WO2022088633A1

WO2022088633A1 - Lateral penetration protection method and apparatus, device and storage medium

Info

Publication number: WO2022088633A1
Application number: PCT/CN2021/090702
Authority: WO
Inventors: 何博; 赵立洲; 林岳川; 闵真; 田立闯
Original assignee: 北京奇虎科技有限公司
Priority date: 2020-10-28
Filing date: 2021-04-28
Publication date: 2022-05-05
Also published as: CN112351017A; CN112351017B

Abstract

The present application relates to the technical field of network attacks, and discloses a lateral penetration protection method and apparatus, a device and a storage medium. The method comprises: when a penetration attack is detected, identifying the attack type of the penetration attack; determining attack information according to the attack type; according to a preset engine decision strategy, determining whether the attack information is a lateral penetration attack; and when the attack information is a lateral penetration attack, blocking the lateral penetration attack.

Description

Horizontal penetration protection method, device, equipment and storage medium

This application claims the priority of the Chinese patent application filed on October 28, 2020, the application number is 202011176011.7, and the title is "Transverse Penetration Protection Method, Apparatus, Equipment and Storage Medium", which is hereby incorporated by reference in its entirety.

technical field

The present application relates to the technical field of network attacks, and in particular, to a lateral penetration protection method, apparatus, device, and storage medium.

Background technique

Lateral penetration attack technology is a widely used technology in complex network attacks, especially in Advanced Persistent Threats (APT). Attackers can use lateral penetration attack technology to use the compromised system as a springboard to access other hosts on the intranet to obtain sensitive information including mailboxes, shared folders or credential information. Attackers can use this sensitive information to further control other systems, escalate privileges or steal more valuable credentials, and ultimately gain control over key network nodes and management devices. Traditional network attack detection methods cannot monitor these lateral penetration attacks, and network security monitoring has dead ends.

The above content is only used to assist the understanding of the technical solutions of the present application, and does not mean that the above content is the prior art.

technical problem

The main purpose of the present application is to provide a lateral penetration protection method, equipment, storage medium and device, aiming at solving the technical problem that the traditional network attack detection method in the prior art cannot monitor the lateral penetration attack, and network security monitoring has dead ends.

technical solutions

In order to achieve the above object, the application provides a lateral penetration protection method, the lateral penetration protection method comprises the following steps:

When an infiltration attack is detected, identifying the attack type of the infiltration attack;

Determine attack information according to the attack type;

Determine whether the attack information is a lateral penetration attack according to a preset engine determination strategy;

When the attack information is a lateral penetration attack, the lateral penetration attack is blocked.

Optionally, the step of identifying the attack type of the penetration attack when monitoring the penetration attack specifically includes:

When the penetration attack is detected, the service process function is called to identify the attack type of the penetration attack.

Optionally, the step of invoking a service process function to identify the attack type of the infiltration attack when an infiltration attack is detected, specifically includes:

When the penetration attack is detected, modify the pointer address in the system call table, so that the pointer address points to the service process function;

The service process function is called by the pointer address, and the service process information corresponding to the penetration attack is determined by the service process function;

Identify the attack type of the penetration attack according to the service process information.

When the penetration attack is detected, the operation process function is called to identify the attack type of the penetration attack.

Optionally, the step of invoking an operation process function to identify the attack type of the infiltration attack when an infiltration attack is detected, specifically includes:

When the penetration attack is detected, the operation process function is called, and the registered HOOK point is set by the operation process function;

Monitoring the creation of the operation process of the penetration attack through the registered HOOK point;

When monitoring the creation of the operation process of the infiltration attack, determine the operation process information corresponding to the infiltration attack through the registered HOOK point;

Identify the attack type of the penetration attack according to the operation process information.

When the penetration attack is detected, the operation interface process function is called to identify the attack type of the penetration attack.

Optionally, the step of invoking an operation interface process function to identify the attack type of the infiltration attack when an infiltration attack is detected, specifically includes:

When the penetration attack is detected, obtain the interface output parameter corresponding to the penetration attack;

calling the operation interface process function, and extracting interface process information from the interface output parameter through the operation interface process function;

Identify the attack type of the penetration attack according to the interface process information.

In addition, in order to achieve the above purpose, the present application also proposes a lateral penetration protection device, the lateral penetration protection device includes:

an identification module, used for identifying the attack type of the penetration attack when the penetration attack is detected;

a determining module, configured to determine attack information according to the attack type;

a judgment module, configured to judge whether the attack information is a lateral penetration attack according to a preset engine judgment strategy;

An execution module, configured to block the lateral penetration attack when the attack information is a lateral penetration attack.

In addition, in order to achieve the above object, the present application also proposes a lateral penetration protection device, the lateral penetration protection device includes: a memory, a processor, and a lateral penetration protection stored on the memory and running on the processor A program for lateral penetration protection configured with steps to implement the lateral penetration protection method as described above.

In addition, in order to achieve the above object, the present application also proposes a storage medium, where a lateral penetration protection program is stored on the storage medium, and when the lateral penetration protection program is executed by a processor, the lateral penetration protection method as described above is implemented. step.

beneficial effect

In this application, when a penetration attack is detected, the attack type of the penetration attack is identified; the attack information is determined according to the attack type; whether the attack information is a lateral penetration attack is determined according to a preset engine determination strategy; When the attack information is a lateral penetration attack, the lateral penetration attack is blocked. Through the above method, it is determined whether the attack information is a lateral penetration attack according to the captured attack information and the preset engine determination strategy, and when it is determined to be a lateral penetration attack, the lateral penetration attack is blocked, so as to realize real-time monitoring of the lateral penetration attack , preventing the spread of lateral penetration attacks, improving the monitoring of network security, and solving the technical problems that the traditional network attack detection methods in the prior art cannot monitor lateral penetration attacks, and network security monitoring has dead ends.

Description of drawings

FIG. 1 is a schematic structural diagram of a lateral penetration protection device of a hardware operating environment according to an embodiment of the present application;

FIG. 2 is a schematic flowchart of the first embodiment of the lateral penetration protection method of the present application;

3 is a schematic flowchart of a second embodiment of the lateral penetration protection method of the present application;

4 is a schematic flowchart of a third embodiment of the lateral penetration protection method of the present application;

5 is a schematic flowchart of a fourth embodiment of the lateral penetration protection method of the present application;

6 is a schematic flowchart of a fifth embodiment of the lateral penetration protection method of the present application;

7 is a schematic flowchart of a sixth embodiment of the lateral penetration protection method of the present application;

8 is a schematic flowchart of a seventh embodiment of the lateral penetration protection method of the present application;

9 is a schematic flowchart of an eighth embodiment of the lateral penetration protection method of the present application;

10 is a schematic flowchart of a ninth embodiment of the lateral penetration protection method of the present application;

FIG. 11 is a structural block diagram of the first embodiment of the lateral penetration protection device of the present application.

The realization, functional characteristics and advantages of the purpose of the present application will be further described with reference to the accompanying drawings in conjunction with the embodiments.

Embodiments of the present invention

It should be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application.

Referring to FIG. 1 , FIG. 1 is a schematic structural diagram of a lateral penetration protection device of a hardware operating environment involved in the solution of the embodiment of the present application.

As shown in FIG. 1 , the lateral penetration protection device may include: a processor 1001 , such as a central processing unit (Central Processing Unit, CPU), a communication bus 1002 , a user interface 1003 , a network interface 1004 , and a memory 1005 . Among them, the communication bus 1002 is used to realize the connection and communication between these components. The user interface 1003 may include a display screen (Display), and the optional user interface 1003 may also include a standard wired interface and a wireless interface. The wired interface of the user interface 1003 may be a USB interface in this application. Optionally, the network interface 1004 may include a standard wired interface and a wireless interface (eg, a wireless fidelity (WIreless-FIdelity, WI-FI) interface). The memory 1005 may be a high-speed random access memory (Random Access Memory, RAM) memory, or may be a non-volatile memory (Non-volatile Memory, NVM), such as a disk memory. Optionally, the memory 1005 may also be a storage device independent of the aforementioned processor 1001 .

Those skilled in the art can understand that the structure shown in FIG. 1 does not constitute a limitation on the lateral penetration protection device, and may include more or less components than shown, or combine some components, or arrange different components.

As shown in FIG. 1 , the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a lateral penetration protection program.

In the lateral penetration protection device shown in FIG. 1 , the network interface 1004 is mainly used to connect to a background server and perform data communication with the background server; the user interface 1003 is mainly used to connect user equipment; the lateral penetration protection device passes through the processor 1001 invokes the lateral penetration protection program stored in the memory 1005, and executes the lateral penetration protection method provided by the embodiment of the present application.

Based on the above hardware structure, an embodiment of the lateral penetration protection method of the present application is proposed.

Referring to FIG. 2 , FIG. 2 is a schematic flowchart of the first embodiment of the lateral penetration protection method of the present application, and the first embodiment of the lateral penetration protection method of the present application is proposed.

In a first embodiment, the lateral penetration protection method includes the following steps:

Step S10: when the penetration attack is detected, identify the attack type of the penetration attack;

It should be noted that the execution body of this embodiment is the lateral penetration protection device, and the lateral penetration protection device may be an electronic device such as a personal computer or a server, which is not limited in this embodiment. When an infiltration attack is detected, the attack type of the infiltration attack can be identified in a variety of ways. The following four ways are used as examples for description. Of course, at least two ways can also be used in combination. In addition, the manner of identifying the attack type of the penetration attack may also be other manners according to the actual situation, which is not limited in this embodiment.

It is easy to understand that after entering the intranet, the attacker searches for the target machine with vulnerabilities (weak passwords, improper permissions configuration, credential theft, etc.) When the target machine can be accessed, the attacker will use various means to further infiltrate and control the target machine. At present, the most common ones are lateral penetration through remote service, remote scheduled task, remote WMI, and remote COM.

Specifically, when a penetration attack is detected, a preset HOOK engine can be used to identify the attack type of the penetration attack, and the preset HOOK engine can call a process function to identify the attack type of the penetration attack, and the process function can Including the service process function, the operation process function, the operation interface process function and the desktop process function; the first method is: when the penetration attack is detected, the service process function is called through the preset HOOK engine to identify the attack type of the penetration attack for remote service. The second method is: when a penetration attack is detected, the operation process function is called by a preset HOOK engine to identify the attack type of the penetration attack as a remote scheduled task method. The third method is: when a penetration attack is detected, the operation interface process function is called by a preset HOOK engine to identify the attack type of the penetration attack as a remote WMI method. The fourth method is: when a penetration attack is detected, the desktop process function is called by a preset HOOK engine to identify the attack type of the penetration attack as a remote COM method.

Step S20: Determine attack information according to the attack type;

It is easy to understand that the step of determining the attack information according to the attack type may include: determining the attack source IP according to the attack type; obtaining an attack instruction corresponding to the attack source IP through a preset mapping relationship; The attack type, the attack source IP, and the attack instruction determine attack information.

It should be noted that, for example, when a penetration attack is detected, the service process function is called by a preset HOOK engine to identify the attack type of the penetration attack as a remote service method, and the attack source IP is determined according to the penetration attack of the remote service method; The attack instruction corresponding to the attack source IP is obtained through a preset mapping relationship; the attack information is determined according to the attack type, the attack source IP and the attack instruction.

Specifically, obtain the network data packets of the penetration attack corresponding to the remote service mode, perform layer-by-layer analysis according to the format of the network protocol in the network data packets, and extract the data packet content; perform correlation analysis and data packet reorganization on the data packet content, and restore the application Layer data packet content, so as to obtain the network address of the attacking host; the network address of the attacking host can include MAC address and IP address, and the network address of the attacking host is used as the attack source IP.

Specifically, the attack instruction corresponding to the attack source IP is obtained through a preset mapping relationship. Before step S10 in this embodiment, a preset mapping relationship needs to be established, and the preset mapping relationship is the attack source IP and the attack source IP obtained in advance according to the reverse analysis. The corresponding relationship of the command is stored, and the corresponding relationship between the attack source IP and the attack command is stored as a preset mapping relationship. The reverse analysis process of the attack source IP can be as follows: reversely disassemble and analyze the structure, process, algorithm and code of the attack source IP, and derive the source code, design principle, structure, algorithm, processing process, and operation method of the attack source IP. and documents, obtain the program structure, communication protocol and command format, generate monitoring configuration files, and obtain attack instructions according to the monitoring configuration files.

Step S30: Determine whether the attack information is a lateral penetration attack according to a preset engine determination policy.

It should be noted that whether the attack information is a lateral penetration attack is determined according to a preset engine determination policy. A variety of preset engine determination strategies can be used to determine whether the attack information is a lateral penetration attack. The following three methods are used as examples for description. Of course, at least two methods can also be used in combination. In addition, the preset engine determination strategy may also be other strategies that need to be adopted according to the actual situation, which is not limited in this embodiment.

Specifically, the first method: determine whether the attack information is a lateral penetration attack according to a preset lateral penetration engine determination strategy: extract attack event data packets from the attack information according to a preset lateral penetration engine determination strategy; The algorithm processes the attack event data packets to obtain attack mode information; and judges whether the attack information is a lateral penetration attack according to the attack mode information.

The second way: combine the preset lateral penetration engine determination strategy and the preset HIPS engine determination policy to determine whether the attack information is a lateral penetration attack: extract attack event data packets from the attack information according to the preset lateral penetration engine determination policy Process the attack event data packets through a clustering algorithm to obtain attack pattern information; analyze the attack pattern information according to the time series to obtain restoration attack scene information; construct a target according to the restoration attack scene information and the attack information attack chain; obtain the host intrusion prevention system according to the preset HIPS engine determination strategy; determine whether the attack information is a lateral penetration attack according to the attack mode information and the target attack chain through the host intrusion prevention system. Among them, the host intrusion prevention system can identify the penetration attack type in the remote registry mode and the penetration attack type invoked by the remote system tool.

The third way: combine the preset lateral penetration engine determination strategy and the preset cloud rule engine determination policy to determine whether the attack information is a lateral penetration attack: extract attack event data from the attack information according to the preset lateral penetration engine determination policy process the attack event data packets through a clustering algorithm to obtain attack mode information; obtain cloud rules according to a preset cloud rule engine decision policy; perform data analysis on the attack mode information according to the cloud rules to obtain cloud analysis information ; According to the attack mode information and the cloud analysis information, determine whether the attack information is a lateral penetration attack.

Step S40: When the attack information is a lateral penetration attack, block the lateral penetration attack.

It is easy to understand that the step of blocking the lateral penetration attack when the attack information is a lateral penetration attack may include: when the attack information is a lateral penetration attack, judging whether the lateral penetration attack is a lateral penetration attack. Target lateral penetration attack; when the lateral penetration attack is the target lateral penetration attack, block the target lateral penetration attack according to a preset attack blocking method; when the lateral penetration attack is not the target lateral penetration attack when the lateral penetration attack is blocked according to the host intrusion prevention system.

Specifically, the target lateral penetration attack may include: remote service mode, remote scheduled task mode, remote WMI mode, and remote COM mode; the preset attack blocking mode may include: the attack source IP address of the lateral penetration attack At least one of adding a blacklist, ending the malicious process of the lateral penetration attack, and closing the compromised port of the lateral penetration attack. When the lateral penetration attack is not the target lateral penetration attack, the lateral penetration attack may be a remote registry method and a remote system tool calling method, and the remote registry method and remote system tool calling method are blocked according to the host intrusion prevention system Way.

It should be noted that, when the attack information is a lateral penetration attack, after the step of blocking the lateral penetration attack, it may further include: generating an attack log file according to the lateral penetration attack; An analysis is performed to generate an analysis report; the analysis report is displayed. When the attack information is a lateral penetration attack, after the step of blocking the lateral penetration attack, the method may further include: prompting the user host to be subjected to a lateral penetration attack through a pop-up window.

In this embodiment, when a penetration attack is monitored, the attack type of the penetration attack is identified; attack information is determined according to the attack type; whether the attack information is a lateral penetration attack is determined according to a preset engine determination strategy; When the attack information is a lateral penetration attack, the lateral penetration attack is blocked. Through the above method, it is determined whether the attack information is a lateral penetration attack according to the captured attack information and the preset engine determination strategy, and when it is determined to be a lateral penetration attack, the lateral penetration attack is blocked, so as to realize real-time monitoring of the lateral penetration attack , preventing the spread of lateral penetration attacks, improving the monitoring of network security, and solving the technical problems that the traditional network attack detection methods in the prior art cannot monitor lateral penetration attacks, and network security monitoring has dead ends.

Referring to FIG. 3 , FIG. 3 is a schematic flowchart of the second embodiment of the lateral penetration protection method of the present application. Based on the first embodiment shown in FIG. 2 above, a second embodiment of the lateral penetration protection method of the present application is proposed.

In the second embodiment, the step S10 includes:

Step S11: When a penetration attack is detected, a service process function is called to identify the attack type of the penetration attack.

It should be noted that after entering the intranet, the attacker searches for the target machine with vulnerabilities (weak password, improper permission configuration, credential theft, etc.) in the intranet environment. When the target machine can be accessed, the attacker will use various This means further penetration to control the target machine. At present, the most common is lateral penetration through remote services.

Specifically, when a penetration attack is detected, a preset HOOK engine can be used to identify the attack type of the penetration attack, and the preset HOOK engine can call a process function to identify the attack type of the penetration attack, and the process function can Including service process functions; the service process functions may be RCreateServiceW, RCreateServiceWOW64W, RChangeServiceConfigW, RChangeServiceConfig2W, RDeleteServiceW and RStartServiceW.

In this embodiment, when the penetration attack is detected, the service process function is called to identify the attack type of the penetration attack. Through the above method, the service process function is called to identify the attack type of the penetration attack, which is used to judge whether the penetration attack is a lateral penetration attack. The real-time monitoring of penetration attacks prevents the spread of lateral penetration attacks, improves the monitoring of network security, and solves the technical problem that traditional network attack detection methods in the prior art cannot monitor horizontal penetration attacks, and network security monitoring has dead ends.

Referring to FIG. 4 , FIG. 4 is a schematic flowchart of the third embodiment of the lateral penetration protection method of the present application. Based on the second embodiment shown in FIG. 3 above, a third embodiment of the lateral penetration protection method of the present application is proposed.

In the third embodiment, the step S11 specifically includes:

Step S110: When the penetration attack is detected, modify the pointer address in the system call table, so that the pointer address points to the service process function.

It should be noted that when a penetration attack is detected, a related function can be called to initiate a system call request. At this time, the system function can execute the int 0x80 soft interrupt instruction. The execution of the soft interrupt instruction will cause the system to jump to a preset kernel. Control address, so that the program enters the operating system kernel state, and the pointer address in the system call table is modified to point to the custom service process function of this embodiment, and the service process function can be RCreateServiceW, RCreateServiceWOW64W, RChangeServiceConfigW, RChangeServiceConfig2W, RDeleteServiceW and RStartServiceW. Among them, hooks can be performed for the calls of these service process functions. For example, modify sys_call_table[__NR_open] to point to the RCreateServiceW function.

Step S111 : calling the service process function through the pointer address, and determining the service process information corresponding to the penetration attack through the service process function.

It is easy to understand that the service process function is called through the pointer address, and the service process function may be RCreateServiceW, RCreateServiceWOW64W, RChangeServiceConfigW, RChangeServiceConfig2W, RDeleteServiceW and RStartServiceW. The service process information corresponding to the penetration attack is determined through the service process function.

Specifically, for example, modify sys_call_table[__NR_open] to point to the RCreateServiceW function. The specified function can be searched according to sys_call_table[__NR_open]. At this time, the system will first call the service process function RCreateServiceW customized in this embodiment. Through the service process function RCreateServiceW, information such as the process id of the application and the read file type will be recorded, thereby recording The attack behavior information of the penetration attack, after the recording is completed, the service process information corresponding to the penetration attack is generated according to the attack behavior information.

Step S112: Identify the attack type of the penetration attack according to the service process information.

It should be noted that, according to the service process information, it can be identified that the attack type of the penetration attack is lateral penetration through a remote service method, and further, it is also necessary to determine the attack source IP according to the attack type; The mapping relationship acquires the attack instruction corresponding to the attack source IP; the attack information is determined according to the attack type, the attack source IP and the attack instruction. Determine whether the attack information is a lateral penetration attack according to a preset engine determination policy; when the attack information is a lateral penetration attack, block the lateral penetration attack.

In this embodiment, when a penetration attack is detected, the pointer address in the system call table is modified, so that the pointer address points to the service process function; the service process function is called by the pointer address, and the service process function is determined by the service process function. Service process information corresponding to the penetration attack; identifying the attack type of the penetration attack according to the service process information. Through the above method, the service process function is called to identify the attack type of the penetration attack, which is used to judge whether the penetration attack is a lateral penetration attack, and when it is determined to be a lateral penetration attack, the lateral penetration attack is blocked, so as to realize the horizontal penetration attack. The real-time monitoring of penetration attacks prevents the spread of lateral penetration attacks, improves the monitoring of network security, and solves the technical problem that traditional network attack detection methods in the prior art cannot monitor horizontal penetration attacks, and network security monitoring has dead ends.

Referring to FIG. 5 , FIG. 5 is a schematic flowchart of the fourth embodiment of the lateral penetration protection method of the present application. Based on the first embodiment shown in FIG. 2 above, a fourth embodiment of the lateral penetration protection method of the present application is proposed. The present embodiment will be described based on the first embodiment.

In the fourth embodiment, the step S10 includes:

Step S12: When an infiltration attack is detected, the operation process function is called to identify the attack type of the infiltration attack.

It should be noted that after entering the intranet, the attacker searches for the target machine with vulnerabilities (weak password, improper permission configuration, credential theft, etc.) in the intranet environment. When the target machine can be accessed, the attacker will use various This means further penetration to control the target machine. At present, the most common is to carry out lateral infiltration through remote planning tasks.

Specifically, when a penetration attack is detected, a preset HOOK engine can be used to identify the attack type of the penetration attack, and the preset HOOK engine can call a process function to identify the attack type of the penetration attack, and the process function can Including an operation process function, the operation process function may be SchRpcRegisterTask.

In this embodiment, when a penetration attack is detected, an operation process function is called to identify the attack type of the penetration attack. Through the above method, the operation process function is called to identify the attack type of the penetration attack, which is used to judge whether the penetration attack is a lateral penetration attack. The real-time monitoring of penetration attacks prevents the spread of lateral penetration attacks, improves the monitoring of network security, and solves the technical problem that traditional network attack detection methods in the prior art cannot monitor horizontal penetration attacks, and network security monitoring has dead ends.

Referring to FIG. 6, FIG. 6 is a schematic flowchart of a fifth embodiment of the lateral penetration protection method of the present application. Based on the fourth embodiment shown in FIG. 5, a fifth embodiment of the lateral penetration protection method of the present application is proposed. The present embodiment will be described based on the fourth embodiment.

In the fifth embodiment, the step S12 specifically includes:

Step S120: When the penetration attack is detected, the operation process function is called, and the registered HOOK point is set through the operation process function.

It should be noted that when the Windows host starts, the monitoring of the penetration attack is started with the kernel module, and the operation process can be HOOK monitored through the process HOOK monitor. When the penetration attack is detected, the operation process function is called, and the operation process function can be SchRpcRegisterTask, and the registered HOOK point is set by the operation process function, for example, the registered HOOK point is set by the SchRpcRegisterTask function.

Step S121: Monitor the creation of the operation process of the penetration attack through the registered HOOK point.

It is easy to understand that, when the creation of the operation process of the penetration attack is monitored, a registered HOOK point is triggered, and the creation of the operation process of the penetration attack can be monitored through the registered HOOK point.

Step S122: When the creation of the operation process of the infiltration attack is monitored, the operation process information corresponding to the infiltration attack is determined through the registered HOOK point.

It should be noted that when the creation of the operation process of the penetration attack is monitored, the registration HOOK point is triggered to obtain the process behavior feature information of the penetration attack, and the pre-stored matching feature module can be called to match with the process behavior feature information, Monitor and discover attack behavior information based on command execution, store attack behavior information corresponding to the penetration attack, and use the attack behavior information as operation process information.

Step S123: Identify the attack type of the penetration attack according to the operation process information.

It is easy to understand that, according to the operation process information, it can be identified that the attack type of the penetration attack is horizontal penetration through remote planning tasks. Further, it is also necessary to determine the attack source IP according to the attack type; A mapping relationship is set to obtain an attack instruction corresponding to the attack source IP; attack information is determined according to the attack type, the attack source IP and the attack instruction. Determine whether the attack information is a lateral penetration attack according to a preset engine determination policy; when the attack information is a lateral penetration attack, block the lateral penetration attack.

It should be noted that HOOK monitoring of the operation process can also be performed through the file HOOK. The file HOOK can register HOOK points for the read() and write() functions. When there is a file read or modified file behavior on the host, the registered HOOK point is triggered to obtain the process behavior characteristic information of the penetration attack, and the pre-stored information can be called. The matching feature module matches the process behavior feature information, monitors and discovers the attack behavior information of executing commands and illegal logins, stores the attack behavior information corresponding to the penetration attack, and uses the attack behavior information as the operation process information. The process information identifies the attack type of the penetration attack.

In this embodiment, when a penetration attack is detected, an operation process function is called, and a registered HOOK point is set through the operation process function; the creation of the operation process of the penetration attack is monitored through the registered HOOK point; When the operation process of the infiltration attack is created, the operation process information corresponding to the infiltration attack is determined through the registered HOOK point; the attack type of the infiltration attack is identified according to the operation process information. Through the above method, the operation process function is called to identify the attack type of the penetration attack, which is used to judge whether the penetration attack is a lateral penetration attack. The real-time monitoring of penetration attacks prevents the spread of lateral penetration attacks, improves the monitoring of network security, and solves the technical problem that traditional network attack detection methods in the prior art cannot monitor horizontal penetration attacks, and network security monitoring has dead ends.

Referring to FIG. 7 , FIG. 7 is a schematic flowchart of the sixth embodiment of the lateral penetration protection method of the present application. Based on the first embodiment shown in FIG. 2 above, a sixth embodiment of the lateral penetration protection method of the present application is proposed. The present embodiment will be described based on the first embodiment.

In the sixth embodiment, the step S10 includes:

Step S13: When the penetration attack is detected, the operation interface process function is called to identify the attack type of the penetration attack.

It should be noted that after entering the intranet, the attacker searches for the target machine with vulnerabilities (weak password, improper permission configuration, credential theft, etc.) in the intranet environment. When the target machine can be accessed, the attacker will use various This means further penetration to control the target machine. At present, the most common one is lateral penetration through remote WMI.

Specifically, when a penetration attack is detected, a preset HOOK engine can be used to identify the attack type of the penetration attack, and the preset HOOK engine can call a process function to identify the attack type of the penetration attack, and the process function can Including an operation interface process function, the operation interface process function may be an IWbemServices interface function.

In this embodiment, when a penetration attack is detected, an operation interface process function is called to identify the attack type of the penetration attack. Through the above method, the operation interface process function is called to identify the attack type of the penetration attack, which is used to determine whether the penetration attack is a lateral penetration attack, and when it is determined to be a lateral penetration attack, the lateral penetration attack is blocked, so as to realize the The real-time monitoring of lateral penetration attacks prevents the spread of lateral penetration attacks, improves the monitoring of network security, and solves the technical problem that traditional network attack detection methods in the prior art cannot monitor lateral penetration attacks, and network security monitoring has dead ends.

Referring to FIG. 8 , FIG. 8 is a schematic flowchart of a seventh embodiment of the lateral penetration protection method of the present application. Based on the sixth embodiment shown in FIG. 7 , a seventh embodiment of the lateral penetration protection method of the present application is proposed. The present embodiment will be described based on the sixth embodiment.

In the seventh embodiment, the step S13 includes:

Step S130: When the penetration attack is detected, obtain the interface output parameter corresponding to the penetration attack.

It should be noted that the operation process can also be HOOK monitored through the network HOOK. The network HOOK can register HOOK points in NF_IP_LOCAL_IN and NF_INET_LOCAL_IN, trigger the registration of HOOK points when the network is connected to the host, monitor the penetration attack, and obtain the interface output parameters corresponding to the penetration attack.

Step S131 : calling an operation interface process function, and extracting interface process information from the interface output parameters through the operation interface process function.

It is easy to understand that the operation interface process function is called, and the operation interface process function may be the IWbemServices interface function. The interface process information is extracted from the interface output parameters through the operation interface process function. Obtain the interface output parameters of the penetration attack, call the operation interface process function to HOOK the interface output parameters, monitor and discover the attack behavior information based on unauthorized access of various network protocols and abnormal access data of specific network protocols, and store The attack behavior information corresponding to the penetration attack is used as the interface process information.

Step S132: Identify the attack type of the penetration attack according to the interface process information.

It should be noted that, according to the interface process information, it can be identified that the attack type of the penetration attack is horizontal penetration through remote WMI. Further, it is also necessary to determine the attack source IP according to the attack type; The mapping relationship acquires the attack instruction corresponding to the attack source IP; the attack information is determined according to the attack type, the attack source IP and the attack instruction. Determine whether the attack information is a lateral penetration attack according to a preset engine determination policy; when the attack information is a lateral penetration attack, block the lateral penetration attack.

In this embodiment, when a penetration attack is detected, the interface output parameters corresponding to the penetration attack are obtained; the operation interface process function is called, and the interface process information is extracted from the interface output parameters through the operation interface process function; according to The interface process information identifies the attack type of the penetration attack. Through the above method, the operation interface process function is called to identify the attack type of the penetration attack, which is used to determine whether the penetration attack is a lateral penetration attack, and when it is determined to be a lateral penetration attack, the lateral penetration attack is blocked, so as to realize the The real-time monitoring of lateral penetration attacks prevents the spread of lateral penetration attacks, improves the monitoring of network security, and solves the technical problem that traditional network attack detection methods in the prior art cannot monitor lateral penetration attacks, and network security monitoring has dead ends.

Referring to FIG. 9 , FIG. 9 is a schematic flowchart of an eighth embodiment of the lateral penetration protection method of the present application. Based on the first embodiment shown in FIG. 2 above, an eighth embodiment of the lateral penetration protection method of the present application is proposed. The present embodiment will be described based on the first embodiment.

In the eighth embodiment, the step S10 includes:

Step S14: When an infiltration attack is detected, the desktop process function is called to identify the attack type of the infiltration attack.

It should be noted that after entering the intranet, the attacker searches for the target machine with vulnerabilities (weak password, improper permission configuration, credential theft, etc.) in the intranet environment. When the target machine can be accessed, the attacker will use various This means further penetration to control the target machine. At present, the most common is lateral penetration through remote COM.

Specifically, when a penetration attack is detected, a preset HOOK engine can be used to identify the attack type of the penetration attack, and the preset HOOK engine can call a process function to identify the attack type of the penetration attack, and the process function can Including desktop process functions, the desktop process functions can be shell32!ShellExecuteExW and CreateProcessInternalW.

In this embodiment, when a penetration attack is detected, a desktop process function is called to identify the attack type of the penetration attack. Through the above method, the desktop process function is called to identify the attack type of the penetration attack, which is used to judge whether the penetration attack is a lateral penetration attack, and when it is determined to be a lateral penetration attack, the lateral penetration attack is blocked, so as to realize the horizontal penetration attack. The real-time monitoring of penetration attacks prevents the spread of lateral penetration attacks, improves the monitoring of network security, and solves the technical problem that traditional network attack detection methods in the prior art cannot monitor horizontal penetration attacks, and network security monitoring has dead ends.

Referring to FIG. 10 , FIG. 10 is a schematic flowchart of the ninth embodiment of the lateral penetration protection method of the present application. Based on the eighth embodiment shown in FIG. 9 above, a ninth embodiment of the lateral penetration protection method of the present application is proposed. This embodiment will be described based on the eighth embodiment.

In the ninth embodiment, the step S14 includes:

Step S140: When an infiltration attack is detected, obtain a remote desktop control behavior function corresponding to the infiltration attack.

It should be noted that when an infiltration attack is detected, based on the working principle of remote desktop control, the HOOK-related remote desktop control behavior function determines whether the current device has remote desktop control behavior according to the remote desktop control behavior function.

Step S141 : calling a desktop process function, and performing HOOK on the remote desktop control behavior function according to the desktop process function to obtain an operation function and a communication function of the remote desktop control behavior function.

It is easy to understand that when calling the desktop process function, the desktop process function can be shell32!ShellExecuteExW and CreateProcessInternalW, and HOOK the remote desktop control behavior function according to the desktop process function, so as to obtain the value of the remote desktop control behavior function. Operation functions and communication functions.

Step S142: Identify the attack type of the penetration attack according to the operation function and the communication function.

It should be noted that, by calling the desktop process function HOOK to the remote desktop control behavior function, the operation function and the communication function of the remote desktop control behavior function are obtained, and it can be determined whether the above operation function and communication function are called. Operation, for example, to determine whether SendInput, keybd_event, mouse_event functions are called, if so, it is determined that the message sending operation of the soft keyboard and soft mouse has occurred; or, for example, to determine whether the CreateCompatibleBitmap function has been called, if so, it is determined that a screen capture has occurred. operation; for another example, it is judged whether the Send and Recv functions are called, and if so, it is determined that a network communication behavior has occurred, and the attack type of the penetration attack can be identified according to the operation function and the communication function.

It is easy to understand that the attack type of the penetration attack can be identified according to the operation function and the communication function as lateral penetration through the remote COM method, and further, the attack source IP address needs to be determined according to the attack type. obtaining the attack instruction corresponding to the attack source IP through a preset mapping relationship; determining the attack information according to the attack type, the attack source IP and the attack instruction. Determine whether the attack information is a lateral penetration attack according to a preset engine determination policy; when the attack information is a lateral penetration attack, block the lateral penetration attack.

In this embodiment, when an infiltration attack is detected, the remote desktop control behavior function corresponding to the infiltration attack is obtained; the desktop process function is called, and the remote desktop control behavior function is hooked according to the desktop process function to obtain The operation function and the communication function of the remote desktop control behavior function; the attack type of the penetration attack is identified according to the operation function and the communication function. Through the above method, the desktop process function is called to identify the attack type of the penetration attack, which is used to judge whether the penetration attack is a lateral penetration attack, and when it is determined to be a lateral penetration attack, the lateral penetration attack is blocked, so as to realize the horizontal penetration attack. The real-time monitoring of penetration attacks prevents the spread of lateral penetration attacks, improves the monitoring of network security, and solves the technical problem that traditional network attack detection methods in the prior art cannot monitor horizontal penetration attacks, and network security monitoring has dead ends.

In addition, an embodiment of the present application further provides a storage medium, where a lateral penetration protection program is stored thereon, and when the lateral penetration protection program is executed by a processor, the steps of the lateral penetration protection method as described above are implemented.

Since the storage medium adopts all the technical solutions of all the above-mentioned embodiments, it has at least all the beneficial effects brought by the technical solutions of the above-mentioned embodiments, which will not be repeated here.

In addition, referring to FIG. 11 , an embodiment of the present application further proposes a lateral penetration protection device, and the lateral penetration protection device includes:

The identification module 10 is configured to identify the attack type of the penetration attack when the penetration attack is detected.

The determining module 20 is configured to determine attack information according to the attack type.

The judgment module 30 is configured to judge whether the attack information is a lateral penetration attack according to a preset engine judgment strategy.

The execution module 40 is configured to block the lateral penetration attack when the attack information is a lateral penetration attack.

This embodiment proposes a lateral penetration protection device, the lateral penetration protection device includes an identification module 10 for identifying an attack type of the penetration attack when a penetration attack is detected; a determination module 20 for identifying the attack type according to the attack The type determines attack information; the judgment module 30 is used to judge whether the attack information is a lateral penetration attack according to a preset engine judgment strategy; the execution module 40 is used to block the lateral penetration attack when the attack information is a lateral penetration attack Penetration attack. Through the above method, it is determined whether the attack information is a lateral penetration attack according to the captured attack information and the preset engine determination strategy, and when it is determined to be a lateral penetration attack, the lateral penetration attack is blocked, so as to realize real-time monitoring of the lateral penetration attack , preventing the spread of lateral penetration attacks, improving the monitoring of network security, and solving the technical problems that the traditional network attack detection methods in the prior art cannot monitor lateral penetration attacks, and network security monitoring has dead ends.

For other embodiments or specific implementation manners of the lateral penetration protection device described in the present application, reference may be made to the foregoing method embodiments, which will not be repeated here.

It should be noted that, herein, the terms "comprising", "comprising" or any other variation thereof are intended to encompass non-exclusive inclusion, such that a process, method, article or system comprising a series of elements includes not only those elements, It also includes other elements not expressly listed or inherent to such a process, method, article or system. Without further limitation, an element qualified by the phrase "comprising a..." does not preclude the presence of additional identical elements in the process, method, article or system that includes the element.

The above-mentioned serial numbers of the embodiments of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments. In a unit claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, and third, etc. do not denote any order, and these words may be construed as identifications.

From the description of the above embodiments, those skilled in the art can clearly understand that the method of the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is better implementation. Based on this understanding, the technical solutions of the present application can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products are stored in a storage medium (such as a read-only memory image (Read Only Memory image, ROM) / Random Access Memory (Random Access Memory, RAM), disk, CD), including several instructions to make a terminal device (can be a mobile phone, computer, server, air conditioner, or network equipment, etc.) to execute the methods described in the various embodiments of the present application.

The above are only the preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made by using the contents of the description and drawings of the present application, or directly or indirectly applied in other related technical fields , are similarly included within the scope of patent protection of this application.

Claims

A lateral penetration protection method, wherein the lateral penetration protection method comprises the following steps:

When an infiltration attack is detected, identifying the attack type of the infiltration attack;

Determine attack information according to the attack type;

Determine whether the attack information is a lateral penetration attack according to a preset engine determination strategy;

When the attack information is a lateral penetration attack, the lateral penetration attack is blocked.
The lateral penetration protection method according to claim 1, wherein the step of identifying the attack type of the penetration attack when the penetration attack is detected, specifically comprises:

When the penetration attack is detected, the service process function is called to identify the attack type of the penetration attack.
The lateral penetration protection method according to claim 2, wherein the step of invoking a service process function to identify the attack type of the penetration attack when a penetration attack is detected, specifically includes:

When the penetration attack is detected, modify the pointer address in the system call table, so that the pointer address points to the service process function;

The service process function is called by the pointer address, and the service process information corresponding to the penetration attack is determined by the service process function;

Identify the attack type of the penetration attack according to the service process information.
The lateral penetration protection method according to claim 1, wherein the step of identifying the attack type of the penetration attack when the penetration attack is detected, specifically comprises:

When the penetration attack is detected, the operation process function is called to identify the attack type of the penetration attack.
The lateral penetration protection method according to claim 4, wherein the step of invoking an operation process function to identify the attack type of the penetration attack when a penetration attack is detected, specifically includes:

When the penetration attack is detected, the operation process function is called, and the registered HOOK point is set by the operation process function;

Monitoring the creation of the operation process of the penetration attack through the registered HOOK point;

When monitoring the creation of the operation process of the infiltration attack, determine the operation process information corresponding to the infiltration attack through the registered HOOK point;

Identify the attack type of the penetration attack according to the operation process information.
The lateral penetration protection method according to claim 1, wherein the step of identifying the attack type of the penetration attack when the penetration attack is detected, specifically comprises:

When the penetration attack is detected, the operation interface process function is called to identify the attack type of the penetration attack.
The lateral penetration protection method according to claim 6, wherein the step of invoking an operation interface process function to identify the attack type of the penetration attack when a penetration attack is detected, specifically includes:

When the penetration attack is detected, obtain the interface output parameter corresponding to the penetration attack;

calling the operation interface process function, and extracting interface process information from the interface output parameter through the operation interface process function;

Identify the attack type of the penetration attack according to the interface process information.
The lateral penetration protection method according to claim 1, wherein the step of identifying the attack type of the penetration attack when the penetration attack is detected, specifically comprises:

When the penetration attack is detected, the desktop process function is called to identify the attack type of the penetration attack.
The lateral penetration protection method according to claim 8, wherein the step of invoking a desktop process function to identify the attack type of the penetration attack when a penetration attack is detected, specifically includes:

When the penetration attack is detected, obtain the remote desktop control behavior function corresponding to the penetration attack;

Call the desktop process function, and HOOK the remote desktop control behavior function according to the desktop process function to obtain the operation function and the communication function of the remote desktop control behavior function;

The attack type of the penetration attack is identified according to the operation function and the communication function.
The lateral penetration protection method according to any one of claims 1 to 9, wherein the step of determining attack information according to the attack type specifically includes:

Determine the attack source IP according to the attack type;

Obtain the attack instruction corresponding to the attack source IP through a preset mapping relationship;

The attack information is determined according to the attack type, the attack source IP and the attack instruction.
The lateral penetration protection method according to claim 10, wherein the step of judging whether the attack information is a lateral penetration attack according to a preset engine determination policy specifically includes:

Extracting attack event data packets from the attack information according to a preset engine determination strategy;

Process the attack event data packets through a clustering algorithm to obtain attack mode information;

Whether the attack information is a lateral penetration attack is determined according to the attack mode information.
The lateral penetration protection method according to claim 10, wherein the step of judging whether the attack information is a lateral penetration attack according to a preset engine determination policy specifically includes:

Extracting attack event data packets from the attack information according to a preset engine determination strategy;

Process the attack event data packets through a clustering algorithm to obtain attack mode information;

Analyze the attack mode information according to the time series, and obtain the restoration attack scene information;

constructing a target attack chain according to the restoration attack scenario information and the attack information;

According to the attack mode information and the target attack chain, the host intrusion prevention system determines whether the attack information is a lateral penetration attack.
The lateral penetration protection method according to claim 10, wherein the step of judging whether the attack information is a lateral penetration attack according to a preset engine determination policy specifically includes:

Extracting attack event data packets from the attack information according to a preset engine determination strategy;

Process the attack event data packets through a clustering algorithm to obtain attack mode information;

Perform data analysis on the attack mode information according to cloud rules to obtain cloud analysis information;

Whether the attack information is a lateral penetration attack is determined according to the attack mode information and the cloud analysis information.
The lateral penetration protection method according to any one of claims 1 to 13, wherein, when the attack information is a lateral penetration attack, the step of blocking the lateral penetration attack specifically includes:

When the attack information is a lateral penetration attack, determine whether the lateral penetration attack is a target lateral penetration attack;

When the lateral penetration attack is the target lateral penetration attack, blocking the target lateral penetration attack according to a preset attack blocking method;

When the lateral penetration attack is not the target lateral penetration attack, the lateral penetration attack is blocked according to the host intrusion prevention system.
The lateral penetration protection method according to any one of claims 1 to 13, wherein, when the attack information is a lateral penetration attack, after the step of blocking the lateral penetration attack, the method further comprises:

generating an attack log file according to the lateral penetration attack;

analyze the attack log file to generate an analysis report;

The analysis report is displayed.
A lateral penetration protection device, wherein the lateral penetration protection device comprises:

an identification module, used for identifying the attack type of the penetration attack when the penetration attack is detected;

a determining module, configured to determine attack information according to the attack type;

a judgment module, configured to judge whether the attack information is a lateral penetration attack according to a preset engine judgment strategy;

An execution module, configured to block the lateral penetration attack when the attack information is a lateral penetration attack.
The lateral penetration protection device according to claim 16, wherein the identifying module is further configured to call a service process function to identify the attack type of the penetration attack when the penetration attack is detected.
The lateral penetration protection device according to claim 17, wherein the identification module is further configured to modify the pointer address in the system call table when the penetration attack is detected, so that the pointer address points to the service process function;

The identification module is further configured to call the service process function through the pointer address, and determine the service process information corresponding to the penetration attack through the service process function;

The identifying module is further configured to identify the attack type of the penetration attack according to the service process information.
A lateral penetration protection device, wherein the lateral penetration protection device includes: a memory, a processor, and a lateral penetration protection program stored on the memory and executable on the processor, the lateral penetration protection program configured There are steps to implement a lateral penetration protection method as claimed in any one of claims 1 to 15.
A storage medium, wherein a lateral penetration protection program is stored on the storage medium, and when the lateral penetration protection program is executed by a processor, the steps of the lateral penetration protection method according to any one of claims 1 to 15 are implemented .