanced persistent threat virus behavior samples; the virus execution virtual machine is controlled by a controller to run the virus sample, so that the virus sample is only executed in the virus execution virtual machine, reducing the risk of virus transmission and infection of other systems, and ensuring the safety of the physical machine; by automatically collecting terminal-side system call behavior data and network-side communication behavior data, detailed and comprehensive information is provided for analyzing the behavioral characteristics of advanced persistent threat viruses, improving the efficiency and accuracy of virus sample analysis, providing a scientific basis for the formulation and implementation of defense strategies, and providing a theoretical basis for the subsequent rapid identification and response to advanced persistent threats, thereby further protecting network and information security.

[0053] The end-to-end collaborative measurement method for advanced persistent threats provided in the embodiment of the present application relates to the field of information security technology. The end-to-end collaborative measurement method for advanced persistent threats provided in the embodiment of the present application can be applied to a terminal, can be applied to a server, or can be software running in a terminal or a server. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, and a car terminal, etc., but is not limited to this; the server side can be configured as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, and can also be configured as a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network, content distribution network) and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network; the software can be an application that implements the end-to-end collaborative measurement method for advanced persistent threats, etc., but is not limited to the above forms.

[0054] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronic devices, network PCs (Personal Computers, personal computers), minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0055] See also Figure 1 , Figure 1 is an optional step flow chart of the end-network collaborative measurement method for advanced persistent threats provided by an embodiment of the present application. Figure 1 The method may include but is not limited to steps S101 to S106.

[0056] Step S101, sending virtual machine configuration data to a virtual machine manager on the physical machine through a controller on the physical machine;

[0057] Among them, the physical machine refers to the computer hardware system in the actual environment. The physical machine serves as the underlying hardware support for virtualization technology. The physical machine can run virtualization software and create and manage virtual machines based on the virtualization software.

[0058] As for the controller, it works on the physical machine and is the core module for controlling the operation of the entire system. The functions of the controller include: transmission of advanced persistent threat virus samples from the physical machine to the virtual machine, transmission of specific execution configuration data and script data from the physical machine to the virtual machine, transmission of traffic log data from the virtual machine to the physical machine, etc. As advanced persistent threat viruses are dangerous to a certain extent, in order to ensure the safety of the measurement process, the encrypted compressed package with the advanced persistent threat virus sample will be decrypted and decompressed only during the execution of the virtual machine executing the virus sample under the control of the controller; in the process of transmitting the encrypted compressed package of the advanced persistent threat virus sample from the physical machine to the virtual machine, the virtual network card will be enabled to establish a network connection between the physical machine and the virtual machine. After the transmission is completed, the virtual network card will be disabled and the network connection between the physical machine and the virtual machine will be cut off to prevent the leakage of the virus sample. In order to realize the automatic measurement of the behavior of the advanced persistent threat virus, the controller will read the configuration file to select the virus sample to be measured, and then transmit the virus sample to be measured to the virtual machine executing the virus sample, and then control the virtual machine executing the virus sample to run the virus sample, and finally transmit the log file back to the physical machine, restore the environment and select the next virus sample to be measured.

[0059] The virtual machine configuration data refers to the parameters and settings that define the characteristics and behaviors of the virtual machine. The virtual machine configuration data may include, but is not limited to, the number of virtual machines, the type of operating system, the IP (Internet Protocol) address of each virtual machine, and other information.

[0060] Among them, the virtual machine manager is a module used to simulate the environment of the user end in the real scene, and it works on the physical machine. The attack target of advanced persistent threats is usually the user terminal, and it has a certain degree of danger. Therefore, the embodiment of the present application uses a virtual machine to simulate the environment of the user end. When measuring the behavior of advanced persistent threat viruses, the virtual machine manager will create multiple virtual machines, among which some virtual machines are used to run programs with viruses, some virtual machines are used as network simulation environments to provide virus execution virtual machines for communication, and some virtual machines are used to collect system logs and network traffic, and jointly complete the measurement of advanced persistent threat virus behaviors. It should be noted that in actual applications, multiple virtual machines can be run on the same physical host according to the scale of specific tasks, and it can also be considered to use multiple physical host clusters for construction, and the embodiment of the present application does not limit this.

[0061] Step S102, creating a virtual network and several virtual machines according to the virtual machine configuration data through the virtual machine manager; wherein the virtual machines include a file transfer virtual machine, a virus execution virtual machine and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data;

[0062] The virtual network refers to the virtual environment of the user end in the real scene simulated by the virtual machine manager. The virtual network includes file transfer virtual machines, virus execution virtual machines and network simulation virtual machines.

[0063] Among them, the file transfer virtual machine is an FTP (File Transfer Protocol) server running on the virtual machine, which is used to store and isolate files and log data. File transfers between physical machines and virtual machines are obtained through uploading and downloading processing on the FTP server. In the specific implementation, when the controller sends the virtual machine configuration data to the virtual machine manager, it also carries the FTP server configuration file to send it to the virtual machine manager. The FTP server configuration file contains the address, user name, password, etc. of the FTP server.

[0064] Among them, the virus execution virtual machine is used to receive and execute advanced persistent threat virus samples. In addition, the virus execution virtual machine is also used to automatically collect end-side system call behavior data, where the end-side system call behavior data may include but is not limited to: file reading and writing, registry reading and modification, process creation and exit, process injection and other system call behaviors. In order to ensure the security of the physical machine, during the research process, the advanced persistent threat virus samples are transmitted by encryption and compression, and are only decrypted and decompressed during the operation of the virus samples. To achieve this purpose, the decryption and decompression functions are set in the virus execution virtual machine. In the specific implementation, the virus execution virtual machine receives and runs the advanced persistent threat virus samples, and notifies the network simulation virtual machine to collect network traffic before the virus samples are run.

[0065] For the network simulation virtual machine, its role is to simulate the actual environment of the external Internet in the virtual machine to build an external Internet simulation environment, and is responsible for collecting logs of the operation behavior of the advanced persistent threat virus, including system call logs and network traffic logs. However, it should be noted that the system call log is automatically collected by the virus execution virtual machine and then uploaded to the network simulation virtual machine, and then the network simulation virtual machine packages the system call log and the network traffic log and uploads them to the file transfer virtual machine; in addition, in the embodiment of the present application, the system call log obtained by the virus execution virtual machine for automatic collection can also be directly uploaded to the file transfer virtual machine. Most of the advanced persistent threats involve network attacks, virus propagation, control and data leakage, etc., which usually require communication with external servers; at the beginning of the virus operation, some viruses will try to establish a connection with an external server, receive instructions, upload data, etc., and some viruses will try to establish a connection with a non-existent domain name to determine whether they are in a virtual machine environment. Therefore, the embodiment of the present application uses a network simulation tool to simulate an external Internet environment isolated from a physical machine, so that the virus samples running on the virus execution virtual machine can communicate with the simulated external server, while ensuring the security of the physical machine.

[0066] The network traffic logs collected by the network simulation virtual machine may include but are not limited to: DNS (Domain Name System) requests, HTTP (Hypertext Transfer Protocol) requests, HTTPS (Hypertext Transfer Protocol Secure) requests, TCP (Transmission Control Protocol) / UDP (User Datagram Protocol) connections and other network traffic behaviors. The network module will collect network traffic logs when the execution module runs the advanced persistent threat virus sample, and store the network traffic logs in a specified location, or send them to a file transfer virtual machine (such as an FTP server).

[0067] In the embodiment of the present application, the end-network collaborative measurement system for advanced persistent threats mainly includes the above-mentioned controller, virtual machine manager, virus execution virtual machine and network simulation virtual machine. Through the collaborative cooperation between the four modules, the automatic measurement of the end-side system call behavior data and the network-side communication behavior data is realized.

[0068] In a specific implementation, the virtual machine manager creates several virtual machines and virtual networks according to configuration requirements; wherein the virtual machines include a file transfer virtual machine, a virus execution virtual machine and a network simulation virtual machine; specifically, the virtual network is used to realize the interconnection between the above virtual machines and to isolate the connectivity between each virtual machine and the outside world; the file transfer virtual machine is used to store and forward the files and log data involved in the whole process; the virus execution virtual machine is used to run the virus sample and collect the system call behavior data when the virus sample is running; the network simulation virtual machine is used to simulate the actual environment of the external Internet in the virtual network to build an external Internet simulation environment, to create an interactive external network environment for the virus sample during operation, and to collect the network traffic behavior data when the virus sample is running.

[0069] Step S103, simulating the actual external Internet environment in the virtual network through the network simulation virtual machine to construct an external Internet simulation environment;

[0070] In some embodiments, before step S103, the method may further include: uploading the network simulation configuration data to the file transfer virtual machine through the controller; and controlling the network simulation virtual machine to download the network simulation configuration data from the file transfer virtual machine through the controller.

[0071] The network simulation configuration data refers to a set of parameters and instructions for instructing the network simulation virtual machine on how to set up and run a virtual network environment.

[0072] In some embodiments, step S103 may include: in a virtual network, simulating the actual environment of the external Internet according to network simulation configuration data through a network simulation virtual machine to build an external Internet simulation environment; wherein the external Internet simulation environment includes a virtual external server, and the virtual external server is used to communicate data with the target advanced persistent threat virus sample running on the virus execution virtual machine.

[0073] Among them, the external Internet simulation environment includes a virtual external server, which is used to communicate data with the target advanced persistent threat virus sample running on the virus execution virtual machine. In the specific implementation, advanced persistent threats mostly involve network attacks, virus propagation, control, and data leakage, etc., which usually require communication with external servers; at the beginning of the virus operation, some viruses will try to establish a connection with the external server, receive instructions, upload data, etc., and some viruses will try to establish a connection with a non-existent domain name to determine whether they are in a virtual machine environment. Therefore, the embodiment of the present application uses a network simulation tool to simulate an external Internet environment isolated from a physical machine, so that the virus sample running on the virus execution virtual machine can communicate with the simulated external server, while ensuring the security of the physical machine.

[0074] Step S104, in the external Internet simulation environment, controlling the virus execution virtual machine through the controller to run the target advanced persistent threat virus sample;

[0075] In some embodiments, before step S104, the method may further include: uploading an initial advanced persistent threat virus sample to a file transfer virtual machine through a controller; wherein the initial advanced persistent threat virus sample is an encrypted and compressed virus sample; controlling the virus execution virtual machine through the controller to download the initial advanced persistent threat virus sample from the file transfer virtual machine; and controlling the virus execution virtual machine through the controller to perform decryption and decompression processing on the initial advanced persistent threat virus sample to obtain a target advanced persistent threat virus sample.

[0076] In the specific implementation, in order to ensure the security of the physical machine, the advanced persistent threat virus sample is transmitted by means of encryption compression and other methods, and is only decrypted and decompressed during the operation of the virus sample. Specifically, the encrypted and compressed initial advanced persistent threat virus sample is first uploaded to the file transfer virtual machine through the controller, and then the controller controls the virus execution virtual machine to download the initial advanced persistent threat virus sample from the file transfer virtual machine, and then the controller controls the virus execution virtual machine to decrypt and decompress the initial advanced persistent threat virus sample to obtain the target advanced persistent threat virus sample, and finally the controller controls the virus execution virtual machine to run the decrypted and decompressed target advanced persistent threat virus sample.

[0077] It should be noted that after the advanced persistent threat virus sample is decrypted and decompressed, the network simulation virtual machine needs to be notified to enable the network traffic log collection function. At the same time, the virus execution virtual machine also needs to enable the system call log collection function. After the network traffic log collection function and the system call log collection function are enabled, the virus sample can be run in the virus execution virtual machine.

[0078] Step S105, when the virus execution virtual machine is running the target advanced persistent threat virus sample, the terminal-side system call behavior data is collected through the virus execution virtual machine, and the network-side communication behavior data is collected through the network simulation virtual machine;

[0079] In some embodiments, step S105 may include: when the virus execution virtual machine is running the target advanced persistent threat virus sample, collecting terminal-side system call behavior data through a system call log monitoring tool configured in the virus execution virtual machine; and collecting network-side communication behavior data through a network traffic monitoring tool configured in the network simulation virtual machine.

[0080] In some embodiments, after step S105, it may also include: sending the terminal side system call behavior data to the network simulation virtual machine through the virus execution virtual machine; uploading the terminal side system call behavior data and the network side communication behavior data to the file transfer virtual machine through the network simulation virtual machine.

[0081] Among them, the system call log monitoring tool uses the Process Monitor tool that supports command line parameter calls to monitor the system calls of the virus execution virtual machine, including file reading and writing, registry reading and modification, process creation and exit, process injection and other system call behaviors. After the virus sample is completed or reaches the specified running time, the system call log collection is stopped, and the system call log is stored in a specified location (such as a network simulation virtual machine), or uploaded to a file transfer virtual machine (FTP server). Specifically, the command line parameters of Process Monitor can be used to capture the log of system calls within a specific time and export the log to a file.

[0082] Among them, the network traffic monitoring tool uses the Tshark tool that supports command line parameter calls to monitor the network traffic of the virus execution virtual machine, including DNS requests, HTTP requests, HTTPS requests, TCP / UDP connections and other network traffic. After the virus sample is completed or reaches the specified running time, the network traffic log is stored in the specified location, or uploaded to a file and transferred to the virtual machine (FTP server).

[0083] In the specific implementation, the advanced persistent threat virus will perform a series of behaviors during its operation, which are divided into the end side and the network side: the end side refers to the system call behavior of the virus on the terminal it infects, including file reading and writing, registry reading and modification, process creation and exit, process injection, etc.; the network side refers to the network communication behavior of the virus, including communicating with the server of the virus maker, detecting the network environment where the infected terminal is located, and spreading itself through the network, etc. Therefore, the embodiment of the present application can obtain a large number of advanced persistent threat virus sample data of various types by realizing the end-to-network collaborative measurement of advanced persistent threat attack behaviors, so as to more comprehensively understand the working principles and mechanisms of various advanced persistent threat viruses. It is an important means to deeply understand the behavioral characteristics of various advanced persistent threat attack viruses and explore their potential laws and commonalities. It is the basis and basis for implementing various new security defense technologies, and can measure a series of advanced persistent threat attack samples without human intervention, with high efficiency and security.

[0084] Step S106: transmitting the terminal-side system call behavior data and the network-side communication behavior data to the physical machine through the controller.

[0085] In some embodiments, step S106 may include: downloading the terminal-side system call behavior data and the network-side communication behavior data from the file transfer virtual machine to the physical machine through the controller.

[0086] In the specific implementation, the end-side system call behavior data is first sent to the network simulation virtual machine through the virus execution virtual machine, and then the end-side system call behavior data and the network-side communication behavior data are uploaded to the file transfer virtual machine through the network simulation virtual machine. Finally, the end-side system call behavior data and the network-side communication behavior data can be downloaded from the file transfer virtual machine to the physical machine through the controller.

[0087] In another embodiment, the virus execution virtual machine may also upload the terminal-side system call behavior data directly to the file transfer virtual machine.

[0088] In steps S101 to S106 shown in the embodiment of the present application, the controller on the physical machine sends the virtual machine configuration data to the virtual machine manager on the physical machine; the virtual machine manager creates a virtual network and several virtual machines according to the virtual machine configuration data; wherein the virtual machines include a file transit virtual machine, a virus execution virtual machine and a network simulation virtual machine, and the file transit virtual machine is used to manage log file data; the network simulation virtual machine simulates the actual environment of the external Internet in the virtual network to build an external Internet simulation environment; in the external Internet simulation environment, the controller controls the virus execution virtual machine to run the target advanced persistent threat virus sample; when the virus execution virtual machine is running the target advanced persistent threat virus sample, the virus execution virtual machine collects the terminal side system call behavior data, and the network simulation virtual machine collects the network side communication behavior data; the controller transmits the terminal side system call behavior data and the network side communication behavior data to the physical machine. The embodiment of the present application creates a virtual network corresponding to a physical machine for simulating and testing advanced persistent threat virus samples, and simulates the actual external Internet environment to build an external Internet simulation environment, which can prevent virus samples from causing harm to the physical network, provide a controlled environment to observe and analyze virus behavior, reduce the impact of the experiment on the actual network environment, enhance the security of the system, and provide a general or customizable isolation environment for different advanced persistent threat virus behavior samples; the virus execution virtual machine is controlled by a controller to run the virus sample, so that the virus sample is only executed in the virus execution virtual machine, reducing the risk of virus transmission and infection of other systems, and ensuring the safety of the physical machine; by automatically collecting terminal-side system call behavior data and network-side communication behavior data, detailed and comprehensive information is provided for analyzing the behavioral characteristics of advanced persistent threat viruses, improving the efficiency and accuracy of virus sample analysis, providing a scientific basis for the formulation and implementation of defense strategies, and providing a theoretical basis for the subsequent rapid identification and response to advanced persistent threats, thereby further protecting network and information security.

[0089] In order to explain the principle of the technical solution of the present invention in detail, the overall process of the present invention is described below in combination with some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and cannot be regarded as a limitation of the present invention.

[0090] In the embodiments of this application, please refer to Figure 2 , Figure 2 is a flow chart of the end-network collaborative measurement system control provided by the embodiment of the present application, such as Figure 2As shown in the figure, the end-to-end collaborative measurement system used in the end-to-end collaborative measurement method for advanced persistent threats mainly includes four main parts: controller, virtual machine manager, virus execution virtual machine and network simulation virtual machine. Its main execution idea is to use virtual machines to simulate the user-side virus running environment and external network communication environment, and automatically collect various virus-related behavior data on the end side and the network side during the virus running period. By utilizing the isolation of virtual machines and virtual networks, it can effectively prevent viruses from infecting physical machines, and at the same time realize the automatic measurement of virus behavior; it is suitable for measuring various types of advanced persistent threat virus behaviors, and can be widely used in various advanced persistent threat virus behavior research, commonality analysis, early detection and other security defense tasks. It has the advantages of automation, efficiency, and security, and solves the fundamental problem of lack of a large amount of diverse real data in the design of intelligent defense solutions for advanced persistent threat viruses based on artificial intelligence.

[0091] like Figure 2 As shown, the specific working principles of the four modules of the end-network collaborative measurement system for advanced persistent threats provided by the embodiment of the present application are as follows:

[0092] One: Controller.

[0093] The controller runs on a physical machine and its function is to control the operation of the entire system. The functions it implements include the transmission of virus samples from a physical machine to a virtual machine, the transmission of specific configurations and scripts from a physical machine to a virtual machine, the transmission of traffic logs from a virtual machine to a physical machine, etc. It can realize the automated measurement of advanced persistent threat virus behaviors, support the measurement of multiple advanced persistent threat virus behavior samples, and provide a customizable isolation environment for different samples.

[0094] The workflow involved in the controller includes the following steps 11 to 16:

[0095] Step 11, read the configuration file. The controller reads the relevant configuration files, among which the virtual machine configuration file contains information such as the number of virtual machines, operating system type, and IP address of each virtual machine; the FTP server configuration file contains the address, user name, password, etc. of the FTP server; the virus execution configuration file specifies the virus sample to be tested, execution time, storage path, operation mode, etc.; the log collection configuration file contains the type, operation time, storage path, etc. of the set log and traffic collection; the script file is used to indicate the script path and execution order running on each virtual machine. Configuration files are usually in JSON or YAML format, which is easy for machines to read and parse.

[0096] Step 12, create a virtual machine. The controller calls the virtual machine creation script and provides the virtual machine configuration file to the virtual machine manager in the form of parameters. The virtual machine manager creates the required virtual machine instances, including a file transfer virtual machine (FTP server) connecting the physical machine and the virtual network, and a series of virtual machines connected only to the virtual network (such as the virus execution virtual machine and the network simulation virtual machine).

[0097] Step 13, distribute the configuration file and the virus sample to be measured. The controller selects the specified virus sample to be tested according to the virus execution configuration file, and distributes the relevant configuration file and the virus sample to be tested to each virtual machine instance. The transmission path of the relevant configuration file and the virus sample to be tested is that the physical machine uploads it to the file transfer virtual machine, and then each virtual machine downloads it to the corresponding location. The distribution method is that the controller executes the FTP upload script and the FTP download script.

[0098] Step 14: Start end-to-end network measurement and run the virus. After the relevant configuration files and execution scripts are transferred to each virtual machine, the controller only needs to trigger the corresponding scripts in a predetermined order to automatically perform virus sample decryption and decompression, virus running, and end-to-end network measurement.

[0099] Step 15, log export. After the virus runs, the network simulation virtual machine packages the system call log file and the network traffic log file and uploads them to the file transfer virtual machine. Finally, the controller executes the FTP download script in the file transfer virtual machine to download the log data to the physical machine.

[0100] Step 16, clean up and restore. The controller can complete the on-site cleanup by shutting down all virtual machines. Since the script that starts the virtual machine specifies that the virtual disk is read-only, the write operation to the disk will be discarded after shutting down the virtual machine instance. In addition, on-site cleanup can also be achieved by creating a disk snapshot of the disk image and restoring the disk image after shutting down.

[0101] 2: Virtual Machine Manager.

[0102] In the specific implementation, the virtual machine manager runs on the physical machine. The virtual machine manager includes a virtualization software and some scripts for creating virtual machine instances. The role of the virtual machine manager is to create multiple virtual machines that meet the requirements according to the configuration file to achieve automated measurement of advanced persistent threat virus samples. In order to automate the measurement process, virtualization software that supports command line control can be used, such as QEMU, VirtualBox, etc.

[0103] The workflow involved in the virtual machine manager includes the following steps 21 to 23:

[0104] Step 21, read the configuration file. The virtual machine manager receives the virtual machine configuration file from the controller, and the virtual machine configuration file includes information such as the number of virtual machines, operating system, IP, gateway, domain name server, etc.

[0105] Step 22, create a virtual machine instance. The virtual machine manager calls the corresponding virtual machine instance creation script to create multiple virtual machines according to the information in the virtual machine configuration file of step 21. The disk image file of the virtual machine can be customized or use the default image. The default image contains the operating system and some basic measurement tools. The image template for running the virus contains the user-side operating system, application programs and other environments. Optionally, it can be placed by placing a number of documents, tables, pictures, videos and other data files to make it more similar to the actual user terminal.

[0106] Step 23, configure the virtual machine network. After the virtual machine instance is created, you can connect to the virtual machine through a serial terminal or the daemon provided by the virtualization software on the physical machine, and configure the virtual machine network through the serial terminal, including IP, gateway, and domain name server.

[0107] See also Figure 3 , Figure 3 Schematic diagram of the connection structure between the physical machine and the virtual network provided in the embodiment of the present application; Figure 3 As shown, the virtual machine manager creates the required virtual machine instances including a file transfer virtual machine (FTP server) connecting the physical machine and the virtual network, and a series of virtual machines connected only to the virtual network (such as the virus execution virtual machine and the network simulation virtual machine).

[0108] 3: Virus executes virtual machine.

[0109] In the specific implementation, the virus execution part runs in the virtual machine, which is responsible for receiving and running the advanced persistent threat virus samples. In addition, the virus execution virtual machine is also used to automatically collect the end-side system call behavior data. In order to ensure the security of the physical machine, during the research process, the advanced persistent threat virus samples are transmitted by encryption and compression, and are only decrypted and decompressed during the running of the virus samples. To achieve this purpose, the decryption and decompression functions are set in the virus execution virtual machine.

[0110] The workflow involved in the virus executing the virtual machine includes the following steps 31 to 35:

[0111] Step 31, receiving the configuration file and the virus sample. The virus execution virtual machine accesses the file transfer virtual machine according to the command of the controller, downloads the encrypted compressed package with the virus sample and the related execution configuration file (such as the virus execution configuration file) from the file transfer virtual machine, and obtains the sample path, compressed package password, execution parameters and other information in the related configuration file.

[0112] Step 32, decryption and decompression. In order to decrypt and decompress the encrypted compressed package, the virus execution virtual machine has a built-in decryption and decompression tool (such as 7z command line). The controller triggers the decryption and decompression script of the virus execution virtual machine to obtain the executable file of the virus sample. In order to prevent the virus sample from being cleaned up by the system's built-in security software, the virus execution virtual machine will temporarily shut down the system's built-in security software before decryption and decompression.

[0113] Step 33: Notify the network simulation virtual machine to start the network traffic log collection function. Before running the virus sample, the virus execution virtual machine notifies the network simulation virtual machine to start the collection of network traffic logs.

[0114] Step 34, system log collection. The system call behavior data on the end side is collected through the system call log monitoring tool configured in the virus execution virtual machine. Specifically, the embodiment of the present application uses a Process Monitor tool that supports command line parameter calls to monitor the system calls of the virus execution virtual machine, including file reading and writing, registry reading and modification, process creation and exit, process injection and other system call behaviors. After the virus sample is completed or reaches the specified running time, the system call log collection is stopped, and the system call log is stored in a specified location (such as a network simulation virtual machine), or uploaded to a file transfer virtual machine. Specifically, the command line parameters of Process Monitor can be used to capture the logs of system calls within a specific time and export the logs to a file.

[0115] Step 35, execute the virus sample. According to the virus execution configuration file, the virus execution virtual machine runs the virus sample. For different virus samples, the execution mode is different. For example, the execution mode may be that the system administrator's authority needs to be executed, the execution mode may be that the execution mode needs to be executed at a specific time, the execution mode may be that some operations that imitate user behavior need to be performed after execution, and the execution mode may be that the virus running time needs to be controlled within a certain range. After the virus sample is completed or reaches the specified running time, the virus execution virtual machine stops collecting system call logs and uploads the local system logs to the network simulation virtual machine. After the upload is completed, the virus execution virtual machine is closed to terminate the virus operation.

[0116] 4: Network simulation virtual machine.

[0117] In the specific implementation, the network simulation part runs on a virtual machine. The network simulation virtual machine is responsible for simulating a network environment isolated from the physical machine, and is responsible for collecting network-side communication behavior data of the advanced persistent threat virus operation behavior. The log data collected on the network simulation virtual machine includes network traffic logs and system call logs uploaded by the virus execution virtual machine. Since the spread, control, and data leakage of advanced persistent threat viruses usually require communication with external servers, the network simulation virtual machine needs to simulate external Internet servers (such as Figure 3 In the embodiment of the present application, the network simulation virtual machine uses Inetsim and Burp network simulation tools, Inetsim simulates the external server, Burp simulates the proxy server, and the workflow involved in the network simulation virtual machine includes the following steps 41 to 44:

[0118] Step 41, receiving the configuration file. The network simulation virtual machine accesses the file transfer virtual machine according to the command of the controller and downloads the relevant configuration file from the file transfer virtual machine, thereby obtaining the network simulation configuration information such as the running configuration of the network simulation tool, the accessible network address, and the return result, and the network log collection configuration information such as the traffic log collection port, collection duration, and log file storage location according to the configuration file, and finally writes the network simulation configuration to the end of the default configuration file of the network simulation tool.

[0119] Step 42: Set up a network simulation environment. Figure 4 , Figure 4 is a schematic diagram of a network module provided in an embodiment of the present application; Figure 4 As shown, in the embodiment of the present application, Inetsim is used as the gateway and domain name server of the virtual machine, and Burp is used as the HTTPS proxy server. In the actual scenario, other tools can be selected to simulate the real network, and the embodiment of the present application does not limit this. Inetsim can simulate a variety of network services, including DNS, HTTP, HTTPS, FTP, SMTP, etc. By configuring Inetsim, external servers can be simulated, including DNS resolution results, testing the connectivity of specific addresses, HTTP / HTTPS requests, etc., so that the virus can communicate with the simulated external server. At the same time, Inetsim's FTP service can be used to transfer virus samples from physical machines to virtual machines, distribute them between virtual machines, and collect traffic logs, and transfer traffic logs from virtual machines to physical machines. Burp is a proxy tool for intercepting and modifying HTTP requests. By configuring Burp as a proxy server and installing Burp's CA certificate as a root certificate in the virtual machine running the virus sample, the TLS traffic generated by the virus can be decrypted so that the traffic log can collect encrypted and plaintext network traffic logs.

[0120] Step 43, collect network traffic logs. After receiving the notification of the traffic log collection function of the virus execution virtual machine being turned on, the network module in the network simulation virtual machine turns on network traffic collection through the network traffic monitoring tool. The embodiment of the present application uses the Tshark tool that supports command line parameter calls to monitor the network traffic of the virtual machine where the virus execution virtual machine is located, including network traffic such as DNS requests, HTTP requests, HTTPS requests, and TCP / UDP connections. After the virus sample is run or reaches the specified running time, the network traffic log is stored in a specified location, or uploaded to a file for transfer to the virtual machine.

[0121] Step 44, log transmission: After the log collection is completed, according to the command of the controller, the network module in the network simulation virtual machine packages the system call log and the network traffic log into a file and uploads it to the virtual machine.

[0122] See also Figure 5 , Figure 5 is a schematic diagram of the process of executing a virus sample provided in an embodiment of the present application; Figure 5 As shown in FIG. 1 , the specific implementation process of virus sample execution and log data collection is as follows: First, the encrypted compressed package of the advanced persistent threat virus sample and related configuration files (such as the virus execution configuration file and the log collection configuration file) are uploaded to the file transfer virtual machine (i.e. Figure 5 Then, the encrypted compressed package and related configuration files of the advanced persistent threat virus sample are downloaded from the file transfer virtual machine through the execution module in the virus execution virtual machine; then, the encrypted compressed package of the advanced persistent threat virus sample is decrypted and decompressed by the execution module in the virus execution virtual machine; further, the virus execution virtual machine notifies the network module in the network simulation virtual machine to start the collection function of network traffic log data, and at the same time, the collection function of system call log data of the execution module in the virus execution virtual machine also needs to be turned on; after the collection function of system call log data and the collection function of network traffic log data are both turned on, the execution module in the virus execution virtual machine is controlled by the controller to run the advanced persistent threat virus sample obtained after decryption and decompression, during which the end-side system call behavior data is collected through the execution module in the virus execution virtual machine, and the network-side communication behavior data is collected through the network module in the network simulation virtual machine; after the virus sample is run or reaches the specified running time, the virus execution virtual machine stops the system call log collection, and sends the end-side system call behavior data collected by the execution module in the virus execution virtual machine to the network simulation virtual machine, and uploads the end-side system call behavior data and the network-side communication behavior data to the file transfer virtual machine through the network module in the network simulation virtual machine.

[0123] See also Figure 6 , Figure 6 It is a flowchart of the end-network collaborative measurement method for advanced persistent threats; Figure 6 As shown, the general process of the end-network collaborative measurement method for advanced persistent threats includes the following steps 61 to 611:

[0124] Step 61, before the end-network collaborative measurement begins, first prepare the required virtual machine images and script files, which include scripts for creating and deleting virtual machine instances, scripts for setting virtual machine instance IP addresses, gateways, and domain name servers, scripts for transferring files from files to virtual machines to upload and download files, scripts for decompressing and executing high-threat virus samples, scripts for calling related interfaces to collect system logs, scripts for using related tools to simulate real network environments, scripts for collecting traffic on network interfaces, etc. And the custom configuration files required to run these scripts, for example, the required number of virtual machines and operating system types, the IP address of each virtual machine, the address of the FTP server and the username and password, the duration of virus execution and log collection, etc.

[0125] In step 62, the controller provides the virtual machine configuration data to the virtual machine manager, and the virtual machine manager calls the virtual machine creation script to create the required virtual machine instances, including a file transfer virtual machine (FTP server) connecting the physical machine and the virtual network, and a series of virtual machines connected only to the virtual network (such as the virus execution virtual machine and the network simulation virtual machine).

[0126] To prevent viruses from leaking to the outside through the network, configure the IP address, gateway, and domain name server of each virtual machine instance on the physical machine through a serial terminal or a daemon provided by the virtualization software according to the virtual machine network configuration.

[0127] Step 63, the controller uploads all high-threat persistent virus samples, related scripts and configuration files to the file transfer virtual machine. After the upload is completed, the required scripts and files are downloaded from the file transfer virtual machine in each virtual machine through the serial terminal on the physical machine. After the download is completed, the file transfer virtual machine is closed to isolate the physical machine and virtual machine network, and subsequent commands are executed on the serial terminal.

[0128] Step 64, controlling the network module in the network simulation virtual machine through the controller to execute the network simulation script to simulate the actual network environment according to the network configuration.

[0129] Step 65: The controller controls the execution module in the virus execution virtual machine to decrypt and decompress the compressed package containing the virus sample.

[0130] Step 66, execute the script for collecting network-side traffic in the network simulation virtual machine, thereby starting traffic collection; at the same time, execute the script for collecting system logs on the terminal side in the virus execution virtual machine, thereby starting system log collection.

[0131] Step 67, the controller controls the execution module in the virus execution virtual machine to execute the virus execution script to run the virus sample. During this period, the terminal side system call behavior data is collected through the virus execution virtual machine, and the network side communication behavior data is collected through the network simulation virtual machine.

[0132] Step 68: After the virus execution virtual machine detects that the virus has finished running and exited or reaches the running time specified in the configuration file, it stops collecting the end-side system call behavior data and notifies the network simulation virtual machine to stop collecting the network-side communication behavior data. The virus execution virtual machine packages the end-side system call behavior data and uploads it to the network simulation virtual machine, and then shuts down the virus execution virtual machine.

[0133] Step 69, after the virus execution virtual machine is shut down, the controller starts the file transfer virtual machine, and the network simulation virtual machine uploads the terminal side system call behavior data and the network side communication behavior data to the file transfer virtual machine.

[0134] Step 610: The controller on the physical machine transfers the terminal-side system call behavior data and the network-side communication behavior data downloaded from the file to the virtual machine.

[0135] Step 611: The controller shuts down all virtual machines and rolls back the virtual machine states to the states before this measurement, completes this measurement, and prepares to start the measurement of the next virus sample.

[0136] In summary, the end-to-network collaborative measurement method for advanced persistent threats provided in the embodiment of the present application mainly includes two parts: system call log data collection on the terminal side and network traffic log data collection on the network side, realizing end-to-network collaborative measurement. That is, the end-to-network collaborative measurement method for advanced persistent threats provided in the embodiment of the present application can realize the automated measurement of advanced persistent threat virus behaviors, support the measurement of multiple advanced persistent threat virus behavior samples, and provide a customizable isolation environment for different samples. It is suitable for the research, analysis, early defense solution design and other fields of advanced persistent threat virus behaviors. The obtained high-quality data set can provide a basis and basis for the research of various new security defense technologies.

[0137] It should be pointed out that this embodiment only provides a brief schematic illustration of the overall process of the end-network collaborative measurement method for advanced persistent threats. The detailed description of each step can refer to the relevant content in the aforementioned embodiment and will not be repeated here. It can be understood that the present invention is not limited to this.

[0138] In an embodiment of the present application, a controller on a physical machine sends virtual machine configuration data to a virtual machine manager on the physical machine; the virtual machine manager creates a virtual network and several virtual machines according to the virtual machine configuration data; wherein the virtual machines include a file transit virtual machine, a virus execution virtual machine and a network simulation virtual machine, and the file transit virtual machine is used to manage log file data; the network simulation virtual machine simulates the actual environment of the external Internet in the virtual network to build an external Internet simulation environment; in the external Internet simulation environment, the controller controls the virus execution virtual machine to run the target advanced persistent threat virus sample; when the virus execution virtual machine is running the target advanced persistent threat virus sample, the virus execution virtual machine collects the terminal side system call behavior data, and the network simulation virtual machine collects the network side communication behavior data; the controller transmits the terminal side system call behavior data and the network side communication behavior data to the physical machine. The embodiment of the present application creates a virtual network corresponding to a physical machine for simulating and testing advanced persistent threat virus samples, and simulates the actual external Internet environment to build an external Internet simulation environment, which can prevent virus samples from causing harm to the physical network, provide a controlled environment to observe and analyze virus behavior, reduce the impact of the experiment on the actual network environment, enhance the security of the system, and provide a general or customizable isolation environment for different advanced persistent threat virus behavior samples; the virus execution virtual machine is controlled by a controller to run the virus sample, so that the virus sample is only executed in the virus execution virtual machine, reducing the risk of virus transmission and infection of other systems, and ensuring the safety of the physical machine; by automatically collecting terminal-side system call behavior data and network-side communication behavior data, detailed and comprehensive information is provided for analyzing the behavioral characteristics of advanced persistent threat viruses, improving the efficiency and accuracy of virus sample analysis, providing a scientific basis for the formulation and implementation of defense strategies, and providing a theoretical basis for the subsequent rapid identification and response to advanced persistent threats, thereby further protecting network and information security.

[0139] In summary, the end-network collaborative measurement method for advanced persistent threats provided by the embodiments of the present application has the following advantages:

[0140] (1) Traditional measurement methods mainly measure the behavior of advanced persistent threat viruses through manual intervention, which is inefficient and cannot achieve automated measurement. However, the embodiments of the present application can achieve automated measurement of advanced persistent threat virus behaviors.

[0141] (2) Traditional measurement methods are often targeted at specific scenarios and limited viruses, resulting in fixed solutions and lack of flexibility when measuring batches of advanced persistent threat virus behavior samples. The embodiments of the present application can provide a universal or customizable isolation environment for different advanced persistent threat virus behavior samples.

[0142] (3) The end-to-end collaborative measurement system for advanced persistent threats provided in the embodiments of the present application can measure the behaviors of a series of advanced persistent threat virus samples without human intervention. It has the characteristics of high efficiency and security, and is suitable for measuring large-scale advanced persistent threat virus behaviors. It can generate high-quality real sample behavior logs and data sets, and provide a basis and basis for the research of various new security defense technologies.

[0143] (4) The end-to-end collaborative measurement system for advanced persistent threats provided in the embodiments of the present application is flexible and customizable. Different system environments can be created through virtual machines to study the behavior patterns of different advanced persistent threat viruses under different conditions, and to provide a large number of real end-to-end collaborative measurement data samples for building a robust detection and defense system, thereby solving the problem of severe data shortage in advanced persistent threat defense.

[0144] See also Figure 7 The embodiment of the present application also provides an end-network collaborative measurement device 700 for advanced persistent threats, which can implement the end-network collaborative measurement method for advanced persistent threats. The device includes the following modules:

[0145] A virtual machine configuration data sending module 701 is used to send the virtual machine configuration data to the virtual machine manager on the physical machine through a controller on the physical machine;

[0146] A virtualized operating environment creation module 702, configured to create a virtual network and a plurality of virtual machines according to the virtual machine configuration data through the virtual machine manager; wherein the virtual machines include a file transfer virtual machine, a virus execution virtual machine and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data;

[0147] The external Internet environment simulation module 703 is used to simulate the actual external Internet environment in the virtual network through the network simulation virtual machine to construct an external Internet simulation environment;

[0148] The virus sample running module 704 is used to control the virus execution virtual machine to run the target advanced persistent threat virus sample through the controller in the external Internet simulation environment;

[0149] The behavior data collection module 705 is used to collect the terminal-side system call behavior data through the virus execution virtual machine when the virus execution virtual machine is running the target advanced persistent threat virus sample, and collect the network-side communication behavior data through the network simulation virtual machine;

[0150] The behavior data transmission module 706 is used to transmit the terminal-side system call behavior data and the network-side communication behavior data to the physical machine through the controller.

[0151] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0152] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned end-network collaborative measurement method for advanced persistent threats when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0153] It can be understood that the contents of the above method embodiments are all applicable to the present device embodiments, the functions specifically implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0154] See also Figure 8 , Figure 8 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0155] The processor 801 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC for short), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application;

[0156] The memory 802 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 802 can store an operating system and other application programs. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 802, and the processor 801 calls and executes the end-network collaborative measurement method for advanced persistent threats in the embodiment of this application;

[0157] Input / output interface 803, used to implement information input and output;

[0158] The communication interface 804 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.);

[0159] A bus 805 that transmits information between the various components of the device (e.g., the processor 801, the memory 802, the input / output interface 803, and the communication interface 804);

[0160] The processor 801 , the memory 802 , the input / output interface 803 and the communication interface 804 are connected to each other in communication within the device via a bus 805 .

[0161] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the above-mentioned end-network collaborative measurement method for advanced persistent threats.

[0162] It can be understood that the contents of the above method embodiments are all applicable to the present storage medium embodiments, the functions specifically implemented by the present storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0163] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0164] The embodiments of the present application provide an end-network collaborative measurement method for advanced persistent threats and an end-network collaborative measurement device for advanced persistent threats. The method sends virtual machine configuration data to a virtual machine manager on a physical machine through a controller on the physical machine; a virtual network and a plurality of virtual machines are created according to the virtual machine configuration data through the virtual machine manager; wherein the virtual machines include a file transfer virtual machine, a virus execution virtual machine and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data; the network simulation virtual machine is used to simulate the actual environment of the external Internet in the virtual network to build an external Internet simulation environment; in the external Internet simulation environment, the controller is used to control the virus execution virtual machine to run the target advanced persistent threat virus sample; when the virus execution virtual machine is running the target advanced persistent threat virus sample, the virus execution virtual machine is used to collect end-side system call behavior data, and the network simulation virtual machine is used to collect network-side communication behavior data; the controller is used to transmit the end-side system call behavior data and the network-side communication behavior data to the physical machine. The embodiment of the present application creates a virtual network corresponding to a physical machine for simulating and testing advanced persistent threat virus samples, and simulates the actual external Internet environment to build an external Internet simulation environment, which can prevent virus samples from causing harm to the physical network, provide a controlled environment to observe and analyze virus behavior, reduce the impact of the experiment on the actual network environment, enhance the security of the system, and provide a general or customizable isolation environment for different advanced persistent threat virus behavior samples; the virus execution virtual machine is controlled by a controller to run the virus sample, so that the virus sample is only executed in the virus execution virtual machine, reducing the risk of virus transmission and infection of other systems, and ensuring the safety of the physical machine; by automatically collecting terminal-side system call behavior data and network-side communication behavior data, detailed and comprehensive information is provided for analyzing the behavioral characteristics of advanced persistent threat viruses, improving the efficiency and accuracy of virus sample analysis, providing a scientific basis for the formulation and implementation of defense strategies, and providing a theoretical basis for the subsequent rapid identification and response to advanced persistent threats, thereby further protecting network and information security.

[0165] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0166] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0167] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0168] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0169] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0170] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0171] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0172] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0173] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0174] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0175] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. The end-to-network collaborative measurement method for advanced persistent threats is characterized by: The method comprises the following steps: Sending the virtual machine configuration data to the virtual machine manager on the physical machine through a controller on the physical machine; Creating a virtual network and several virtual machines according to the virtual machine configuration data through the virtual machine manager; wherein the virtual machines include a file transfer virtual machine, a virus execution virtual machine and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data; The actual environment of the external Internet is simulated in the virtual network by the network simulation virtual machine to construct an external Internet simulation environment; In the external Internet simulation environment, the virus execution virtual machine is controlled by the controller to run the target advanced persistent threat virus sample; When the virus execution virtual machine is running the target advanced persistent threat virus sample, the terminal-side system call behavior data is collected through the virus execution virtual machine, and the network-side communication behavior data is collected through the network simulation virtual machine; The terminal-side system call behavior data and the network-side communication behavior data are transmitted to the physical machine through the controller.

2. The method according to claim 1, characterized in that Before simulating the external Internet actual environment in the virtual network through the network simulation virtual machine to construct the external Internet simulation environment, the method further includes: Uploading the network simulation configuration data to the file transfer virtual machine through the controller; The controller controls the network simulation virtual machine to download the network simulation configuration data from the file transfer virtual machine.

3. The method according to claim 2, characterized in that The method of simulating the actual external Internet environment in the virtual network through the network simulation virtual machine to construct an external Internet simulation environment includes: In the virtual network, the actual external Internet environment is simulated according to the network simulation configuration data through the network simulation virtual machine to construct the external Internet simulation environment; wherein the external Internet simulation environment includes a virtual external server, and the virtual external server is used to communicate data with the target advanced persistent threat virus sample running on the virus execution virtual machine.

4. The method according to claim 1, characterized in that: Before controlling the virus execution virtual machine to run the target advanced persistent threat virus sample through the controller, the method further includes: Uploading the initial advanced persistent threat virus sample to the file transfer virtual machine through the controller; wherein the initial advanced persistent threat virus sample is an encrypted and compressed virus sample; Controlling the virus execution virtual machine to download the initial advanced persistent threat virus sample from the file transfer virtual machine through the controller; The controller controls the virus execution virtual machine to perform decryption and decompression processing on the initial advanced persistent threat virus sample to obtain the target advanced persistent threat virus sample.

5. The method according to claim 1, characterized in that When the virus execution virtual machine is running the target advanced persistent threat virus sample, collecting terminal-side system call behavior data through the virus execution virtual machine, and collecting network-side communication behavior data through the network simulation virtual machine, includes: When the virus execution virtual machine is running the target advanced persistent threat virus sample, the terminal-side system call behavior data is collected through a system call log monitoring tool configured in the virus execution virtual machine; The network-side communication behavior data is collected through a network traffic monitoring tool configured in the network simulation virtual machine.

6. The method according to claim 1, characterized in that After collecting the terminal-side system call behavior data through the virus execution virtual machine and collecting the network-side communication behavior data through the network simulation virtual machine when the virus execution virtual machine is running the target advanced persistent threat virus sample, the method further includes: Sending the terminal-side system call behavior data to the network simulation virtual machine through the virus execution virtual machine; The terminal-side system call behavior data and the network-side communication behavior data are uploaded to the file transfer virtual machine through the network simulation virtual machine.

7. The method according to claim 6, characterized in that The transmitting the terminal-side system call behavior data and the network-side communication behavior data to the physical machine through the controller includes: The controller downloads the terminal-side system call behavior data and the network-side communication behavior data from the file transfer virtual machine to the physical machine.

8. The end-to-network collaborative measurement device for advanced persistent threats is characterized by: The device comprises the following modules: A virtual machine configuration data sending module, used to send the virtual machine configuration data to the virtual machine manager on the physical machine through a controller on the physical machine; A virtualized operating environment creation module, used to create a virtual network and several virtual machines according to the virtual machine configuration data through the virtual machine manager; wherein the virtual machines include a file transfer virtual machine, a virus execution virtual machine and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data; An external Internet environment simulation module, used to simulate the actual external Internet environment in the virtual network through the network simulation virtual machine to construct an external Internet simulation environment; A virus sample running module, used to control the virus execution virtual machine to run a target advanced persistent threat virus sample through the controller in the external Internet simulation environment; A behavior data collection module, configured to collect terminal-side system call behavior data through the virus execution virtual machine when the virus execution virtual machine is running the target advanced persistent threat virus sample, and collect network-side communication behavior data through the network simulation virtual machine; A behavior data transmission module is used to transmit the terminal-side system call behavior data and the network-side communication behavior data to the physical machine through the controller.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images