File-free memory horse detection method and device based on deep learning

Abstract

The invention provides a file-free memory horse detection method and device based on deep learning, and the method comprises the steps: firstly obtaining a Filter object metadata table and a historical attack event table, building a first incidence relation between the two tables, and calculating an attack interval time generation sequence; determining a high-risk target according to the sequence, extracting a feature value of the high-risk target, and establishing a second association relationship with a malicious code injection type; the abnormal performance of the high-risk target is detected through the relation, and an abnormal performance sequence is generated. And taking the sequence and a detection sequence of a normal Filter object as a positive sample and a negative sample respectively, and training a neural network to detect the non-file memory horse attack. According to the method, multi-dimensional space-time correlation analysis and a deep learning model are fused, periodic attacks are recognized through the first correlation relation and the density clustering algorithm, the feature confusion resistance is improved through the second correlation relation, and high-precision detection is achieved.

Description

Technical Field

[0001] This application belongs to the field of Trojan detection, and particularly relates to a fileless memory Trojan detection method and device based on deep learning. Background Art

[0002] The fileless memory Trojan attack achieves persistent attack by directly residing in memory and injecting malicious code using legitimate processes, and its attack vector does not rely on disk files.

[0003] Existing dynamic detection technologies defend by monitoring sensitive API calls, but there is an overlap in API calls between normal Filter operations and attack behaviors, resulting in a high false positive rate. Moreover, existing detections mostly rely on single features, and advanced memory Trojans use technologies such as dynamic class loading and reflection calls to bypass detections, leading to a reduction in detection efficiency. Summary of the Invention

[0004] The purpose of this application is to overcome the defects in the above-mentioned existing technologies and provide a fileless memory Trojan detection method and device based on deep learning.

[0005] This application provides a fileless memory Trojan detection method based on deep learning, including:

[0006] Obtain the Filter object metadata table and the historical attack event table of the fileless memory Trojan, where the historical attack event table contains malicious code injection types;

[0007] Establish a first association relationship between the Filter object metadata table and the historical attack event table;

[0008] Calculate the attack interval time of the historical attack events corresponding to each Filter object according to the first association relationship, and generate an attack interval time series;

[0009] Determine high-risk targets in the Filter objects according to the attack interval time series, and extract the feature values of the high-risk targets;

[0010] Establish a second association relationship between the feature values of the high-risk targets and the malicious code injection types;

[0011] Detect the abnormal manifestations of the high-risk targets in the malicious code injection types according to the second association relationship, and generate an abnormal manifestation series;

[0012] Use the abnormal manifestation series and the detection series of normal Filter objects as positive samples and negative samples respectively to train a neural network for detecting attack events of fileless memory Trojans.

[0013] Optionally, determining high-risk targets in the Filter object according to the attack interval time series includes:

[0014] Calculating the mean attack interval time corresponding to each Filter object;

[0015] Performing density clustering analysis based on the mean, and marking the Filter objects corresponding to the interval times with an aggregation density exceeding a preset threshold as high-risk targets.

[0016] Optionally, the eigenvalue includes:

[0017] The Filter class loader hash value, the Filter class bytecode checksum, the Filter instantiation time, and the time offset of the most recent attack event.

[0018] Optionally, establishing a second association relationship between the eigenvalue of the high-risk target and the malicious code injection type includes:

[0019] Constructing an eigenvalue distribution histogram for each malicious code injection type;

[0020] According to the eigenvalue distribution histogram, using KL divergence to measure the deviation degree of the eigenvalue from the historical attack characteristics, and establishing the second association relationship when the deviation degree exceeds the dynamic threshold.

[0021] Optionally, the neural network includes:

[0022] A convolutional layer for processing the original bytecode features, an LSTM layer for processing the temporal anomaly performance, and a fully connected layer for processing the metadata features.

[0023] This application also provides a fileless memory horse detection device based on deep learning, including:

[0024] An acquisition module that acquires the Filter object metadata table and the historical attack event table of the fileless memory horse, where the historical attack event table contains the malicious code injection type;

[0025] A first association module that establishes a first association relationship between the Filter object metadata table and the historical attack event table;

[0026] A time module that calculates the attack interval time of the historical attack event corresponding to each Filter object according to the first association relationship, and generates an attack interval time series;

[0027] A screening module that determines high-risk targets in the Filter object according to the attack interval time series, and extracts the eigenvalues of the high-risk targets;

[0028] A second association module that establishes a second association relationship between the eigenvalue of the high-risk target and the malicious code injection type;

[0029] A sequence module that detects abnormal manifestations of the high-risk target in the malicious code injection type according to the second association relationship and generates an abnormal manifestation sequence;

[0030] A training module that uses the abnormal manifestation sequence and the detection sequence of normal Filter objects as positive samples and negative samples respectively to train a neural network for detecting attack events of fileless memory horses.

[0031] Optionally, the screening module determines the high-risk target in the Filter object according to the attack interval time series, including:

[0032] Calculating the average attack interval time corresponding to each Filter object;

[0033] Performing density clustering analysis based on the average value, and marking the Filter object corresponding to the interval time with an aggregation density exceeding a preset threshold as a high-risk target.

[0034] Optionally, the eigenvalue includes:

[0035] Filter class loader hash value, Filter class bytecode checksum, Filter instantiation time, and time offset of the most recent attack event.

[0036] Optionally, the second association module establishes the second association relationship between the eigenvalue of the high-risk target and the malicious code injection type, including:

[0037] Constructing an eigenvalue distribution histogram for each malicious code injection type;

[0038] According to the eigenvalue distribution histogram, using KL divergence to measure the deviation degree of the eigenvalue from the historical attack characteristics, and establishing the second association relationship when the deviation degree exceeds the dynamic threshold.

[0039] Optionally, the neural network includes:

[0040] A convolutional layer for processing raw bytecode features, an LSTM layer for processing temporal abnormal manifestations, and a fully connected layer for processing metadata features.

[0041] The beneficial effects of this application are:

[0042] This application provides a fileless memory horse detection method based on deep learning, including: obtaining a Filter object metadata table and a historical attack event table of fileless memory horses, where the historical attack event table contains malicious code injection types; establishing a first association relationship between the Filter object metadata table and the historical attack event table; calculating the attack interval time of the historical attack events corresponding to each Filter object according to the first association relationship to generate an attack interval time series; determining high-risk targets in the Filter objects according to the attack interval time series, and extracting the feature values of the high-risk targets; establishing a second association relationship between the feature values of the high-risk targets and the malicious code injection types; detecting abnormal manifestations of the high-risk targets in the malicious code injection types according to the second association relationship to generate an abnormal manifestation sequence; and using the abnormal manifestation sequence and the detection sequence of normal Filter objects as positive samples and negative samples respectively to train a neural network for detecting attack events of fileless memory horses. The present invention realizes high-precision detection of fileless memory horses through the integration of multi-dimensional spatio-temporal correlation analysis and a deep learning model. Among them, by establishing a first association relationship between Filter object metadata and historical attack events, and combining the density clustering algorithm to analyze the attack interval time series, periodic attack patterns are accurately identified. Establishing a second association relationship between the feature values of the high-risk targets and the malicious code injection types significantly improves the feature confusion resistance ability compared with single-feature detection. Description of the Drawings

[0043] Figure 1 is a schematic diagram of fileless memory horse detection based on deep learning in this application. Detailed Embodiments

[0044] Hereinafter, exemplary embodiments of the present disclosure will be described in more detail with reference to the drawings. Although the exemplary embodiments of the present disclosure are shown in the drawings, it can be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, the embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0045] Please refer to Figure 1 as shown in Figure 1 which shows the detection process of fileless memory horses based on deep learning.

[0046] A fileless memory horse detection method based on deep learning provided by this application includes:

[0047] S101. Obtain a Filter object metadata table and a historical attack event table of fileless memory horses, where the historical attack event table contains malicious code injection types;

[0048] Obtain multiple Filter type objects of the target system, including authentication Filter, authorization Filter, logging Filter, encoding Filter, compression Filter, etc.

[0049] Obtain multiple fileless memory horse attack information of multiple Filter type objects of the target system within a preset historical window.

[0050] The target system is any system that needs to be detected for fileless memory horses.

[0051] The preset historical window is a preset time range for retrieving historical data, which is used to analyze fileless memory horse attack events within the time range, thereby ensuring that data collection covers a sufficient time period to capture changes in multiple attack events.

[0052] Furthermore, use a memory scanning tool, such as Arthas, VisualVM, etc., to obtain information about all loaded Filter type objects in the target system. Extract relevant information, including class name, class loader, object status, creation time, etc. Create a metadata table containing all Filter type objects.

[0053] Collect a historical attack event table of fileless memory horses occurring in multiple Filter type objects within a preset historical window from sources such as security monitoring systems, log files, intrusion detection systems, etc. The historical attack event table includes: attack timestamp, attack method, such as which Filter type object initiated the attack, affected Filter type objects, attack source IP or user information.

[0054] S102. Establish a first association relationship between the Filter object metadata table and the historical attack event table;

[0055] Perform a security level analysis on the multiple Filter type objects, and filter and obtain K target Filter type objects according to the analysis results. Retrieve K target scan information sets using the K target Filter type objects as indexes to build a first association relationship.

[0056] Specifically, by checking historical vulnerabilities and known risks, analyzing configuration security, such as whether the latest security measures are applied, and evaluating the historical behavior data of the object, such as the frequency and severity of being attacked, assign a security level score to each Filter type object to achieve a security level analysis of the collected Filter type objects. Thus, determine the security status of each Filter type object to identify objects that may be threatened.

[0057] Based on the results of the security level analysis, K Filter type objects with lower security levels or affected by attacks are screened out, and the first association relationship between the Filter object metadata table and the historical attack event table is constructed.

[0058] Furthermore, for the K target Filter type objects screened out, the corresponding set of scanning information is retrieved. The K target scanning information sets reflect the basic situation of the K target Filter type objects, including the configuration parameters of the objects, the most recent access logs, and other data related to the object behavior. The goal of establishing a detailed set of scanning information for each target Filter type object and preparing for eigenvalue extraction and subsequent analysis is achieved.

[0059] The meaning of the first association relationship is that by systematically obtaining multiple Filter type objects in the target system and their fileless memory horse attack information within a preset historical window, performing security level analysis, and screening out K target Filter type objects and their corresponding sets of scanning information.

[0060] S103. Calculate the attack interval time of the historical attack events corresponding to each Filter object according to the first association relationship, and generate an attack interval time series;

[0061] Retrieve the multiple fileless memory horse attack information with the attack timestamp as the index to determine multiple sets of attack timestamps. Determine the interval time between two adjacent attacks according to the multiple sets of attack timestamps to obtain multiple attack interval time series.

[0062] S104. Determine the high-risk targets in the Filter objects according to the attack interval time series, and extract the eigenvalue of the high-risk targets;

[0063] Based on the multiple attack interval time series, perform centralized analysis to determine multiple centralized attack interval times. Calculate the ratio of the multiple centralized attack interval times to the total sum of the multiple centralized attack interval times to obtain multiple first security coefficients.

[0064] Sort the multiple first security coefficients in descending order, and take the Filter type objects corresponding to the first K first security coefficients as high-risk targets.

[0065] Furthermore, calculate the mean values of the multiple attack interval time series respectively to obtain multiple attack interval time means. Starting from the multiple attack interval time means, iterate in the multiple attack interval time series according to a preset iteration step length to determine multiple iterative attack interval times.

[0066] Further, determine whether the aggregation density of multiple iterative attack interval times is greater than or equal to the aggregation density of the mean of the multiple attack interval times. If so, use the multiple iterative attack interval times as the multiple stage attack interval times.

[0067] Among them, continue to iterate based on the multiple stage attack interval times and count the number of iterations. When the number of iterations meets the preset number of iterations, and the difference in aggregation density between the multiple stage attack interval times obtained in the previous iteration and the multiple iterative attack interval times obtained in this iteration is less than or equal to the preset difference, stop the iteration, and use the multiple iterative attack interval times obtained in this iteration as the multiple concentrated attack interval times.

[0068] When the aggregation density of the multiple stage attack interval times obtained in the previous iteration is less than the aggregation density of the multiple iterative attack interval times obtained in this iteration, stop the iteration, and use the multiple iterative attack interval times obtained in this iteration as the multiple concentrated attack interval times.

[0069] Further, use the attack timestamp as an index to retrieve multiple fileless memory horse attack information that has been collected. Extract all attack timestamps from the attack information to form multiple attack timestamp sets. Thus, obtain the attack event data for a specific time period.

[0070] According to the multiple attack timestamp sets, determine the interval time between two adjacent attacks, record these time intervals, and form multiple attack interval time series. For example, if attack event A occurs at time t1 and event B occurs at time t2, the interval time is t2 - t1. Thus, quantify the temporal relationship between attacks to facilitate the identification of attack patterns.

[0071] Conduct a centralized analysis of the multiple attack interval time series, analyze the general situation of each attack interval time series, and determine multiple concentrated attack interval times.

[0072] Specifically, calculate the ratio of the multiple concentrated attack interval times to their sum to determine the security level of each Filter type object. The larger the ratio, the greater the corresponding first security factor. Achieve the goal of evaluating the relative security of each concentrated attack interval time for subsequent sorting.

[0073] Sort the multiple first security factors in descending order, and select the Filter type objects corresponding to the top K first security factors as high-risk targets.

[0074] Further, calculate the mean values of multiple attack interval time series respectively to obtain multiple attack interval time means. Since the mean value can relatively represent the average level of each attack interval time series considering marginal values and accidental values, therefore, use the multiple attack interval time means as the starting point for subsequent iterative analysis.

[0075] Take the multiple attack interval time means as the starting point and perform iteration in multiple attack interval time series according to a preset iteration step size. Wherein, the preset iteration step size is the difference in attack interval time for a single iteration preset by those skilled in the art. After iteration, obtain multiple iterative attack interval times.

[0076] In each iteration, determine whether the aggregation density of the current multiple iterative attack interval times is greater than or equal to the aggregation density of the mean value. Wherein, the aggregation density of multiple iterative attack interval times is the ratio of the number of attack interval times in the area constructed with the multiple iterative attack interval times as the center and the preset iteration step size as the radius to the area of the region, reflecting the density of the attack interval times aggregated around the multiple iterative attack interval times.

[0077] If the condition is satisfied, take the current multiple iterative attack interval times as multiple stage attack interval times and continue the iteration. Obtain more accurate attack interval times through iteration to identify potential attack patterns.

[0078] Count the number of iterations. When the number of iterations meets the preset threshold, check the difference between the aggregation density of the multiple stage attack interval times obtained in the previous iteration and the aggregation density obtained in this iteration. If the difference is less than or equal to the preset difference, it indicates that the relatively dense area has been reached, then stop the iteration and take the multiple iterative attack interval times obtained in this iteration as multiple concentrated attack interval times. Ensure that the iterative process is efficient and does not waste computing resources, and finally obtain stable concentrated attack interval times.

[0079] When the aggregation density of the multiple stage attack interval times obtained in the previous iteration is less than the aggregation density of the multiple iterative attack interval times obtained in this iteration, it indicates that the edge of the relatively dense distribution area has been reached. At this time, stop the iteration and take the multiple iterative attack interval times obtained in this iteration as multiple concentrated attack interval times. Ensure that the final result reflects the real attack interval pattern through dynamic adjustment of the analysis method.

[0080] Extract eigenvalues according to the preset eigenvalue set for the K target scan information sets to obtain eigenvalues.

[0081] S105. Establish a second association relationship between the eigenvalues of the high-risk targets and the malicious code injection types;

[0082] The second association relationship refers to: based on the extraction result, combining the multiple fileless memory malware attack information to analyze the detection channel type, determining K detection channel type sets, where the eigenvalue and the detection channel type have a one-to-many mapping relationship.

[0083] The preset eigenvalue set includes the name of the loaded Filter class, the class loader of the specific loaded Filter, and the file path corresponding to the Filter class.

[0084] Taking the malicious code injection type as an index, retrieve the multiple fileless memory malware attack information to determine multiple malicious code injection type sets, and based on the K target Filter type objects, match the multiple malicious code injection type sets to obtain K target malicious code injection type sets;

[0085] Extract eigenvalues from the K target scan information sets according to the preset eigenvalue set to obtain K eigenvalue sets;

[0086] Analyze the K target malicious code injection type sets and the K eigenvalue sets to determine the K detection channel type sets.

[0087] Further, based on the multiple fileless memory malware attack information, perform frequency screening on the K target malicious code injection type sets, and remove the target malicious code injection types with frequencies lower than the preset frequency to obtain K cleaned target malicious code injection type clusters;

[0088] According to the K cleaned target malicious code injection type clusters, subdivide the K eigenvalue sets to determine K subdivided eigenvalue sets;

[0089] Take the K subdivided eigenvalue sets as the K detection channel type sets.

[0090] Further, extract eigenvalues from the K target scan information sets according to the preset eigenvalue set (such as the name of the loaded Filter class, the class loader, and the corresponding file path). Extract relevant feature information for each target Filter object to ensure that all eigenvalues are accurately recorded.

[0091] Taking the malicious code injection type as an index, retrieve the multiple fileless memory malware attack information to determine multiple malicious code injection type sets. Collect different malicious code injection types to ensure that various possible attack methods (such as SQL injection, script injection, etc.) are covered. Thus, construct a complete malicious code injection type set for matching and analysis.

[0092] Match multiple malicious code injection type sets based on K target Filter type objects to obtain K target malicious code injection type sets. Ensure that each target Filter object is associated with the malicious code injection types it may face. Confirm the specific injection threats that each target Filter may be subject to, providing a basis for subsequent analysis.

[0093] Comprehensively analyze the K target malicious code injection type sets and K eigenvalue sets to determine K detection channel type sets. Among them, there is a one-to-many mapping relationship between eigenvalues and detection channel types, facilitating further subdivision of eigenvalues and improving detection accuracy. By identifying the detection channel types related to fileless memory horse attacks, it provides a basis for subsequent construction of detection channels.

[0094] Based on multiple fileless memory horse attack information, perform frequency screening on the K target malicious code injection type sets. Eliminate the target malicious code injection types with frequencies lower than the preset frequency to obtain K cleaned target malicious code injection type clusters. Retain the high-frequency malicious code injection types to ensure that the analysis and detection focus on more threatening types.

[0095] According to the K cleaned target malicious code injection type clusters, subdivide the K eigenvalue sets. Ensure that the eigenvalues can effectively correspond to the cleaned malicious code injection types, so that each subdivided eigenvalue set is associated with the corresponding malicious code injection type. Enhance the relevance and effectiveness of the eigenvalues for subsequent analysis of detection channel types. Use the K subdivided eigenvalue sets as K detection channel type sets. Each detection channel type should be consistent with the corresponding subdivided eigenvalue and malicious code injection type to ensure the pertinence of detection. Provide a clear type basis for subsequent construction of detection channels to ensure effectiveness and precision.

[0096] Based on the K detection channel type sets, construct detection channels respectively to determine K detection channel sets;

[0097] According to the above-determined K detection channel type sets, define the functions and objectives of each detection channel. Each channel should focus on specific eigenvalues and corresponding malicious code injection types. Ensure that the purpose of each detection channel is clear.

[0098] Create a detection channel object for each detection channel type. Each object contains necessary configuration parameters such as subdivided eigenvalues, monitoring parameters, input sources, etc.

[0099] Establish an independent running instance for each detection channel to facilitate its separate monitoring and management.

[0100] Configure corresponding monitoring parameters according to the objectives of each detection channel. These parameters include: monitoring frequency (such as per second, per minute), threshold setting (such as the alarm threshold of eigenvalue), data acquisition source (such as access logs, memory snapshots, etc.). Ensure that the detection channel can monitor relevant features in real time and can alarm in time when anomalies are detected.

[0101] Connect each detection channel to its corresponding data source. Data sources include: real-time log files, network traffic monitoring tools, system call monitoring tools. Ensure that each detection channel can access the required data to support the real-time extraction and analysis of sub-feature values.

[0102] Furthermore, collect the data and feedback of each detection channel during operation and analyze its performance. If it is found that the detection accuracy of a certain channel is not high or there are missed alarms / false alarms, corresponding optimizations are carried out. Adjust monitoring parameters, feature extraction algorithms or data source configurations to improve the performance of the detection channel.

[0103] According to the above steps, an effective construction based on the set of K detection channel types is ensured, providing a dedicated monitoring and response mechanism for the detection of fileless memory horses. The successful implementation of this process is the basis for subsequent abnormal behavior sequence generation and security detection.

[0104] S106. Detect the abnormal behavior of the high-risk target in the malicious code injection type according to the second association relationship, and generate an abnormal behavior sequence;

[0105] Use the set of K detection channels to perform eigenvalue mapping analysis on the K target Filter type objects of the target system respectively, and determine K abnormal behavior sequences, where each abnormal behavior sequence includes a judgment result sequence of a detection channel set;

[0106] Identify the K high-risk targets that need to be analyzed. These high-risk targets are screened from the previous steps and have a relatively high risk or are affected by attacks.

[0107] Prepare an abnormal behavior sequence container for each high-risk target to store the analysis results of eigenvalue mapping. For example, set a data structure to facilitate the storage and management of the detection results of each Filter object.

[0108] Use the set of K detection channels to perform eigenvalue mapping analysis on each target Filter object.

[0109] Judge whether the behavior of the target Filter is normal through the eigenvalue extracted by the detection channel. Record the judgment result of each channel on each Filter object, such as normal (0) or abnormal (1).

[0110] Generate a sequence of judgment results associated with each target Filter object.

[0111] Summarize the detection channel judgment result sequences of each target Filter object to form corresponding abnormal performance sequences. Each abnormal performance sequence should include judgment results from K detection channels, indicating the performance of the Filter object under different detection channels. Create abnormal performance sequences that can reflect the behavior of the Filter object to provide a basis for subsequent security identification.

[0112] Integrate and store all the generated K abnormal performance sequences in a unified data structure for subsequent analysis and processing. Ensure that each abnormal performance sequence can be associated with its corresponding target Filter object and detection channel, facilitating subsequent identification and evaluation, and providing structured and organized data support for subsequent network security identification steps.

[0113] Conduct a preliminary verification on the generated abnormal performance sequences to ensure their correctness and integrity. For example, compare the abnormal performance sequences with known attack samples to confirm whether the sequences accurately reflect the abnormal behavior of the Filter object. Ensure the quality of the abnormal performance sequences to lay a foundation for subsequent security detection.

[0114] S107: Use the abnormal performance sequences and the detection sequences of normal Filter objects as positive and negative samples respectively to train a neural network for detecting fileless in-memory malware attack events.

[0115] Call the security detection network to perform network security identification on the K abnormal performance sequences, and determine K identification detection results. Among them, each identification detection result is the existence or non-existence of fileless in-memory malware.

[0116] Furthermore, obtain a set of K sample abnormal performance sequences and a set of K sample identification detection results.

[0117] Using the sample identification detection results as supervision and the sample abnormal performance sequences as inputs, train the security detection network in combination with the set of K sample abnormal performance sequences and the set of K sample identification detection results.

[0118] Use the constructed security detection network (such as a deep learning model) to perform network security identification on the generated K abnormal performance sequences. Input each abnormal performance sequence into the security detection network and execute the identification process. Determine whether each abnormal performance sequence shows the characteristics of fileless in-memory malware, and output K identification detection results. Among them, each identification detection result is the existence or non-existence of fileless in-memory malware.

[0119] Further, based on the output of the security detection network, determine whether there is a fileless in-memory horse in each abnormal behavior sequence. The results can be:

[0120] Exists (1): There are signs of fileless in-memory horse attacks on the specified Filter object.

[0121] Does not exist (0): No fileless in-memory horse attacks are detected on the specified Filter object. Thus, clear identification results are provided to assist in decision-making and response to potential security threats.

[0122] Further, collect K sets of sample abnormal behavior sequences and K sets of sample identification and detection results. These sample data can be sourced from historical records, known attack samples, or simulated attacks. Using the sample identification and detection results as supervision signals and the sample abnormal behavior sequences as inputs, train a security detection network constructed with a feedforward neural network as the framework. During the training process, the network will learn the relationship between features and identification results and adjust the model parameters through the backpropagation algorithm to improve the identification accuracy.

[0123] During the model training process, monitor metrics such as the loss function and accuracy in real-time to evaluate the training effect of the model. If overfitting or poor training effect is found, hyperparameters such as the learning rate, batch size, or network structure can be adjusted. Ensure that the training process is stable and efficient, and finally obtain an accurate and reliable security detection network. It achieves the technical effect of enabling the security detection network to effectively identify fileless in-memory horses and improve its detection ability in the actual environment.

[0124] In summary, the embodiments of this application have at least the following technical effects:

[0125] This application obtains multiple fileless memory horse attack information of multiple Filter type objects in a target system within a preset historical window, analyzes the security levels of the multiple Filter type objects, and filters out K target Filter type objects according to the analysis results. Using the K target Filter type objects as indexes, K target scan information sets are retrieved. Then, eigenvalue extraction is performed on the K target scan information sets according to a preset eigenvalue set. Based on the extraction results and combined with the multiple fileless memory horse attack information, the detection channel type is analyzed to determine K detection channel type sets. Among them, the eigenvalue and the detection channel type have a one-to-many mapping relationship. Furthermore, based on the K detection channel type sets, detection channels are constructed respectively to determine K detection channel sets. Then, eigenvalue mapping analysis is performed on the K target Filter type objects of the target system using the K detection channel sets respectively to determine K abnormal performance sequences. Each abnormal performance sequence includes a judgment result sequence of a detection channel set. The security detection network is called to perform network security identification on the K abnormal performance sequences to determine K identification detection results. Each identification detection result is whether there is a fileless memory horse or not. It achieves the technical effects of improving the detection quality of fileless memory horses and enhancing the system security.

[0126] This application also provides a fileless memory horse detection device based on deep learning, including:

[0127] An acquisition module that acquires a Filter object metadata table and a historical attack event table of fileless memory horses. The historical attack event table contains malicious code injection types;

[0128] A first association module that establishes a first association relationship between the Filter object metadata table and the historical attack event table;

[0129] A time module that calculates the attack interval time of the historical attack events corresponding to each Filter object according to the first association relationship and generates an attack interval time sequence;

[0130] A screening module that determines high-risk targets among the Filter objects according to the attack interval time sequence and extracts the eigenvalues of the high-risk targets;

[0131] A second association module that establishes a second association relationship between the eigenvalues of the high-risk targets and the malicious code injection types;

[0132] A sequence module that detects the abnormal performance of the high-risk targets in the malicious code injection types according to the second association relationship and generates an abnormal performance sequence;

[0133] A training module uses the abnormal behavior sequence and the detection sequence of normal Filter objects as positive and negative samples respectively to train a neural network for detecting fileless in-memory malware attack events.

[0134] Further, the screening module determines high-risk targets in the Filter objects according to the attack interval time series, including:

[0135] Calculating the average attack interval time corresponding to each Filter object;

[0136] Performing density clustering analysis based on the average value, and marking the Filter objects corresponding to the interval times with an aggregation density exceeding a preset threshold as high-risk targets.

[0137] Further, the eigenvalue includes:

[0138] Filter class loader hash value, Filter class bytecode checksum, Filter instantiation time, and time offset of the most recent attack event.

[0139] Further, the second association module establishes a second association relationship between the eigenvalue of the high-risk target and the malicious code injection type, including:

[0140] Constructing an eigenvalue distribution histogram for each malicious code injection type;

[0141] According to the eigenvalue distribution histogram, using KL divergence to measure the deviation degree of the eigenvalue from the historical attack characteristics, and establishing the second association relationship when the deviation degree exceeds the dynamic threshold.

[0142] Further, the neural network includes:

[0143] A convolutional layer for processing raw bytecode features, an LSTM layer for processing temporal abnormal behaviors, and a fully connected layer for processing metadata features.

[0144] The above order of the embodiments of the present application is only for description and does not represent the advantages or disadvantages of the embodiments. And the above describes specific embodiments of this specification. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0145] The above are only the preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

[0146] This specification and the accompanying drawings are merely exemplary descriptions of the present application and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of the present application. Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the present application and its equivalent technologies, the present application is intended to include these changes and modifications therein.

Claims

1. A fileless memory horse detection method based on deep learning, characterized in that, including: Obtain the Filter object metadata table and the historical attack event table of the fileless memory horse, where the historical attack event table contains malicious code injection types; Establish a first association relationship between the Filter object metadata table and the historical attack event table; Calculate the attack interval time of the historical attack events corresponding to each Filter object according to the first association relationship, and generate an attack interval time series; Determine the high-risk targets in the Filter objects according to the attack interval time series, and extract the characteristic values of the high-risk targets; Establish a second association relationship between the characteristic values of the high-risk targets and the malicious code injection types; Detect the abnormal performance of the high-risk targets in the malicious code injection types according to the second association relationship, and generate an abnormal performance series; Use the abnormal performance series and the detection series of normal Filter objects as positive samples and negative samples respectively to train a neural network for detecting attack events of fileless memory horses.

2. The method for detecting fileless memory horses based on deep learning according to claim 1, wherein, Determine the high-risk targets in the Filter objects according to the attack interval time series, including: Calculate the average value of the attack interval time corresponding to each Filter object; Perform density clustering analysis based on the average value, and mark the Filter objects corresponding to the interval time with an aggregation density exceeding the preset threshold as high-risk targets.

3. The method for detecting fileless memory horses based on deep learning according to claim 1, characterized in that, The characteristic values include: Filter class loader hash value, Filter class bytecode checksum, Filter instantiation time, and time offset of the most recent attack event.

4. The method for detecting fileless memory horses based on deep learning according to claim 1, wherein, Establish a second association relationship between the characteristic values of the high-risk targets and the malicious code injection types, including: Construct a characteristic value distribution histogram for each malicious code injection type; According to the characteristic value distribution histogram, use KL divergence to measure the deviation degree of the characteristic values from the historical attack characteristics, and establish the second association relationship when the deviation degree exceeds the dynamic threshold.

5. The method for detecting fileless memory horses based on deep learning according to claim 1, wherein The neural network includes: A convolutional layer for processing raw bytecode features, an LSTM layer for processing temporal abnormal performance, and a fully connected layer for processing metadata features.

6. A fileless memory malware detection device based on deep learning, characterized in that, including: An acquisition module that acquires the Filter object metadata table and the historical attack event table of the fileless memory horse, where the historical attack event table contains malicious code injection types; A first association module that establishes a first association relationship between the Filter object metadata table and the historical attack event table; A time module that calculates the attack interval time of the historical attack events corresponding to each Filter object according to the first association relationship, and generates an attack interval time series; A screening module that determines the high-risk targets in the Filter objects according to the attack interval time series, and extracts the characteristic values of the high-risk targets; A second association module that establishes a second association relationship between the characteristic values of the high-risk targets and the malicious code injection types; A sequence module that detects the abnormal performance of the high-risk targets in the malicious code injection types according to the second association relationship, and generates an abnormal performance series; The training module uses the abnormal behavior sequence and the detection sequence of the normal Filter object as positive and negative samples respectively to train a neural network for detecting fileless memory horse attack events.

7. The memoryless malware detection device based on deep learning according to claim 6, characterized in that, The screening module determines high-risk targets in the Filter object according to the attack interval time series, including: Calculating the average attack interval time corresponding to each Filter object; Performing density clustering analysis based on the average value, and marking the Filter object corresponding to the interval time with an aggregation density exceeding the preset threshold as a high-risk target.

8. The memoryless malware detection device based on deep learning according to claim 6, characterized in that The eigenvalue includes: Filter class loader hash value, Filter class bytecode checksum, Filter instantiation time, and time offset of the most recent attack event.

9. The memoryless malware detection device based on deep learning according to claim 6, wherein The second association module establishes a second association relationship between the eigenvalue of the high-risk target and the malicious code injection type, including: Constructing an eigenvalue distribution histogram for each malicious code injection type; According to the eigenvalue distribution histogram, using KL divergence to measure the deviation degree of the eigenvalue from the historical attack feature, and establishing the second association relationship when the deviation degree exceeds the dynamic threshold.

10. The memoryless malware detection device based on deep learning according to claim 6, wherein, The neural network includes: A convolutional layer for processing raw bytecode features, an LSTM layer for processing temporal abnormal behaviors, and a fully connected layer for processing metadata features.

Images