Security product detection capability verification method and device based on sand table mimicry protocol

Abstract

The invention discloses a sand table mimicry protocol-based security product detection capability verification method and device, and relates to the technical field of network security, and the device comprises a host security product management end, a control end and a mimicry isolation system. The mimicry isolation system comprises a host security product, an actuator, malicious software / samples, a mimicry DNS, mimicry protocol recognition, mimicry protocol analysis and response construction. The control end communicates with the actuator, transmits samples and informs the actuator of how to execute the corresponding samples; according to the security product detection capability verification method and device based on the sand table mimicry protocol, the technical content provided by the invention solves the problem that the host security product detection capability cannot be truly and effectively evaluated due to the fact that the real click means and intention of malicious software / samples cannot be exposed for a limited network in the prior art; and the authenticity and effectiveness of evaluating the host security product detection capability are ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and particularly to a method and device for verifying the detection ability of security products based on a sand table mimicry protocol. Background Art

[0002] Host security products can collect the behaviors of terminal software through some means, and determine whether the software is performing malicious or abnormal operations, so as to intercept or alarm functions. The terminal refers to any operating system computer, such as linux, mac, windows, etc.

[0003] Currently, there are some malicious programs that will only trigger their malicious or abnormal behaviors when specific network conditions are met. In other words, when specific network conditions are not met, some malicious programs will not perform malicious or abnormal operations, resulting in the host security product being unable to collect the malicious operations or abnormal operations of the malicious software.

[0004] When evaluating the effectiveness of host security products, there is no safe, reliable, and convenient method or device in the prior art to know whether the host security product has an interception or alarm function for this type of malicious software with samples or behaviors.

[0005] Because the malicious software does not meet the conditions for triggering malicious or abnormal operations, that is, it does not expose its attack means and intentions, resulting in the host security product not alarming. Indirectly, the actual purpose of the evaluation is not achieved. The specific network conditions mentioned above are not limited to the following situations: 1. The domain name accessed by the malicious software on the network is no longer in use, logically resulting in the malicious software no longer making traffic requests or other operations. Such as C2 software 2. There is no corresponding port or protocol open in the network, logically resulting in the malicious software no longer performing the next operation. Such as network-aware malware.

[0006] Therefore, the present invention proposes a method and device for verifying the detection ability of security products based on a sand table mimicry protocol. Summary of the Invention

[0007] Aiming at the deficiencies of the prior art, the present invention provides a method and device for verifying the detection ability of security products based on a sand table mimicry protocol, and solves the problems raised in the above background art.

[0008] To achieve the above object, the present invention is implemented through the following technical solutions: A security product detection ability verification device based on a sand table mimicry protocol, including a host security product management end, a control end, and a mimicry isolation system. The mimicry isolation system includes a host security product, an actuator, malware / samples, mimicry DNS, mimicry protocol identification, mimicry protocol parsing, and response construction; The control end communicates with the actuator, transmits samples, and tells the actuator how to execute the corresponding samples; The malware / samples refer to the source objects for verifying the detection ability of the host security product. That is, for a certain malware / sample, the host security product captures and analyzes the behavior of the malware / sample to draw a conclusion on whether there are security issues. Further, the host security product alarms or intercepts according to the obtained conclusion. When the malware / samples run, a series of behaviors will be generated, including the following network behavior / file operation / registry operation related behaviors. The network behavior will send data packets to request outside the isolation system; The mimicry DNS refers to hijacking the DNS requests of malicious samples and directly performing DNS responses. The response is a response constructed by the mimicry DNS itself, not an actual real and authoritative DNS response. The resolved address of the response is the address where the mimicry protocol identification is located; The mimicry protocol identification refers to identifying the traffic of malware / samples, identifying and matching according to the bytecode characteristics of different protocols, and forwarding the data to the mimicry protocol parsing and response construction according to the matched protocol types; The mimicry protocol parsing and response construction refers to parsing the traffic forwarded by the mimicry protocol identification and constructing and replying the response according to the content of the parsed specific protocol; The host security product monitors all behaviors in the host operating system, conducts relevant comparison and analysis on the behaviors, and alarms or intercepts; The host security product management end. The terminal security product management end can be one or more, that is, the entire method or device can obtain the alarm and interception information of multiple terminal security product management ends, and simultaneously conduct the detection function verification of multiple terminal security products, achieving high efficiency and speed.

[0009] Optionally, the mimicry isolation system includes an isolation system and a mimicry system. The isolation system includes a host security product, an actuator, and malware / samples. The mimicry system includes mimicry DNS, mimicry protocol identification, and mimicry protocol parsing and response construction.

[0010] Optionally, a method for verifying using the security product detection ability verification device includes the following steps: Step 1: The control end sends an instruction to execute malware / sample to the executor. The malicious program to be executed can include scripts, command lines, malicious file binaries, etc. Step 2: The executor executes the instruction. The execution of the instruction means that the executor parses the malware / sample instruction sent by the control end and runs the malware / sample according to the established steps. The established steps can be one step or multiple steps. Step 3: The malware / sample makes a DNS request. Since the malware / sample accesses the external network through a domain name, DNS domain name resolution is required. The DNS domain name resolution request of the malware / sample will be sent to the mimetic DNS. Step 4: The mimetic DNS makes a mimetic response. The mimetic response means that after the mimetic DNS module receives the DNS request from the malware / sample, it uses the IP address where the mimetic protocol recognition module is located as an entry for DNS response for response.

[0011] Step 5: The malware / sample conducts external protocol communication. For the external protocol communication, since the DNS response IP in Step 4 is the IP address of the mimetic protocol recognition module, the data packet for external protocol communication will be directly sent to the mimetic protocol recognition module. Step 6: The mimetic protocol recognition module recognizes the protocol and forwards it to the corresponding mimetic protocol parsing and response construction module. Recognizing the protocol means identifying which type of protocol the data packet for external protocol communication belongs to through technical means. Further, the technical means can be the predefined feature codes of different protocols. Step 7: Mimetic protocol parsing and response construction. The mimetic protocol parsing means parsing the byte code or string of the protocol to truly understand the protocol content. The response construction means making a specific response according to the understood protocol content. Further, the response here can be the predefined response content, that is, predefined different requests corresponding to different response contents. Step 8: The malware / sample continues to execute. The continued execution means continuing to run the subsequent processes of the sample. Step 9: The host security product captures and analyzes the behaviors of the malware / sample. The behaviors include file operations, network operations, etc. Step 10: The host security product synchronizes the sample behavior conclusion to the host security product management end. The conclusion can include alarms, interceptions, threat levels, and specific behavior information. The synchronization depends on the protocol of the security product itself, a private protocol.

[0012] Step 11: The host security product management end synchronizes the information to the control end. The synchronization can be that the control end actively obtains it from the host security product management end through the API. Step Twelve: The control end associates with the information of the host security product management end and gives a report on the detection capabilities of the host security product. The information associated with the host security product management end can be the name specific to the sample.

[0013] Optionally, in Step Six: The mimic protocol recognition module recognizes the protocol and forwards it to the corresponding mimic protocol parsing and response construction module. The technique for recognizing the protocol, which refers to the process of identifying which type of protocol the data packet of the external protocol communication belongs to through technical means, can be to recognize different communication protocols through machine learning algorithms.

[0014] Optionally, in Step Seven: Mimic protocol parsing and response construction. The mimic protocol parsing refers to parsing the bytecode or string of the protocol to truly understand the content of the protocol. The response construction refers to making a specific response based on the understood protocol content. Further, the response here can be predefined response content, that is, different requests are predefined with corresponding different response contents. The response can also be that a single request corresponds to multiple response contents, and a random response is selected each time a request is made. The response can be automatically generated through machine learning algorithms, and the same can also achieve the effect of a changing response each time a request is made.

[0015] Optionally, in Step Eight: The malware / sample continues to execute. The "continues to execute" means continuing to run the subsequent processes of the sample. The subsequent processes can also include one or more of Step Three, Step Four, Step Five, Step Six, and Step Seven, that is, the malware / sample can perform protocol communication for multiple domains or multiple times.

[0016] Optionally, in Step Eleven: The host security product management end synchronizes information to the control end. The synchronization can be that the control end actively obtains information from the host security product management end through the API. The synchronization can also be that the host security management end pushes information to the control end, and the push can be various methods, including related methods of kafka, syslog, and snmp.

[0017] Optionally, in Step Twelve: The control end associates with the information of the host security product management end and gives a report on the detection capabilities of the host security product. The information associated with the host security product management end can be the name specific to the sample. In this process, the information associated with the host security product management end can also be related information such as the specific path of the sample and the specific time range during which the sample runs.

[0018] The present invention provides a method and device for verifying the detection capabilities of a security product based on a sandbox mimic protocol, having the following beneficial effects: The method and device for verifying the detection ability of a security product based on a sand table mimicry protocol solve the problem in the prior art that the true attack means and intentions of malware / samples cannot be exposed in a restricted network, resulting in the inability to truly and effectively evaluate the detection ability of a host security product, and ensure the true effectiveness of evaluating the detection ability of a host security product. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is the integrated architecture diagram of the mimicry isolation system of the present invention; Figure 2 It is the separate architecture diagram of the isolation system and the mimicry system of the present invention; Figure 3 It is the schematic diagram of the step flow structure of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments.

[0021] Please refer to Figure 1 and Figure 3 , the present invention provides a technical solution: a device for verifying the detection ability of a security product based on a sand table mimicry protocol, including a host security product management end, a control end and a mimicry isolation system. The mimicry isolation system includes a host security product, an actuator, malware / samples, mimicry DNS, mimicry protocol identification, mimicry protocol parsing and response construction; The control end communicates with the actuator, transmits samples, and tells the actuator how to execute the corresponding samples. The samples can be various forms such as bat / sh / powshell / py / exe / elf, etc.; Malware / samples refer to the source objects for verifying the detection ability of a host security product. That is, for a certain malware / sample, the host security product captures and analyzes the behavior of the malware / sample to draw a conclusion on whether there are security issues. Further, the host security product alarms or intercepts according to the obtained conclusion. When the malware / sample runs, a series of behaviors will occur, including the following network behavior / file operation / registry operation related behaviors. The network behavior will send data packets to request outside the isolation system; Mimicry DNS refers to hijacking the DNS requests of malicious samples and directly performing DNS responses. The responses are constructed by the mimicry DNS itself and are not actual real authoritative DNS responses. The parsed address of the response is the address where the mimicry protocol identification is located; Mimic protocol recognition refers to the recognition of the traffic of malware / samples. It is recognized and matched according to the bytecode characteristics of different protocols, and data is forwarded to mimic protocol parsing and response construction according to the matched protocol types. Protocol recognition includes but is not limited to TCP, UDP, ICMP, etc. Further, it is not limited to protocols such as MQTT, CoAP, and SCADA; Mimic protocol parsing and response construction refers to parsing the traffic forwarded by mimic protocol recognition, and constructing and replying the response according to the content of the parsed specific protocol; The constructed response can be a predefined response according to the protocol content, or a randomly constructed response according to the protocol content, or a response automatically generated and constructed using machine learning algorithms according to the protocol content; Host security products monitor all behaviors in the host operating system, perform relevant comparison and analysis on the behaviors, and give alarms or intercept; Host security product management terminal. There can be one or more terminal security product management terminals, that is, the entire method or device can obtain the alarm and interception information of multiple terminal security product management terminals, and at the same time verify the detection functions of multiple terminal security products, achieving high efficiency and speed.

[0022] Among them, the method of verifying using a security product detection ability verification device includes the following steps: Step 1: The control end sends an instruction to execute malware / sample to the executor. Executing malicious programs can include scripts, command lines, malicious file binaries, etc.

[0023] Step 2: The executor executes the instruction. Executing the instruction means that the executor parses the malware / sample instruction sent by the control end and runs the malware / sample according to the established steps. The established steps can be one step or multiple steps.

[0024] Step 3: The malware / sample makes a DNS request. That is, the malware / sample accesses the external network through the domain name, so DNS domain name resolution is required. The DNS domain name resolution request of the malware / sample will be sent to the mimic DNS module.

[0025] Step 4: The mimic DNS makes a mimic response. The mimic response means that after the mimic DNS module receives the DNS request from the malware / sample, it uses the IP address where the mimic protocol recognition module is located as an entry for DNS response for response.

[0026] Step 5: The malware / sample communicates with external protocols. For external protocol communication, since the DNS response IP in Step 4 is the IP address of the mimic protocol recognition module, the data packet for external protocol communication will be directly sent to the mimic protocol recognition module.

[0027] Step 6: The mimic protocol recognition module recognizes the protocol and forwards it to the corresponding mimic protocol parsing and response construction module. Recognizing the protocol means identifying, through technical means, which type of protocol the data packet for external protocol communication belongs to. Further, the technical means can be the signature codes of predefined different protocols, or it can be identifying different communication protocols through machine learning algorithms, etc. Here, it refers to a category of methods.

[0028] Step 7: Mimic protocol parsing and response construction. Mimic protocol parsing means parsing the bytecode or string of the protocol to truly understand the content of the protocol. Response construction means making a specific response according to the understood protocol content. Further, the response here can be predefined response content, that is, different requests are predefined, corresponding to different response contents, or it can be that a single request corresponds to multiple response contents, and a response is randomly selected each time a request is made; the response here can be automatically generated through machine learning algorithms, and can also achieve the effect of a changing response each time a request is made; Step 8: The malware / sample continues to execute. Continuing to execute means continuing to run the subsequent processes of the sample. The subsequent processes can also include one or more of the processes of Step 3, Step 4, Step 5, Step 6, and Step 7, that is, the malware / sample may perform protocol communication for multiple or multiple domains; Step 9: The host security product captures and analyzes the behavior of the malware / sample. The behavior includes file operations, network operations, etc.; Step 10: The host security product synchronizes the sample behavior conclusion to the host security product management end. The conclusion can include alarm, interception, threat level, specific behavior information, etc. The synchronization specifically depends on the protocol of the security product itself. Generally speaking, it is a private protocol; Step 11: The host security product management end synchronizes the information to the control end. The synchronization can be that the control end actively obtains it from the host security product management end through the API; it can also be that the host security management end pushes the information to the control end. Further, the push can be in various ways, such as kafka, syslog, snmp, etc.; Step 12: The control end associates the information of the host security product management end and gives a report on the detection ability of the host security product. Associating the information of the host security product management end can be through the specific name of the sample, through the specific path of the sample, through the specific time range when the sample runs, etc.

[0029] Embodiment 2 The differences between this embodiment and Embodiment 1 are as follows: 1. As Figure 2As shown in the figure, the mimic isolation system includes an isolation system and a mimic system. The isolation system is used to prevent malicious software / samples from damaging the external network system. The isolation system can be implemented using various technologies such as Vbox, QEMU, and containers. The isolation system includes host security products, actuators, and malicious software / samples. The mimic system includes mimic DNS, mimic protocol recognition, mimic protocol parsing, and response construction. Figure 1 and Figure 2 The systems in Figure 2 are essentially mutually replaceable deployment solutions. That is, merging the mimic system and the isolation system in Figure 1 results in the mimic isolation system in Figure 2 In 2. The communication directions between the control end, the actuator, and the host security product management end are not restricted. That is, Figure 1 in the directions of the 1 and 11 arrows can be reversed and combined arbitrarily. 3. The operating system installed in the isolation system is not limited and can be linux, mac, windows, etc. 4. The form in which the mimic system exists is not limited and can be a container, a virtual machine image, a hardware router, etc. 5. The type of sandbox is not limited and can be a virtual machine such as vbox or qemu, or a sandbox browser such as chrome. 6. The communication protocol between components is not limited, and the content format is not limited. As long as similar functions are completed, alternative solutions can be implemented. The communication protocol can be grpc, restfull api, etc. 7. The actuator for the control end communication can be one or more. 8. All components, including the control end, the actuator, the mimic DNS, the mimic protocol recognition, the mimic protocol parsing, and the response construction, can be implemented in any programming language.

[0030] As described above, the above are only the preferred specific implementation manners of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention, according to the technical solution and inventive concept of the present invention, makes equivalent substitutions or changes, and all should be covered by the protection scope of the present invention.

Claims

1. A security product detection capability verification device based on a sandbox mimicry protocol, characterized in that: It includes a host security product management end, a control end and a mimic isolation system, wherein the mimic isolation system includes a host security product, an actuator, malware / samples, a mimic DNS, mimic protocol identification, mimic protocol parsing and response construction; The control end communicates with the actuator, transmits samples, and tells the actuator how to execute the corresponding samples; The malware / sample refers to the source object for host security product detection capability verification, which means that for a certain malware / sample, the host security product captures and analyzes the behavior of the malware / sample to draw a conclusion on whether there is a security problem. Further, the host security product issues an alarm or intercepts according to the conclusion. When the malware / sample is running, a series of behaviors will be generated, including the following network behaviors / file operations / registry operations related behaviors. The network behaviors will send data packets to request outside the isolation system; The pseudo-DNS refers to hijacking the DNS request of the malicious sample and directly responding to the DNS. The response is a response constructed by the pseudo-DNS itself, not an actual authoritative DNS response. The resolution address of the response is the address where the pseudo-protocol identification is located; The mimetic protocol identification refers to identifying the traffic of malware / samples, identifying and matching according to the bytecode features of different protocols, and forwarding data to the mimetic protocol for parsing and response construction according to the different protocol types matched; The mimetic protocol parsing and response construction refers to parsing the mimetic protocol to identify the forwarded traffic, and constructing and replying the response according to the content of the parsed specific protocol; The host security product monitors all behaviors in the host operating system, performs relevant comparison and analysis on the behaviors, and issues alarms or interceptions; The host security product management end and the terminal security product management end can be one or more, that is, the entire method or device can obtain alarm and interception information from multiple terminal security product management ends, and simultaneously perform multiple terminal security product detection function verifications, so as to achieve high efficiency and speed.

2. The device for verifying the safety product detection capability based on the sandbox mimicry protocol according to claim 1 is characterized in that: The mimetic isolation system includes an isolation system and a mimetic system. The isolation system includes a host security product, an executor, and malware / samples. The mimetic system includes a mimetic DNS, mimetic protocol identification, and mimetic protocol parsing and response construction.

3. The device for verifying the safety product detection capability based on the sandbox mimicry protocol according to claim 1 is characterized in that: The method for verifying using the safety product detection capability verification device comprises the following steps: Step 1: The control end sends a command to execute malware / sample to the executor. The execution of the malicious program may include a script, a command line, a malicious file binary, etc. Step 2: The executor executes the instruction, which refers to the executor parsing the malware / sample instruction sent by the control end and running the malware / sample according to the established steps. The established steps can be one step or multiple steps. Step 3: The malware / sample makes a DNS request. The malware / sample accesses the external network through the domain name, so DNS domain name resolution is required. The domain name resolution request of the malware / sample will be sent to the pseudo DNS. Step 4: The mimic DNS performs a mimic response. The mimic response refers to the mimic DNS module responding with the IP address of the mimic protocol identification module as an entry in the DNS response after receiving a DNS request from the malware / sample. Step 5: The malware / sample communicates with the external protocol. For the external protocol communication, since the DNS response IP in step 4 is the IP address of the mimicry protocol identification module, the data packet of the external protocol communication will be directly sent to the mimicry protocol identification module; Step 6: The mimic protocol identification module identifies the protocol and forwards it to the corresponding mimic protocol parsing and response construction module. Identifying the protocol means identifying which type of protocol the data packet communicating with the external protocol belongs to by technical means. Furthermore, the technical means may be predefined feature codes of different protocols. Step 7: mimetic protocol parsing and response construction. The mimetic protocol parsing refers to parsing the bytecode or string of the protocol to truly understand the protocol content. The response construction refers to making a specific response to the content based on the understood protocol content. Furthermore, the response here can be a predefined response content, that is, different requests are predefined, corresponding to different response contents. Step 8: The malware / sample continues to execute, where the continued execution refers to continuing to run the subsequent process of the sample; Step 9: The host security product captures and analyzes the behavior of the malware / sample, including file operations, network operations, etc. Step 10: The host security product synchronizes the sample behavior conclusion to the host security product management terminal. The conclusion may include alarm, interception, threat level, and specific behavior information. The synchronization depends on the security product's own protocol, private protocol. Step 11: The host security product management end synchronizes information to the control end, and the synchronization may be that the control end actively obtains information from the host security product management end through an API; Step 12: The control end associates the host security product management end information and provides a host security product detection capability report. The associated host security product management end information can be through a sample-specific name.

4. The device for verifying the safety product detection capability based on the sandbox mimicry protocol according to claim 1 is characterized in that: The step six: the mimic protocol identification module identifies the protocol and forwards it to the corresponding mimic protocol parsing and response construction module. The protocol identification refers to the process of identifying which type of protocol the data packet of the external protocol communication belongs to by technical means. The technical means can be to identify different communication protocols through machine learning algorithms.

5. The device for verifying the safety product detection capability based on the sandbox mimicry protocol according to claim 1 is characterized in that: The step seven: pseudo-protocol parsing and response construction, the pseudo-protocol parsing refers to parsing the bytecode or string of the protocol to achieve a true understanding of the protocol content, and the response construction refers to making a specific response to the content based on the understood protocol content. Furthermore, the response here can be a predefined response content, that is, predefine different requests, and the response in the process corresponding to different response contents can also be a predefined single request corresponding to multiple response contents, and a response is randomly selected for each request; the response can be automatically generated by a machine learning algorithm, and a changing response effect can also be achieved for each request.

6. The device for verifying the safety product detection capability based on the sandbox mimicry protocol according to claim 1 is characterized in that: The step eight: the malware / sample continues to execute, and the continued execution refers to continuing to run the subsequent process of the sample, and the subsequent process may also include one or more steps three, four, five, six, and seven processes, that is, the malware / sample can perform protocol communications multiple times or on multiple domain names.

7. The device for verifying the safety product detection capability based on the sandbox mimicry protocol according to claim 1 is characterized in that: Step eleven: the host security product management end synchronizes information to the control end. The synchronization can be a process in which the control end actively obtains information from the host security product management end through an API. The synchronization can be the host security management end pushing information to the control end. The push can be various methods, including kafka, syslog, and snmp related methods.

8. The device for verifying the safety product detection capability based on the sandbox mimicry protocol according to claim 1 is characterized in that: The step twelve: the control end associates the host security product management end information and provides a host security product detection capability report. The associated host security product management end information can be included in the process of the sample-specific name, or it can be related information through the sample-specific path and the specific time range of the sample operation.

Images