A method and apparatus for detecting lateral movement behavior of encrypted traffic

Abstract

This invention provides a method and apparatus for detecting lateral movement behavior in encrypted traffic, relating to the field of network security technology. The method includes: first, using an eBPF probe mounted at a critical location in the network protocol stack to capture network traffic data about to be encrypted; second, filtering communication traffic related to lateral movement attacks and matching the relevant communication traffic against predefined lateral movement rules. If a match is found between the traffic and the lateral movement attack rules, it is determined that the target host exhibits lateral movement behavior. Otherwise, a dynamically adjusted behavior model is used to further analyze traffic anomalies, and a security alert is triggered when suspicious behavior is detected. This invention can utilize eBPF combined with known attack characteristics and a behavior analysis model to identify encrypted lateral movement attack behavior, improving the accuracy of identification.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for detecting lateral movement behavior of encrypted traffic. Background Technology

[0002] Lateral movement is a common and high-risk attack technique in modern cyberattacks, typically occurring in internal network environments. After gaining control of a host within the internal network, an attacker uses that host to access other hosts, gradually expanding their control until they gain access to critical data or systems. Lateral movement not only allows attackers to acquire more system privileges but can also lead to the collapse of the entire internal network and data breaches.

[0003] Existing methods for identifying network attacks generally target individual hosts, analyzing their traffic data to determine if they are under attack. However, lateral movement primarily involves hosts attacking other hosts to expand their control scope. Therefore, simply using methods targeting individual hosts for attack identification results in low accuracy. Summary of the Invention

[0004] This invention provides a method and apparatus for detecting lateral movement behavior in encrypted traffic. By linking the communication between multiple hosts on the same intranet, it identifies lateral movement attack behavior, thereby improving the accuracy of identification.

[0005] In a first aspect, embodiments of the present invention provide a method for detecting lateral movement behavior of encrypted traffic, comprising:

[0006] Use eBPF to capture valid messages on the target host before encryption;

[0007] Extract the metadata fields that match the filtering rules from the packet header protocol stack of the valid message, and concatenate the matching metadata fields; wherein, the filtering rules are determined based on the communication type between the target host and other hosts on the same intranet as the target host;

[0008] The concatenated metadata fields are matched with the preset fields corresponding to the filtering rules; wherein, the preset fields corresponding to the filtering rules are fields that would appear if the communication type of the filtering rule is valid and the lateral movement behavior exists.

[0009] If the concatenated metadata fields match the preset fields corresponding to the filtering rules, then it is determined that the target host has engaged in lateral movement behavior.

[0010] The above method can extract the metadata fields of valid packets from multiple valid packets before encryption, according to the communication type between the target host and other hosts in the same intranet. It then uses the metadata fields and preset fields corresponding to the filtering rules to match them. If a match is found, it is determined that there is lateral movement behavior. In this way, by associating the communication between multiple hosts in the same intranet, lateral movement attack behavior can be identified, thus improving the accuracy of identification.

[0011] In one possible implementation, before extracting metadata fields that conform to the filtering rules from the packet header protocol stack of the valid message, the method further includes:

[0012] Valid packets that do not contain the rules for forming the predetermined internal network IP address will be deleted.

[0013] The above method can delete valid packets that do not contain the predetermined internal network IP address formation rules, that is, delete valid packets that do not belong to communication between internal networks. This avoids traffic interference between the host and external devices and improves the purity of network traffic data.

[0014] In one possible implementation, metadata fields conforming to the filtering rules are extracted from the packet header protocol stack of the valid message, including:

[0015] According to each filtering rule, multiple valid packets are divided to obtain the valid packets corresponding to each filtering rule;

[0016] Based on the preset fields corresponding to each filtering rule, extract metadata fields from the valid messages corresponding to each filtering rule.

[0017] The above method can filter out different metadata fields based on different filtering rules determined for different communication types, thereby determining whether the target host has lateral movement behavior for valid messages of different communication types, thus improving the accuracy of the determination.

[0018] In one possible implementation, the metadata field includes multiple individual fields and statistical fields; based on the preset fields corresponding to each filtering rule, the metadata field is extracted from the valid messages corresponding to each filtering rule, including:

[0019] For each filtering rule, if the metadata field corresponding to the filtering rule is a separate field, then extract the separate field from each valid message corresponding to the filtering rule.

[0020] If the metadata field corresponding to the filtering rule is a statistical field, then from the multiple valid messages corresponding to the filtering rule, count the number of messages that contain all the individual fields corresponding to the filtering rule, and use the counted number as the statistical field.

[0021] In one possible implementation, eBPF is used to capture valid messages on the target host before encryption, including:

[0022] On the target host, multiple valid messages before encryption are captured by an eBPF program mounted at the application and transport layers of the encryption protocol.

[0023] The above method can obtain plaintext information by capturing multiple network traffic data before encryption through an eBPF program mounted on the application and transport layers of the encryption protocol on the target host, thus improving the accuracy of identification.

[0024] In one possible implementation, the method further includes:

[0025] If neither the concatenated metadata field nor the preset field corresponding to the filtering rule shows a match, the concatenated metadata field is input into the prediction model to obtain the prediction result, wherein the prediction result indicates that the target host exhibits lateral movement behavior or that the target host does not exhibit lateral movement behavior.

[0026] The above method can further improve the accuracy of identification by using a prediction model when the target host is determined to have no lateral movement behavior using filtering rules.

[0027] In one possible implementation, the method further includes:

[0028] Determine whether the target host exhibits actual lateral movement behavior;

[0029] If the actual situation differs from the prediction result, the parameters in the prediction model are adjusted according to the actual situation until the prediction result of the prediction model for multiple concatenated metadata fields is the same as the actual situation. Alternatively, a modification interface is provided to the maintenance user, and the prediction model is updated according to the parameters of the prediction model entered by the maintenance user in the modification interface.

[0030] The above method can automatically adjust the prediction model or allow users to modify the parameters of the prediction model when the actual situation differs from the prediction result, thereby improving the accuracy of the prediction model.

[0031] Secondly, embodiments of the present invention provide a device for detecting lateral movement behavior of encrypted traffic, comprising:

[0032] The capture module is used to capture valid packets on the target host before encryption using eBPF;

[0033] The extraction module is used to extract metadata fields that meet the filtering rules from the packet header protocol stack of the valid message, and concatenate the matching metadata fields; wherein, the filtering rules are determined based on the communication type between the target host and other hosts on the same intranet as the target host;

[0034] The matching module is used to match the concatenated metadata fields with the preset fields corresponding to the filtering rules; wherein, the preset fields corresponding to the filtering rules are fields that will appear in valid messages of the communication type of the filtering rules if the lateral movement behavior exists; if there is a rule match between the concatenated metadata fields and the preset fields corresponding to the filtering rules, it is determined that the target host has lateral movement behavior.

[0035] Thirdly, embodiments of the present invention provide an electronic device, comprising:

[0036] processor;

[0037] A processor for executing a computer program or instructions in the memory, such that the method for detecting lateral movement of encrypted traffic as described in any of the first aspects is executed.

[0038] Fourthly, embodiments of the present invention provide a computer-readable storage medium that, when instructions in the storage medium are executed by a processor, enables the processor to perform a lateral movement behavior detection method for encrypted traffic as described in any of the first aspects.

[0039] Fifthly, embodiments of the present invention provide a computer program product, the computer program product comprising: computer program code, which, when executed on a computer, causes the computer to perform the lateral movement behavior detection method for encrypted traffic as described in any of the first aspects.

[0040] Furthermore, the technical effects of any of the implementation methods in the second to fifth aspects can be found in the technical effects of different implementation methods in the first aspect, and will not be repeated here.

[0041] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description

[0042] Figure 1 A structural diagram of an intranet system provided in an embodiment of the present invention;

[0043] Figure 2 A flowchart illustrating a method for detecting lateral movement behavior of encrypted traffic, provided as an embodiment of the present invention;

[0044] Figure 3A flowchart illustrating a method for dividing multiple network traffic data into an array, as provided in an embodiment of the present invention;

[0045] Figure 4 A schematic diagram illustrating the matching of arrays and lateral movement attack rules, provided as an embodiment of the present invention;

[0046] Figure 5 This is a schematic diagram illustrating the capture of network traffic data before encryption, provided as an embodiment of the present invention.

[0047] Figure 6 A flowchart of another method for detecting lateral movement behavior of encrypted traffic provided in an embodiment of the present invention;

[0048] Figure 7 A schematic diagram illustrating the adjustment of parameters for a prediction model, provided in an embodiment of the present invention;

[0049] Figure 8 A structural diagram of a transverse motion detection device for encrypted traffic provided in an embodiment of the present invention;

[0050] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0052] In the description of the embodiments of this application, unless otherwise stated, "multiple" refers to two or more.

[0053] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature.

[0054] Definitions:

[0055] Intranet: Also known as a local area network, such as internet cafes, campus networks, and office networks. An intranet requires a server or router as a gateway to access the internet. The server acting as the gateway has a public IP address, and the IP addresses of other computers on the intranet can be freely set based on it, provided that the first three digits of the IP address are the same as its public IP address, and the fourth digit can be any number from 0 to 255 but must be different from the server's IP address.

[0056] eBPF (extended Berkeley Packet Filter) program: A high-efficiency program that runs in the kernel to monitor and analyze system events, especially network traffic and system calls.

[0057] Lateral movement: A technique used by network attackers to expand their attack scope by accessing other hosts after successfully compromising a host.

[0058] Encrypted traffic: Data transmitted via encryption protocols (such as TLS, SSL, SSH, etc.) whose content cannot be viewed directly without authorization.

[0059] The present invention will be described in detail below with reference to the accompanying drawings:

[0060] Combination Figure 1 As shown, this embodiment of the invention provides an intranet system including multiple hosts and a gateway 100. The multiple hosts include host 1, host 2, ..., host n. The gateway 100 provides a public IP address. The IP addresses of host 1, host 2, ..., host n are configured based on the public IP address, and the first three digits of each IP address are the same as the public IP address. When host 1 is attacked, the attacker is likely to use host 1 to attack host 2, host 3, or other hosts in the intranet system, thus forming a lateral movement attack.

[0061] However, existing attack identification methods mainly focus on identifying the network behavior of a single host and do not pay special attention to the characteristics of lateral movement attacks, resulting in relatively low accuracy in identifying lateral movement attacks.

[0062] Based on this, embodiments of the present invention provide a lateral movement behavior detection scheme, which identifies lateral movement attack behavior by means of communication association between multiple hosts in the same intranet, thereby improving the accuracy of identification.

[0063] The detection scheme provided by the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0064] Combination Figure 2 As shown, this embodiment of the invention provides a method for detecting lateral movement behavior of encrypted traffic, including:

[0065] S200: Use eBPF to capture valid messages on the target host before encryption.

[0066] For example, the target host can be Figure 1 Any one of the hosts in the target host. Capture the valid messages that require encryption but are not encrypted on the target host. This can help to understand the content inside the valid messages.

[0067] S201: Extract the metadata fields that match the filtering rules from the packet header protocol stack of valid messages, and concatenate the matching metadata fields; wherein, the filtering rules are determined based on the communication type between the target host and other hosts on the same intranet as the target host.

[0068] The communication type includes both types determined by different communication protocols and types determined by different communication commands. The communication protocol is the network protocol used when lateral movement occurs, such as SSH (Secure Shell), SMB (Server Message Block), and TLS (Transport Layer Security). The communication command is the command used when lateral movement occurs, such as PsExec. For example, the communication type could include SSH, SMB, TLS, or PsExec.

[0069] The filtering rules include: filtering rules based on types containing SSH, filtering rules based on types containing SMB, filtering rules based on types containing TLS, and filtering rules based on types containing PsExec.

[0070] S202: Match the concatenated metadata fields with the preset fields corresponding to the filtering rules; wherein, the preset fields corresponding to the filtering rules are the fields that will appear when there is lateral movement behavior in the valid messages of the communication type that determine the filtering rules.

[0071] The fields that exhibit lateral movement behavior differ depending on the communication type. Preset fields corresponding to different filtering rules can be determined according to different communication types.

[0072] In detail, during matching, any concatenated metadata field and any preset field corresponding to a filtering rule can be arbitrarily combined for matching. For example, the concatenated metadata fields come from four communication types, including array 41, array 42, array 43, and array 44. The preset fields corresponding to the filtering rules also come from four communication types, including rule set 45, rule set 46, rule set 47, and rule set 48. Combining these four arrays and rule sets results in 16 possible combinations. For example, combining... Figure 3 As shown, the first array 41 is combined with the first rule set 45 to the fourth rule set 48, the second array 42 is combined with the first rule set 45 to the fourth rule set 48, the third array 43 is combined with the first rule set 45 to the fourth rule set 48, and the fourth array 44 is combined with the first rule set 45 to the fourth rule set 48. Based on the above 16 combinations, the concatenated metadata fields and the preset fields corresponding to the filtering rules are matched.

[0073] S203: If there is a rule match between the concatenated metadata field and the preset field corresponding to the filtering rule, it is determined that the target host has lateral movement behavior.

[0074] The embodiments of the present invention can extract metadata fields according to the communication type between the target host and other hosts in the same intranet, and match the metadata fields with preset fields corresponding to the filtering rules. If a match is found, it is determined that the target host has lateral movement attack behavior. In this way, by identifying lateral movement attack behavior through the communication association between multiple hosts in the same intranet, the accuracy of identification is improved.

[0075] In some embodiments, using eBPF to capture valid messages on the target host before encryption includes:

[0076] On the target host, multiple valid messages before encryption are captured by an eBPF program mounted at the application and transport layers of the encryption protocol.

[0077] In this method, network traffic is captured by mounting an eBPF probe on the target host via a kernel module. eBPF programs allow user-defined code to be executed within kernel space for efficient capture and processing of network events.

[0078] In detail, the first point concerns mount point selection: eBPF programs can be mounted to different locations in the network protocol stack. Specifically, the mount point should be chosen at the application layer (such as TLS, SSL) and transport layer (such as TCP) of encryption protocols. To capture plaintext data before encryption, mount points can be placed on functions such as `tcp_sendmsg`, `tls_push_record`, or `tls_do_encryption`. The `tcp_sendmsg` function handles send operations in the TCP protocol stack; by mounting the eBPF program to this function, plaintext data from the transport layer can be obtained before the data packet is encrypted. Combined with... Figure 5 As shown, tls_push_record, tls_do_encryption, or similar functions are used to capture plaintext data by attaching eBPF to this function before TLS / SSL encrypted data.

[0079] Secondly, regarding probe types: eBPF provides different probe types for different system events. For network traffic, you can use either kprobe or tracepoint eBPF probes, depending on the function that needs to be monitored. Kprobe can be used to capture kernel function calls, such as monitoring tcp_sendmsg. Tracepoint can be used to monitor events defined in the kernel, such as traffic transmission in the network protocol stack.

[0080] The third point to capture: After the probe is mounted, the eBPF program will capture network traffic packets sent by the host. Special attention needs to be paid to capturing application-layer data that will soon be encrypted, such as HTTP requests and user login information, as this data remains in plaintext before passing through the encryption layer of the protocol stack. After completing the deployment of the eBPF-based traffic capture module, proceed to the second step.

[0081] Fourthly, regarding privacy protection measures: To protect user privacy, this invention employs multiple privacy protection measures when capturing traffic data using eBPF. First, the system only captures and analyzes necessary data, avoiding the collection of excessive user information. All captured data is encrypted during storage to prevent unauthorized access. The system also strictly controls access permissions to the captured data, allowing only authorized personnel and the system to access it. Furthermore, during analysis, user-identified information is anonymized to ensure user privacy is not compromised. This invention also complies with relevant privacy laws and regulations, ensuring that the data processing process complies with legal requirements.

[0082] In some embodiments, before extracting metadata fields that conform to the filtering rules from the packet header protocol stack of a valid message, the method further includes:

[0083] Valid packets that do not contain the rules for forming the predetermined internal network IP address will be deleted.

[0084] Among these, the transmission of authentication information and credentials between hosts is a typical characteristic of lateral movement. Since each host's IP address within the intranet is formed based on the gateway's public IP address, the rule for forming the intranet IP address is that the first three digits of the public IP address must be identical.

[0085] In detail, network traffic data whose first three digits differ from a public IP address is considered network traffic data that does not contain the predetermined internal IP address formation rules, and this network traffic data can be deleted. For example, the internal IP range is IP... internal Then the filtered traffic F S It can be represented as F S ={S|S 通信IP特征 ∈IP internal}

[0086] In some embodiments, metadata fields that conform to the filtering rules are extracted from the packet header protocol stack of valid messages, including:

[0087] According to each filtering rule, multiple valid packets are divided to obtain the valid packets corresponding to each filtering rule;

[0088] Based on the preset fields corresponding to each filtering rule, extract metadata fields from the valid messages corresponding to each filtering rule.

[0089] In detail, set the filtering rules to P, F P ={S∈F S |S 协议 ∈P}, the captured multiple valid messages are filtered according to the above conditions to obtain a valid message F containing only protocol P. P By following this process, different network protocols and commands are set to obtain multiple sets of valid packets containing only one protocol or command. Each set of valid packets corresponds to a specific filtering rule.

[0090] For example, in combination Figure 4 As shown, the captured valid packets are divided into four arrays according to SSH, SMB, TLS, and PsExec. The valid packets in the first array all contain SSH, the valid packets in the second array all contain SMB, the valid packets in the third array all contain TLS, and the valid packets in the fourth array all contain PsExec.

[0091] For example, combining Figure 3As shown, the valid messages in the first array 41 contain SSH, the valid messages in the second array 42 contain SMB, the valid messages in the third array 43 contain TLS, and the valid messages in the fourth array 44 contain PsExec. The first rule set 45 contains preset fields corresponding to valid messages containing SSH, the second rule set 46 contains preset fields corresponding to valid messages containing SMB, the third rule set 47 contains preset fields corresponding to valid messages containing TLS, and the fourth rule set 48 contains preset fields corresponding to valid messages containing PsExec. The first array 41 containing SSH is matched against the first rule set 45; the second array 42 containing SMB is matched against the second rule set 46; the third array 43 containing TLS is matched against the third rule set 47; and the fourth array 44 containing PsExec is matched against the fourth rule set 48. This results in a total of four matching pairs, which requires less computation and improves processing efficiency compared to combinations of 16.

[0092] In some embodiments, the metadata fields include multiple individual fields and statistical fields; based on the preset fields corresponding to each filtering rule, the metadata fields are extracted from the valid messages corresponding to each filtering rule, including:

[0093] For each filtering rule, if the metadata field corresponding to the filtering rule is a separate field, then extract the separate field from each valid message corresponding to the filtering rule.

[0094] If the metadata field corresponding to the filtering rule is a statistical field, then from the multiple valid messages corresponding to the filtering rule, count the number of messages that contain all the individual fields corresponding to the filtering rule, and use the count as the statistical field.

[0095] In detail, after capturing all effective packets from the host, the focus will be on identifying communications related to lateral movement attacks. Individual fields include some or all of the following network protocols, communication domain name characteristics, IP characteristics, and port characteristics; statistical fields include the number of executions. Assuming a filtering rule is expressed as:

[0096] S = <protocol, communication domain name characteristics, IP characteristics, port characteristics, content characteristics, number of transmissions>.

[0097] For example, traffic patterns of PsExec or SSH commands are known attack methods; detecting these patterns can reveal attacker activity. Additionally, unusual file-sharing requests (such as those using the SMB protocol) may also be an indication of lateral movement. Specifically, the filtering rules include the following:

[0098] Filter Rule 1: When S = <SSH,example.com,192.168.1.10,22,login failed, number of times>, it indicates that SSH login requests fail frequently. The individual fields of Filter Rule 1 include SSH, example.com, 192.168.1.10, 22, login failed (login failure), and the statistical field is 5 times. For the valid packets corresponding to this filter rule, these packets extract the individual fields. When having this individual field, it can be counted as 1. If the number of valid packets with the above situation is 10 times, then the statistical field is 10. Then the concatenated metadata field is

[0099] SSH,example.com,192.168.1.10,22,login failed,10.

[0100] When determining whether there is a rule match between the concatenated metadata field and the preset field corresponding to the filter rule, it is judged whether the statistical number of times exceeds the preset number of times. For example, the preset number of times is 5 times, but the statistical number of times is 10 times. 10 times exceeds 5 times, so it is determined that there is a lateral movement behavior of the target host.

[0101] Similarly, Filter Rule 2: When S = <

[0102] SMB,fileserver,192.168.1.20,445,file access, number of times>, it indicates that the SMB file sharing request is abnormal. The individual fields of Filter Rule 2 include SMB, fileserver (file server), 192.168.1.20, 445, file access (file access).

[0103] When determining whether there is a rule match between the concatenated metadata field and the preset field corresponding to the filter rule, it is judged the number of valid packets with SMB, fileserver (file server), 192.168.1.20, 445, and file access, that is, whether the statistical number of times exceeds the preset number of times. For example, the preset number of times is 10 times, and the statistical number of times is 11 times. 11 times exceeds 10 times, so it is determined that there is a lateral movement behavior of the target host.

[0104] Rule 3: When S = <PsExec,admin,192.168.1.30,135,command execution, number of times>, it indicates the execution of the PsExec command. The individual fields of Rule 3 include PsExec, admin (administration), 192.168.1.30, 135, command execution (command execution), and the statistical field is 2 times.

[0105] Determine the number of valid packets with PsExec, admin (management), 192.168.1.30, 135, and command execution, that is, check if the statistical count exceeds a preset count. For example, if the preset count is 1 time and the statistical count is 2 times, and 2 times exceeds 1 time, then it is determined that there is a lateral movement behavior on the target host.

[0106] Rule 4: When S = <TLS, secure.com, 192.168.1.40, 443, password attempt, count>, it indicates frequent password attempt failures in the TLS connection. The individual fields of Rule 4 include TLS, secure.com, 192.168.1.40, 443, password attempt (password attempt), and the statistical field is 8 times.

[0107] Determine the number of valid packets with TLS, secure.com, 192.168.1.40, 443, and password attempt, that is, check if the statistical count exceeds a preset count. For example, if the preset count is 7 times and the statistical count is 8 times, and 8 times exceeds 7 times, then it is determined that there is a lateral movement behavior on the target host.

[0108] In some embodiments, after determining that there is a lateral movement behavior on the target host, the method further includes:

[0109] Extract display data of a preset type from the concatenated metadata fields that match the filtering rules;

[0110] Generate an alarm message based on the display data and display the alarm message to the user so that the user can handle the lateral movement behavior of the target host according to the alarm message.

[0111] Specifically, after determining that there is a lateral movement behavior on the target host, a security alarm will be immediately triggered. The alarm message includes detailed information about the suspicious traffic, such as the source IP address, target IP address, port number, transmitted data, behavior analysis results, etc. This information will be recorded in the log system for further investigation by the security team. The system can also automatically block the relevant network connections when detecting the lateral movement behavior to prevent the attack from spreading further.

[0112] Combined with Figure 6 As shown, an embodiment of the present invention also provides a method for detecting lateral movement behavior of encrypted traffic, including:

[0113] S600: Use eBPF to capture valid packets before encryption on the target host;

[0114] S601: Extract the metadata fields that match the filtering rules from the protocol stack of the packet header of a valid message, and concatenate the matching metadata fields;

[0115] S602: Match the concatenated metadata fields with the preset fields corresponding to the filtering rules in pairs;

[0116] S603: Determine if the concatenated metadata field matches the preset field corresponding to the filtering rule; if yes, execute S604; otherwise, execute S605.

[0117] S604: The target host has been found to be moving laterally;

[0118] S605: Input the concatenated metadata fields into the prediction model to obtain the prediction results.

[0119] For steps 600-604, please refer to... Figure 2 The content regarding step 605 is explained as follows: If no matching occurs between any array and any lateral movement attack rule, then multiple concatenated metadata fields are input into the prediction model to obtain a prediction result, wherein the prediction result indicates that the target host exhibits lateral movement behavior or that the target host does not exhibit lateral movement behavior.

[0120] In detail, besides rule-based detection, this embodiment of the invention also utilizes pre-trained behavioral analysis models to perform deeper analysis of captured traffic. These pre-trained models are typically provided open-source by well-known cybersecurity organizations or research institutions, trained on a large amount of normal host traffic and known attack traffic, and possess the ability to identify potential attack characteristics. In practical applications, by inputting captured traffic data, the predictive model can quickly assess the degree of traffic anomaly and identify potential lateral movement behavior. The advantage of pre-trained models lies in their extensive data training, resulting in high accuracy and stability, and their ability to be deployed and begin detection immediately, saving the time and resources required for model training.

[0121] Example 1: Suppose a host (A) makes frequent SSH login requests to multiple hosts (B, C, D) in a short period of time, and the failure rate of each login request is abnormally high. After the behavior model detects this traffic pattern, it will mark the host's behavior as a suspicious lateral movement attempt.

[0122] Example 2: A host experiences a sudden increase in traffic, and the traffic uses encrypted communication protocols (such as HTTPS). The behavioral model, trained on historical traffic data, can identify abnormal file transfer patterns in the HTTPS traffic (such as a large number of small file transfers in a short period of time) and mark them as potential data leakage behaviors.

[0123] In some embodiments, the method further includes:

[0124] Determine the actual situation regarding whether the target host exhibits lateral movement behavior;

[0125] If the actual situation differs from the predicted result, the parameters in the prediction model are adjusted according to the actual situation until the prediction result of the prediction model for multiple concatenated metadata fields is the same as the actual situation. Alternatively, a modification interface is provided to the maintenance user, and the prediction model is updated according to the parameters of the prediction model entered by the maintenance user in the modification interface.

[0126] In detail, in order to adapt to the ever-changing network environment and new attack methods, combined with Figure 7 As shown, the parameters of the prediction model provided in this embodiment of the invention can be dynamically adjusted according to actual conditions. The automated system continuously monitors network traffic, collects false positives and false negatives, and automatically adjusts model parameters using reinforcement learning algorithms to reduce the false positive rate and improve detection accuracy. In certain specific networks, certain traffic patterns may be legitimate business needs; the model will gradually learn these legitimate behaviors and adjust its parameters accordingly. Maintenance users within the security team can manually intervene in model adjustments, especially when new attack methods emerge or complex network changes occur. Based on threat intelligence and actual detection results, maintenance users within the security team can fine-tune the model, update the rule base, and parameter settings. The pre-trained model can also receive threat intelligence updates, automatically adjust detection strategies, and improve the ability to detect new types of attacks.

[0127] Example 3: In a certain detection, the system mistakenly marked a legitimate internal network scanning operation as suspicious behavior. Through the false alarm feedback mechanism and manual intervention, the model gradually learned that the behavior was a normal operation and maintenance activity. Subsequently, the rules were dynamically adjusted to avoid similar activities being incorrectly marked in the future.

[0128] By using a pre-trained model and fine-tuning it in conjunction with the actual network environment, this invention can dynamically adjust the detection strategy, improving the accuracy and flexibility of lateral movement attack detection. If suspicious lateral movement behavior is identified, a fifth-step alarm is triggered.

[0129] The embodiments of the present invention provide the following beneficial effects through the solution described herein:

[0130] 1. Pre-encryption traffic capture based on eBPF: This invention, by deploying an eBPF probe in the operating system, can capture the plaintext content of traffic before encryption. Compared to traditional methods based on encrypted traffic metadata analysis, this approach can more intuitively detect malicious behavior and improve the accuracy of attack detection.

[0131] 2. Fine-grained lateral movement detection mechanism: This invention enables fine-grained analysis of captured plaintext data before encryption. Combining rule-based detection and deep learning techniques, it can dynamically adjust the detection strategy according to changes in the network environment. This application can adapt to new attack methods and improves the flexibility of detection.

[0132] 3. Real-time performance and low system overhead: The eBPF probe can run efficiently within the system kernel without affecting the normal performance of the host, and can capture and analyze traffic in real time. Compared with existing network traffic monitoring solutions, this invention has stronger real-time performance and is suitable for security protection in large-scale network environments.

[0133] like Figure 8 As shown, the present invention also provides a device for detecting lateral movement behavior of encrypted traffic, comprising:

[0134] The capture module 800 is used to capture valid messages on the target host before encryption using eBPF;

[0135] Extraction module 801 is used to extract metadata fields that meet the filtering rules from the packet header protocol stack of the valid message, and concatenate the matching metadata fields; wherein, the filtering rules are determined based on the communication type between the target host and other hosts on the same intranet as the target host;

[0136] The matching module 802 is used to match the concatenated metadata field with the preset field corresponding to the filtering rule; wherein, the preset field corresponding to the filtering rule is the field that will appear if the communication type of the filtering rule is valid. If there is a rule match between the concatenated metadata field and the preset field corresponding to the filtering rule, it is determined that the target host has lateral movement behavior.

[0137] Optionally, the device further includes a deletion module disposed between the capture module 800 and the extraction module 801;

[0138] The deletion module is used to delete valid packets that do not contain the predetermined internal network IP address formation rules.

[0139] Optionally, the extraction module 801 is specifically used to divide multiple valid packets according to each filtering rule to obtain the valid packets corresponding to each filtering rule;

[0140] Based on the preset fields corresponding to each filtering rule, extract metadata fields from the valid messages corresponding to each filtering rule.

[0141] Optionally, the metadata fields include multiple individual fields and statistical fields; the extraction module 801 is specifically used for:

[0142] For each filtering rule, if the metadata field corresponding to the filtering rule is a separate field, then extract the separate field from each valid message corresponding to the filtering rule.

[0143] If the metadata field corresponding to the filtering rule is a statistical field, then from the multiple valid messages corresponding to the filtering rule, count the number of messages that contain all the individual fields corresponding to the filtering rule, and use the counted number as the statistical field.

[0144] Optionally, the capture module 800 is specifically used to capture multiple valid messages before encryption on the target host by using an eBPF program mounted on the application layer or transport layer of the encryption protocol.

[0145] Optionally, the apparatus further includes a prediction module, which follows the matching module;

[0146] The prediction module is used to input the concatenated metadata field into the prediction model to obtain a prediction result if neither the concatenated metadata field nor the preset field corresponding to the filtering rule matches. The prediction result indicates that the target host has lateral movement behavior or that the target host does not have lateral movement behavior.

[0147] Optionally, the device further includes: an adjustment module, which is located after the prediction module;

[0148] The adjustment module is used to determine whether the target host is actually exhibiting lateral movement behavior.

[0149] If the actual situation differs from the prediction result, the parameters in the prediction model are adjusted according to the actual situation until the prediction result of the prediction model for multiple concatenated metadata fields is the same as the actual situation. Alternatively, a modification interface is provided to the maintenance user, and the prediction model is updated according to the parameters of the prediction model entered by the maintenance user in the modification interface.

[0150] In addition, combined Figures 1-8 The method and apparatus for detecting lateral movement of encrypted traffic described in the embodiments of the present invention can be implemented by an electronic device.

[0151] Electronic devices, including: processors;

[0152] Memory used to store the processor's executable instructions;

[0153] The processor is configured to execute the instructions to implement the lateral movement behavior detection method for encrypted traffic as described above.

[0154] Among them, electronic devices can be any host in the intranet, or devices connected to hosts in the intranet.

[0155] Based on the above introduction, an example is proposed. Figure 9 The structure of electronic devices.

[0156] The electronic device may include a processor 910 and a memory 920 storing computer program instructions.

[0157] Specifically, the processor 910 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of the present invention.

[0158] Memory 920 may include mass storage for data or instructions. For example, and not limitingly, memory 920 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where suitable, memory 920 may include removable or non-removable (or fixed) media. Where suitable, memory 920 may be internal or external to a data processing device. In a particular embodiment, memory 920 is a non-volatile solid-state memory. In a particular embodiment, memory 920 includes read-only memory (ROM). Where suitable, the ROM may be a mask-programmed ROM, a programmable ROM (PROM), an erasable PROM (EPROM), an electrically erasable PROM (EEPROM), an electrically rewritable ROM (EAROM), or flash memory, or a combination of two or more of these.

[0159] The processor 910 implements any of the methods for performing tasks in the above embodiments by reading and executing computer program instructions stored in the memory 920.

[0160] In one example, the electronic device may also include a communication interface 930 and a bus 940. For example, Figure 9 As shown, the processor 910, memory 920, and communication interface 930 are connected via bus 940 and communicate with each other.

[0161] The communication interface 930 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of the present invention.

[0162] Bus 940 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 940 may include one or more buses. While specific buses are described and illustrated in embodiments of the invention, the invention contemplates any suitable bus or interconnect.

[0163] The electronic device can execute the lateral movement behavior detection method for encrypted traffic in this embodiment of the invention based on the received task, thereby achieving a combination of... Figures 1-8 The method and apparatus described herein are for detecting lateral movement behavior of encrypted traffic.

[0164] In addition, in conjunction with the electronic devices in the above embodiments, the present invention can provide a storage medium that, when the instructions in the storage medium are executed by the processor of the electronic device, enables the electronic device to perform the lateral movement behavior detection method for encrypted traffic as described in any of the above embodiments.

[0165] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0166] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0167] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0168] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0169] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for detecting lateral movement behavior of encrypted traffic, characterized in that, include: Use eBPF to capture valid messages on the target host before encryption; Extract the metadata fields that match the filtering rules from the packet header protocol stack of the valid message, and concatenate the matching metadata fields; wherein, the filtering rules are determined based on the communication type between the target host and other hosts on the same intranet as the target host; the communication type includes types determined based on different communication protocols, and types determined by different communication commands, wherein the communication protocol is the network protocol used to cause lateral movement behavior, and the communication command is the command used to cause lateral movement behavior; The concatenated metadata fields are matched with the preset fields corresponding to the filtering rules; wherein, the preset fields corresponding to the filtering rules are fields that would appear if the communication type of the filtering rule is valid and the lateral movement behavior exists. If the concatenated metadata fields match the preset fields corresponding to the filtering rules, then it is determined that the target host has engaged in lateral movement behavior.

2. The method for detecting lateral movement behavior of encrypted traffic according to claim 1, characterized in that, Before extracting the metadata fields that match the filtering rules from the packet header protocol stack of the valid message, the method further includes: Valid packets that do not contain the rules for forming the predetermined internal network IP address will be deleted.

3. The method for detecting lateral movement behavior of encrypted traffic according to claim 1, characterized in that, Extract the metadata fields that match the filtering rules from the packet header protocol stack of the valid message, including: According to each filtering rule, multiple valid packets are divided to obtain the valid packets corresponding to each filtering rule; Based on the preset fields corresponding to each filtering rule, metadata fields are extracted from the valid messages corresponding to each filtering rule.

4. The method for detecting lateral movement behavior of encrypted traffic according to claim 3, characterized in that, The metadata fields include multiple individual fields and statistical fields; based on the preset fields corresponding to each filtering rule, metadata fields are extracted from the valid messages corresponding to each filtering rule, including: For each filtering rule, if the metadata field corresponding to the filtering rule is a separate field, then extract the separate field from each valid message corresponding to the filtering rule. If the metadata field corresponding to the filtering rule is a statistical field, then from the multiple valid messages corresponding to the filtering rule, count the number of messages that contain all the individual fields corresponding to the filtering rule, and use the counted number as the statistical field.

5. The method for detecting lateral movement behavior of encrypted traffic according to claim 1, characterized in that, Using eBPF, capture valid packets on the target host before encryption, including: On the target host, multiple valid messages before encryption are captured by an eBPF program mounted at the application or transport layer of the encryption protocol.

6. The method for detecting lateral movement behavior of encrypted traffic according to any one of claims 1 to 5, characterized in that, The method further includes: If neither the concatenated metadata field nor the preset field corresponding to the filtering rule shows a match, the concatenated metadata field is input into the prediction model to obtain the prediction result, wherein the prediction result indicates that the target host exhibits lateral movement behavior or that the target host does not exhibit lateral movement behavior.

7. The method for detecting lateral movement behavior of encrypted traffic according to claim 6, characterized in that, The method further includes: Determine whether the target host exhibits actual lateral movement behavior; If the actual situation differs from the prediction result, the parameters in the prediction model are adjusted according to the actual situation until the prediction result of the prediction model for multiple concatenated metadata fields is the same as the actual situation. Alternatively, a modification interface is provided to the maintenance user, and the prediction model is updated according to the parameters of the prediction model entered by the maintenance user in the modification interface.

8. A device for detecting lateral movement behavior of encrypted traffic, characterized in that, include: The capture module is used to capture valid packets on the target host before encryption using eBPF; The extraction module is used to extract metadata fields that meet the filtering rules from the packet header protocol stack of the valid message, and to concatenate the matching metadata fields; wherein, the filtering rules are determined based on the communication type between the target host and other hosts on the same intranet as the target host; the communication type includes types determined based on different communication protocols, and types determined by different communication commands, wherein the communication protocol is the network protocol used when lateral movement behavior occurs, and the communication command is the command used when lateral movement behavior occurs; The matching module is used to match the concatenated metadata fields with the preset fields corresponding to the filtering rules; wherein, the preset fields corresponding to the filtering rules are fields that will appear in valid messages of the communication type of the filtering rules if the lateral movement behavior exists; if there is a rule match between the concatenated metadata fields and the preset fields corresponding to the filtering rules, it is determined that the target host has lateral movement behavior.

9. An electronic device, characterized in that, include: Memory is used to store computer programs or instructions; A processor for executing a computer program or instructions in the memory such that the method for detecting lateral movement of encrypted traffic as described in any one of claims 1-7 is executed.

10. A computer-readable storage medium, characterized in that, When the instructions in the storage medium are executed by the processor, the processor is able to perform the lateral movement behavior detection method for encrypted traffic as described in any one of claims 1-7.

Images