A file load behavior deep analysis method and system based on multi-modal luring

Abstract

This invention relates to the field of network security technology, and in particular to a method and system for in-depth analysis of file payload behavior based on multimodal trapping. The method includes: determining trap points based on anomaly frequency ratios according to the monitoring cycle sequence, or determining trap points for matching or segmented trapping based on matching reference values; in segmented trapping, determining fixed trap point updates based on an evaluation threshold or triggered trap point updates based on behavioral anomaly degree and screenshot anomaly comparison degree based on the danger level of the monitoring cycle and the anomaly capture rate; setting the number of trap points based on behavioral error values, and determining whether to adjust the number of trap points based on proximity change coefficients according to the segment sequence. This invention can improve the accuracy of capturing malicious behavior in file payloads.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for in-depth analysis of file payload behavior based on multimodal trapping. Background Technology

[0002] In multimodal decoy attacks, file decoy analysis is a crucial component. File payloads, as the primary object of file decoy analysis, play a vital role in network attacks. However, file payload behavior analysis suffers from drawbacks such as a lack of targeted decoy point settings, a single dimension for risk level assessment, and a rigid decoy point update mechanism. These shortcomings lead to missed detection of key malicious behaviors, inaccurate quantification of risk levels, delayed response to covert attacks, and difficulty in identifying unknown and mutated malicious payloads. Therefore, improving the accuracy of file payload behavior analysis is a technical problem that urgently needs to be solved by those skilled in the art.

[0003] Chinese Patent Publication No. CN112272177A discloses a method for batch deployment of honeynet trapping nodes, including: S1: detecting the Docker environment installation conditions of the batch running trapping node system, and installing the Docker environment after successful detection; S2: configuring the bridge network for the batch running trapping node system, and connecting the physical network cards of the batch running trapping node system to the bridge network; S3: installing the pipework tool on the batch running trapping node system, and installing and upgrading the ipcalc tool; S4: setting the bridge interface information and Docker container configuration information through user input; S5: the Docker environment creates Docker containers in batches according to the bridge interface information and Docker container configuration information, automatically installing the trapping node runtime program in the created containers, and completing the batch deployment of honeynet trapping nodes after installation. It is evident that the above technical solution has the following problems: it only focuses on the batch deployment of trapping nodes, lacks the ability to dynamically analyze file payload behavior, and cannot flexibly adjust the trapping strategy according to the actual application scenario, resulting in poor accuracy in capturing malicious behavior of file payloads. Summary of the Invention

[0004] To address this, the present invention provides a method and system for in-depth analysis of file payload behavior based on multimodal trapping, which overcomes the problem in the prior art of lacking dynamic analysis capabilities for file payload behavior, being unable to flexibly adjust trapping strategies according to actual application scenarios, and resulting in poor accuracy in capturing malicious behavior of file payloads.

[0005] To achieve the above objectives, this invention provides a method for in-depth analysis of file payload behavior based on multimodal trapping, comprising:

[0006] Obtain file payload behavior;

[0007] The trapping points are set based on the ratio of abnormal frequencies according to the monitoring cycle sequence, or the trapping points are set by matching or segmented according to the matching reference value.

[0008] In the matching and setting of trap points, trap points are set based on the matching coefficient;

[0009] In the segmented setting of trapping points, the risk level of the monitoring period and the abnormal capture rate determine whether to update the trapping points in a fixed manner based on the assessment threshold or in a triggered manner based on the degree of behavioral abnormality and the degree of abnormality comparison of the operation screenshot; wherein, the risk level of the monitoring period is determined based on the degree of environmental interaction abnormality and the degree of convergence of historical abnormalities.

[0010] The number of trap points is set based on the behavior error value, and it is determined whether to adjust the number of trap points based on the proximity change coefficient according to the paragraph order.

[0011] Furthermore, for monitoring cycles with a standard monitoring sequence, trapping points are set based on the ratio of abnormal frequencies;

[0012] For monitoring cycles whose sequence is longer than the standard sequence, the trapping points should be set according to the matching reference value, or the trapping points should be set in segments.

[0013] Furthermore, for monitoring periods where the matching reference value is greater than or equal to the preset matching reference value, trapping points are set for matching.

[0014] For monitoring periods where the matching reference value is less than the preset matching reference value, trapping points are set in segments.

[0015] Furthermore, the hazard levels include:

[0016] A hazard level is defined as one where the degree of environmental interaction anomaly is greater than or equal to the preset degree of environmental interaction anomaly or the degree of historical anomaly convergence is greater than or equal to the preset degree of historical anomaly convergence.

[0017] The second-class hazard level is defined as having an environmental interaction anomaly degree less than the preset environmental interaction anomaly degree and a historical anomaly convergence degree less than the preset historical anomaly convergence degree.

[0018] Furthermore, for monitoring periods where the hazard level is Class I or the abnormal capture rate is greater than or equal to the preset abnormal capture rate, fixed trapping points are updated based on the evaluation threshold.

[0019] Furthermore, for monitoring periods where the hazard level is Class II and the anomaly capture rate is less than the preset anomaly capture rate, trigger-based trapping point updates are performed based on behavioral anomaly degree and anomaly comparison degree of operation screenshots.

[0020] Furthermore, for time periods where the paragraph order is the standard order, the number of trapping points is determined based on the behavioral error value.

[0021] Furthermore, for time periods where the paragraph order is greater than the standard order, the number of initial trapping points is determined based on the behavioral error value, and the number of initial trapping points is adjusted based on the proximity change coefficient.

[0022] For time periods when the neighboring change coefficient is greater than or equal to the preset neighboring change coefficient, the number of trapping points is increased based on the change coefficient comparison value.

[0023] For time periods when the neighbor change coefficient is less than the preset neighbor change coefficient, the initial trapping point quantity setting is determined based on the adjustment reference value.

[0024] Furthermore, for periods when the adjustment reference value is less than the preset adjustment reference value, the initial number of trapping points is determined to be unqualified, and the number of trapping points is increased based on the adjustment reference value.

[0025] For time periods when the adjustment reference value is greater than or equal to the preset adjustment reference value, the initial trapping point quantity setting is deemed qualified.

[0026] This invention also provides a system for in-depth analysis of document payload behavior based on multimodal trapping, comprising:

[0027] The data acquisition module is used to obtain file payload behavior;

[0028] The analysis module is connected to the data acquisition module and is used to determine the trapping points based on the abnormal frequency ratio according to the monitoring cycle sequence, or to determine the trapping points to be set by matching or segmented according to the matching reference value.

[0029] A matching setting module, which is connected to the setting analysis module, is used to set trapping points based on matching coefficients;

[0030] The first segment setting module, which is connected to the setting analysis module, is used to determine whether to update the fixed trap point based on the evaluation threshold or the triggered trap point based on the abnormality degree of behavior and the abnormality comparison degree of the operation screenshot, based on the danger level of the monitoring period and the abnormality capture rate; wherein, the danger level of the monitoring period is determined based on the abnormality degree of environmental interaction and the convergence degree of historical abnormality.

[0031] The second segment setting module, which is connected to the first segment setting module, is used to set the number of trap points based on the behavior error value, and to determine whether to adjust the number of trap points based on the proximity change coefficient according to the segment order.

[0032] Compared with the prior art, the beneficial effects of the present invention are that, in the technical solution of the present invention, by monitoring whether the cycle sequence is a standard sequence, the analysis stage of the file payload behavior can be effectively reflected. Then, different trap point setting methods can be adaptively selected according to the monitoring cycle sequence, which is conducive to quickly establishing a basic monitoring defense line in the initial stage, accurately and dynamically adjusting the strategy in the continuous stage, and accurately setting the number of trap points in different analysis stages, thereby improving the accuracy of capturing malicious behavior of file payloads.

[0033] Furthermore, this invention effectively reflects the similarity between historical behavior in the current monitoring period and verified qualified historical behavior by matching reference values. Then, based on the matching reference values, trap points are adaptively set or trap points are set in segments. This is beneficial to optimize resource allocation and accurately adapt strategies while ensuring the effectiveness of monitoring, thereby improving the efficiency and depth of file payload behavior analysis and reducing the risk of missed capture.

[0034] Furthermore, this invention effectively reflects the risk characteristics of file payload behavior in the current monitoring period through environmental interaction anomaly degree and historical anomaly convergence degree, as well as the degree of abnormal fluctuation in interaction with the environment and the similarity with known abnormal behaviors. Based on these two indicators, the danger level of the monitoring period is determined, which is conducive to achieving accurate classification and differentiated response of risk level, thereby providing clear risk guidance for subsequent trap point update strategies and improving the monitoring intensity of high-risk scenarios.

[0035] Furthermore, this invention effectively reflects the risk level and anomaly capture degree of the current monitoring period by using the danger level and anomaly capture rate of the monitoring period. Then, based on the danger level and anomaly capture rate of the monitoring period, it determines whether to update the trap point by a fixed method based on the evaluation threshold or by a triggered method based on the degree of behavioral anomaly and the degree of anomaly comparison of the running screenshot. This is conducive to achieving precise monitoring and control driven by both risk classification and efficiency feedback. In this way, it ensures the comprehensiveness of monitoring in high-risk scenarios and optimizes resource consumption in low-risk scenarios, ultimately effectively balancing the accuracy and operational efficiency of file payload behavior analysis.

[0036] Furthermore, this invention effectively reflects the temporal sequence of different time periods within a single monitoring cycle by determining whether the paragraph order is a standard order. This allows for the determination of the corresponding trapping point quantity setting method based on the paragraph order, which is beneficial for achieving layered and precise control of the trapping point quantity for different data reference conditions in different time periods. This helps ensure the monitoring accuracy of each time period and thus improves the accuracy of capturing malicious behavior in file payloads. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of the document payload behavior depth analysis method based on multimodal trapping according to the present invention;

[0038] Figure 2 This is a flowchart illustrating how the present invention determines the matching setting of trap points or the segmented setting of trap points based on the matching reference value of file payload behavior.

[0039] Figure 3 This is a flowchart illustrating the process of determining the hazard level based on environmental interaction anomaly degree and historical anomaly convergence degree in this invention.

[0040] Figure 4 This is a unit connection diagram of the document payload behavior depth analysis system based on multimodal trapping according to the present invention. Detailed Implementation

[0041] To make the objectives and advantages of the present invention clearer, the present invention will be further described below with reference to embodiments; it should be understood that the specific embodiments described herein are merely for explaining the present invention and are not intended to limit the present invention.

[0042] Preferred embodiments of the present invention will now be described with reference to the accompanying drawings. Those skilled in the art should understand that these embodiments are merely illustrative of the technical principles of the present invention and are not intended to limit the scope of protection of the present invention.

[0043] It should be noted that in the description of this invention, the terms "upper", "lower", "left", "right", "inner", "outer", etc., which indicate the direction or positional relationship, are based on the direction or positional relationship shown in the drawings. This is only for the convenience of description and is not intended to indicate or imply that the device or element must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, it should not be construed as a limitation of this invention.

[0044] Furthermore, it should be noted that, in the description of this invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention according to the specific circumstances.

[0045] Please see Figures 1 to 3 As shown, this invention provides a method for in-depth analysis of file payload behavior based on multimodal trapping, comprising:

[0046] Obtain file payload behavior;

[0047] The trapping points are set based on the ratio of abnormal frequencies according to the monitoring cycle sequence, or the trapping points are set by matching or segmented according to the matching reference value.

[0048] In the matching and setting of trap points, trap points are set based on the matching coefficient;

[0049] In the segmented setting of trapping points, the risk level of the monitoring period and the abnormal capture rate determine whether to update the trapping points in a fixed manner based on the assessment threshold or in a triggered manner based on the degree of behavioral abnormality and the degree of abnormality comparison of the operation screenshot; wherein, the risk level of the monitoring period is determined based on the degree of environmental interaction abnormality and the degree of convergence of historical abnormalities.

[0050] The number of trap points is set based on the behavior error value, and it is determined whether to adjust the number of trap points based on the proximity change coefficient according to the paragraph order.

[0051] The application scenario of this invention is the setting of dynamic trap points in the process of file payload behavior analysis. This invention has several historical records. Each historical record records at least one matching reference value, environmental interaction anomaly degree, historical anomaly convergence degree, behavior anomaly degree, and running screenshot anomaly comparison degree in the historical process of setting dynamic trap points in the process of file payload behavior analysis. Each historical record has a corresponding qualified mark. The qualified mark records whether the process of setting dynamic trap points in the process of file payload behavior analysis meets the user's needs. The qualified mark can be recorded manually. The qualified mark records whether the historical record meets the user's needs. It is understood that determining whether the user's needs are met based on self-defined indicators (e.g., number of anomalies) is a means that those skilled in the art have mastered, and will not be elaborated here. The number of anomalies is the cumulative number of times that file payload behaviors with potential malicious attributes or that do not conform to normal operating logic cannot be captured. File payload behaviors with potential malicious attributes or that do not conform to normal operating logic include, but are not limited to, unauthorized external connections initiated by the file payload, communication with malicious IPs / domains, and abnormal data encrypted transmission.

[0052] The file payload behavior is the sum of all dynamic operations, state changes, and interactions with the external environment that occur when the file payload is executed in the target runtime environment.

[0053] The file payload is the component within the file that carries core functionality, including but not limited to executable code, script fragments, and malicious code modules. The target runtime environment includes but is not limited to operating systems, sandboxes, and terminal devices.

[0054] Dynamic operations include, but are not limited to, process creation / termination initiated by the file payload, memory read / write, registry modification, and file addition, deletion, modification, and query; interactions with the external environment include, but are not limited to, interactions between the file payload and the network (such as connecting to IP / domain names, sending / receiving data), interactions with hardware devices (such as reading hard disk information, calling the camera), and interactions with other software (such as calling system interfaces, injecting into other processes); state changes include, but are not limited to, changes in the state of the file payload itself (such as code unpacking, module loading), and changes to the state of the runtime environment (such as modifying system configuration, abnormal fluctuations in resource usage).

[0055] Specifically, for monitoring cycles with a standard monitoring sequence, trapping points are set based on the ratio of abnormal frequencies.

[0056] For monitoring cycles whose sequence is longer than the standard sequence, the trapping points should be set according to the matching reference value, or the trapping points should be set in segments.

[0057] Specifically, this invention sets a continuous monitoring cycle starting from the activation moment of the file payload behavior. The duration of the monitoring cycle can be set according to the user's needs. The greater the user's need for monitoring accuracy, the shorter the duration of the monitoring cycle. One possible value for the monitoring cycle is 10 minutes. The activation moment of the file payload behavior refers to the point in time when the file payload changes from a static storage state to a dynamic execution state and begins to interact with the system environment (such as calling resources, executing code, transmitting data, etc.).

[0058] The standard sequence is 1, and the monitoring cycle sequence is the sequence number of the monitoring cycles that are continuously cycled after the file load behavior is activated.

[0059] When setting trap points based on anomaly frequency, for a single file payload behavior, the file payload corresponding to that file payload behavior is detected. When the anomaly frequency ratio corresponding to that file payload is greater than or equal to the preset anomaly frequency ratio, the number of trap points set in the monitoring cycle with the standard order is 25. When the anomaly frequency ratio corresponding to that file payload is less than the preset anomaly frequency ratio, the number of trap points set in the monitoring cycle with the standard order is 16.

[0060] For a single file payload, the file payload behavior corresponding to that file payload in the historical records that can meet the user's needs is detected and recorded as the reference file payload behavior. The abnormal frequency ratio corresponding to that file payload is the ratio of the number of abnormal reference file payload behaviors to the total number of reference file payload behaviors. Abnormal reference file payload behavior is the reference file payload behavior in which the set trap point successfully captures the abnormal behavior. Abnormal behavior includes, but is not limited to, starting from an unexpected path and making unauthorized API calls. This is content that is easy for those skilled in the art to understand and will not be elaborated on in detail.

[0061] The user can determine the preset anomaly frequency ratio value according to the actual application scenario. The greater the user's requirement for the accuracy of risk identification, the smaller the preset anomaly frequency ratio value should be. One preset anomaly frequency ratio value is provided, which is 0.5.

[0062] Specifically, for monitoring periods where the matching reference value is greater than or equal to the preset matching reference value, trap points are set for matching.

[0063] For monitoring periods where the matching reference value is less than the preset matching reference value, trapping points are set in segments.

[0064] Specifically, each monitoring period of the file load behavior corresponding to the historical records that can meet the user's needs will be recorded as the effective historical period;

[0065] The historical behavior corresponding to a single monitoring period is the file payload behavior of each monitoring period prior to that monitoring period.

[0066] The matching reference value for a single monitoring period is the maximum value among the matching coefficients of the historical behavior corresponding to that monitoring period and the historical behavior corresponding to each valid historical period.

[0067] For any two monitoring periods, the historical behaviors are denoted as behavior A and behavior B, respectively. The formula for calculating the matching coefficient S between the two behaviors is: S = α × S1 + β × S2 + γ × S3.

[0068] Where S1 = number of overlapping dynamic operations in the two behaviors / (total number of dynamic operations in behavior A + total number of dynamic operations in behavior B - number of overlapping dynamic operations), S2 = number of overlapping state change types in the two behaviors / (total number of state change types in behavior A + total number of state change types in behavior B - number of overlapping state change types), S3 = number of overlapping external environment interaction activities in the two behaviors / (total number of external environment interaction activities in behavior A + total number of external environment interaction activities in behavior B - number of overlapping external environment interaction activities), α is 0.3, β is 0.2, and γ is 0.5.

[0069] The user can determine the value of the preset matching reference value according to the actual application scenario. The greater the user's requirement for the accuracy of matching file payload behavior, the larger the value of the preset matching reference value. A method for determining the value of the preset matching reference value is provided: detect the historical records of the user's matching and setting of trap points, and record the average value of the matching reference values ​​corresponding to the historical records that meet the user's requirements as the preset matching reference value.

[0070] In the matching and setting of trap points, trap points are set based on the matching coefficient. For a single monitoring period, the trap point configuration of the effective historical period corresponding to the historical behavior with the largest matching coefficient corresponding to that monitoring period is directly reused, including the number of trap points and the deployment position of each trap point on the time axis.

[0071] Understandably, matching reference values ​​effectively reflect the similarity between the historical behavior of the current monitoring period and the verified qualified historical behavior. When the matching reference value is greater than or equal to the preset matching reference value, it indicates that the current behavior is highly similar to the behavior of a certain valid historical period, and the behavior pattern has stability and reusability. Since the trap point configuration of the historical period has been verified to meet the user's needs, direct reuse can reduce the cost of repeated calculations and quickly achieve accurate monitoring. Therefore, matching is used to set trap points.

[0072] When the matching reference value is less than the preset matching reference value, it indicates that the current behavior is significantly different from the behavior of all valid historical periods, and the behavior pattern is unique or uncertain. At this time, it is necessary to conduct fine-grained segmented monitoring based on the dynamic characteristics of the current behavior, and flexibly adjust the trapping strategy through danger level judgment and abnormal triggering mechanism to avoid missed judgment. Therefore, trapping points are set in segments.

[0073] Specifically, the danger levels include:

[0074] A hazard level is defined as one where the degree of environmental interaction anomaly is greater than or equal to the preset degree of environmental interaction anomaly or the degree of historical anomaly convergence is greater than or equal to the preset degree of historical anomaly convergence.

[0075] The second-class hazard level is defined as having an environmental interaction anomaly degree less than the preset environmental interaction anomaly degree and a historical anomaly convergence degree less than the preset historical anomaly convergence degree.

[0076] Specifically, for a single monitoring period, the monitoring periods that are adjacent to and located within that monitoring period are recorded as the neighboring monitoring periods corresponding to that monitoring period;

[0077] The method for confirming the environmental interaction anomaly degree corresponding to a single monitoring cycle is as follows: obtain the CPU utilization rate, TCP connection count, and database read / write count at each time point in the adjacent monitoring cycles corresponding to the file load behavior of that monitoring cycle, and plot the CPU utilization rate time-domain curve, TCP connection count time-domain curve, and database read / write count time-domain curve respectively. The CPU utilization rate time-domain curve, TCP connection count time-domain curve, and database read / write count time-domain curve are two-dimensional curves with time as the horizontal axis and CPU utilization rate, TCP connection count, and database read / write count as the vertical axis. The time segment between two adjacent time points is recorded as a segment, and the ratio of the number of abnormal slope segments in adjacent monitoring cycles to the number of segment segments is recorded as the environmental interaction anomaly degree. The time points are set by the user. One method for setting the time points is provided: take the start time of a single monitoring cycle as the starting point, and set an interval point every 5 seconds in chronological order. The starting point and each interval point are recorded as time points.

[0078] For a single segment, if the slope of the segment in the CPU utilization time domain curve is not within the preset CPU utilization slope range, or the slope of the TCP connection count time domain curve is not within the preset TCP connection count slope range, or the slope of the database read / write count time domain curve is not within the preset database read / write count slope range, then the segment is an abnormal slope segment.

[0079] The preset CPU utilization slope range, preset TCP connection number slope range, and preset database read / write count slope range can be set by the user according to the actual application scenario. The greater the user's requirement for the accuracy of environmental interaction anomaly recognition, the narrower these three preset slope ranges will be. One method is provided to set the three preset slope ranges. The preset CPU utilization slope range, preset TCP connection number slope range, and preset database read / write count slope range are [-3,+5], [-2,+3], and [-1,+4], respectively, with units of % / 5 seconds, counts / 5 seconds, and times / 5 seconds, respectively.

[0080] CPU utilization rate is the percentage of CPU resources used by the file payload corresponding to the file payload behavior at a certain point in time. TCP connection count is the total number of TCP network connections established by the file payload corresponding to the file payload behavior at a certain point in time (including established and in progress). Database read and write count is the cumulative number of "read operations (SELECT)" and "write operations (INSERT / UPDATE / DELETE)" performed by the file payload corresponding to the file payload behavior on the database (such as MySQL, SQL Server) at a certain point in time. The database includes, but is not limited to, MySQL and SQL Server.

[0081] The historical anomaly convergence degree corresponding to a single monitoring period is the maximum value among the matching coefficients between the historical behavior corresponding to that monitoring period and the load behavior of each anomaly reference file; the calculation method for the matching coefficient between a single historical behavior and the load behavior of a single anomaly reference file is the same as the calculation method for the matching coefficient between two historical behaviors, and will not be elaborated here.

[0082] Users can determine the values ​​of preset environmental interaction anomaly degree and preset historical anomaly convergence degree according to the actual application scenario. The larger the values ​​of preset environmental interaction anomaly degree and preset historical anomaly convergence degree, the greater the accuracy of the user in classifying the monitoring period as a Class II hazard level. A method for determining the values ​​of preset environmental interaction anomaly degree and preset historical anomaly convergence degree is provided, which can meet the user's needs by recording the average value of environmental interaction anomaly degree and the average value of historical anomaly convergence degree corresponding to each Class I hazard level in the historical records as the preset environmental interaction anomaly degree and the preset historical anomaly convergence degree, respectively.

[0083] Specifically, for monitoring periods where the danger level is Class I or the abnormal capture rate is greater than or equal to the preset abnormal capture rate, fixed trapping points are updated based on the evaluation threshold.

[0084] Specifically, the evaluation threshold is calculated as follows: (Environmental interaction anomaly degree / preset environmental interaction anomaly degree) × first weighting coefficient + (Historical anomaly convergence degree / preset historical anomaly convergence degree) × second weighting coefficient, where both the first and second weighting coefficients are 0.5.

[0085] When updating fixed trapping points based on the evaluation threshold, for a single monitoring period, a preset number is determined based on the evaluation threshold, and the monitoring period is divided into a preset number of time periods. The trapping points are updated at the end of each time point.

[0086] Preset quantity = evaluation threshold × quantity threshold, where the quantity threshold is 8;

[0087] The anomaly capture rate for a single monitoring period is the ratio of the total number of abnormal behaviors captured by each trap point set in the adjacent monitoring periods corresponding to that monitoring period to the average number of trap points. The average number of trap points is the average number of trap points set at each time point in the adjacent monitoring periods corresponding to that monitoring period.

[0088] The user can determine the preset anomaly capture rate value according to the actual application scenario. The greater the user's requirement for the accuracy of anomaly behavior capture sensitivity, the smaller the preset anomaly capture rate value. One preset anomaly capture rate value is provided, which is 0.3.

[0089] Specifically, for monitoring periods where the danger level is Class II and the anomaly capture rate is less than the preset anomaly capture rate, trigger-based trapping point updates are performed based on behavioral anomaly degree and anomaly comparison degree of operation screenshots.

[0090] Specifically, when updating the trigger-based trap point based on the abnormality of behavior and the abnormality comparison of running screenshots, the time point in the monitoring period when the abnormality of behavior is greater than the preset abnormality of behavior or the abnormality comparison of running screenshots is greater than the preset abnormality comparison of running screenshots is recorded as the trigger time point, and the trap point is updated at each trigger time point.

[0091] The formula for calculating the degree of behavioral abnormality N at a single time point is: N = 0.6 × D1 + 0.4 × D2;

[0092] Where D1 = 1 - min(C / Cmax, Cmax / C), C represents the number of TCP connections at that time point, the reference file payload behavior that is not captured by the set trap point is recorded as normal reference file payload behavior, and Cmac is the maximum number of TCP connections corresponding to each time point of normal reference file payload behavior;

[0093] For a single point in time, if the IP address connected to the file payload corresponding to the file payload behavior at that point in time is not in the normal IP database, then D2=1; if the connected IP address is in the normal IP database, then D2=0. This invention sets up a normal IP database, which stores several normal IP addresses. Normal IP addresses include, but are not limited to, enterprise intranet IP addresses, trusted business IP addresses, and public trusted IP addresses. For example, normal IP addresses include 192.168.0.0 / 16, 10.0.0.0 / 8, 8.8.8.8, and 1.1.1.1, etc.

[0094] In this invention, a screenshot of the running interface of the file payload is taken every 2 seconds from the activation time of the file payload behavior to obtain several running screenshots;

[0095] The anomaly comparison degree of the screenshot corresponding to a single time point is the difference between the anomaly feature value of that time point and the anomaly feature value of the neighboring time points corresponding to that time point; the neighboring time points corresponding to a single time point are the time points that are adjacent to that time point and earlier than that time point.

[0096] The anomaly characteristic value for a single time point is the maximum number of anomalies corresponding to each screenshot obtained within the time interval corresponding to that time point; the time interval corresponding to a single time point is [the time of the nearest time point corresponding to that time point, and the time of that time point]; the number of anomalies corresponding to a single screenshot is the total number of anomalies appearing in that screenshot. Anomalies include the appearance of file browsing window anomalies, untitled tiny windows, black console windows, and unfamiliar program icons in the screenshot. File browsing window anomalies are defined as the complete path string in the address bar containing "\AppData\Local\" and this path is a real user-level configuration directory that exists in the current system; untitled tiny windows are defined as the presence of any visible window with a title bar text length of 0 and a title bar height < 30 px; black console windows are defined as the presence of any window with a class name equal to "ConsoleWindowClass" and an RGB mean value of the client area < 50; unfamiliar program icons are defined as executable file icons appearing in the taskbar or desktop area, and their SHA-256 values ​​are not included in the whitelist of sample installation packages.

[0097] The values ​​of preset behavior anomaly degree and preset runtime screenshot anomaly comparison degree can be determined by the user according to the actual application scenario. The greater the user's requirement for the accuracy of risk identification, the smaller the values ​​of preset behavior anomaly degree and preset runtime screenshot anomaly comparison degree. A method for determining the values ​​of preset behavior anomaly degree and preset runtime screenshot anomaly comparison degree is provided. The historical records of trigger-based trap point updates based on behavior anomaly degree and runtime screenshot anomaly comparison degree are detected. The average value of behavior anomaly degree and the average value of runtime screenshot anomaly comparison degree corresponding to each time point of trap point updates in the historical records that can meet the user's needs are respectively recorded as preset behavior anomaly degree and preset runtime screenshot anomaly comparison degree.

[0098] Understandably, the risk level and anomaly capture rate of the current monitoring period effectively reflect the risk level and anomaly capture degree of the current monitoring period. When the risk level is Class I or the anomaly capture rate is greater than or equal to the preset anomaly capture rate, it indicates that the current period is high-risk and requires full-cycle coverage updates to ensure no omissions. In this case, a fixed update based on the assessment threshold is adopted. The monitoring period can be subdivided according to the risk intensity, and the trap points are forcibly updated at the end of each time period to achieve intensive and stable monitoring of high-risk scenarios. Therefore, a fixed trap point update is performed based on the assessment threshold. When the risk level is Class II and the anomaly capture rate is less than the preset anomaly capture rate, it indicates that the current period is low-risk. In this case, a trigger-based trap point update is performed based on the behavioral anomaly degree and the anomaly comparison degree of the running screenshot. This can reduce the waste of resources in low-risk scenarios and make up for the lack of capture efficiency through dynamic response.

[0099] Specifically, for time periods where the paragraph order is the standard order, the number of trapping points is determined based on the behavioral error value.

[0100] Specifically, when updating fixed trap points based on evaluation thresholds, the time period is a preset number of equally divided time periods; when updating triggered trap points based on behavioral anomaly degree and screenshot anomaly comparison degree, the time period is obtained by using each trigger time point as the dividing point.

[0101] The paragraph order is the sequence number corresponding to each time period after all time periods are divided within a single monitoring cycle and sorted from morning to night.

[0102] When determining the number of trap points based on behavioral error values, for time periods where the paragraph order is the standard order, the number of trap points corresponding to this time period = trap point number threshold + [(behavioral error value - behavioral error value threshold) / behavioral error value threshold] × trap point number threshold × 0.3. The trap point number threshold is the average number of trap points corresponding to each time point in the adjacent time periods corresponding to this time period, and the behavioral error value threshold is 0.14.

[0103] The behavioral error value corresponding to a single time period is the standard deviation of the characterization coefficients corresponding to each time point in the adjacent time periods. The characterization coefficient corresponding to a single time point = behavioral anomaly degree / preset behavioral anomaly degree × anomaly degree weighting coefficient + screenshot anomaly comparison degree / preset screenshot anomaly comparison degree × comparison degree weighting coefficient. The anomaly degree weighting coefficient is 0.56, and the comparison degree weighting coefficient is 0.44.

[0104] The adjacent time period corresponding to a single time period is the time period that is adjacent to that time period and earlier than that time period. It should be noted that if the monitoring cycle sequence of the monitoring cycle in which the time period is located is 2, then the adjacent time period corresponding to the time period is the monitoring cycle with the monitoring cycle sequence of 1.

[0105] Understandably, whether the paragraph order is a standard order effectively reflects the temporal sequence of different time periods within a single monitoring cycle. When the paragraph order is a standard order, it indicates that the time period is the earliest within the monitoring cycle, and data from adjacent time periods in the previous cycle can only be relied upon. Therefore, the number of traps is directly determined based on the behavioral error value (quantifying the risk fluctuation amplitude of adjacent historical data) to quickly establish the initial monitoring foundation. When the paragraph order is greater than the standard order, it indicates that the time period is later in the monitoring cycle, and behavioral data from earlier time periods in the same period are available for reference. The initial number determined solely by the behavioral error value may not be suitable for the current and previous risk changes. Therefore, an initial number is first set based on the behavioral error value, and then further adjusted using the proximity change coefficient to ensure that the number matches real-time risk changes.

[0106] Specifically, for time periods where the paragraph order is greater than the standard order, the number of initial trapping points is determined based on the behavior error value, and the number of initial trapping points is adjusted based on the proximity change coefficient.

[0107] For time periods when the neighboring change coefficient is greater than or equal to the preset neighboring change coefficient, the number of trapping points is increased based on the change coefficient comparison value.

[0108] For time periods when the neighbor change coefficient is less than the preset neighbor change coefficient, the initial trapping point quantity setting is determined based on the adjustment reference value.

[0109] Specifically, when determining the initial number of trap points based on behavioral error values, for a single time period, if the behavioral error value is greater than or equal to the behavioral error value threshold, the initial number of trap points for that time period is set to 1.27 times the trap point number threshold; if the behavioral error value is less than the behavioral error value threshold, the initial number of trap points for that time period is set to 0.92 times the trap point number threshold.

[0110] The neighboring change coefficient for a single time period is the difference between the characterization coefficient corresponding to the start time of that time period and the characterization coefficient corresponding to the start time of the neighboring time period.

[0111] The value of the preset neighbor change coefficient can be determined by the user according to the actual application scenario. The smaller the value of the preset neighbor change coefficient, the greater the user's need to increase the number of initial trapping points based on the change coefficient comparison value. A method for determining the value of the preset neighbor change coefficient is provided, which detects the historical records of increasing the number of initial trapping points based on the change coefficient comparison value, and records the average value of the neighbor change coefficients corresponding to the historical records that meet the user's needs as the preset neighbor change coefficient.

[0112] For a single time period, obtain the anomaly capture rate at each time point of the adjacent time period corresponding to that time period, and draw an anomaly capture rate time domain curve based on the anomaly capture rate at each time point. The anomaly capture rate time domain curve is a two-dimensional curve with time as the horizontal axis and anomaly capture rate as the vertical axis. The adjustment reference value corresponding to a single time period is the slope of the last time point of the adjacent time period in the anomaly capture rate time domain curve.

[0113] Understandably, the proximity change coefficient effectively reflects the difference in risk level between the current time period and an earlier adjacent time period at the start time. When the proximity change coefficient is greater than or equal to the preset proximity change coefficient, it indicates that the initial risk of the current time period has increased significantly compared to the previous period. The initial number of traps may not be able to cover the new risks. Therefore, the number of traps is increased based on the change coefficient comparison value to strengthen the monitoring of sudden risk. When the proximity change coefficient is less than the preset proximity change coefficient, it indicates that the initial risk of the current time period is not significantly different from the previous period. The rationality of the initial number needs to be further verified. Therefore, the initial number is judged to be qualified based on the adjustment reference value to avoid blindly increasing or decreasing resources.

[0114] Specifically, for periods when the adjustment reference value is less than the preset adjustment reference value, the initial number of trapping points is determined to be unqualified, and the number of trapping points is increased based on the adjustment reference value.

[0115] For time periods when the adjustment reference value is greater than or equal to the preset adjustment reference value, the initial trapping point quantity setting is deemed qualified.

[0116] Specifically, the user can determine the value of the preset adjustment reference value according to the actual application scenario. The greater the user's need to improve the accuracy of anomaly capture, the larger the value of the preset adjustment reference value. A method for determining the value of the preset adjustment reference value is provided, which detects the historical records in which the user determines that the initial trapping point quantity is qualified, and records the average value of the adjustment reference value corresponding to the historical records that meet the user's needs as the preset adjustment reference value.

[0117] When increasing the number of trapping points based on the adjustment reference value, the increase in the number of trapping points = (preset adjustment reference value - adjustment reference value) / preset adjustment reference value × initial number of trapping points;

[0118] It is understandable that when the adjustment reference value is less than the preset adjustment reference value, it indicates that the anomaly capture rate is declining in the early stage, and the existing initial quantity may be missing due to insufficient density. Therefore, the initial quantity is deemed unqualified and the quantity needs to be increased to improve the capture capacity. When the adjustment reference value is greater than or equal to the preset adjustment reference value, it indicates that the anomaly capture rate is stable in the early stage and the initial quantity can meet the monitoring requirements.

[0119] It should be noted that when setting trap points based on the ratio of abnormal frequency or setting trap points in segments, after determining the number of trap points, users can determine the location of trap points themselves based on the key operation nodes corresponding to dynamic operations (such as process creation, modification of sensitive registry entries, reading and writing of sensitive directory files), external interactions (such as network connection establishment, send / recv data transmission, unexpected hardware calls), and state changes (such as code unpacking, privilege escalation, sudden increase in resource consumption). There are no specific restrictions, as long as the user's needs are met.

[0120] Please see Figure 4 The diagram shown is a unit connection diagram of the document payload behavior depth analysis system based on multimodal trapping according to the present invention. The present invention also provides a document payload behavior depth analysis system based on multimodal trapping, comprising:

[0121] The data acquisition module is used to obtain file payload behavior;

[0122] The analysis module is connected to the data acquisition module and is used to determine the trapping points based on the abnormal frequency ratio according to the monitoring cycle sequence, or to determine the trapping points to be set by matching or segmented according to the matching reference value.

[0123] A matching setting module, which is connected to the setting analysis module, is used to set trapping points based on matching coefficients;

[0124] The first segment setting module, which is connected to the setting analysis module, is used to determine whether to update the fixed trap point based on the evaluation threshold or the triggered trap point based on the abnormality degree of behavior and the abnormality comparison degree of the operation screenshot, based on the danger level of the monitoring period and the abnormality capture rate; wherein, the danger level of the monitoring period is determined based on the abnormality degree of environmental interaction and the convergence degree of historical abnormality.

[0125] The second segment setting module, which is connected to the first segment setting module, is used to set the number of trap points based on the behavior error value, and to determine whether to adjust the number of trap points based on the proximity change coefficient according to the segment order.

[0126] It should be noted that the data acquisition module, configuration analysis module, matching configuration module, and first / second segment configuration module can be deployed on the same x86 server (Ubuntu 22.04 + Python 3.10) or a distributed cluster, with inter-node communication using gRPC over TCP / PCIe. Hardware configurations include, but are not limited to, physical servers, ARM terminals, and KVM virtualization sandboxes.

[0127] The technical solution of the present invention has been described above with reference to the preferred embodiments shown in the accompanying drawings. However, it will be readily understood by those skilled in the art that the scope of protection of the present invention is obviously not limited to these specific embodiments. Without departing from the principles of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will all fall within the scope of protection of the present invention.

Claims

1. A method for in-depth analysis of file payload behavior based on multimodal trapping, characterized in that, include: Obtain file payload behavior; The trapping points are set based on the ratio of abnormal frequencies according to the monitoring cycle sequence, or the trapping points are set by matching or segmented according to the matching reference value. In the matching and setting of trap points, trap points are set based on the matching coefficient; In the segmented setting of trapping points, the risk level of the monitoring period and the abnormal capture rate determine whether to update the trapping points in a fixed manner based on the assessment threshold or in a triggered manner based on the degree of behavioral abnormality and the degree of abnormality comparison of the operation screenshot; wherein, the risk level of the monitoring period is determined based on the degree of environmental interaction abnormality and the degree of convergence of historical abnormalities. The number of trap points is set based on the behavior error value, and the number of trap points is adjusted based on the proximity change coefficient according to the paragraph order. For monitoring cycles with a standard monitoring sequence, trapping points are set based on the ratio of abnormal frequencies. For monitoring cycles whose monitoring cycle sequence is greater than the standard sequence, the trapping points should be set for matching or segmented according to the matching reference value. For monitoring periods where the matching reference value is greater than or equal to the preset matching reference value, trap points are set for matching. For monitoring periods where the matching reference value is less than the preset matching reference value, trapping points are set in segments; The matching reference value is the maximum value among the matching coefficients of the historical behavior corresponding to a single monitoring period and the historical behavior corresponding to each valid historical period; The anomaly frequency ratio is the ratio of the number of abnormal reference file payload behaviors to the total number of reference file payload behaviors. Abnormal reference file payload behaviors are reference file payload behaviors that have been successfully captured by the set trap point. Reference file payload behaviors are the corresponding file payload behaviors in the historical records that can meet the user's needs. The matching coefficient is the degree of similarity of historical behaviors corresponding to any two monitoring periods; The behavioral error value is the standard deviation of the characterization coefficients corresponding to each time point in the adjacent time period of a single time period. The characterization coefficient corresponding to a single time point = behavioral abnormality degree / preset behavioral abnormality degree × abnormality degree weight coefficient + running screenshot abnormality comparison degree / preset running screenshot abnormality comparison degree × comparison degree weight coefficient. The proximity change coefficient is the difference between the characteristic coefficient corresponding to the start time of a single time period and the characteristic coefficient corresponding to the start time of the adjacent time period.

2. The method for in-depth analysis of file payload behavior based on multimodal trapping according to claim 1, characterized in that, The hazard levels include: A hazard level is defined as one where the degree of environmental interaction anomaly is greater than or equal to the preset degree of environmental interaction anomaly or the degree of historical anomaly convergence is greater than or equal to the preset degree of historical anomaly convergence. The second-class hazard level is defined as having an environmental interaction anomaly degree less than the preset environmental interaction anomaly degree and a historical anomaly convergence degree less than the preset historical anomaly convergence degree.

3. The method for in-depth analysis of file payload behavior based on multimodal trapping according to claim 2, characterized in that, For monitoring periods where the hazard level is Class I or the abnormal capture rate is greater than or equal to the preset abnormal capture rate, the fixed trapping points are updated based on the evaluation threshold.

4. The method for in-depth analysis of file payload behavior based on multimodal trapping according to claim 3, characterized in that, For monitoring periods where the hazard level is Class II and the anomaly capture rate is less than the preset anomaly capture rate, trigger-based trap point updates are performed based on behavioral anomaly degree and anomaly comparison degree of operation screenshots.

5. The method for in-depth analysis of file payload behavior based on multimodal trapping according to claim 4, characterized in that, For time periods where the paragraph order is the standard order, the number of trapping points is determined based on the behavioral error value.

6. The method for in-depth analysis of file payload behavior based on multimodal trapping according to claim 5, characterized in that, For time periods where the paragraph order is greater than the standard order, the number of initial trapping points is determined based on the behavior error value, and the number of initial trapping points is adjusted based on the proximity change coefficient. For time periods when the neighboring change coefficient is greater than or equal to the preset neighboring change coefficient, the number of trapping points is increased based on the change coefficient comparison value. For time periods when the neighbor change coefficient is less than the preset neighbor change coefficient, the initial trapping point quantity setting is determined based on the adjustment reference value.

7. The method for in-depth analysis of file payload behavior based on multimodal trapping according to claim 6, characterized in that, If the adjustment reference value is less than the preset adjustment reference value during a certain period, it is determined that the initial number of trapping points is not set properly, and the number of trapping points is increased based on the adjustment reference value. For time periods when the adjustment reference value is greater than or equal to the preset adjustment reference value, the initial trapping point quantity setting is deemed qualified.

8. An analysis system applying the multimodal trapping-based document payload behavior depth analysis method according to any one of claims 1 to 7, characterized in that, include: The data acquisition module is used to obtain file payload behavior; The analysis module is connected to the data acquisition module and is used to determine the trapping points based on the abnormal frequency ratio according to the monitoring cycle sequence, or to determine the trapping points to be set by matching or segmented according to the matching reference value. A matching setting module, which is connected to the setting analysis module, is used to set trapping points based on matching coefficients; The first segment setting module, which is connected to the setting analysis module, is used to determine whether to update the fixed trap point based on the evaluation threshold or the triggered trap point based on the abnormality degree of behavior and the abnormality comparison degree of the operation screenshot, based on the danger level of the monitoring period and the abnormality capture rate; wherein, the danger level of the monitoring period is determined based on the abnormality degree of environmental interaction and the convergence degree of historical abnormality. The second segment setting module, which is connected to the first segment setting module, is used to set the number of trap points based on the behavior error value, and to determine whether to adjust the number of trap points based on the proximity change coefficient according to the segment order.

Images