Supply chain-oriented intrusion detection system and method

Abstract

The invention relates to the technical field of terminal security, in particular to an intrusion detection system and method for a supply chain, and the system comprises a data extraction and correction module which is used for reading the physical memory page data of a key process of a supply chain terminal, extracting a memory resident PE head and a memory import address table, reading the file header information of a disk storage executable component, and storing the file header information of the disk storage executable component; and generating an original import table set of the supply chain process. According to the method, slice bitmap snapshots are collected in a continuous time window, the accumulation number of non-zero bits is counted, a time domain Hamming weight sequence reflecting dynamic changes of memory content is generated, fine-grained fluctuation variance calculation and statistical analysis are carried out on the sequence, the active amplitude of a memory page in the time dimension can be quantified, and therefore the memory page can be quantified. Therefore, under the condition of not depending on static feature codes, periodic decryption logic and abnormal communication heartbeat signals hidden in a legal process memory are captured, and recognition of no file attack and memory residence threat in a supply chain environment is achieved.

Description

Technical Field

[0001] This invention relates to the field of terminal security technology, and in particular to an intrusion detection system and method for the supply chain. Background Technology

[0002] Endpoint security technology focuses on providing full lifecycle security protection for endpoint devices connected to enterprise networks, aiming to defend against malware, ransomware, advanced persistent threats, and zero-day vulnerability attacks.

[0003] Current endpoint security technologies primarily rely on file system scanning and static signature database matching mechanisms, focusing on identifying known malicious code fragments in permanently stored files. These technologies often fail against memory-resident attacks that utilize legitimate software supply chains and do not generate permanently stored files. Furthermore, conventional behavior monitoring techniques are mostly based on hooking and intercepting specific system APIs. Attackers can bypass monitoring defenses by directly making system calls or unhooking techniques, resulting in blind spots in the defense mechanism. Traditional memory analysis methods typically employ offline forensics after whole-machine memory image dumping; this non-real-time, coarse-grained detection mode struggles to distinguish between normal memory operations of legitimate processes and covert activities of malicious code. Therefore, improvements are needed. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing an intrusion detection system and method for the supply chain.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: an intrusion detection system for the supply chain includes: The data extraction and correction module is used to read the physical memory page data of key processes in the supply chain terminal, extract the memory-resident PE header and memory import address table, read the executable component file header information stored on the disk in parallel, generate the original import table set of the supply chain process, and unify the logical address space of memory and disk data according to the original import table set of the supply chain process to generate a relocation correction import address matrix. The differential verification analysis module is used to traverse the row vectors inside the relocation correction import address matrix, filter and generate heterogeneous differential vectors of the import table, read the memory address page table attributes contained in the heterogeneous differential vectors of the import table, determine whether the address falls into the non-executable area of ​​the stack or the unknown code segment outside the module, and generate a non-executable segment hook pointing set. The memory fluctuation calculation module is used to locate the heap memory space of the supply chain process to which the non-executable segment hook pointer set belongs, perform grid-based slicing of the heap memory space according to fixed byte granularity, generate a heap memory page temporal Hamming weight sequence, calculate the heap memory page temporal Hamming weight sequence, quantify the fluctuation amplitude of memory page content in the time dimension, and generate fine-grained fluctuation values ​​of memory pages. The attack behavior determination module is used to load the fine-grained fluctuation value of the memory page, call the preset activity benchmark threshold parameter, filter and generate a set of active memory pages exceeding the threshold, determine that the set of active memory pages exceeding the threshold has periodic decryption communication behavior, and output a supply chain fileless attack determination signal.

[0006] Preferably, the step of obtaining the relocation correction import address matrix is ​​as follows: Read the physical memory page data of key processes in the supply chain terminal, parse the memory-resident PE header to extract the import address table, read the executable component file header information stored on the disk to parse the static import address table and relocation table data, calculate the numerical difference between the memory loading base address and the disk static base address, and linearly superimpose the numerical difference onto each address entry in the static import address table to generate the original import table set of the supply chain process. Based on the original import table set of the supply chain process, a fixed-length vector is generated for each import record in the order of the address field. A row index is established by module label and a column index is established by API symbol. The vector elements are filled with address values ​​after numerical difference correction, forming a vector matrix mapping result. Based on the vector matrix mapping result, the address base of each row vector is corrected according to the relocation table data and aligned with the module start offset. The address identifiers of the row index and column index are replaced according to the mapping relationship from the memory load base address to the disk static base address. Each entry is verified to fall within the valid range of the unified logical address space, and a relocation correction import address matrix is ​​generated.

[0007] Preferably, the step of obtaining the heterogeneous difference vector of the import table is as follows: Traverse each row vector of the relocation correction import address matrix, lock the memory address entry and disk address entry corresponding to the same API symbol, calculate the memory address value minus the disk address value, record the difference and the corresponding API entry index position, and generate a sequence of memory and disk address differences. Calculate the heterogeneous hook risk metric based on the memory and disk address difference sequence; Based on the heterogeneous hook risk metric, entries with a risk metric greater than the risk threshold are selected. The corresponding memory jump target address is extracted according to the index position of the entry record, and arranged in order of API symbol to generate the heterogeneous difference vector of the import table.

[0008] Preferably, the step of obtaining the non-executable segment hook pointer set is as follows: Based on the heterogeneous differential vector in the import table, memory addresses are located to page table entries one by one. The page table attribute fields of the memory addresses are read, including page frame number, page start address, page end address, read / write flag, execution flag, module identifier, and page classification label. The memory address is checked to ensure it falls within the range of page start address to page end address. The execution flag status is checked. If the flag is disabled and the page classification label is heap or stack, it is marked as a non-executable section of the stack. If the module identifier is empty or not in the module list loaded by the supply chain process and the execution flag is enabled, it is marked as an unknown code segment outside the module. Unmarked jump entries are removed, marked jump entries are retained, and a set of non-executable segment hooks is generated.

[0009] Preferably, the step of obtaining the time-domain Hamming weight sequence of the heap memory pages is as follows: Based on the set of non-executable segment hooks, determine the start and end addresses of the heap memory space of the supply chain process. Divide the heap memory space into equal-length slices according to a fixed byte granularity, number them sequentially and establish a slice index table. Set a unified sampling time base and periodically collect bitmap snapshots of each slice within a continuous time window to form a heap memory slice bitmap snapshot sequence. Based on the heap memory slice bitmap snapshot sequence, the cumulative number of non-zero bits in each slice is counted snapshot by snapshot. The cumulative number of snapshots of the same heap memory pages is arranged in chronological order to form a heap memory page temporal Hamming weight sequence.

[0010] Preferably, the step of obtaining the set of active memory pages exceeding the threshold is as follows: Load the fine-grained fluctuation value of the memory page, read the preset activity benchmark threshold parameter, compare the fine-grained fluctuation value of the memory page with the preset activity benchmark threshold parameter, mark the memory pages below the preset activity benchmark threshold parameter as static pages and remove them from the list, retain the memory pages that are not removed as high-frequency fluctuation pages, and generate a set of high-frequency fluctuation pages.

[0011] Preferably, the step of obtaining the set of active memory pages exceeding the threshold further includes: reading the memory page table permission bit information page by page according to the set of high-frequency fluctuating pages, checking that the read flag, write flag, and execute flag are all enabled at the same time, removing memory pages that are not enabled at the same time from the set of high-frequency fluctuating pages, and arranging the remaining memory pages in address order to generate the set of active memory pages exceeding the threshold.

[0012] Preferably, the step of obtaining the supply chain no-file attack determination signal is as follows: Based on the set of active memory pages exceeding the threshold, the memory access event time index sequence of each page is segmented according to a fixed time step. The time interval between adjacent peaks is counted and the number of repeated intervals is accumulated. If the number of repeated intervals reaches a preset judgment limit and the peak order is stable with the decryption stage preceding the communication stage, it is determined that there is periodic decryption communication behavior, and a supply chain fileless attack judgment signal is generated.

[0013] The present invention also provides a method comprising the following steps: Read the physical memory page data of key processes in the supply chain terminal, extract the memory-resident PE header and memory import address table, read the executable component file header information stored on the disk in parallel, generate the original import table set of the supply chain process, and unify the logical address space of memory and disk data according to the original import table set of the supply chain process to generate a relocation correction import address matrix. Traverse the row vectors inside the relocation correction import address matrix, filter and generate import table heterogeneous differential vectors, read the memory address page table attributes contained in the import table heterogeneous differential vectors, determine whether the address falls into the non-executable region of the stack or an unknown code segment outside the module, and generate a non-executable segment hook pointer set. Locate the heap memory space of the supply chain process to which the non-executable segment hook pointer set belongs, perform gridded slicing of the heap memory space according to fixed byte granularity, generate a heap memory page temporal Hamming weight sequence, calculate the heap memory page temporal Hamming weight sequence, quantify the fluctuation range of memory page content in the time dimension, and generate fine-grained fluctuation values ​​of memory pages. Load the fine-grained fluctuation value of the memory page, call the preset activity benchmark threshold parameter, filter and generate a set of active memory pages exceeding the threshold, determine that the set of active memory pages exceeding the threshold has periodic decryption communication behavior, and output a supply chain no file attack determination signal.

[0014] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, by reading the physical memory page data of key processes in the supply chain terminal and extracting the resident PE header and import table information, and parsing the disk storage component file header in parallel to obtain static table data, the difference between the memory load base address and the disk static base address is calculated and linearly superimposed for correction. This unifies the dynamic memory data and the static disk data into the same logical address space, eliminating address offset interference caused by address space layout randomization. Based on the constructed relocation correction import address matrix, vectorized differential verification is performed to locate the numerical differences of API address entries between memory and disk, and further trace the memory jump targets pointed to by the difference entries. Combined with the analysis of non-executable regions of the stack and the module... The attribute discrimination of unknown code segments outside the block can filter out malicious hook behaviors pointing to abnormal regions. Based on this, the relevant heap memory space is located and gridded slices are implemented. Slice bitmap snapshots are collected within a continuous time window and the cumulative number of non-zero bits is counted to generate a temporal Hamming weight sequence reflecting the dynamic changes of memory content. Fine-grained fluctuation variance calculation and statistical analysis are performed on this sequence to quantify the activity of memory pages in the time dimension. Thus, without relying on static signatures, periodic decryption logic and abnormal communication heartbeat signals hidden in the memory of legitimate processes can be captured, enabling the identification of fileless attacks and memory-resident threats in the supply chain environment. Attached Figure Description

[0015] Figure 1 This is a system flowchart of the present invention. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0017] Please see Figure 1 This invention provides a technical solution: an intrusion detection system for the supply chain, comprising: The data extraction and correction module is used to read the physical memory page data of key processes in the supply chain terminal, extract the memory-resident PE header and memory import address table, read the executable component file header information stored on the disk in parallel, generate the original import table set of the supply chain process, and unify the logical address space of memory and disk data according to the original import table set of the supply chain process to generate the relocation correction import address matrix. The differential verification analysis module is used to traverse the row vectors inside the relocation and correction import address matrix, filter and generate heterogeneous differential vectors in the import table, read the memory address page table attributes contained in the heterogeneous differential vectors in the import table, determine whether the address falls into the non-executable area of ​​the stack or the unknown code segment outside the module, and generate a set of hooks pointing to non-executable segments. The memory fluctuation calculation module is used to locate the heap memory space of the supply chain process to which the non-executable segment hook pointer set belongs, perform grid-based slicing of the heap memory space according to fixed byte granularity, generate the heap memory page temporal Hamming weight sequence, calculate the heap memory page temporal Hamming weight sequence, quantify the fluctuation amplitude of memory page content in the time dimension, and generate fine-grained fluctuation values ​​of memory pages. The attack behavior determination module is used to load fine-grained fluctuation values ​​of memory pages, call preset activity baseline threshold parameters, filter and generate a set of active memory pages exceeding the threshold, determine whether the set of active memory pages exceeding the threshold has periodic decryption communication behavior, and output a supply chain fileless attack determination signal.

[0018] The steps for obtaining the relocation correction import address matrix are as follows: Read the physical memory page data of key processes in the supply chain terminal, parse the memory-resident PE header to extract the import address table, read the executable component file header information stored on the disk to parse the static import address table and relocation table data, calculate the numerical difference between the memory loading base address and the disk static base address, and linearly superimpose the numerical difference onto each address entry in the static import address table to generate the original import table set of the supply chain process. Based on the original import table set of the supply chain process, a fixed-length vector is generated for each import record in the order of the address field. Row indexes are created by module tags and column indexes are created by API symbols. The vector elements are filled with address values ​​after numerical difference correction, forming a vector matrix mapping result. Based on the vector matrix mapping results, the address base of each row vector is corrected according to the relocation table data and aligned with the module start offset. The address identifiers of the row index and column index are replaced according to the mapping relationship from the memory load base address to the disk static base address. Each entry is verified to fall within the valid range of the unified logical address space, and a relocation correction import address matrix is ​​generated.

[0019] Specifically, the process reads the physical memory page data of key processes at the supply chain terminal, calls the large page memory read interface exported by the operating system kernel level, passes in the value of the page directory base address register CR3 of the target process, traverses the page table entries to locate the page frame mapped to physical memory, copies the acquired physical page content to the analysis buffer via direct memory access (DMA), searches the buffer for the magic number feature of the PE file, i.e., the hexadecimal value 0x5A4D, to locate the DOS header structure, reads the e_lfanew field value in the DOS header, jumps to the beginning of the PE header, parses the IMAGE_NT_HEADERS structure, extracts the DataDirectory array in the OptionalHeader, and reads the directory corresponding to the second item in the array. The RVA address and size are entered into the table. The IMAGE_IMPORT_DESCRIPTOR linked list in memory is traversed, extracting the module name pointed to by the Name field and the Import Address Table (IAT) pointed to by FirstThunk. The executable component file header information is read from the disk. The corresponding binary file is opened using the file system API. The IMAGE_FILE_HEADER and IMAGE_OPTIONAL_HEADER in the file header are located and read. The ImageBase field is extracted as the static base address on the disk. Simultaneously, the SectionTable is parsed to obtain the raw pointers and virtual sizes of each section. The difference between the memory load base address and the static base address on the disk is calculated using the following formula: ,in, This represents the address relocation difference. This represents the actual starting address of the module obtained during the memory resolution phase. This represents the default preferred base address read from the OptionalHeader of the disk file header. If the calculation result is negative, the sign bit is retained for two's complement arithmetic. The numerical difference is linearly added to each address entry in the static import address table. Each member of the static IAT table obtained from disk parsing is traversed, its original virtual address (VA) is retrieved, and addition is performed. ,in, The corrected expected memory address. The original address recorded in the disk file. The original import table set for the supply chain process is generated based on the repositioning difference calculated above.

[0020] Based on the original import table set of the supply chain process, a fixed-length vector is generated for each import record in order of address field, and the vector length parameter is set. The specific value is 2048. This value is based on statistics of the number of exported functions in commonly used system dynamic link libraries. The statistics show that 95% of DLLs have fewer than 2000 exported functions. Therefore, 48 redundant bits are reserved as a buffer. The vector space is initialized with all zeros. Row indexes are created by module tags and column indexes are created by API symbols. The module name string of each entry in the import table is extracted. The hash value of the name string is calculated and modulo the hash table size to determine the row number. The API function name or ordinal number is extracted, and the BKDRHash algorithm is used to map the API symbol to a unique integer index. The calculation formula is: ,in, For column index value, The length of the API string. For the string number The ASCII code value of each character, where 31 is the selected prime multiplier. Given a vector length of 2048 as previously set, the fill vector elements are address values ​​corrected by numerical differences, in the matrix coordinates. The corresponding 64-bit or 32-bit virtual memory address is filled in. If a hash collision occurs, the open addressing method is used to probe backwards to fill the empty space, forming a vector matrix mapping result.

[0021] Based on the vector matrix mapping results, the address base of each row vector is corrected according to the relocation table data and aligned with the module start offset. The .reloc section data of the disk PE file is read, the IMAGE_BASE_RELOCATION structure block is parsed, and a list of page offsets requiring relocation is obtained. Relocation entries of type IMAGE_REL_BASED_HIGHLOW or IMAGE_REL_BASED_DIR64 are identified. The address values ​​of the corresponding offset positions in the matrix row vectors are corrected a second time to eliminate the random offset effect caused by ASLR address space layout randomization, ensuring that the address base is consistent with the disk static layout. The address identifiers of the row and column indices are replaced according to the mapping relationship from memory load base address to disk static base address. A mapping table between memory module handles and disk file paths is established. The matrix row index is converted from the module load order ID in memory to a unique identifier of the disk file, such as a file hash fingerprint. Each entry is verified to fall within the valid range of a unified logical address space, and the valid address space range is set. ,in The value is set to 0x00010000, and this value is determined based on the smallest granularity of user space memory allocation in the operating system and the size of the null pointer protection zone. Set to 0x7FFEFFFF, this value is determined based on the upper limit boundary of the private space in the user mode of a 64-bit Windows system. Address entries falling outside this range are marked as invalid or abnormal, valid entries within the range are retained, and a relocation correction import address matrix is ​​generated.

[0022] The steps to obtain the heterogeneous difference vector of the import table are as follows: Traverse each row vector of the relocation and correction import address matrix, lock the memory address entry and disk address entry corresponding to the same API symbol, calculate the memory address value minus the disk address value, record the difference and the corresponding API entry index position, and generate a sequence of memory and disk address differences. Based on the sequence of differences between memory and disk addresses, calculate the heterogeneous hook risk metric. The calculation formula is as follows: ; in, For the first Heterogeneous hook risk metric for each API entry For the first in memory The actual target address for each API entry. For the first file in the disk file after relocation correction The expected address of each API entry. This is the difference between memory and disk addresses. For the first The load base address of the module to which each API belongs. For the first The size of the module to which each API belongs. As the module boundary penalty factor, Indicates if the target address is redirected If the address exceeds the module address range, calculate the deviation distance from the module boundary; otherwise, calculate zero. Based on the heterogeneous hook risk metric, entries with a risk metric greater than the risk threshold are selected. The corresponding memory jump target address is extracted according to the index position of the entry record, and arranged in order of API symbol to generate the heterogeneous difference vector of the import table.

[0023] Specifically, the process iterates through each row vector of the relocation and correction import address matrix. First, it initializes an iteration counter based on the matrix's dimension information. The row index ranges from 0 to the total number of rows minus 1, corresponding to the number of loaded modules. The column index ranges from 0 to the total number of columns minus 1, corresponding to the total number of API symbols exported from all modules. Within a double loop structure, the matrix cells are accessed sequentially, locking the memory address and disk address entries corresponding to the same API symbol. Specifically, this involves reading specific coordinates within the matrix. The stored data structure contains two 64-bit unsigned integers, representing the actual runtime address extracted from the physical memory snapshot and the expected static address after relocation correction from the disk PE file header. These two address values ​​are validated to ensure they are not empty and are within the valid user space range (i.e., the address value must be greater than 0x10000 and less than 0x7FFFFFFFFFFFF). The memory address value is subtracted from the disk address value using a 64-bit integer subtraction operation to obtain the signed difference. If the difference is 0, it indicates that the API entry has not been modified; if the difference is not 0, it indicates a potential redirection. The difference and the corresponding API entry index position are recorded. The calculated difference is combined with the current row and column index to form a tuple, which is stored in a temporary cache list. This list is arranged according to the module base address order to ensure data locality in subsequent processing, generating a sequence of memory and disk address differences.

[0024] The formula for calculating the risk metric of heterogeneous hooks quantifies the risk level of code injection attacks using a geometric distance model, where the first term... The second term characterizes the absolute Euclidean distance deviation of the memory address relative to the expected address, used to identify typical function hook behavior. The weighted squared outbound distance introduces a spatial constraint mechanism, which amplifies the risk value of jumping to outside the module (such as the stack area or invalid area) through a non-linear penalty term. This makes the detection sensitivity of "escape" jump behavior, which is common in fileless attacks, significantly better than simple address comparison, and constructs an equivalent risk distance metric standard with "byte" as the unit of measurement.

[0025] For the first in memory The actual target address of each API entry is obtained by traversing the physical memory page table of the key processes in the supply chain terminal, using the CR3 register to locate the page directory base address, parsing the multi-level page table to obtain the mapping from virtual address to physical address, and reading the 64-bit virtual memory address value stored in the target API pointer. In this actual detection example, the actual memory address pointed to by the API entry in a certain logistics process was detected to be 0x00007FF750105000 (decimal 140,700,147,699,712).

[0026] For the first file in the disk file after relocation correction The expected address of each API entry is derived from the static parsing of the executable file PE structure stored on disk. The ImageBase and DataDirectory import table information in the OptionalHeader are read and the value is calculated after correction with the relocation table. In the example, the expected static address of this API is 0x00007FF750101000 (decimal 140,700,147,683,328).

[0027] The module boundary penalty factor, defined as a dimensionless weighting coefficient, is used to balance the risk weights of "intra-module offset" and "extra-module boundary crossing." This value is set based on statistical analysis of shellcode jump distances in historical malware sample libraries. The average offset of intra-module hot patches (typically less than 1KB) and the boundary crossing distance of malware injection (typically greater than 1MB) are calculated separately. The penalty factor is determined by maximizing the discriminant difference between the risk values ​​of the two types of samples. The optimal value is 10, which means that the risk of each 1-byte out-of-bounds distance is equivalent to a 10-byte intra-module offset.

[0028] For the first The loading base address of the module to which each API belongs is obtained by reading the Ldr module loading list in the process environment block (PEB). In the example, the loading base address of the target module kernel32.dll in memory is 0x00007FF750100000.

[0029] For the first The size of the module to which each API belongs is obtained by parsing the SizeOfImage field in the PE header in memory. This parameter represents the length of the virtual memory space occupied by the module. In the example, the module size is 0x4000 bytes.

[0030] Calculations based on parameters: First, calculate the basic difference between the memory and disk addresses (in bytes): ; Next, calculate the address out-of-bounds distance: upper bound address of module ; Check for deviation from the lower bound: (If less than 0, set to 0); Check for deviation from the upper bound: (If greater than 0, take 4,096); The outbound distance term is ; Substitute into the formula for the final calculation: ; ; Calculated risk metric Approximately 44,115.27 bytes, this value far exceeds the baseline risk brought about by a simple 16KB address deviation, clearly quantifying the high-risk characteristic of the target address jumping to 4KB outside the module, indicating that the API call is very likely to have been hijacked to the heap spray region or an independent malicious code segment, rather than a legitimate code update within the module.

[0031] Based on the risk metric of heterogeneous hooks, a baseline for risk assessment, namely the risk threshold, is first established. This threshold is set using the 3-sigma statistical criterion based on Gaussian distribution. The target software is run in a clean sandbox environment, and the risk metric of 100,000 API calls is continuously collected. The average value of this sample set is then calculated. Approximately 5 (primarily caused by minor ASLR jitter) and standard deviation Approximately 2, the risk threshold is set as the average plus three standard deviations, i.e. Entries with heterogeneous hook risk metrics greater than the risk threshold are filtered out. The calculated risk value of 44,115.27 is compared with the threshold of 11. The result shows that the risk value is much greater than the threshold, and the entry is determined to be abnormal. The corresponding memory jump target address is extracted based on the index position of the entry record. Using the previously cached tuple information, the original matrix or memory snapshot is traced back to read the 64-bit virtual memory address actually pointed to by the high-risk entry. The addresses are arranged in order according to the API symbol order. All the extracted suspicious target addresses are sorted in lexicographical order according to the corresponding API function names to construct an ordered address list and generate the heterogeneous difference vector of the import table.

[0032] The steps for obtaining the set of hook pointers for non-executable segments are as follows: Based on the heterogeneous differential vector in the import table, memory addresses are located to page table entries one by one. The page table attribute fields of the memory addresses are read, including page frame number, page start address, page end address, read / write flag, execution flag, module identifier, and page classification label. The memory address is verified to be within the range of page start address to page end address. The execution flag status is checked. If the flag is disabled and the page classification label is heap or stack, it is marked as a non-executable section of the stack. If the module identifier is empty or not in the module list loaded by the supply chain process and the execution flag is enabled, it is marked as an unknown code segment outside the module. Unmarked jump entries are removed, marked jump entries are retained, and a set of non-executable segment hooks is generated.

[0033] Specifically, based on the heterogeneous differential vector in the import table, a memory attribute query mechanism is initiated to locate memory addresses to page table entries one by one. Using the operating system's Memory Management Unit (MMU) interface or by traversing the Page Directory Table (PDT) and Page Table (PT), the physical page frame containing the virtual address is found. The page table attribute fields of the memory address are read, including the page frame number, page start address, page end address, read / write flag, execution flag, module identifier, and page classification label. Detailed metadata of the page is obtained, such as whether the page permissions include PAGE_EXECUTE_READWRITE. The memory address is verified to be within the range of the page start address to the page end address, confirming that the address pointer is not dangling and indeed falls within the valid byte range of the attribute page. The execution flag status is checked, and the NX (No-Execute) bit in the page table entry or the system's DEP (Data Execution Protection) status is read. If the flag is disabled and the page classification label is heap or stack, it is marked as a non-executable area of ​​the stack. The specific judgment logic is: if the execution permission bit is 0, it is not executable, and simultaneously... By querying the Type field of the Virtual Address Descriptor (VAD) tree, it was found that the allocation type of the page was MEM_PRIVATE and the Tag was Heap or Stack. This indicates that the code attempted to jump to the stack area, which should only store data. This is a typical feature of a buffer overflow attack. If the module identifier is empty or not in the list of loaded modules in the supply chain process and the execution flag is enabled, it is marked as an unknown code segment outside the module. The specific judgment logic is that if the execution permission bit is 1, it can be executed. However, the memory area to which the page belongs is not associated with any known DLL file name, or its base address is not in the loaded module list maintained by the process PEB. This indicates that this is a free code segment privately allocated through functions such as VirtualAlloc. This is common in Shellcode injection. Remove the unmarked jump items, keep the marked jump items, and remove those entries that neither fall into the non-executable area of ​​the stack nor are judged as unknown code segments from the list. Only the addresses with clear malicious characteristics are left, and a set of non-executable segment hooks is generated.

[0034] The steps to obtain the temporal Hamming weight sequence of heap memory pages are as follows: Based on the set of hooks pointing to non-executable segments, determine the start and end addresses of the heap memory space of the process in the supply chain. Divide the heap memory space into equal-length slices according to a fixed byte granularity, number them sequentially and establish a slice index table. Set a unified sampling time base and periodically collect bitmap snapshots of each slice within a continuous time window to form a sequence of heap memory slice bitmap snapshots. Based on the snapshot sequence of the heap memory slice bitmap, the cumulative number of non-zero bits in each slice is counted for each snapshot. The cumulative number of snapshots of the same heap memory pages is arranged in chronological order to form the heap memory page temporal Hamming weight sequence.

[0035] Specifically, based on the set of non-executable segment hooks, the recorded memory address attributes are parsed to lock the unique identifier (PID) of the target supply chain process. The virtual memory query interface provided by the operating system kernel, such as the VirtualQueryEx function on the Windows platform, is called to traverse the entire user-mode address space of the process. The status and type fields of each memory block are checked, and regions with a status of MEM_COMMIT and a type of MEM_PRIVATE are selected. Further comparison of the allocation protection attributes of these regions is performed. Contiguous memory blocks marked PAGE_READWRITE and with non-empty heap manager handles are identified as heap memory segments. The base address and size of each heap segment are read and combined to calculate the start and end addresses of the heap memory space. The slice granularity parameter is set to 4096 bytes, which corresponds to the standard physical... The page size ensures efficient alignment of memory access. Based on this granularity, the heap space is linearly divided, and a unique 32-bit integer index number is assigned to each slice. A slice index mapping table is constructed to record the virtual starting address corresponding to each index. A unified sampling time base is set, a high-precision multimedia timer is initialized, and the sampling interval is set to 50 milliseconds. This interval is set according to the heartbeat communication frequency of common remote control Trojans. Read operations are periodically triggered within a continuous time window. For each slice in the index table, the binary data in the slice is completely copied to the analysis buffer using direct memory read instructions or system debugging APIs. No data format conversion is performed, and the data is directly saved as the original binary bitmap. All slice bitmaps obtained in a single traversal are timestamped and stored in a circular queue cache in chronological order to form a heap memory slice bitmap snapshot sequence.

[0036] Based on the heap memory slice bitmap snapshot sequence, initialize the data processing pointer to point to the head snapshot of the circular queue. Count the cumulative number of non-zero bits in each slice snapshot by snapshot. In specific implementation, load 4096 bytes of data from a specific slice in the current snapshot and treat it as an array of 512 64-bit unsigned integers. Utilize CPU-supported hardware instructions such as POPCNT or AVX-512 instruction set VPOPCNTDQ to calculate the number of binary "1"s in each 64-bit integer in parallel. Accumulate these 512 local count results to obtain the Hamming weight value of the slice at the current moment. This value reflects the information entropy and data fill density of the memory page. Traverse all snapshots within the time window, extract the Hamming weight values ​​of the same index slice at different time points, and fill these values ​​into a one-dimensional array in ascending order of timestamps. The constructed array represents the content change trajectory of the memory page in the time dimension. Repeat this process for all slices to generate the heap memory page time-domain Hamming weight sequence.

[0037] The steps to obtain fine-grained fluctuation values ​​of memory pages are as follows: Based on the Hamming weight sequence of heap memory pages in the time domain, the fine-grained fluctuation value of memory pages is calculated using the following formula: ; in, For the first Fine-grained fluctuation value of memory pages per memory page. For the first The original fine-grained variance of each memory page is calculated as follows: , For the first The memory page is in the... Hamming weight at each point in time For the first The average weight of all Hamming weights in a memory page. This represents the total number of slice bitmap snapshots within a continuous time window, and the total number of samples taken within the statistical period. For the first The normalized spectral entropy of the nth memory page, specifically for the nth memory page... Hamming weight sequence of memory pages Perform a Fourier transform to obtain the spectral energy distribution, and calculate the power spectrum. Normalization yields the probability distribution Then calculate the spectral entropy. , The number of frequency points involved in the calculation.

[0038] Specifically, the formula for calculating the fine-grained fluctuation value of memory pages is based on the fluctuation amplitude in the time domain. The degree of disorder in the frequency domain This combination specifically amplifies periodic memory transformation behaviors, such as periodically decrypting instructions or heartbeat packet construction, while utilizing exponential decay terms. It effectively suppresses random memory read / write noise, because although random noise has a large variance, it also has a high spectral entropy, which will lead to a significant reduction in the final score, thereby achieving high signal-to-noise ratio detection of covert communication behavior.

[0039] For the first The raw fine-grained variance of the memory page, which is used to quantify the severity of changes in the memory page content, is obtained by extracting the first value from the heap memory page temporal Hamming weight sequence generated in the previous step. The sequence data of the page was used to set a sampling window in the actual monitoring process of a certain e-commerce supply chain software. The Hamming weight sequence was collected 128 times. It exhibits a clear sinusoidal fluctuation characteristic, with values ​​oscillating between 14,000 and 18,000. Calculate the average value of this sequence. The value is 16000, and then the data for each time point is calculated. The sum of the squared differences from the mean, totaling 128 squared differences, yields a total sum of squared deviations of 508,000,000. This summation is divided by the degrees of freedom. That is, 127, from which the variance value is calculated. Approximately 4,000,000.

[0040] For the first The normalized spectral entropy of each memory page, which measures the disorder of memory fluctuation rhythms, is calculated. A value closer to 0 indicates more regular fluctuations, while a value closer to 1 indicates more random fluctuations. The steps to obtain this value are as follows: [The text abruptly ends here, likely due to an incomplete sentence or missing information.] Performing a Fast Fourier Transform (FFT) yields the complex spectrum at 64 effective frequency points. The power spectrum is obtained by calculating the square of the modulus at each frequency point. In the example, due to the obvious periodicity of the sequence, the energy is highly concentrated at the fundamental frequency and its harmonics, with the main peak energy accounting for a very large proportion. The probability distribution is obtained by normalizing the power spectrum by dividing it by the total energy. Spectral entropy is calculated using the information entropy formula and then divided by... After normalization, the final calculated normalized spectral entropy is obtained. The value of 0.15 indicates that the fluctuation has a very strong regularity.

[0041] The total number of slice bitmap snapshots within a continuous time window represents the total number of samples taken within the statistical period. This parameter is set based on the Nyquist sampling theorem and detection response time requirements. To capture communication characteristics with frequencies below 25Hz, the sampling frequency is set to 50Hz, and the detection window duration is 2.56 seconds. Therefore, the number of sampling points is determined. It is 128.

[0042] For the first The memory page is in the... The Hamming weight at the specified time point is directly derived from the heap memory page time-domain Hamming weight sequence, representing the total number of non-zero bits in the physical memory page. Specifically, at the specified time point... The memory bitmap read from the sampling points was statistically analyzed using the POPCNT instruction, and its value was 17450.

[0043] Calculations based on parameters: Substitute the parameters obtained from the actual data collection and calculation into the formula: ; ; Calculate the exponential decay term: ; Calculate the final fluctuation value: ; Calculated fine-grained fluctuation value of memory pages The value reaches 3,442,800, maintaining most of the original variance with only minor decay. This indicates that the memory page not only fluctuates wildly but also exhibits a highly ordered fluctuation pattern, consistent with the behavior of malicious code periodically decrypting and sending data. If the same variance originates from random memory operations, its spectral entropy... It is usually close to 0.9, at which point the decay term The final score will drop to 1,624,000, thus becoming significantly distinguishable in comparison.

[0044] The steps to obtain the set of active memory pages exceeding the threshold are as follows: Load the fine-grained fluctuation value of memory pages, read the preset activity benchmark threshold parameter, compare the fine-grained fluctuation value of memory pages with the preset activity benchmark threshold parameter, mark memory pages that are lower than the preset activity benchmark threshold parameter as static pages and remove them from the list, keep the memory pages that are not removed as high-frequency fluctuation pages, and generate a set of high-frequency fluctuation pages. Based on the set of high-frequency fluctuating pages, the permission bit information of the memory page table is read page by page. The read flag, write flag, and execute flag are all enabled. Memory pages that are not enabled at the same time are removed from the set of high-frequency fluctuating pages. The remaining memory pages are arranged in address order to generate a set of active memory pages that exceed the threshold.

[0045] Specifically, fine-grained fluctuation values ​​of memory pages are loaded. Based on large-scale normal operation data collected during the establishment phase of the supply chain software security baseline, an activity benchmark threshold parameter is constructed. This threshold is set using the 3-sigma principle in statistics. Specifically, the target supply chain terminal process is run in a clean sandbox environment, and the fine-grained fluctuation values ​​of all its memory pages are monitored continuously for 24 hours, recording approximately ten million sample data points. The average value of memory page fluctuation under normal conditions is then calculated. The standard deviation is 50,000. The preset activity baseline threshold parameter is set to 15,000. The coefficient 10 is chosen based on the analysis of historical false alarm rates, ensuring that only extreme abnormal fluctuations with a probability less than 10 to the power of -23 are selected. The fine-grained fluctuation value of memory pages calculated in the previous steps (e.g., 3,442,800) is compared with the threshold 200,000. For pages with a value less than 200,000, they are determined to be static pages of code segments or low-frequency data pages, marked as "static" and removed from the linked list to be analyzed, releasing the analysis resources they occupy. For pages with a value greater than or equal to 200,000, they are determined to have drastic content overwriting or obfuscation transformations, and are kept in the current processing queue. The physical address, virtual address, and fluctuation score of these pages are encapsulated into a structure and stored in a dynamic array to generate a set of high-frequency fluctuation pages.

[0046] Based on the set of high-frequency fluctuating pages, each page object in the dynamic array is traversed. Using the virtual memory query interface (such as VirtualQueryEx) provided by the operating system kernel, the target process handle and page base address are passed in to obtain the MEMORY_BASIC_INFORMATION structure data. The Protect attribute field is extracted from this structure. This field is a 32-bit mask used to define memory access permissions. A specific permission mask constant, PAGE_EXECUTE_READWRITE, with a hexadecimal value of 0x40, is set. The read flag, write flag, and execute flag are all checked to be enabled simultaneously. Specifically, the obtained Protect field value is bitwise ANDed with 0x40, or the presence of PAGE_EXECUTE is checked simultaneously. The combined attributes of PAGE_READ (0x10), PAGE_WRITE (0x02), and PAGE_WRITE (0x04) are used to remove pages with only read-only (PAGE_READONLY), read-write (PAGE_READWRITE), or execute-only (PAGE_EXECUTE_READ) permissions from the high-frequency fluctuation page set, even though their fluctuation values ​​are high (possibly due to video buffers or high-frequency logs). Only pages with permissions that strictly match the typical Shellcode or JIT code characteristics of "readable, writable, and executable" are retained. The retained memory pages are then quickly sorted according to their virtual memory addresses in ascending order, and the index list is reconstructed to generate a set of active memory pages exceeding the threshold.

[0047] The steps for obtaining the signal to detect fileless attacks in the supply chain are as follows: Based on the set of active memory pages exceeding the threshold, the memory access event time index sequence of each page is segmented according to a fixed time step. The time interval between adjacent peaks is counted and the number of repeated intervals is accumulated. If the number of repeated intervals reaches the preset judgment limit and the peak order is stable with the decryption stage preceding the communication stage, it is determined that there is periodic decryption communication behavior, and a supply chain fileless attack judgment signal is generated.

[0048] Specifically, based on the set of active memory pages exceeding the threshold, for the Hamming weight time-domain sequence associated with each memory page in the set, a peak identification algorithm is executed. The peak determination threshold is set to 1.5 times the sequence mean. All local maxima in the sequence are identified, the timestamp indices of these peaks are recorded, and the time difference between two adjacent peaks is calculated. An interval sequence is obtained, and a preset judgment threshold of 5 times is set. This value is based on the heartbeat tolerance setting of common C2 communication, that is, attackers usually send at least 5 heartbeat packets to establish connection stability. The repeated values ​​in the interval sequence are counted. If the number of repetitions in a certain time interval (e.g., 5000 milliseconds, tolerance range ±100 milliseconds) exceeds 5 times, it is determined that there is a periodic heartbeat. Further analysis of the waveform morphology in each heartbeat cycle is conducted, and the change of data entropy value before and after the peak is checked. If it is found that the rising edge of the peak is accompanied by a sudden change in entropy value from low to high (corresponding to the decryption process), and the peak holding phase is accompanied by a write operation to the network socket buffer (corresponding to the communication phase), it is confirmed that the peak order is stable with the decryption phase first and the communication phase later. Combining these two characteristics, it is determined that malicious code residing in memory is performing periodic decryption and reconnection, triggering alarm logic and generating a supply chain fileless attack judgment signal.

Claims

1. A supply chain oriented intrusion detection system, characterized by, The system comprises: a data extraction correction module for reading supply chain terminal key process physical memory page data, extracting memory resident PE header and memory import address table, and reading disk storage executable component file header information in parallel to generate a supply chain process original import table set, uniformly logical address space of memory and disk data according to the supply chain process original import table set, and generating a relocation correction import address matrix; a differential check analysis module for traversing internal row vectors of the relocation correction import address matrix, screening to generate an import table heterogeneous differential vector, reading memory address page table attributes contained in the import table heterogeneous differential vector, judging whether the address falls into a stack non-executable interval or a module external unknown code segment, and generating a non-executable segment hook pointing set; a memory fluctuation calculation module for locating supply chain process heap memory space to which the non-executable segment hook pointing set belongs, grid slicing the heap memory space according to a fixed byte granularity, generating a heap memory page time domain Hamming weight sequence, calculating the heap memory page time domain Hamming weight sequence, quantifying time dimension fluctuation amplitude of memory page content, and generating a memory page fine-grained fluctuation value; an attack behavior judgment module for loading the memory page fine-grained fluctuation value, calling a preset activity benchmark threshold parameter, screening to generate a super-threshold active memory page set, judging that the super-threshold active memory page set exists periodic decryption communication behavior, and outputting a supply chain fileless attack judgment signal.

2. The supply chain oriented intrusion detection system of claim 1, wherein, The obtaining step of the relocation correction import address matrix is: reading supply chain terminal key process physical memory page data, parsing memory resident PE header to extract an import address table, reading disk storage executable component file header information to parse static import address table and relocation table data, calculating a numerical difference between a memory loading base address and a disk static base address, linearly superimposing the numerical difference to each address entry of the static import address table, and generating a supply chain process original import table set; according to the supply chain process original import table set, generating a fixed length vector for each import record in address field order, establishing row index according to module label and column index according to API symbol, filling vector elements with address values corrected by the numerical difference, and forming a vector matrix mapping result; according to the vector matrix mapping result, correcting address benchmarks of each row vector according to relocation table data, aligning according to module starting offset, replacing address identifiers of row index and column index according to a mapping relationship between the memory loading base address and the disk static base address, checking whether each entry falls into an effective range of unified logical address space, and generating a relocation correction import address matrix.

3. The supply chain oriented intrusion detection system of claim 1, wherein, The obtaining step of the import table heterogeneous differential vector is: traversing each row vector of the relocation correction import address matrix, locking memory address entries and disk address entries corresponding to the same API symbol, calculating a memory address value minus a disk address value, recording a difference value and a corresponding API entry index position, and generating a memory and disk address difference sequence; according to the memory and disk address difference sequence, calculating a heterogeneous hook risk measurement value; and According to the heterogeneous hook risk measurement value, the entries with the risk measurement value greater than the risk threshold value are screened, the corresponding memory jump target addresses are extracted according to the index positions of the entry records, and the import table heterogeneous differential vector is generated by arranging the addresses in sequence according to the API symbol order.

4. The supply chain oriented intrusion detection system of claim 1, wherein, The obtaining step of the non-executable segment hook pointing set is: According to the import table heterogeneous differential vector, the memory address is located to the page table item, the memory address page table attribute field is read, the field is the page frame number, the page start address, the page end address, the read-write flag bit, the execution flag bit, the module identification and the page classification label, the memory address is located in the range of the page start address to the page end address, the execution flag bit state is checked, the flag bit is disabled, and the page classification label is the heap or the stack, and the non-executable interval of the heap and the stack is marked, the module identification is empty or not in the supply chain process loaded module list, and the execution flag bit is enabled, and the module outside the unknown code segment is marked, the jump items not marked are removed, the jump items marked are retained, and the non-executable segment hook pointing set is generated.

5. The supply chain oriented intrusion detection system of claim 1, wherein, The obtaining step of the heap memory page time domain Hamming weight sequence is: According to the non-executable segment hook pointing set, the start address and the end address of the heap memory space of the supply chain process are determined, the heap memory space is divided into equal-length slices according to the fixed byte granularity, the slices are numbered in sequence and a slice index table is established, a unified sampling time reference is set, the bitmap snapshots of each slice are periodically collected in a continuous time window, and a heap memory slice bitmap snapshot sequence is formed. According to the heap memory slice bitmap snapshot sequence, the cumulative number of non-zero bits in each slice is counted, and the snapshot cumulative numbers of the same heap memory page are arranged in time sequence to form a heap memory page time domain Hamming weight sequence.

6. The supply chain oriented intrusion detection system of claim 1, wherein, The obtaining step of the super-threshold active memory page set is: The memory page fine-grained fluctuation value is loaded, the preset activity reference threshold parameter is read, the memory page fine-grained fluctuation value is compared with the preset activity reference threshold parameter, the memory pages lower than the preset activity reference threshold parameter are marked as static pages and removed from the list, the memory pages not removed are retained as high-frequency fluctuation pages, and a high-frequency fluctuation page set is generated.

7. The supply chain oriented intrusion detection system of claim 6, wherein, The obtaining step of the super-threshold active memory page set further includes: according to the high-frequency fluctuation page set, the memory page table permission bit information is read page by page, the read flag bit, the write flag bit and the execution flag bit are checked, the memory pages not simultaneously enabled are excluded from the high-frequency fluctuation page set, the remaining memory pages are arranged in address order, and a super-threshold active memory page set is generated.

8. The supply chain oriented intrusion detection system of claim 1, wherein, The obtaining step of the supply chain fileless attack judgment signal is: According to the super-threshold active memory page set, the memory access event time index sequence of each page is segmented according to a fixed time step, the time interval of adjacent peaks is counted and the number of repeated intervals is accumulated, it is determined that the number of repeated intervals reaches a preset judgment limit and the peak order is stable, that is, the decryption phase is before the communication phase, it is determined that there is periodic decryption communication behavior, and a supply chain fileless attack judgment signal is generated.

9. The method of supply chain oriented intrusion detection system according to any of claims 1-8, characterized in that, The method comprises the following steps: The method comprises the following steps: Read the supply chain terminal key process physical memory page data, extract the memory resident PE header and memory import address table, read the disk storage executable component file header information in parallel, generate the supply chain process original import table set, unify the memory and disk data logical address space according to the supply chain process original import table set, and generate the relocation correction import address matrix; Traverse the internal row vector of the relocation correction import address matrix, filter and generate an import table heterogeneous difference vector, read the memory address page table attributes contained in the import table heterogeneous difference vector, judge whether the address falls into the stack non-executable interval or the unknown code segment outside the module, and generate a non-executable segment hook pointing set; Locate the supply chain process heap memory space to which the non-executable segment hook pointing set belongs, perform grid slicing on the heap memory space according to a fixed byte granularity, generate a heap memory page time domain hamming weight sequence, calculate the heap memory page time domain hamming weight sequence, quantify the time dimension fluctuation amplitude of the memory page content, and generate a memory page fine-grained fluctuation value; Load the memory page fine-grained fluctuation value, call a preset activity reference threshold parameter, filter and generate a super-threshold active memory page set, determine that the super-threshold active memory page set exists periodic decryption communication behavior, and output a supply chain fileless attack judgment signal.

Images