A sandbox detection method and system for network security persistent threats

Abstract

The application provides a sandbox detection method and system for network security persistent threats, and belongs to the technical field of network security. The method comprises the following steps: obtaining the context information of a to-be-detected object and a source subject thereof, performing dynamic trust evaluation on the source subject to generate a trust score, and determining the analysis duration of the to-be-detected object in the sandbox according to the trust score, so that the samples from low-trust sources obtain a longer analysis window; performing static analysis and dynamic analysis within the analysis duration, generating a comprehensive judgment result according to the analysis result, and immediately blocking the access of the source subject and the to-be-detected object to the protected resources when malicious behavior is determined to exist. The application associates the continuous evaluation capability of the zero trust architecture with the dynamic analysis duration of the sandbox, so that the analysis duration changes adaptively with the trust score of the source subject, and reliable detection and timely blocking of advanced persistent threats are realized on the premise of guaranteeing the system throughput.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a sandbox detection method and system for persistent network security threats. Background Technology

[0002] Zero-trust architecture emphasizes not implicitly granting trust to any access source, but continuously assessing its trustworthiness based on multi-dimensional context such as identity, environment, and behavior; sandbox detection, on the other hand, identifies potential malicious activities by executing suspicious objects in an isolated virtualized environment and monitoring their behavior. The goal of combining the two is to improve the detection and response capabilities to advanced persistent threats.

[0003] Currently, mainstream sandbox detection solutions generally adopt dynamic analysis technology, which puts suspicious files into a virtualized environment to run. Within a set fixed analysis time (usually 3 to 5 minutes), behavior logs are collected through API hooks, system call tracing and other means, and the threat is determined based on the behavior logs.

[0004] However, advanced persistent threat (APT) groups and sophisticated malware families commonly insert long-duration delay instructions (such as Sleep functions, logic bombs, or idling loops) into their malicious code, causing malicious behavior to remain inactive or harmless for a 3- to 5-minute analysis window. Once the sandbox determines the sample is safe and releases it after the analysis period expires, the malicious code awakens in the real environment and executes attacks, leading to missed detections and substantial losses such as data breaches and business interruptions. Summary of the Invention

[0005] To address the aforementioned problems, this invention provides a sandbox detection method and system for persistent network security threats.

[0006] To achieve the above objectives, the present invention provides a sandbox detection method for persistent network security threats, comprising: Obtain the identity attribute information, device security status information, historical behavior information, and current environmental status information of the object to be detected in the network and the source entity of the object to be detected.

[0007] Dimensional scores are generated for the identity attribute information, device security status information, historical behavior information, and current environmental status information, respectively. These scores are then weighted and fused to generate a trust score for the source entity. The analysis duration of the target object in the sandbox is dynamically determined based on the trust score, increasing as the trust score decreases. Within the analysis duration, static and dynamic analyses are performed on the target object in the sandbox, and a comprehensive risk score is generated based on the static and dynamic analysis results.

[0008] When the comprehensive risk score indicates that the target of detection is engaging in malicious behavior, the access of the source entity and the target of detection to the protected network resources is immediately blocked.

[0009] Preferably, the static analysis includes extracting the file structure features and code features of the object to be detected, and generating static analysis results based on the file structure features and code features; the dynamic analysis includes executing the object to be detected in a preset virtualization environment, monitoring and recording its API call sequence, file operation behavior, registry modification behavior and network communication behavior during its operation, and generating dynamic analysis results based on the monitoring records.

[0010] Preferably, the file structure features and code features of the object to be detected are extracted, and static analysis results are generated based on the file structure features and code features, specifically including: Extracting the file structure features of the object to be detected includes: calculating the Shannon entropy value of each section of the object to be detected, and generating an entropy score based on the Shannon entropy value; Extracting the code features of the object to be detected includes: analyzing the import table of the object to be detected, identifying the number of sensitive application programming interfaces and imported dynamic link libraries contained therein, and generating an import table suspicion score based on the identification results; Extract printable strings from the object to be detected, match them with a preset malicious software feature string library, and generate a string matching score based on the matching results; Detect abnormal features in the PE file structure of the object to be detected, and generate a PE structure anomaly score based on the detection results; The static score is generated by summing the entropy score, the import table suspicion score, the string matching score, and the PE structure anomaly score.

[0011] Preferably, the monitoring and recording of API call sequences, file operation behaviors, registry modification behaviors, and network communication behaviors during the monitoring process, and the generation of dynamic analysis results based on the monitoring records, specifically includes: Analyze the degree of anomaly in the API call sequence, identify process injection API combinations, privilege escalation API calls, and anti-debugging API calls, and generate an API anomaly score based on the identification results; The file operation behaviors are analyzed to identify large-scale file encryption behaviors, creation behaviors of critical system directory files, modification behaviors of system executable files, and creation behaviors of hidden files. A file operation risk score is generated based on the identification results. The registry modification behavior is analyzed to identify startup item addition behavior, system service configuration modification behavior, security related setting modification behavior, and WMI event subscription creation behavior, and a registry modification score is generated based on the identification results; The dynamic score is generated by summing the API anomaly score, the file operation risk score, and the registry modification score.

[0012] Preferably, the identity attribute information includes the identity authentication strength, account type, and permission level of the source entity; the device security status information includes the patch update status, antivirus software installation and operation status, and device compliance status of the terminal device used by the source entity; the historical behavior information includes the source entity's historical access records, historical abnormal behavior records, and historical security event participation records; and the current environment status information includes the source entity's access time, access location, access frequency, and the security level of the current network environment.

[0013] Preferably, the blocking operation specifically includes: the management server issuing blocking policies to the boundary firewall and the internal firewall; the management server is independently deployed in the security control area, and establishes communication connections with the sandbox, the boundary firewall and the internal firewall through an out-of-band management network or an encrypted management channel, and undertakes the unified orchestration function of the dual firewall policies and the sandbox detection policies.

[0014] Preferably, the analysis duration of the object to be detected in the sandbox is dynamically determined based on the trust score, specifically including: when the trust score is lower than a preset threshold, the analysis duration is set to a first duration; when the trust score is not lower than the preset threshold, the analysis duration is set to a second duration; wherein, the first duration is longer than the second duration.

[0015] Preferably, after determining that the target object exhibits malicious behavior based on the comprehensive risk score, the method further includes: performing a tiered response operation according to the comprehensive risk score, specifically including: When the comprehensive risk score is greater than or equal to the first threshold, it is determined to be high risk and a blocking operation is performed; When the comprehensive risk score is less than the first threshold and greater than or equal to the second threshold, it is determined to be of medium risk, and a manual review prompt is generated. When the comprehensive risk score is less than the second threshold, it is determined to be low risk, and the object to be detected is allowed to pass, while the behavior of the source entity and the object to be detected is continuously monitored.

[0016] This invention also provides a sandbox detection system for persistent cybersecurity threats, comprising: The data acquisition module is used to acquire the identity attribute information, device security status information, historical behavior information, and current environmental status information of the object to be detected in the network and the source entity of the object to be detected.

[0017] The evaluation and judgment module is used to generate dimensional scores corresponding to the identity attribute information, device security status information, historical behavior information, and current environmental status information, respectively, and to perform weighted fusion of the dimensional scores to generate a trust score for the source entity; dynamically determine the analysis time of the object to be detected in the sandbox based on the trust score, and the analysis time increases as the trust score decreases; within the analysis time, perform static and dynamic analysis on the object to be detected through the sandbox, and generate a comprehensive risk score based on the static analysis results and the dynamic analysis results.

[0018] The protection module is used to immediately block the source entity and the target entity from accessing the protected network resources when the comprehensive risk score determines that the target object to be detected has malicious behavior.

[0019] The present invention also provides a computer-readable storage medium storing a computer program that, when loaded by a processor, is capable of executing any of the steps in the sandbox detection method for persistent network security threats.

[0020] The sandbox detection method for persistent network security threats provided by this invention has the following beneficial effects: This invention answers who is accessing the network through identity attributes, access methods through device security status, past behavior, and access conditions under which the network is accessing the network through the current environment. These four dimensions are logically independent and complementary. It is difficult for attackers to maintain consistent behavioral characteristics simultaneously within a multi-dimensional evaluation framework, and anomalies in any dimension cannot be completely masked in the others. This achieves a blind-spot-free assessment of the risk status of the source entity, ensuring that the trust score truly reflects the credibility of the source entity. Based on this score, this invention matches differentiated analysis durations to the target object before sandbox execution, making the allocation of analysis duration no longer a fixed constant but a variable that adaptively changes with the trust score. This allows for effective detection of advanced persistent threats that evade long-dormant behavior without sacrificing system throughput, ensuring system security. Attached Figure Description

[0021] To more clearly illustrate the embodiments and design schemes of the present invention, the accompanying drawings required for this embodiment will be briefly described below. The drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1This is a flowchart illustrating a sandbox detection method for persistent cybersecurity threats according to an embodiment of the present invention. Figure 2 This is the APT-SDS deployment architecture according to an embodiment of the present invention. Detailed Implementation

[0023] To enable those skilled in the art to better understand and implement the technical solutions of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. The following embodiments are only used to more clearly illustrate the technical solutions of the present invention and should not be construed as limiting the scope of protection of the present invention.

[0024] This invention aims to address the structural and technical deficiencies exposed by existing sandbox detection technologies and zero-trust architectures in responding to advanced persistent threats (APT-SDS), and provides an APT-SDS sandbox detection method based on a zero-trust architecture. This method is deployed in a demilitarized zone (DMZ) between dual firewalls, employing a combined working mode of inline detection and bypass mirror backup.

[0025] System deployment architecture such as Figure 2 As shown, network traffic from the Internet first undergoes initial filtering by the perimeter firewall, then deep inspection by APT-SDS, and finally granular access control by the internal firewall before entering the protected internal network. The management server, deployed independently of the isolation zone in the security control zone, establishes communication connections with APT-SDS and various security devices via an out-of-band management network or encrypted management channel, and is responsible for the unified orchestration of dual firewall policies and sandbox detection policies. Under this architecture, all network traffic and files entering the internal network must undergo a triple check: initial filtering by the perimeter firewall, deep inspection by APT-SDS, and access control by the internal firewall, forming a defense-in-depth system.

[0026] The APT-SDS method of this invention includes the following functional modules: a zero-trust access control module, responsible for implementing access control policies based on dual firewall isolation, SDP stealth, MFA authentication, and micro-segmentation; a multi-layer sandbox detection engine, responsible for performing static analysis, dynamic analysis, and network behavior monitoring on suspicious files and traffic in a virtualized environment; an intelligent behavior analysis engine, responsible for intelligently fusing and analyzing behavioral data collected by the sandbox and making detection decisions; a zero-day exploit detection module, responsible for identifying and detecting attacks exploiting zero-day vulnerabilities through abnormal behavior patterns; a threat intelligence linkage module, responsible for data interaction with local and cloud-based threat intelligence sources and coordinating the collaborative responses of security devices such as firewalls, IDS, IPS, and SIEM; and a management server, responsible for policy orchestration, situational awareness visualization, detection report generation, and log auditing. These modules exchange data and synchronize policies through an internal secure channel, collectively forming a complete processing chain of detection-analysis-decision-response.

[0027] Based on this, the present invention provides a sandbox detection method for persistent network security threats, specifically as follows: Figure 1 As shown, it includes the following steps: S1. System Deployment and Architecture Configuration The sandbox detection system is deployed in an isolated area between the border firewall and the internal firewall, and the management server is deployed independently in the security control area. The management server establishes communication connections with the sandbox detection system, the border firewall, and the internal firewall through an out-of-band management network or an encrypted management channel.

[0028] S2, Multi-dimensional Risk Scoring All network traffic entering the protected intranet passes through the initial filtering of the boundary firewall, the deep detection of the sandbox detection system, and the access control of the internal firewall in sequence. The sandbox detection system performs risk quantification assessment on the samples from multiple dimensions, including static features, dynamic behavior, network behavior, and threat intelligence matching. It calculates the risk score for each dimension and performs weighted fusion processing according to the preset weights of each dimension to obtain a comprehensive risk score.

[0029] This embodiment illustrates the working process of the multi-dimensional risk scoring model in the APT-SDS method, including the scoring methods for each dimension, weighted fusion calculation, and threshold determination.

[0030] S201, Static Feature Score (S_static, 0–100 points) The static feature scoring module performs risk quantification assessment based on file static attributes without executing samples. The file structure features include PE file structure anomaly features and Shannon entropy values ​​for each section; the code features include import table features and printable string features. The scoring dimensions and calculation methods are as follows:

[0031] S2011, PE Entropy Score (0–25 points): Calculate the Shannon entropy value of each segment of the sample. An entropy value close to 8.0 indicates possible encryption or compression code (packing feature), while an entropy value below 5.0 indicates the code may not be encrypted. The scoring rules are as follows: - Entropy value of any segment > 7.5: 25 points (highly suspicious); - Entropy value of any segment 6.5–7.5: 15 points (moderately suspicious); - Entropy value of any segment < 5.0 and abnormally low entropy value of the code segment: 10 points (possible padding avoidance); - Other cases: calculate the score based on linear interpolation of the entropy value distribution.

[0032] S2012, Import Table Suspicion Score (0–25 points): Analyze the names of dynamic link libraries and functions imported in the PE import table: - Importing sensitive APIs (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, CryptEncrypt, etc.): 3 points for each sensitive API, up to a maximum of 15 points; - Importing an unusually small number of DLLs (<10) and suspected of dynamic import: 10 points; - Importing normal system DLLs and no sensitive APIs: 0 points.

[0033] S2013, String Matching Score (0–25 points): Extract printable strings from the sample and match them against a malware signature string library: - Matching C2 (Command and Control) domains, IP addresses, and URLs: 5 points per match, up to a maximum of 15 points; - Matching malware family signature strings: 10 points; - Matching sensitive registry paths (such as Run keys, Services keys): 2 points per match, up to a maximum of 5 points.

[0034] S2014, PE (Portable Executable) Structure Anomaly Score (0–25 points): Detects abnormal features in the PE file structure: - Section names contain non-standard names (such as ".vmp0", ".upx0", ".petite"): 10 points; - Code section size does not match the entry point: 5 points; - Multiple PE headers exist: 5 points; - Invalid or forged digital signature: 5 points.

[0035] The formula for calculating the static feature score is: S_static = PE entropy score + import table suspiciousness score + string matching score + PE structural anomaly score, with a maximum score of 100.

[0036] S202, Dynamic Behavior Rating (S_dynamic, 0–100 points) The dynamic behavior scoring module performs risk quantification assessment based on the runtime behavior of samples in the sandbox environment: S201, API anomaly score (0–35 points). Analyze the anomaly severity of API call sequences: - Process injection API combination (OpenProcess+VirtualAllocEx+WriteProcessMemory+CreateRemoteThread): Detecting a complete chain scores 35 points, partial matches score proportionally; - Privilege escalation API calls (Nt Set Information Process, AdjustToken Privileges): 20 points; - Anti-debugging API calls (Is Debugger Present, Check RemoteDebugger Present, Nt Query Information Process): Detecting multiple calls scores 10 points; - Sensitive API call frequency exceeds 3 times the normal program baseline: 15 points.

[0037] S2021, Document Operation Risk Score (0–35 points) File operation behavior of the analysis sample: - Large-scale file encryption behavior (read → encrypt → write → delete mode): 35 points for encrypting more than 50 files, and proportional points for 10-50 files; - Creating files in critical system directories (%SYSTEMROOT%, %APPDATA%): 2 points per file, maximum 10 points; - Modifying system executable files: 20 points; - Creating hidden files or setting hidden attributes: 1 point per file, maximum 5 points.

[0038] S2022, Registry Modification Rating (0–30 points): Analyze the registry operation behavior of the sample: - Add startup item (Run key, Run Once key): 15 points; - Modify system service configuration (Services key): 10 points; - Modify security related settings (such as disabling Windows Defender): 15 points; - Create WMI event subscription (no file persistence): 15 points.

[0039] The formula for calculating the dynamic behavior score is: S_dynamic = API anomaly score + file operation risk score + registry modification score, with a maximum score of 100.

[0040] S203, Network Behavior Score (S_network, 0–100 points) The network behavior scoring module performs risk quantification assessment based on the network communication behavior of the samples: S2031, C2 Communication Feature Scoring (0–40 points): Analyze whether the network communication pattern of the sample conforms to the C2 communication features: - Periodic heartbeat communication (sending fixed-size data packets at fixed time intervals, coefficient of variation <0.1): 20 points; - Communication uses non-standard ports (such as HTTP over 8080, HTTPS over 8443): 10 points; - Communication content is highly encrypted and has no normal HTTP header features: 10 points; - Uses domain fronting technology to hide the real C2 address: 15 points.

[0041] S2032, Data Outflow Scoring (0–30 points): Analyze the data outflow behavior of the sample: - Outflow data volume exceeds 10 times the normal baseline: 30 points; - Outflow data volume exceeds 5–10 times the normal baseline: 20 points; - Outflow data volume exceeds 2–5 times the normal baseline: 10 points.

[0042] S2033, DNS Anomaly Score (0–30 points): Analyze the DNS query behavior of the sample: - Querying random domains generated by DGA (Domain Name Generation Algorithm): 20 points; - Querying recently registered domains (<30 days): 10 points; - Querying known dynamic DNS service domains: 10 points; - Abnormal DNS query frequency (a large number of queries in a short period of time): 10 points.

[0043] The network behavior score is calculated as follows: S_network = C2 communication feature score + data outflow score + DNS anomaly score, with a maximum score of 100.

[0044] S204 Threat Intelligence Matching Score (S_intelligence, 0–100 points) The threat intelligence matching and scoring module assesses risk based on the degree of matching between the sample and known threat intelligence. S2041, IOC Hit Score (0–60 points): Matching the multidimensional features of the sample with IOCs in the threat intelligence database: - File hash matching known malware (100% match): 60 points; - C2 domain / IP matching known malicious IOCs: 15 points per match, maximum 30 points; - YARA rule matching known malware families: 10–20 points based on rule confidence; - Behavioral pattern matching known attack techniques (MITREATT&CK mapping): 5 points per technique, maximum 20 points.

[0045] S2042, Family Relationship Score (0–40 points): Evaluated based on the similarity of sample features to known malware families: - Code similarity > 90% (by binary comparison): 40 points; - Code similarity 70%–90%: 25 points; - Behavioral pattern similarity > 85% (similar API call sequences, network behavior): 20 points; - Use of the same C2 infrastructure as known families: 15 points.

[0046] The formula for calculating the threat intelligence matching score is: S_intelligence = IOC hit score + family association score, with a maximum score of 100.

[0047] S205, Weighted Fusion Calculation and Threshold Determination The multi-dimensional risk scoring model receives the scoring data from the above four dimensions and calculates the comprehensive risk score according to the following weighted formula: ; The weighting of each dimension is based on the following: dynamic behavioral characteristics directly reflect the actual threat level of the sample (weight 0.35), network behavior reflects the external communication threat of the sample (weight 0.25), and static characteristics and threat intelligence provide auxiliary judgment basis (weight 0.20 for each).

[0048] S3, Access Control and Trust Linkage Based on the comparison between the comprehensive risk score and the preset threshold, corresponding access control operations are performed; the sandbox detection results are fed back to the zero-trust trust assessment engine to dynamically update the trust score of the subject that sent the sample, and the access permissions of the subject are adjusted according to the updated trust score.

[0049] Specifically, based on the comprehensive risk score, the system performs the following threshold determination: - ≥80 points: Determined as "high risk", immediate blocking operation will be performed and a critical alarm will be generated; -50 points ≤ <80 points: Determined as "Medium Risk", submitted to a security analyst for manual review; <50 points: judged as "low risk", the sample is allowed to pass but its behavior is continuously monitored.

[0050] Risk scoring example demonstration Suppose that a sample is scored as follows across the dimensions after analysis: -S_static=72 points (PE file shows signs of being packed, import table contains multiple sensitive APIs, string matching reveals suspicious URLs); -S_dynamic=85 points (process injection API combination and large-scale file operations are detected, registry startup item modification exists); -S_network=60 points (periodic heartbeat communication and abnormal DNS queries are detected, outgoing data volume is slightly higher than normal baseline); -S_intelligence=55 points (C2 domain hits known suspicious IOC, YARA rules partially match a known family).

[0051] Comprehensive risk score calculation: The sample received a composite score of 70.15, which falls within the 50–80 range. The system classified it as “medium risk” and submitted it to a security analyst for manual review.

[0052] The aforementioned multi-dimensional risk scoring model serves as the core computational framework for sample determination. However, in actual deployments, APT groups commonly employ anti-sandbox analysis techniques and zero-day exploit methods to evade detection. To further enhance the effectiveness and anti-interference capabilities of sandbox analysis, this embodiment also provides the following enhancement measures:

[0053] 1. Multi-layer virtualization anti-escape technology The sandbox detection system employs multi-layered virtualization anti-escape technology, including: environment randomization: randomly assigning virtual machine hardware configuration parameters for each analysis task; user interaction simulation: simulating random mouse movement, keyboard input, and file list access operations; time-based anti-escape: combining sleep time compression with multi-time point checks; and kernel-level monitoring: monitoring low-level behavior through kernel event tracing providers, kernel callback mechanisms, and file system microfilter drivers.

[0054] 2. Zero-day exploit detection The monitoring process continuously allocates a large number of memory blocks of the same size within a preset time window, identifying abnormal memory allocation entropy values ​​and allocation-free ratios to detect heap spray attacks; through control flow integrity monitoring, it detects execution flow anomalies and indirect jump target anomalies in non-code regions on the stack to detect return-oriented programming chains, jump-oriented programming chains, or call-oriented programming chains; it monitors abnormal creation behavior of executable memory pages, continuous no-operation instruction fragment patterns, and code decryption behavior in memory regions to identify shellcode execution; the zero-day exploit detection does not rely on known vulnerability signature databases.

[0055] Performance test verification To verify the detection effectiveness of the APT-SDS method, a large-scale experiment was conducted. The test dataset contained 100,000 known malware samples, 5,000 unknown malware samples, and 50,000 normal software samples. The experimental results are shown in Tables 1 and 2.

[0056] Table 1. Comparison of the effects of this method with existing technologies. Known malware detection rate 85–90% 95–98% ≥99% Unknown malware detection rate 40–50% 60–70% ≥85% Zero-day exploit detection rate <20% 30–40% ≥80% False alarm rate 5–10% 2–5% ≤1% Average detection time 5–15 minutes 3–8 minutes 3–8 minutes Concurrent analysis sample size ≤10 ≤20 ≥50 Sandbox escape resistance Low middle high Zero Trust Integration none none Deep integration APT end-to-end detection Not supported Partial support Full support As shown in Table 1, APT-SDS achieved a zero-day exploit detection rate of ≥80%, compared to <20% for the traditional sandbox (Cuckoo) and 30–40% for the commercial sandbox (JoeSecurity). This difference is primarily due to APT-SDS's signatureless behavior pattern detection technology and memory behavior monitoring modules (heap spray detection, ROP chain detection, and shellcode detection). Regarding the false positive rate, APT-SDS, through a multi-dimensional weighted fusion scoring model, controlled the false positive rate to ≤1%, compared to 5–10% for the traditional sandbox and 2–5% for the commercial sandbox. This reduction in false positive rate can be attributed to the multi-dimensional cross-validation mechanism's layer-by-layer filtering of suspicious behavior. In terms of concurrent analysis sample count, APT-SDS supports concurrent analysis of ≥50 samples, compared to ≤10 for the traditional sandbox and ≤20 for the commercial sandbox. This improved concurrency capability is related to the system's distributed analysis architecture and virtualized resource pool scheduling mechanism.

[0057] Table 2. Experimental data on malware family detection Table 2 presents the detection results for 10 representative malware families. A total of 21,600 samples were tested, with 21,457 detected, resulting in an overall detection rate of 99.34%. The detection rates for each family ranged from 99.00% to 99.67%, with WannaCry having the highest detection rate (99.67%) and Emotet the lowest (99.21%). Regarding detection time, the average detection time for ransomware samples (Locky, WannaCry) was 3–5 minutes, while the average detection time for APT group samples (APT-C-00, APT-C-39) was 7–8 minutes. This difference in detection time is related to the longer analysis window required for the multi-stage characteristics of APT attacks.

[0058] Based on the same inventive concept, this invention also provides a sandbox detection system for persistent cybersecurity threats, comprising: The data acquisition module is used to acquire the identity attribute information, device security status information, historical behavior information, and current environmental status information of the object to be detected in the network and the source entity of the object to be detected.

[0059] The evaluation and judgment module is used to generate dimensional scores corresponding to the identity attribute information, device security status information, historical behavior information, and current environmental status information, respectively, and to perform weighted fusion of the dimensional scores to generate a trust score for the source entity; dynamically determine the analysis time of the object to be detected in the sandbox based on the trust score, and the analysis time increases as the trust score decreases; within the analysis time, perform static and dynamic analysis on the object to be detected through the sandbox, and generate a comprehensive risk score based on the static analysis results and the dynamic analysis results.

[0060] The protection module is used to immediately block the source entity and the target entity from accessing the protected network resources when the comprehensive risk score determines that the target object to be detected has malicious behavior.

[0061] The present invention also provides a computer-readable storage medium storing a computer program that can be used to execute the sandbox detection method for persistent cybersecurity threats provided above.

[0062] Specific limitations on the computing system for sandbox detection of persistent cybersecurity threats can be found in the above-mentioned limitations of the sandbox detection method for persistent cybersecurity threats, and will not be repeated here. Each module in the aforementioned sandbox detection system for persistent cybersecurity threats can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device, or stored in the memory of the computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0063] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. Furthermore, the above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A sandbox detection method for persistent network security threats, characterized in that, Includes the following steps: Obtain the identity attribute information, device security status information, historical behavior information, and current environmental status information of the object to be detected in the network and the source entity of the object to be detected; The identity attribute information, device security status information, historical behavior information and current environmental status information are generated respectively, and the dimension scores are weighted and fused to generate the trust score of the source entity. The analysis duration of the object to be tested in the sandbox is dynamically determined based on the trust score, and the analysis duration increases as the trust score decreases; within the analysis duration, static and dynamic analyses are performed on the object to be tested through the sandbox, and a comprehensive risk score is generated based on the static and dynamic analysis results; When the comprehensive risk score indicates that the target of detection is engaging in malicious behavior, the access of the source entity and the target of detection to the protected network resources is immediately blocked.

2. The sandbox detection method for persistent network security threats according to claim 1, characterized in that, The static analysis includes extracting the file structure features and code features of the object to be detected, and generating static analysis results based on the file structure features and code features; the dynamic analysis includes executing the object to be detected in a preset virtualization environment, monitoring and recording its API call sequence, file operation behavior, registry modification behavior and network communication behavior during its operation, and generating dynamic analysis results based on the monitoring records.

3. The sandbox detection method for persistent network security threats according to claim 2, characterized in that, Extract the file structure features and code features of the object to be detected, and generate static analysis results based on the file structure features and code features, specifically including: Extracting the file structure features of the object to be detected includes: calculating the Shannon entropy value of each section of the object to be detected, and generating an entropy score based on the Shannon entropy value; Extracting the code features of the object to be detected includes: analyzing the import table of the object to be detected, identifying the number of sensitive application programming interfaces and imported dynamic link libraries contained therein, and generating an import table suspicion score based on the identification results; Extract printable strings from the object to be detected, match them with a preset malicious software feature string library, and generate a string matching score based on the matching results; Detect abnormal features in the PE file structure of the object to be detected, and generate a PE structure anomaly score based on the detection results; The static score is generated by summing the entropy score, the import table suspicion score, the string matching score, and the PE structure anomaly score.

4. The sandbox detection method for persistent network security threats according to claim 2, characterized in that, The system monitors and records the API call sequence, file operation behavior, registry modification behavior, and network communication behavior during its operation, and generates dynamic analysis results based on the monitoring records, specifically including: Analyze the degree of anomaly in the API call sequence, identify process injection API combinations, privilege escalation API calls, and anti-debugging API calls, and generate an API anomaly score based on the identification results; The file operation behaviors are analyzed to identify large-scale file encryption behaviors, creation behaviors of critical system directory files, modification behaviors of system executable files, and creation behaviors of hidden files. A file operation risk score is generated based on the identification results. The registry modification behavior is analyzed to identify startup item addition behavior, system service configuration modification behavior, security related setting modification behavior, and WMI event subscription creation behavior, and a registry modification score is generated based on the identification results; The dynamic score is generated by summing the API anomaly score, the file operation risk score, and the registry modification score.

5. The sandbox detection method for persistent network security threats according to claim 1, characterized in that, The identity attribute information includes the identity authentication strength, account type, and permission level of the source entity; the device security status information includes the patch update status, antivirus software installation and operation status, and device compliance status of the terminal device used by the source entity; the historical behavior information includes the source entity's historical access records, historical abnormal behavior records, and historical security event participation records; the current environment status information includes the source entity's access time, access location, access frequency, and the security level of the current network environment.

6. The sandbox detection method for persistent network security threats according to claim 1, characterized in that, The blocking operation specifically includes: the management server issuing blocking policies to the boundary firewall and the internal firewall; the management server is independently deployed in the security control area, and establishes communication connections with the sandbox, the boundary firewall and the internal firewall through an out-of-band management network or an encrypted management channel, and undertakes the unified orchestration function of the dual firewall policies and the sandbox detection policies.

7. The sandbox detection method for persistent network security threats according to claim 1, characterized in that, The analysis duration of the object to be detected in the sandbox is dynamically determined based on the trust score, specifically including: when the trust score is lower than a preset threshold, the analysis duration is set to a first duration; when the trust score is not lower than the preset threshold, the analysis duration is set to a second duration; wherein, the first duration is longer than the second duration.

8. The sandbox detection method for persistent network security threats according to claim 1, characterized in that, After determining that the target object exhibits malicious behavior based on the comprehensive risk score, the method further includes: performing a tiered response operation according to the comprehensive risk score, specifically including: When the comprehensive risk score is greater than or equal to the first threshold, it is determined to be high risk and a blocking operation is performed; When the comprehensive risk score is less than the first threshold and greater than or equal to the second threshold, it is determined to be of medium risk, and a manual review prompt is generated. When the comprehensive risk score is less than the second threshold, it is determined to be low risk, and the object to be detected is allowed to pass, while the behavior of the source entity and the object to be detected is continuously monitored.

9. A sandbox detection system for persistent network security threats, characterized in that, include: The data acquisition module is used to acquire the identity attribute information, device security status information, historical behavior information, and current environmental status information of the object to be detected in the network and the source entity of the object to be detected; The evaluation and judgment module is used to generate dimension scores corresponding to the identity attribute information, device security status information, historical behavior information and current environmental status information, respectively, and to perform weighted fusion of each dimension score to generate the trust score of the source subject. The analysis duration of the object to be tested in the sandbox is dynamically determined based on the trust score, and the analysis duration increases as the trust score decreases; within the analysis duration, static and dynamic analyses are performed on the object to be tested through the sandbox, and a comprehensive risk score is generated based on the static and dynamic analysis results; The protection module is used to immediately block the source entity and the target entity from accessing the protected network resources when the comprehensive risk score determines that the target object to be detected has malicious behavior.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is loaded by the processor, it is able to perform the steps of the method according to any one of claims 1 to 8.

Images