End-to-end collaborative measurement method and device for advanced persistent threats

Abstract

The application discloses an end-to-network cooperative measurement method and device for advanced persistent threats, and the method comprises the following steps: creating a virtual network and a plurality of virtual machines through a virtual machine manager; simulating an external Internet actual environment through a network simulation virtual machine; running a target advanced persistent threat virus sample through a virus execution virtual machine; collecting end-side system call behavior data through the virus execution virtual machine, and collecting network-side communication behavior data through the network simulation virtual machine; and transmitting the end-side system call behavior data and the network-side communication behavior data to a physical machine through a controller. The application can provide a controlled virtual environment for analyzing virus behavior, so that the virus sample is only executed in the virus execution virtual machine, the risk of virus spreading and infecting other systems is reduced, the collected end-to-network two-side data provides comprehensive information for analyzing the behavior characteristics of the virus, the efficiency and accuracy of virus sample analysis can be improved, and the application can be widely applied to the field of information security technology.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to end-to-end network collaborative measurement methods and apparatus for advanced persistent threats. Background Technology

[0002] With the rapid development of the internet, cybersecurity issues have become increasingly prominent, and various cyberattack methods are emerging one after another. Among them, Advanced Persistent Threat (APT) attacks are a particularly dangerous type of cyberattack. However, existing defense technologies are unable to effectively and quickly detect APT attacks. Therefore, it is necessary to measure and analyze the behavioral data of APT attacks to aid in their detection. However, existing virus behavior measurement methods only target specific virus samples, limiting their application in real-world scenarios. Furthermore, the data collected by these methods is singular and cannot comprehensively analyze virus behavioral characteristics.

[0003] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the Invention

[0004] The embodiments of this application aim to at least partially address one of the technical problems in the related art. Therefore, the main objective of the embodiments of this application is to propose an end-to-end network collaborative measurement method and apparatus for advanced persistent threats. This method provides a controlled virtual environment for analyzing virus behavior, ensuring that virus samples execute only within a virus execution virtual machine, reducing the risk of virus propagation and infection of other systems. The collected data from both ends of the network provide comprehensive information for analyzing the behavioral characteristics of the virus, thereby improving the efficiency and accuracy of virus sample analysis.

[0005] To achieve the above objectives, one aspect of this application proposes an end-to-end network cooperative measurement method for advanced persistent threats, the method comprising the following steps:

[0006] The virtual machine configuration data is sent from the controller on the physical machine to the virtual machine manager on the physical machine.

[0007] The virtual machine manager creates a virtual network and several virtual machines based on the virtual machine configuration data; wherein, the virtual machines include a file transfer virtual machine, a virus execution virtual machine, and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data;

[0008] The network simulation virtual machine simulates the actual external Internet environment in the virtual network to construct an external Internet simulation environment;

[0009] In the simulated external internet environment, the controller controls the virus execution virtual machine to run a target advanced persistent threat virus sample.

[0010] When the virus execution virtual machine is running the target advanced persistent threat virus sample, it collects end-side system call behavior data through the virus execution virtual machine and network-side communication behavior data through the network simulation virtual machine.

[0011] The controller transmits the terminal-side system call behavior data and the network-side communication behavior data to the physical machine.

[0012] In some embodiments, before simulating the actual external Internet environment in the virtual network through the network-simulated virtual machine to construct an external Internet simulation environment, the method further includes:

[0013] The controller uploads network simulation configuration data to the file transfer virtual machine.

[0014] The controller controls the network simulation virtual machine to download the network simulation configuration data from the file transfer virtual machine.

[0015] In some embodiments, the step of simulating the actual external Internet environment in the virtual network through the network simulation virtual machine to construct an external Internet simulation environment includes:

[0016] In the virtual network, the external Internet environment is simulated by the network simulation virtual machine according to the network simulation configuration data to construct the external Internet simulation environment; wherein, the external Internet simulation environment includes a virtual external server, which is used to communicate with the target advanced persistent threat virus sample running on the virus execution virtual machine.

[0017] In some embodiments, prior to controlling the virus execution virtual machine to run a target advanced persistent threat virus sample via the controller, the method further includes:

[0018] The controller uploads an initial advanced persistent threat (APS) virus sample to the file transfer virtual machine; wherein the initial APS virus sample is an encrypted and compressed virus sample.

[0019] The controller controls the virus execution virtual machine to download the initial advanced persistent threat virus sample from the file-to-virtual machine;

[0020] The controller controls the virus execution virtual machine to decrypt and decompress the initial advanced persistent threat virus sample to obtain the target advanced persistent threat virus sample.

[0021] In some embodiments, when the virus execution virtual machine is running the target advanced persistent threat virus sample, collecting end-side system call behavior data through the virus execution virtual machine and collecting network-side communication behavior data through the network simulation virtual machine includes:

[0022] When the virus execution virtual machine is running the target advanced persistent threat virus sample, the system call behavior data on the end side is collected by the system call log monitoring tool configured in the virus execution virtual machine;

[0023] The network-side communication behavior data is collected using a network traffic monitoring tool configured in the network simulation virtual machine.

[0024] In some embodiments, after collecting end-side system call behavior data through the virus execution virtual machine and collecting network-side communication behavior data through the network simulation virtual machine when the virus execution virtual machine is running the target advanced persistent threat virus sample, the method further includes:

[0025] The virus executes the virtual machine to send the endpoint system call behavior data to the network simulation virtual machine;

[0026] The network simulation virtual machine uploads the end-side system call behavior data and the network-side communication behavior data to the file transfer virtual machine.

[0027] In some embodiments, transmitting the end-side system call behavior data and the network-side communication behavior data to the physical machine via the controller includes:

[0028] The controller downloads the endpoint system call behavior data and the network-side communication behavior data from the file transfer virtual machine to the physical machine.

[0029] To achieve the above objectives, another aspect of this application proposes an end-to-end network collaborative measurement device for advanced persistent threats, the device comprising the following modules:

[0030] The virtual machine configuration data sending module is used to send virtual machine configuration data to the virtual machine manager on the physical machine via the controller on the physical machine.

[0031] The virtualization runtime environment creation module is used to create a virtual network and several virtual machines according to the virtual machine configuration data through the virtual machine manager; wherein, the virtual machines include a file transfer virtual machine, a virus execution virtual machine, and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data;

[0032] An external internet environment simulation module is used to simulate the actual external internet environment in the virtual network through the network simulation virtual machine, so as to construct an external internet simulation environment;

[0033] The virus sample execution module is used to control the virus execution virtual machine to run a target advanced persistent threat virus sample in the external Internet simulation environment through the controller;

[0034] The behavior data acquisition module is used to collect end-side system call behavior data through the virus execution virtual machine and network-side communication behavior data through the network simulation virtual machine when the virus execution virtual machine is running the target advanced persistent threat virus sample.

[0035] The behavior data transmission module is used to transmit the end-side system call behavior data and the network-side communication behavior data to the physical machine through the controller.

[0036] To achieve the above objectives, another aspect of this application provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the method described above.

[0037] To achieve the above objectives, another aspect of the embodiments of this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the methods described above.

[0038] The embodiments of this application include at least the following beneficial effects: This application provides an end-to-end network collaborative measurement method and apparatus for advanced persistent threats (APS). This scheme involves a controller on a physical machine sending virtual machine configuration data to a virtual machine manager on the physical machine; the virtual machine manager creating a virtual network and several virtual machines based on the virtual machine configuration data; wherein the virtual machines include a file transfer virtual machine, a virus execution virtual machine, and a network simulation virtual machine, with the file transfer virtual machine used to manage log file data; the network simulation virtual machine simulating the actual external internet environment in the virtual network to construct an external internet simulation environment; in the external internet simulation environment, the controller controls the virus execution virtual machine to run a target APS virus sample; when the virus execution virtual machine is running the target APS virus sample, the virus execution virtual machine collects end-side system call behavior data, and the network simulation virtual machine collects network-side communication behavior data; the controller transmits the end-side system call behavior data and network-side communication behavior data to the physical machine. This application's embodiments create a virtual network corresponding to the physical machine to simulate and test advanced persistent threat (APS) virus samples. Simultaneously, it simulates the actual external internet environment to construct an external internet simulation environment. This prevents virus samples from harming the physical network, provides a controlled environment for observing and analyzing virus behavior, reduces the impact of experiments on the actual network environment, enhances system security, and can provide a general or customizable isolation environment for different APS virus behavior samples. By controlling the virus execution virtual machine to run the virus sample through a controller, the virus sample is ensured to execute only within the virus execution virtual machine, reducing the risk of virus propagation and infection of other systems, thus protecting the physical machine's security. Through automated collection of end-side system call behavior data and network-side communication behavior data, detailed and comprehensive information is provided for analyzing the behavioral characteristics of APS viruses, improving the efficiency and accuracy of virus sample analysis. This provides a scientific basis for the formulation and implementation of defense strategies and a theoretical basis for subsequent rapid identification and response to APS threats, thereby further protecting network and information security. Attached Figure Description

[0039] Figure 1 This is a flowchart of the steps of the end-to-end network collaborative measurement method for advanced persistent threats provided in the embodiments of this application;

[0040] Figure 2 This is a schematic diagram of the control process of the end-to-end network collaborative measurement system provided in the embodiments of this application;

[0041] Figure 3 This is a schematic diagram of the connection structure between the physical machine and the virtual network provided in the embodiments of this application;

[0042] Figure 4 This is a schematic diagram of the network module provided in an embodiment of this application;

[0043] Figure 5 This is a schematic diagram of the process of executing a virus sample provided in an embodiment of this application;

[0044] Figure 6 This is a flowchart illustrating an end-to-end network collaborative measurement method for advanced persistent threats.

[0045] Figure 7 This is a schematic diagram of the end-to-end network collaborative measurement device for advanced persistent threats provided in this application embodiment;

[0046] Figure 8 This is a schematic diagram of the hardware structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of this application and are not intended to limit it. In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with those of this application; they are merely examples of apparatuses and methods consistent with some aspects of the embodiments of this application as detailed in the appended claims.

[0048] It is understood that the terms “first,” “second,” etc., used in this application may be used herein to describe various concepts, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of the embodiments of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the words “if,” “when,” or “in response to a determination” as used herein may be interpreted as “when…” or “when…” or “in response to a determination.”

[0049] As used in this application, the terms "at least one", "multiple", "each", "any", etc., "at least one" includes one, two or more, "multiple" includes two or more, "each" refers to each of the corresponding multiples, and "any" refers to any one of the multiples.

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0051] With the rapid development of the internet, cybersecurity issues have become increasingly prominent, and various cyberattack methods are emerging one after another. Among them, Advanced Persistent Threat (APPT) attacks are a particularly dangerous type of cyberattack. "Advanced" refers to the higher degree of customization and complexity required to execute an APPT attack compared to traditional attacks; it demands significant time and resources to research and identify vulnerabilities within the system; "long-term" refers to the continuous monitoring of the target to achieve a specific objective, maintaining long-term access to the target; and "threat" emphasizes human involvement in the planning of the attack, targeting high-value organizations, and often causing substantial losses if successful. APPT attacks are long-term, persistent cyberattacks targeting specific objectives using advanced attack methods, typically a combination of various attack methods. Therefore, defense requires multi-layered and multi-faceted detection and defense. However, advanced persistent threat (APS) attacks are characterized by complex and varied attacker behavior patterns and highly covert attack methods, making them difficult to detect using traditional security defenses. Manually managed security systems often generate tens of thousands of alerts daily, and APS attacks are typically hidden within these alerts, making them difficult to detect. Newer machine learning-based security defense technologies lack large-scale, high-quality datasets on APS virus behavior, hindering their effective detection. Therefore, it is necessary to measure and analyze APS behavioral data to aid in detection. However, existing virus behavior feature measurement schemes, while achieving automated monitoring and analysis, have two main limitations: first, the behavioral data measurement during APS virus operation is limited to a single instance; second, they only target specific virus samples, significantly limiting their practical application.

[0052] In view of this, embodiments of this application provide an end-to-end network collaborative measurement method and apparatus for advanced persistent threats (APS). This scheme involves a controller on a physical machine sending virtual machine configuration data to a virtual machine manager on the physical machine; the virtual machine manager creating a virtual network and several virtual machines based on the virtual machine configuration data; the virtual machines include a file transfer virtual machine, a virus execution virtual machine, and a network simulation virtual machine, with the file transfer virtual machine used to manage log file data; the network simulation virtual machine simulating the actual external internet environment within the virtual network to construct an external internet simulation environment; in the external internet simulation environment, the controller controls the virus execution virtual machine to run a target APS virus sample; when the virus execution virtual machine is running the target APS virus sample, it collects end-side system call behavior data and network-side communication behavior data; the controller transmits the end-side system call behavior data and network-side communication behavior data to the physical machine. This application's embodiments create a virtual network corresponding to the physical machine to simulate and test advanced persistent threat (APS) virus samples. Simultaneously, it simulates the actual external internet environment to construct an external internet simulation environment. This prevents virus samples from harming the physical network, provides a controlled environment for observing and analyzing virus behavior, reduces the impact of experiments on the actual network environment, enhances system security, and can provide a general or customizable isolation environment for different APS virus behavior samples. By controlling the virus execution virtual machine to run the virus sample through a controller, the virus sample is ensured to execute only within the virus execution virtual machine, reducing the risk of virus propagation and infection of other systems, thus protecting the physical machine's security. Through automated collection of end-side system call behavior data and network-side communication behavior data, detailed and comprehensive information is provided for analyzing the behavioral characteristics of APS viruses, improving the efficiency and accuracy of virus sample analysis. This provides a scientific basis for the formulation and implementation of defense strategies and a theoretical basis for subsequent rapid identification and response to APS threats, thereby further protecting network and information security.

[0053] The endpoint-network collaborative measurement method for advanced persistent threats provided in this application relates to the field of information security technology. This endpoint-network collaborative measurement method for advanced persistent threats can be applied to terminals, servers, or software running on either terminal or server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, or in-vehicle terminal, but is not limited to these. The server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The server can also be a node server in a blockchain network. The software can be an application implementing the endpoint-network collaborative measurement method for advanced persistent threats, but is not limited to the above forms.

[0054] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics devices, network PCs, minicomputers, mainframes, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0055] Please see Figure 1 , Figure 1 This is an optional flowchart of the end-to-end network collaborative measurement method for advanced persistent threats provided in this application embodiment. Figure 1 The method may include, but is not limited to, steps S101 to S106.

[0056] Step S101: Send virtual machine configuration data to the virtual machine manager on the physical machine via the controller on the physical machine;

[0057] Physical machines refer to computer hardware systems in a real-world environment. They serve as the underlying hardware support for virtualization technology, enabling them to run virtualization software and create and manage virtual machines based on that software.

[0058] The controller, operating on the physical machine, is the core module controlling the entire system's operation. Its functions include: transmitting advanced persistent threat (APS) virus samples from the physical machine to the virtual machine; transmitting specific execution configuration data and script data from the physical machine to the virtual machine; and transmitting traffic log data from the virtual machine to the physical machine. Due to the inherent danger of APS viruses, to ensure the security of the measurement process, the encrypted compressed package containing the APS virus sample is decrypted and decompressed only during the execution of the virus sample by the virtual machine under the controller's control. During the transmission of the encrypted compressed package from the physical machine to the virtual machine, a virtual network adapter is enabled to establish a network connection between the physical machine and the virtual machine. After the transmission is complete, the virtual network adapter is disabled, severing the network connection between the physical machine and the virtual machine to prevent virus sample leakage. To automate the measurement of APS virus behavior, the controller reads the configuration file to select the virus sample to be measured, then transmits the virus sample to the virtual machine executing the virus sample, controls the virtual machine to run the virus sample, and finally transmits the log file back to the physical machine to restore the environment and select the next virus sample to be measured.

[0059] Virtual machine configuration data consists of parameters and settings that define the characteristics and behaviors of virtual machines. Virtual machine configuration data may include, but is not limited to: the number of virtual machines, the type of operating system, and the IP (Internet Protocol) address of each virtual machine.

[0060] The virtual machine manager is a module used to simulate the user terminal environment in a real-world scenario, and it operates on a physical machine. Advanced persistent threats (APS) typically target user terminals and pose a certain degree of danger; therefore, this embodiment uses virtual machines to simulate the user terminal environment. When measuring APS virus behavior, the virtual machine manager creates multiple virtual machines. Some virtual machines run programs containing viruses, some serve as a network simulation environment for communication between the virus execution virtual machine and the target virtual machine, and others are used for collecting system logs and network traffic, collaboratively completing the measurement of APS virus behavior. It should be noted that in practical applications, depending on the scale of the specific task, multiple virtual machines can be run on the same physical host, or a cluster of multiple physical hosts can be used; this embodiment does not impose such limitations.

[0061] Step S102: The virtual machine manager creates a virtual network and several virtual machines according to the virtual machine configuration data; wherein, the virtual machines include a file transfer virtual machine, a virus execution virtual machine, and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data;

[0062] Virtual networks refer to virtual environments that simulate real-world user scenarios using a virtual machine manager. Virtual networks include file transfer virtual machines, virus execution virtual machines, and network simulation virtual machines.

[0063] The file transfer virtual machine is an FTP (File Transfer Protocol) server running on the virtual machine, used to store and isolate file and log data. File transfers between the physical machine and the virtual machine are all processed through the FTP server. In the specific implementation, when the controller sends virtual machine configuration data to the virtual machine manager, it also sends the FTP server configuration file to the virtual machine manager. The FTP server configuration file contains the FTP server address, username, password, etc.

[0064] The virus execution virtual machine (VVM) is responsible for receiving and executing Advanced Persistent Threat (APT) virus samples. Additionally, it automates the collection of client-side system call behavior data, which may include, but is not limited to, file read / write, registry read / modification, process creation / exit, and process injection. To ensure physical machine security, APT virus samples are transmitted using encryption and compression methods, with decompression and decompression only performed during sample execution. To achieve this, the VVM includes decompression and decompression functionality. In its implementation, the VVM receives and runs APT virus samples and, before execution, notifies the network simulation virtual machine to collect network traffic.

[0065] The network simulation virtual machine (VM) is used to simulate the actual external internet environment within the virtual machine to construct a simulated external internet environment. It is responsible for collecting logs of the operational behavior of advanced persistent threat (APS) viruses, including system call logs and network traffic logs. However, it should be noted that the system call logs are automatically collected by the virus execution virtual machine and then uploaded to the network simulation virtual machine. The network simulation virtual machine then packages the system call logs and network traffic logs and uploads them to a file transfer virtual machine. Alternatively, in this embodiment, the system call logs automatically collected by the virus execution virtual machine can also be directly uploaded to the file transfer virtual machine. APS viruses often involve network attacks, virus propagation, control, and data leakage, typically requiring communication with external servers. At the start of virus execution, some viruses attempt to establish connections with external servers, receive instructions, and upload data. Other viruses attempt to establish connections with non-existent domains to determine if they are in a virtual machine environment. Therefore, this embodiment uses a network simulation tool to simulate an external internet environment isolated from the physical machine, allowing the virus sample running on the virus execution virtual machine to communicate with the simulated external server while ensuring the security of the physical machine.

[0066] The network traffic logs collected by the network simulation virtual machine can include, but are not limited to, network traffic behaviors such as DNS (Domain Name System) requests, HTTP (Hypertext Transfer Protocol) requests, HTTPS (Hypertext Transfer Protocol Secure) requests, and TCP (Transmission Control Protocol) / UDP (User Datagram Protocol) connections. The network module collects network traffic logs while the execution module is running advanced persistent threat virus samples and stores these logs in a specified location or sends them to a file transfer virtual machine (such as an FTP server).

[0067] In this embodiment, the system for end-to-end network collaborative measurement of advanced persistent threats mainly includes the aforementioned controller, virtual machine manager, virus execution virtual machine, and network simulation virtual machine. Through the collaborative cooperation of these four modules, automated measurement of end-side system call behavior data and network-side communication behavior data is achieved.

[0068] In its implementation, the virtual machine manager creates several virtual machines and virtual networks according to configuration requirements. These virtual machines include file transfer virtual machines, virus execution virtual machines, and network simulation virtual machines. Specifically, the virtual network is used to interconnect these virtual machines and isolate them from the outside world. The file transfer virtual machine stores and forwards file and log data involved in the entire process. The virus execution virtual machine runs the virus sample and collects system call behavior data during virus sample execution. The network simulation virtual machine simulates the actual external internet environment in the virtual network to build an external internet simulation environment, creating an interactive external network environment for virus sample execution and collecting network traffic behavior data during virus sample execution.

[0069] Step S103: The network simulation virtual machine simulates the actual external Internet environment in the virtual network to construct an external Internet simulation environment;

[0070] In some embodiments, prior to step S103, the method may further include: uploading network simulation configuration data to a file transfer virtual machine via a controller; and controlling the network simulation virtual machine to download network simulation configuration data from the file transfer virtual machine via a controller.

[0071] Among them, network simulation configuration data refers to a set of parameters and instructions used to guide network simulation virtual machines on how to set up and run virtual network environments.

[0072] In some embodiments, step S103 may include: in a virtual network, simulating the actual external Internet environment through a network simulation virtual machine according to network simulation configuration data to construct an external Internet simulation environment; wherein, the external Internet simulation environment includes a virtual external server, which is used to communicate data with a target advanced persistent threat virus sample running on a virus execution virtual machine.

[0073] The external internet simulation environment includes a virtual external server, which is used to communicate with the target advanced persistent threat (APS) virus sample running on the virus execution virtual machine. In practice, APS often involve network attacks, virus propagation, control, and data leakage, which typically require communication with an external server. When a virus starts running, some viruses attempt to establish connections with the external server, receive instructions, and upload data. Others attempt to establish connections with non-existent domains to determine if they are in a virtual machine environment. Therefore, this embodiment uses a network simulation tool to simulate an external internet environment isolated from the physical machine, allowing the virus sample running on the virus execution virtual machine to communicate with the simulated external server while ensuring the security of the physical machine.

[0074] Step S104: In the simulated external internet environment, the controller controls the virus execution virtual machine to run the target advanced persistent threat virus sample.

[0075] In some embodiments, before step S104, the method may further include: uploading an initial advanced persistent threat (APS) virus sample to a file transfer virtual machine via a controller; wherein the initial APS virus sample is an encrypted and compressed virus sample; controlling a virus execution virtual machine via the controller to download the initial APS virus sample from the file transfer virtual machine; and controlling the virus execution virtual machine via the controller to decrypt and decompress the initial APS virus sample to obtain a target APS virus sample.

[0076] In its implementation, to ensure the security of the physical machine, advanced persistent threat (APS) virus samples are transmitted using encryption and compression methods, with decompression and decompression only occurring during the execution of the virus sample. Specifically, the controller first uploads the encrypted and compressed initial APS virus sample to a file transfer virtual machine. Then, the controller controls the virus execution virtual machine to download the initial APS virus sample from the file transfer virtual machine. Next, the controller controls the virus execution virtual machine to decrypt and decompress the initial APS virus sample to obtain the target APS virus sample. Finally, the controller controls the virus execution virtual machine to run the decrypted and decompressed target APS virus sample.

[0077] It should be noted that after the advanced persistent threat virus sample is decrypted and decompressed, the network simulation virtual machine needs to be notified to enable the network traffic log collection function. At the same time, the virus execution virtual machine also needs to enable the system call log collection function. The virus sample is only run in the virus execution virtual machine after the network traffic log collection function and the system call log collection function are enabled.

[0078] Step S105: When the virus execution virtual machine is running the target advanced persistent threat virus sample, the system call behavior data on the end side is collected through the virus execution virtual machine, and the network communication behavior data on the network simulation virtual machine is collected.

[0079] In some embodiments, step S105 may include: when the virus execution virtual machine is running a target advanced persistent threat virus sample, collecting end-side system call behavior data through a system call log monitoring tool configured in the virus execution virtual machine; and collecting network-side communication behavior data through a network traffic monitoring tool configured in the network simulation virtual machine.

[0080] In some embodiments, after step S105, the method may further include: sending the endpoint system call behavior data to the network simulation virtual machine via the virus execution virtual machine; and uploading the endpoint system call behavior data and network communication behavior data to the file transfer virtual machine via the network simulation virtual machine.

[0081] The system call log monitoring tool uses Process Monitor, which supports command-line arguments, to monitor system calls made by the virus's virtual machine execution. This includes file read / write, registry read / modification, process creation / exit, and process injection. Once the virus sample has finished running or reached a specified runtime, system call log collection stops, and the logs are stored in a specified location (such as a network-simulated virtual machine) or uploaded to a file transfer virtual machine (FTP server). Specifically, Process Monitor's command-line arguments can be used to capture system call logs within a specific timeframe and export the logs to a file.

[0082] The network traffic monitoring tool uses the Tshark tool, which supports command-line parameter calls, to monitor the network traffic of the virus execution virtual machine, including network traffic such as DNS requests, HTTP requests, HTTPS requests, and TCP / UDP connections. After the virus sample finishes running or reaches the specified runtime, the network traffic logs are stored in a specified location or uploaded to a file transfer virtual machine (FTP server).

[0083] In practical implementation, Advanced Persistent Threat (APT) viruses perform a series of behaviors during their operation, categorized into endpoint-side and network-side behaviors. Endpoint-side behaviors refer to the virus's system call behaviors on the infected endpoints, including file read / write, registry reading and modification, process creation and exit, and process injection. Network-side behaviors refer to the virus's network communication behaviors, including communicating with the virus creator's server, probing the network environment of the infected endpoints, and propagating itself over the network. Therefore, this application's embodiment, by implementing endpoint-network collaborative measurement of APT attack behaviors, can obtain a large number of diverse APT virus sample data. This allows for a more comprehensive understanding of the working principles and mechanisms of various APT viruses, serving as a crucial means to deeply understand the behavioral characteristics of various APT attack viruses, uncover their potential patterns and commonalities, and providing the foundation and basis for implementing various new security defense technologies. Furthermore, it allows for the measurement of a series of APT attack samples without manual intervention, demonstrating both high efficiency and security.

[0084] Step S106: The controller transmits the terminal-side system call behavior data and the network-side communication behavior data to the physical machine.

[0085] In some embodiments, step S106 may include: downloading end-side system call behavior data and network-side communication behavior data from the file transfer virtual machine to the physical machine via the controller.

[0086] In the specific implementation, the system call behavior data of the client side is first sent to the network simulation virtual machine through the execution virtual machine of the virus. Then, the system call behavior data of the client side and the network communication behavior data are uploaded to the file transfer virtual machine through the network simulation virtual machine. Finally, the system call behavior data of the client side and the network communication behavior data can be downloaded from the file transfer virtual machine to the physical machine through the controller.

[0087] In another embodiment, the virus execution virtual machine can also directly upload end-side system call behavior data to the file transfer virtual machine.

[0088] Steps S101 to S106 as illustrated in this embodiment involve sending virtual machine configuration data to a virtual machine manager on the physical machine via a controller on the physical machine; creating a virtual network and several virtual machines based on the virtual machine configuration data via the virtual machine manager; the virtual machines include a file transfer virtual machine, a virus execution virtual machine, and a network simulation virtual machine, with the file transfer virtual machine used to manage log file data; simulating the actual external internet environment in the virtual network via the network simulation virtual machine to construct an external internet simulation environment; in the external internet simulation environment, controlling the virus execution virtual machine to run a target advanced persistent threat virus sample via the controller; when the virus execution virtual machine is running the target advanced persistent threat virus sample, collecting end-side system call behavior data via the virus execution virtual machine and collecting network-side communication behavior data via the network simulation virtual machine; and transmitting the end-side system call behavior data and network-side communication behavior data to the physical machine via the controller. This application's embodiments create a virtual network corresponding to the physical machine to simulate and test advanced persistent threat (APS) virus samples. Simultaneously, it simulates the actual external internet environment to construct an external internet simulation environment. This prevents virus samples from harming the physical network, provides a controlled environment for observing and analyzing virus behavior, reduces the impact of experiments on the actual network environment, enhances system security, and can provide a general or customizable isolation environment for different APS virus behavior samples. By controlling the virus execution virtual machine to run the virus sample through a controller, the virus sample is ensured to execute only within the virus execution virtual machine, reducing the risk of virus propagation and infection of other systems, thus protecting the physical machine's security. Through automated collection of end-side system call behavior data and network-side communication behavior data, detailed and comprehensive information is provided for analyzing the behavioral characteristics of APS viruses, improving the efficiency and accuracy of virus sample analysis. This provides a scientific basis for the formulation and implementation of defense strategies and a theoretical basis for subsequent rapid identification and response to APS threats, thereby further protecting network and information security.

[0089] To explain in detail the principle of the technical solution of the present invention, the overall process of the present invention will be described below with reference to some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and should not be regarded as a limitation of the present invention.

[0090] In the embodiments of this application, please refer to Figure 2 , Figure 2 This is a schematic diagram of the control process of the end-to-end network collaborative measurement system provided in the embodiments of this application, such as... Figure 2As shown, the end-to-end collaborative measurement system for advanced persistent threats (APPT) mainly consists of four parts: a controller, a virtual machine manager, a virus execution virtual machine, and a network simulation virtual machine. Its main execution approach is to use virtual machines to simulate the user-side virus runtime environment and external network communication environment, automatically collecting various virus-related behavioral data from both the endpoint and network sides during virus execution. Utilizing the isolation of virtual machines and virtual networks, it effectively prevents virus infection of physical machines while enabling automated measurement of virus behavior. It is suitable for measuring the behavior of various types of APT viruses and can be widely applied to security defense tasks such as behavioral research, commonality analysis, and early detection of various APT viruses. It has advantages such as automation, efficiency, and security, solving the fundamental problem of lacking a large amount of diverse real-world data in the design of AI-based intelligent defense solutions for APT viruses.

[0091] like Figure 2 As shown in the embodiments of this application, the specific working principles of the four modules of the end-to-end network collaborative measurement system for advanced persistent threats are as follows:

[0092] 1. Controller.

[0093] The controller runs on the physical machine and its role is to control the operation of the entire system. Its functions include the transmission of virus samples from the physical machine to the virtual machine, specific configurations and scripts from the physical machine to the virtual machine, and the transmission of traffic logs from the virtual machine to the physical machine. It can realize the automated measurement of advanced persistent threat virus behavior, support the measurement of multiple advanced persistent threat virus behavior samples, and provide customizable isolation environments for different samples.

[0094] The workflow involved in the controller includes the following steps 11 to 16:

[0095] Step 11, Read Configuration Files. The controller reads the relevant configuration files, including: the virtual machine configuration file (containing information such as the number of virtual machines, operating system type, and IP address of each virtual machine); the FTP server configuration file (containing the FTP server address, username, and password); the virus execution configuration file (specifying the virus sample to be tested, execution duration, storage path, and running mode); the log collection configuration file (setting the type, duration, and storage path for logs and traffic collection); and script files (specifying the script paths and execution order on each virtual machine). Configuration files are typically in JSON or YAML format for easy machine reading and parsing.

[0096] Step 12, Create Virtual Machines. The controller calls the virtual machine creation script, providing the virtual machine configuration file as a parameter to the virtual machine manager. The virtual machine manager creates the required virtual machine instances, including a file transfer virtual machine (FTP server) connecting the physical machine and the virtual network, and a series of virtual machines connected only to the virtual network (such as virus execution virtual machines and network emulation virtual machines).

[0097] Step 13: Distribute configuration files and virus samples to be tested. The controller selects the specified virus sample to be tested based on the virus execution configuration file and distributes the relevant configuration file and virus sample to each virtual machine instance. The transmission path for the relevant configuration file and virus sample is that it is uploaded from the physical machine to a file transfer virtual machine, and then downloaded to the corresponding location by each virtual machine. The distribution method is that the controller executes FTP upload scripts and FTP download scripts.

[0098] Step 14: Start end-to-end network measurement and run the virus. After transferring the relevant configuration files and execution scripts to each virtual machine, the controller only needs to trigger the corresponding scripts in a predetermined order to automatically perform virus sample decryption and decompression, virus execution, and end-to-end network measurement.

[0099] Step 15, Log Export. After the virus finishes running, the network simulation virtual machine packages the system call log file and network traffic log file and uploads them to the file transfer virtual machine. Finally, the controller executes an FTP download script in the file transfer virtual machine to download the log data to the physical machine.

[0100] Step 16, Cleanup and Recovery. The controller will shut down all virtual machines to complete the cleanup. Since the scripts that started the virtual machines specified the virtual disks as read-only, write operations on the disks will be discarded after the virtual machine instances are shut down. Alternatively, cleanup can be achieved by creating a disk snapshot from the disk image and restoring the disk image after shutdown.

[0101] 2. Virtual Machine Manager.

[0102] In its implementation, the virtual machine manager runs on the physical machine. The virtual machine manager includes virtualization software and scripts for creating virtual machine instances. Its role is to create multiple virtual machines that meet specific requirements based on configuration files, enabling automated measurement of advanced persistent threat virus samples. To automate the measurement process, command-line controlled virtualization software, such as QEMU or VirtualBox, can be used.

[0103] The workflow involved in the virtual machine manager includes the following steps 21 to 23:

[0104] Step 21, Read the configuration file. The virtual machine manager receives the virtual machine configuration file from the controller. The virtual machine configuration file contains information such as the number of virtual machines, operating system, IP address, gateway, and domain name server.

[0105] Step 22: Create virtual machine instances. Based on the information in the virtual machine configuration file from Step 21, the virtual machine manager calls the corresponding virtual machine instance creation script to create multiple virtual machines. The disk image file for the virtual machines can be customized or a default image can be used. The default image contains the operating system and some basic measurement tools. The image template for running the virus contains the user's operating system, applications, and other environment. Optionally, it can be made more similar to an actual user terminal by placing several data files such as documents, spreadsheets, images, and videos.

[0106] Step 23, Configure the virtual machine network. After the virtual machine instance is created, you can connect to the virtual machine from the physical machine via a serial terminal or the daemon provided by the virtualization software. Configure the virtual machine's network via the serial terminal, including IP address, gateway, and domain name server.

[0107] Please see Figure 3 , Figure 3 This is a schematic diagram of the connection structure between the physical machine and the virtual network provided in an embodiment of this application; as shown... Figure 3 As shown, the virtual machine instances required for the Virtual Machine Manager to create include a file transfer virtual machine (FTP server) that connects the physical machine and the virtual network, as well as a series of virtual machines that only connect to the virtual network (such as virus execution virtual machines and network emulation virtual machines).

[0108] 3. The virus executes a virtual machine.

[0109] In the implementation, the virus execution component runs in a virtual machine, responsible for receiving and running advanced persistent threat (APS) virus samples. Furthermore, the virus execution virtual machine is also used for automated collection of system call behavior data from the endpoint. To ensure the security of the physical machine, APS virus samples are transmitted using encryption and compression methods during the research process, with decryption and decompression only performed during sample execution. To achieve this, decryption and decompression functions are included in the virus execution virtual machine.

[0110] The workflow involved in the virus executing the virtual machine includes the following steps 31 to 35:

[0111] Step 31: Receive configuration file and virus sample. The virus execution virtual machine accesses the file transfer virtual machine according to the controller's command, downloads the encrypted compressed package containing the virus sample and related execution configuration files (such as the virus execution configuration file) from the file transfer virtual machine, and obtains information such as sample path, compressed package password, and execution parameters from the relevant configuration files.

[0112] Step 32, Decryption and Decompression. To decrypt and decompress the encrypted compressed package, the virus execution virtual machine has a built-in decryption and decompression tool (such as a command-line tool like 7z). The controller triggers the decryption and decompression script of the virus execution virtual machine to obtain the executable file of the virus sample. To prevent the virus sample from being cleaned up by the system's built-in security software, the virus execution virtual machine temporarily disables the system's built-in security software before decryption and decompression.

[0113] Step 33: Notify the network simulation virtual machine to enable network traffic log collection. Before running the virus sample, the virus execution virtual machine notifies the network simulation virtual machine to enable the collection of network traffic logs.

[0114] Step 34, System Log Collection. System call behavior data on the client side is collected using a system call log monitoring tool configured in the virus execution virtual machine. Specifically, this embodiment uses the Process Monitor tool, which supports command-line arguments, to monitor system calls made by the virus execution virtual machine, including file read / write, registry read / modification, process creation / exit, process injection, and other system call behaviors. After the virus sample finishes running or reaches a specified runtime, system call log collection stops, and the system call logs are stored in a specified location (such as a network simulation virtual machine) or uploaded to a file transfer virtual machine. Specifically, the command-line arguments of Process Monitor can be used to capture system call logs within a specific time period and export the logs to a file.

[0115] Step 35: Execute the virus sample. According to the virus execution configuration file, the virus execution virtual machine runs the virus sample. The execution method varies depending on the virus sample. For example, the execution method may require system administrator privileges, execution at a specific time, post-execution actions mimicking user behavior, or the virus runtime may need to be controlled within a certain range. After the virus sample finishes running or reaches the specified runtime, the virus execution virtual machine stops collecting system call logs and uploads the local system logs to the network simulation virtual machine. After uploading, the virus execution virtual machine is shut down to terminate the virus execution.

[0116] 4. Network simulation virtual machine.

[0117] In its implementation, the network simulation component runs on a virtual machine. This virtual machine is responsible for simulating a network environment isolated from the physical machine and for collecting network-side communication behavior data related to the operation of advanced persistent threat (APS) viruses. The log data collected on the virtual machine includes network traffic logs and system call logs uploaded by the virus execution virtual machine. Since the propagation, control, and data leakage of APS viruses typically require communication with external servers, the virtual machine needs to simulate an external internet server (such as...). Figure 3 (External network shown). In this embodiment, the network simulation virtual machine uses Inetsim and Burp network simulation tools. Inetsim simulates an external server, and Burp simulates a proxy server. The workflow involved in the network simulation virtual machine includes the following steps 41 to 44:

[0118] Step 41: Receive configuration file. The network simulation virtual machine accesses the file transfer virtual machine according to the controller's commands and downloads the relevant configuration file from the file transfer virtual machine. Based on the configuration file, it obtains network simulation configuration information such as the network simulation tool's running configuration, accessible network addresses, and return results, as well as network log collection configuration information such as the traffic log collection port, collection duration, and log file storage location. Finally, it writes the network simulation configuration to the end of the network simulation tool's default configuration file.

[0119] Step 42, set up the network simulation environment. Please refer to [link / reference]. Figure 4 , Figure 4 This is a schematic diagram of the network module provided in an embodiment of this application; as shown Figure 4 As shown in this embodiment, Inetsim is used as the gateway and domain name server for the virtual machine, and Burp is used as the HTTPS proxy server. In real-world scenarios, other tools can be used to simulate the real network, and this embodiment does not impose any restrictions on this. Inetsim can simulate various network services, including DNS, HTTP, HTTPS, FTP, SMTP, etc. By configuring Inetsim, external servers can be simulated, including DNS resolution results, testing the connectivity of specific addresses, HTTP / HTTPS requests, etc., allowing the virus to communicate with the simulated external server. Simultaneously, Inetsim's FTP service can be used to transfer virus samples from physical machines to virtual machines, distribute them between virtual machines, collect traffic logs, and transfer traffic logs from virtual machines to physical machines. Burp is a proxy tool for intercepting and modifying HTTP requests. By configuring Burp as a proxy server and installing Burp's CA certificate as the root certificate in the virtual machine running the virus sample, the TLS traffic generated by the virus can be decrypted, enabling the collection of both encrypted and plaintext network traffic logs.

[0120] Step 43: Collect network traffic logs. After receiving the notification that the traffic log collection function of the virus execution virtual machine has been enabled, the network module in the network simulation virtual machine starts network traffic collection through a network traffic monitoring tool. In this embodiment, the network traffic of the virtual machine where the virus execution virtual machine resides is monitored using the Tshark tool, which supports command-line parameter calls. This includes network traffic such as DNS requests, HTTP requests, HTTPS requests, and TCP / UDP connections. After the virus sample finishes running or reaches a specified runtime, the network traffic logs are stored in a specified location or uploaded to a file transfer virtual machine.

[0121] Step 44, Log Transfer. After log collection is complete, the network module in the network simulation virtual machine packages and uploads the system call logs and network traffic logs to the file transfer virtual machine according to the controller's commands.

[0122] Please see Figure 5 , Figure 5 This is a schematic diagram of the execution process of a virus sample provided in an embodiment of this application; as shown Figure 5 As shown, the specific implementation process of virus sample execution and log data collection is as follows: First, the encrypted compressed package of the advanced persistent threat virus sample and related configuration files (such as the virus execution configuration file and the log collection configuration file) are uploaded to the file transfer virtual machine (i.e., Figure 5 The process involves several steps: First, the execution module in the virus execution virtual machine (hereinafter referred to as the "file transfer server") downloads the encrypted compressed package of the Advanced Persistent Threat (APPT) virus sample and related configuration files from the file transfer virtual machine. Next, the execution module in the virus execution virtual machine decrypts and decompresses the encrypted compressed package of the APPT virus sample. Then, the virus execution virtual machine instructs the network module in the network simulation virtual machine to enable the collection of network traffic log data. Simultaneously, the system call log data collection function of the execution module in the virus execution virtual machine also needs to be enabled. After both the system call log data collection function and the network traffic log data collection function are enabled, the controller controls the execution module in the virus execution virtual machine to run the decrypted and decompressed APPT virus sample. During this period, the execution module in the virus execution virtual machine collects endpoint system call behavior data, and the network module in the network simulation virtual machine collects network-side communication behavior data. After the virus sample finishes running or reaches the specified runtime, the virus execution virtual machine stops collecting system call logs and sends the endpoint system call behavior data collected by the execution module in the virus execution virtual machine to the network simulation virtual machine. The network module in the network simulation virtual machine then uploads the endpoint system call behavior data and network-side communication behavior data to the file transfer virtual machine.

[0123] Please see Figure 6 , Figure 6 This is a flowchart illustrating an end-to-end network collaborative measurement method for advanced persistent threats; such as... Figure 6 As shown, the general process of the end-to-end network collaborative measurement method for advanced persistent threats includes the following steps 61 to 611:

[0124] Step 61: Before starting the end-to-end network collaborative measurement, first prepare the necessary virtual machine images and script files. These include scripts for creating and deleting virtual machine instances, setting virtual machine instance IP addresses, gateways, and domain name servers, scripts for transferring files between virtual machines for uploading and downloading files, scripts for decompressing and executing high-threat virus samples, scripts for calling relevant interfaces to collect system logs, scripts for simulating a real network environment using relevant tools, and scripts for collecting traffic on network interfaces. Also included are custom configuration files required to run these scripts, exemplarily specifying the required number of virtual machines and operating system type, the IP address of each virtual machine, the FTP server address and username / password, and the duration of virus execution and log collection.

[0125] Step 62: The controller provides the virtual machine configuration data to the virtual machine manager. The virtual machine manager calls the virtual machine creation script to create the required virtual machine instances, including a file transfer virtual machine (FTP server) that connects the physical machine and the virtual network, and a series of virtual machines that are only connected to the virtual network (such as virus execution virtual machines and network simulation virtual machines).

[0126] To prevent viruses from leaking to the outside world through the network, the IP address, gateway, and domain name server of each virtual machine instance are configured on the physical machine through a serial terminal or the daemon provided by the virtualization software, according to the virtual machine network configuration.

[0127] Step 63: The controller uploads the high-threat persistent virus sample, related scripts, and configuration files to the file transfer virtual machine. After the upload is complete, the necessary scripts and files are downloaded from the file transfer virtual machine on each virtual machine via a serial terminal on the physical machine. After the download is complete, the file transfer virtual machine is shut down to isolate the physical machine from the virtual machine network. Subsequent commands are executed on the serial terminal.

[0128] Step 64: Control the network module in the network simulation virtual machine to execute the network simulation script through the controller, so as to simulate the actual network environment according to the network configuration.

[0129] Step 65: Control the execution module in the virus execution virtual machine to decrypt and decompress the compressed package containing the virus sample through the controller.

[0130] Step 66: Execute the script for network-side traffic collection in the network simulation virtual machine to start traffic collection; at the same time, execute the script for end-side system log collection in the virus execution virtual machine to start system log collection.

[0131] Step 67: The controller controls the execution module in the virus execution virtual machine to execute the virus execution script to run the virus sample. During this period, the system call behavior data on the end side is collected through the virus execution virtual machine, and the network side communication behavior data is collected through the network simulation virtual machine.

[0132] Step 68: After the virus execution virtual machine detects that the virus has finished running and exited or has reached the runtime specified in the configuration file, it stops collecting end-side system call behavior data and notifies the network simulation virtual machine to stop collecting network-side communication behavior data. The virus execution virtual machine packages the end-side system call behavior data and uploads it to the network simulation virtual machine, and then shuts down the virus execution virtual machine.

[0133] Step 69: After the virus execution virtual machine is shut down, the controller starts the file transfer virtual machine. The network simulation virtual machine uploads the end-side system call behavior data and network-side communication behavior data to the file transfer virtual machine.

[0134] Step 610: The controller on the physical machine transfers the virtual machine's download-side system call behavior data and network-side communication behavior data from the file.

[0135] Step 611: The controller shuts down all virtual machines and reverts the virtual machine state to the state before this measurement, completing this measurement and preparing to start the measurement of the next virus sample.

[0136] In summary, the end-to-end network collaborative measurement method for advanced persistent threats (APPT) provided in this application mainly includes two parts: system call log data collection on the terminal side and network traffic log data collection on the network side, thus realizing collaborative measurement between the end and network. That is, the end-to-end network collaborative measurement method for APPT provided in this application can achieve automated measurement of APPT virus behavior, support the measurement of multiple APPT virus behavior samples, and provide customizable isolation environments for different samples. It is applicable to research, analysis, and early defense scheme design of APPT virus behavior, and the resulting high-quality dataset can provide a foundation and basis for the research of various new security defense technologies.

[0137] It should be noted that this embodiment is only a brief illustrative description of the overall process of the end-to-end network collaborative measurement method for advanced persistent threats. Detailed descriptions of each step can be found in the relevant content of the foregoing embodiments, and will not be repeated here. It is understood that the present invention does not limit this.

[0138] This application embodiment sends virtual machine configuration data to a virtual machine manager on the physical machine via a controller on the physical machine. The virtual machine manager creates a virtual network and several virtual machines based on the virtual machine configuration data. The virtual machines include a file transfer virtual machine, a virus execution virtual machine, and a network simulation virtual machine. The file transfer virtual machine is used to manage log file data. The network simulation virtual machine simulates the actual external Internet environment in the virtual network to construct an external Internet simulation environment. In the external Internet simulation environment, the controller controls the virus execution virtual machine to run a target advanced persistent threat virus sample. When the virus execution virtual machine is running the target advanced persistent threat virus sample, it collects endpoint system call behavior data and network communication behavior data through the network simulation virtual machine. The controller transmits the endpoint system call behavior data and network communication behavior data to the physical machine. This application's embodiments create a virtual network corresponding to the physical machine to simulate and test advanced persistent threat (APS) virus samples. Simultaneously, it simulates the actual external internet environment to construct an external internet simulation environment. This prevents virus samples from harming the physical network, provides a controlled environment for observing and analyzing virus behavior, reduces the impact of experiments on the actual network environment, enhances system security, and can provide a general or customizable isolation environment for different APS virus behavior samples. By controlling the virus execution virtual machine to run the virus sample through a controller, the virus sample is ensured to execute only within the virus execution virtual machine, reducing the risk of virus propagation and infection of other systems, thus protecting the physical machine's security. Through automated collection of end-side system call behavior data and network-side communication behavior data, detailed and comprehensive information is provided for analyzing the behavioral characteristics of APS viruses, improving the efficiency and accuracy of virus sample analysis. This provides a scientific basis for the formulation and implementation of defense strategies and a theoretical basis for subsequent rapid identification and response to APS threats, thereby further protecting network and information security.

[0139] In summary, the end-to-end network collaborative measurement method for advanced persistent threats provided in this application has the following advantages:

[0140] (1) Traditional measurement methods mainly rely on manual intervention to measure the behavior of advanced persistent threat viruses, which is inefficient and cannot achieve automated measurement. However, the embodiments of this application can achieve automated measurement of the behavior of advanced persistent threat viruses.

[0141] (2) Traditional measurement methods are often targeted at specific scenarios and limited viruses, resulting in fixed schemes and lack of flexibility when facing a large number of advanced persistent threat virus behavior samples. However, the embodiments of this application can provide a general or customizable isolation environment for different advanced persistent threat virus behavior samples.

[0142] (3) The end-to-end collaborative measurement system for advanced persistent threats provided in this application embodiment can measure the behavior of a series of advanced persistent threat virus samples without human intervention. It has the characteristics of high efficiency and security, and is suitable for the measurement of large-scale advanced persistent threat virus behavior. It generates high-quality real sample behavior logs and datasets, providing a basis and basis for the research of various new security defense technologies.

[0143] (4) The end-to-end network collaborative measurement system for advanced persistent threats provided in this application is flexible and customizable. Different system environments can be created through virtual machines to study the behavior patterns of different advanced persistent threat viruses under different conditions. This provides a large number of real end-to-end network collaborative measurement data samples for building a robust detection and defense system, thereby solving the problem of severe data shortage in the defense of advanced persistent threats.

[0144] Please see Figure 7 This application also provides an end-to-end network collaborative measurement device 700 for advanced persistent threats, which can implement the above-mentioned end-to-end network collaborative measurement method for advanced persistent threats. The device includes the following modules:

[0145] The virtual machine configuration data sending module 701 is used to send virtual machine configuration data to the virtual machine manager on the physical machine via the controller on the physical machine.

[0146] The virtualization runtime environment creation module 702 is used to create a virtual network and several virtual machines according to the virtual machine configuration data through the virtual machine manager; wherein, the virtual machines include a file transfer virtual machine, a virus execution virtual machine, and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data;

[0147] The external internet environment simulation module 703 is used to simulate the actual external internet environment in the virtual network through the network simulation virtual machine, so as to construct an external internet simulation environment;

[0148] The virus sample execution module 704 is used to control the virus execution virtual machine to run the target advanced persistent threat virus sample in the external Internet simulation environment through the controller;

[0149] The behavior data acquisition module 705 is used to collect end-side system call behavior data through the virus execution virtual machine and to collect network-side communication behavior data through the network simulation virtual machine when the virus execution virtual machine is running the target advanced persistent threat virus sample.

[0150] The behavior data transmission module 706 is used to transmit the end-side system call behavior data and the network-side communication behavior data to the physical machine through the controller.

[0151] It is understood that the content of the above method embodiments is applicable to the present device embodiments. The specific functions implemented by the present device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0152] This application also provides an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned end-to-end network collaborative measurement method for advanced persistent threats. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0153] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0154] Please see Figure 8 , Figure 8 The hardware structure of an electronic device according to another embodiment is illustrated. The electronic device includes:

[0155] The processor 801 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0156] The memory 802 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 802 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 802 and is called and executed by the processor 801 to implement the end-to-end network collaborative measurement method for advanced persistent threats according to the embodiments of this application.

[0157] The 803 input / output interface is used to implement information input and output.

[0158] The communication interface 804 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0159] Bus 805 transmits information between various components of the device (e.g., processor 801, memory 802, input / output interface 803, and communication interface 804);

[0160] The processor 801, memory 802, input / output interface 803, and communication interface 804 are connected to each other within the device via bus 805.

[0161] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described end-to-end network collaborative measurement method for advanced persistent threats.

[0162] It is understood that the content of the above method embodiments is applicable to this storage medium embodiment. The specific functions implemented in this storage medium embodiment are the same as those in the above method embodiments, and the beneficial effects achieved are also the same as those achieved in the above method embodiments.

[0163] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0164] The endpoint-network collaborative measurement method and device for advanced persistent threats (APPT) provided in this application embodiment send virtual machine configuration data to a virtual machine manager on the physical machine via a controller on the physical machine. The virtual machine manager creates a virtual network and several virtual machines based on the virtual machine configuration data. The virtual machines include a file transfer virtual machine, a virus execution virtual machine, and a network simulation virtual machine. The file transfer virtual machine is used to manage log file data. The network simulation virtual machine simulates the actual external Internet environment in the virtual network to construct an external Internet simulation environment. In the external Internet simulation environment, the controller controls the virus execution virtual machine to run a target APPT virus sample. When the virus execution virtual machine is running the target APPT virus sample, it collects endpoint system call behavior data and network communication behavior data through the network simulation virtual machine. The controller transmits the endpoint system call behavior data and network communication behavior data to the physical machine. This application's embodiments create a virtual network corresponding to the physical machine to simulate and test advanced persistent threat (APS) virus samples. Simultaneously, it simulates the actual external internet environment to construct an external internet simulation environment. This prevents virus samples from harming the physical network, provides a controlled environment for observing and analyzing virus behavior, reduces the impact of experiments on the actual network environment, enhances system security, and can provide a general or customizable isolation environment for different APS virus behavior samples. By controlling the virus execution virtual machine to run the virus sample through a controller, the virus sample is ensured to execute only within the virus execution virtual machine, reducing the risk of virus propagation and infection of other systems, thus protecting the physical machine's security. Through automated collection of end-side system call behavior data and network-side communication behavior data, detailed and comprehensive information is provided for analyzing the behavioral characteristics of APS viruses, improving the efficiency and accuracy of virus sample analysis. This provides a scientific basis for the formulation and implementation of defense strategies and a theoretical basis for subsequent rapid identification and response to APS threats, thereby further protecting network and information security.

[0165] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0166] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0167] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0168] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0169] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0170] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0171] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0172] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0173] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0174] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0175] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. An end-to-end network collaborative measurement method for advanced persistent threats, characterized in that, The method includes the following steps: The virtual machine configuration data is sent from the controller on the physical machine to the virtual machine manager on the physical machine. The virtual machine manager creates a virtual network and several virtual machines based on the virtual machine configuration data; wherein, the virtual machines include a file transfer virtual machine, a virus execution virtual machine, and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data; The network simulation virtual machine simulates the actual external Internet environment in the virtual network to construct an external Internet simulation environment; In the simulated external internet environment, the controller controls the virus execution virtual machine to run a target advanced persistent threat virus sample. When the virus execution virtual machine is running the target advanced persistent threat virus sample, it collects end-side system call behavior data through the virus execution virtual machine and network-side communication behavior data through the network simulation virtual machine. The controller transmits the terminal-side system call behavior data and the network-side communication behavior data to the physical machine. The process of simulating the actual external internet environment in the virtual network through the network simulation virtual machine to construct an external internet simulation environment includes: In the virtual network, the network simulation virtual machine simulates the actual external Internet environment according to network simulation configuration data to construct the external Internet simulation environment; wherein, the external Internet simulation environment includes a virtual external server, which is used to communicate with the target advanced persistent threat virus sample running on the virus execution virtual machine; Before controlling the virus execution virtual machine to run the target advanced persistent threat virus sample via the controller, the method further includes: The controller uploads an initial advanced persistent threat (APS) virus sample to the file transfer virtual machine; wherein the initial APS virus sample is an encrypted and compressed virus sample. The controller controls the virus execution virtual machine to download the initial advanced persistent threat virus sample from the file-to-virtual machine; The controller controls the virus execution virtual machine to decrypt and decompress the initial advanced persistent threat virus sample to obtain the target advanced persistent threat virus sample.

2. The method according to claim 1, characterized in that, Before constructing the external internet simulation environment by simulating the actual external internet environment in the virtual network through the network simulation virtual machine, the method further includes: The controller uploads network simulation configuration data to the file transfer virtual machine. The controller controls the network simulation virtual machine to download the network simulation configuration data from the file transfer virtual machine.

3. The method according to claim 1, characterized in that, When the virus execution virtual machine is running the target advanced persistent threat virus sample, the process of collecting client-side system call behavior data through the virus execution virtual machine and collecting network-side communication behavior data through the network simulation virtual machine includes: When the virus execution virtual machine is running the target advanced persistent threat virus sample, the system call behavior data on the end side is collected by the system call log monitoring tool configured in the virus execution virtual machine; The network-side communication behavior data is collected using a network traffic monitoring tool configured in the network simulation virtual machine.

4. The method according to claim 1, characterized in that, After the method collects endpoint system call behavior data through the virus execution virtual machine and network-side communication behavior data through the network simulation virtual machine when the virus execution virtual machine is running the target advanced persistent threat virus sample, the method further includes: The virus executes the virtual machine to send the endpoint system call behavior data to the network simulation virtual machine; The network simulation virtual machine uploads the end-side system call behavior data and the network-side communication behavior data to the file transfer virtual machine.

5. The method according to claim 4, characterized in that, The step of transmitting the end-side system call behavior data and the network-side communication behavior data to the physical machine via the controller includes: The controller downloads the endpoint system call behavior data and the network-side communication behavior data from the file transfer virtual machine to the physical machine.

6. An end-to-end network collaborative measurement device for advanced persistent threats, characterized in that: The device includes the following modules: The virtual machine configuration data sending module is used to send virtual machine configuration data to the virtual machine manager on the physical machine via the controller on the physical machine. The virtualization runtime environment creation module is used to create a virtual network and several virtual machines according to the virtual machine configuration data through the virtual machine manager; wherein, the virtual machines include a file transfer virtual machine, a virus execution virtual machine, and a network simulation virtual machine, and the file transfer virtual machine is used to manage log file data; An external internet environment simulation module is used to simulate the actual external internet environment in the virtual network through the network simulation virtual machine, so as to construct an external internet simulation environment; The virus sample execution module is used to control the virus execution virtual machine to run a target advanced persistent threat virus sample in the external Internet simulation environment through the controller; The behavior data acquisition module is used to collect end-side system call behavior data through the virus execution virtual machine and network-side communication behavior data through the network simulation virtual machine when the virus execution virtual machine is running the target advanced persistent threat virus sample. The behavior data transmission module is used to transmit the end-side system call behavior data and the network-side communication behavior data to the physical machine through the controller; The external internet environment simulation module is specifically used for: In the virtual network, the network simulation virtual machine simulates the actual external Internet environment according to network simulation configuration data to construct the external Internet simulation environment; wherein, the external Internet simulation environment includes a virtual external server, which is used to communicate with the target advanced persistent threat virus sample running on the virus execution virtual machine; The device is also used for: The controller uploads an initial advanced persistent threat (APS) virus sample to the file transfer virtual machine; wherein the initial APS virus sample is an encrypted and compressed virus sample. The controller controls the virus execution virtual machine to download the initial advanced persistent threat virus sample from the file-to-virtual machine; The controller controls the virus execution virtual machine to decrypt and decompress the initial advanced persistent threat virus sample to obtain the target advanced persistent threat virus sample.

7. An electronic device, characterized in that, The electronic device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method according to any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 5.

Images