CN111641589A - Advanced sustainable threat detection method, system, computer and storage medium - Google Patents

Abstract

The invention discloses an advanced sustainable threat detection method, system, computer and storage medium. The detection method includes: analyzing the traffic of an operator's backbone network and restoring files transmitted in the backbone network; Perform filtering to filter out normal traffic and files; detect the filtered files; detect intrusion attack traffic in the backbone network; process the detection results, and intercept and block the corresponding intrusion attack traffic; The detected attacks are recorded in logs; the recorded logs are displayed for evidence collection and source tracing of subsequent advanced sustainable threat attacks. The above method can detect Advanced Persistent Threat (APT) attacks in multiple directions, provide operators with strong data support for APT detection and provide detailed traceability information, and at the same time can block network attacks to ensure interests of users.

Description

Advanced sustainable threat detection method, system, computer, and storage medium

technical field

Embodiments of the present invention relate to computer network security technologies, and in particular, to an advanced sustainable threat detection method, system, computer and storage medium.

Background technique

Advanced Persistent Threat (ATP) attacks are usually dormant for a long time after infiltrating the inside of the network, using the personnel inside the organization as an attack springboard, constantly trying various attack methods, and constantly collecting various information until important intelligence is collected. The intent of APT attacks is to steal data, not to cause damage to the network.

At present, the protection against APT is generally to detect traffic, behaviors or files at the gateway of the LAN network exit, and generally requires the network firewall to have this related function. As the key node of the network, the operator is completely unaware of the APT attack in the network. At the same time, if such a phenomenon occurs in the network, the subsequent operator cannot block, trace the source of the attack in the network, and cannot find the network. The real culprit of the attack.

SUMMARY OF THE INVENTION

Based on this, in view of the above technical problems, the present invention provides an advanced sustainable threat detection method, system, computer and storage medium, which can trace the APT attack in the source network by monitoring the traffic of the backbone network and find out the real culprit of the network attack.

In a first aspect, an embodiment of the present invention provides an advanced sustainable threat detection method, including:

Analyze the traffic of the operator's backbone network and restore the files transmitted in the backbone network;

Filter the traffic in the backbone network to filter out normal traffic and files;

Check the filtered files;

Detect the intrusion attack traffic in the backbone network;

The detection results are processed, and the corresponding intrusion attack traffic is intercepted and blocked;

Log the detected attacks;

The recorded logs are displayed for evidence collection and source tracing of subsequent advanced sustainable threat attacks.

The above-mentioned advanced sustainable threat detection method can detect APT attacks in multiple directions, provide operators with strong data support for APT detection and provide detailed traceability information, and at the same time can block network attacks to protect the interests of users.

In one embodiment, the step of filtering traffic in the backbone network to filter out normal traffic and files includes:

Obtain identification information of normal traffic and files;

Generate the mapping library of the identification information according to the bloom filter algorithm;

The mapping library is used to match the traffic, and the traffic containing the normal identification information is filtered out.

In one embodiment, the identification information includes at least one of IP information, URL information, DNS information and MD5 information.

In one of the embodiments, the step of detecting the filtered file includes:

Initialize the scan engine library;

Create a scan engine;

Load virus database;

Compile the scan engine;

Initialize file monitoring and monitor filtered file paths;

adding the newly written file in the file path to the monitoring queue;

The files in the monitoring queue are scanned by means of hyperscan.

In one embodiment, the step of detecting the intrusion attack traffic in the backbone network includes:

Load the intrusion detection rule base;

Compile intrusion detection rules and establish rule mapping relationships;

Use hyperscan to scan traffic and output scan results.

In a second aspect, an embodiment of the present invention also provides an advanced sustainable threat detection system, including:

The analysis and restoration module is used to analyze the traffic of the operator's backbone network and restore the files transmitted in the backbone network;

The information filtering module is used to filter the traffic in the backbone network to filter out the normal traffic and files;

a file detection module for detecting the files filtered by the information filtering module;

The attack detection module is used to detect the intrusion attack traffic in the backbone network;

an interception and blocking module, configured to process the detection results of the file detection module and the attack detection module, and to intercept and block the corresponding intrusion attack traffic;

The logging module is used to log the detected attacks;

The log display module is used to display the recorded logs for subsequent evidence collection and traceability of advanced sustainable threat attacks.

The above-mentioned advanced sustainable threat detection system can detect APT attacks in multiple directions, provide operators with strong data support for APT detection and provide detailed traceability information, and can block network attacks to protect the interests of users.

In one embodiment, the analysis and restoration module has operator-level processing capabilities, and uses a dpdk development kit to complete network traffic processing.

In one embodiment, the file detection module adopts a multi-thread model, wherein one thread monitors the path for generating the file and writes it to the monitoring queue in real time, and the other threads acquire files from the monitoring queue in real time for scanning.

In a third aspect, an embodiment of the present invention further provides a computer device, including a memory, a processor, and a computer program stored in the memory and running on the processor, the processor implementing the above-mentioned program when executing the program advanced sustainable threat detection methods.

In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, implements the above-mentioned advanced sustainable threat detection method.

Description of drawings

1 is a schematic flowchart of an advanced sustainable threat detection method in one embodiment;

2 is a schematic flowchart of steps in an embodiment of filtering the traffic in the backbone network to filter out normal traffic and files;

Fig. 3 is a schematic flow chart of the step of detecting the filtered file in one embodiment;

4 is a schematic flowchart of steps in an embodiment of detecting intrusion attack traffic in a backbone network;

FIG. 5 is a schematic diagram of the architecture of an advanced persistent threat detection system in one embodiment.

Detailed ways

The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention. In addition, it should be noted that, for the convenience of description, the drawings only show some but not all structures related to the present invention.

FIG. 1 is a schematic flowchart of an advanced sustainable threat detection method in an embodiment. As shown in FIG. 1 , in an embodiment, the embodiment of the present application is used for a network security device, and an advanced sustainable threat detection method includes: Follow the steps below:

Step 110: Analyze the traffic of the operator's backbone network and restore the files transmitted in the backbone network.

Specifically, after the network traffic of the backbone network received by the device, the first step of analyzing the network traffic is required to restore the files transmitted in the network, so as to obtain relevant information to be detected later. Sure.

Step S120: Filter the traffic in the backbone network to filter out normal traffic and files.

Specifically, after analyzing and restoring the traffic of the backbone network, compare and query the traffic and files according to the obtained detection-related information, and the comparison query can be completed by using a bloom filter. and files are filtered out, and then the remaining suspicious traffic and files are detected. Since the trusted traffic and files are no longer detected in the future, the amount of data for subsequent detection and processing can be greatly reduced, and the processing performance of the device can be improved.

Step S130: Detect the filtered file.

Specifically, the filtered suspicious files are detected. Generally, the files transmitted in the network may contain various forms, such as executable program exe files, compressed files rar/zip/gz and packed files, etc. These files can be sequentially Classify, and then perform actions such as decompression or unpacking. Finally, use the hyperscan scanning method to scan the file to obtain the scanning result. The attack file is marked according to the scanning result, otherwise it is not marked.

Step S140: Detect intrusion attack traffic in the backbone network.

Specifically, in addition to suspicious files, it is also necessary to detect the filtered suspicious traffic. Specifically, the hyperscan scanning method can be used to scan the characteristics in the traffic packets and obtain the scanning results. And mark the intrusion attack traffic according to the scan results, otherwise it will not be marked

Step S150: Process the detection result, and intercept and block the corresponding intrusion attack traffic.

Specifically, intercept and block the traffic and files of the advanced persistent threat attack marked after detection to ensure the network security of the local device.

Step S160: Log the detected attack.

Specifically, after interception, it is also necessary to perform log output processing on the marked data stream and write it into the log database. The log information recorded includes but is not limited to time, log level, source address, destination address, protocol type, event name, event type, virus name, file name, APT organization, country and other information.

Step S170 : Display the recorded logs for subsequent evidence collection and source tracing of advanced sustainable threat attacks.

Specifically, on the web side, the interception and blocking information in the log records can be read from the database, so that the same or similar advanced sustainable threat attacks can be prevented based on the blocking and blocking information, and the network security can be continuously improved.

The above-mentioned advanced sustainable threat detection method can detect APT attacks in multiple directions, provide operators with strong data support for APT detection and provide detailed traceability information, and at the same time can block network attacks to protect the interests of users.

FIG. 2 is a schematic flowchart of the above steps in an embodiment of filtering traffic in a backbone network to filter out normal traffic and files. As shown in FIG. 2 , step S120 in this embodiment may specifically include:

Step S121: Acquire identification information of normal traffic and files.

Step S122: Generate a mapping library of normal identification information according to the bloom filter algorithm.

Step S123: Use the mapping library to match the traffic, and filter out the traffic containing normal identification information.

Specifically, first obtain identification information of normal traffic and files. In a preferred embodiment, the identification information includes at least one of IP information, URL information, DNS information, and MD5 information. For example, if the traffic is DNS packets, the DNS information of the DNS packets is mainly obtained; if the traffic is HTTP packets, the URL field information is mainly obtained; if the traffic is other ordinary packets, the IP information is mainly obtained; If the message is a file, restore the file and record the corresponding MD5 information. After obtaining the IP, URL, DNS and MD5 information of the collected normal information, the mapping library of IP, URL, DNS and MD5 information can be generated according to the bloomfilter algorithm, and the mapping library is used to match the traffic in the backbone network, which will contain the normal information. The traffic of IP, URL, DNS, and yijiMD5 information is filtered out, and only suspicious traffic and files remain.

FIG. 3 is a schematic flowchart of the steps in the foregoing embodiment for detecting the filtered files. As shown in FIG. 3 , step S130 in this embodiment may specifically include:

Step S131: initialize the scan engine library;

Step S132: create a scan engine;

Step S133: load the virus database;

Step S134: compiling the scan engine;

Step S135: Initialize file monitoring and monitor the filtered file path;

Step S136: adding the newly written file in the file path to the monitoring queue;

Step S137: Scan the files in the monitoring queue in a hyperscan manner.

Specifically, since the existing file detection method has a relatively large defect in the scanning performance of the file, in order to achieve high-performance file detection, a multi-threading method can be used to realize the thread distinction between the monitoring file and the scanning file, and at the same time Use hyperscan scanning to achieve virus scanning. The main process first initializes the scan engine library for subsequent file scanning interface calls, loads the virus library and compiles the scan engine. Initialize file monitoring and monitor the filtered file path, mainly monitor the file attributes of IN_CLOSE_WRITE. Create a monitoring thread and bind it to a CPU thread. This thread mainly adds the newly written file to the monitoring queue, and then creates a file scanning thread and binds it to other CPU threads. The number of the threads can be based on the actual situation. OK, both are used to process file scanning. The scanning principle can use the hyperscan method to further improve performance, obtain files from the monitoring queue, scan them one by one, and output the scan results.

FIG. 4 is a schematic flowchart of the steps in the foregoing embodiment for detecting intrusion attack traffic in the backbone network. As shown in FIG. 4 , step S140 in this embodiment may specifically include:

Step S141: load the intrusion detection rule base;

Step S142: compiling intrusion detection rules, and establishing a rule mapping relationship;

Step S143: Scan the traffic in a hyperscan manner and output the scan result.

Specifically, since the existing intrusion detection methods also have relatively large defects in performance, in order to achieve high-performance intrusion detection, the hyperscan scanning method can be used instead of the currently popular AC/BM method.

FIG. 5 is a schematic structural diagram of an advanced persistent threat detection system in an embodiment. As shown in FIG. 5 , in an embodiment, an advanced persistent threat detection system 300 includes:

The analysis and restoration module 310 is used to analyze the traffic of the operator's backbone network and restore the files transmitted in the backbone network; the information filtering module 320 is used to filter the traffic in the backbone network to filter out normal traffic and files. The file detection module 330 is used to detect the files filtered by the information filtering module 320; the attack detection module 340 is used to detect the intrusion attack traffic in the backbone network; the interception block module 350 is used to detect the file 330 and the result detected by the attack detection module 350 are processed, and the corresponding intrusion attack traffic is intercepted and blocked; the log recording module 360 is used to log the detected attacks; the log display module 370 is used to record the recorded attacks. The logs are displayed for the forensics and source tracing of subsequent advanced sustainable threat attacks.

Specifically, the analysis and restoration module 310 receives and analyzes the network traffic of the backbone network, restores the files transmitted in the network to obtain relevant information to be detected by subsequent modules, and sends the relevant information to the information filtering module 320 . In a preferred embodiment, the analysis and restoration module 310 has operator-level processing capabilities, and uses a dpdk development kit to complete network traffic processing. The information filtering module 320 can filter the received traffic through the identification information mapping library of normal traffic, and the identification information can specifically include IP information, URL information, DNS information and MD5 information, and filter out the traffic and files of the normal identification information, Suspicious files and traffic are sent to the file detection module 330 and the attack detection module 340, respectively.

The file detection module 330 and the attack detection module 340 respectively detect the received suspicious files and traffic. The specific detection method can be determined according to the actual situation. For example, hyperscan can be used to scan files and traffic packets. In a preferred embodiment, the file detection module 340 adopts a multi-threading model, wherein one thread monitors the path for generating the file and writes it to the monitoring queue in real time, and the other threads acquire files from the monitoring queue in real time for scanning, so that the detection can be effectively improved. efficiency. After the files and traffic are detected, the file detection module 330 and the attack detection module 340 send the detection results to the interception and blocking module 350 .

The interception and blocking module 350 intercepts and blocks the corresponding files and traffic of the advanced persistent threat attack according to the accepted detection, and sends the interception and blocking information to the logging module 360 . The logging module 360 records the interception and blocking information as log information and writes it into the database. The log information may specifically include time, log level, source address, destination address, protocol type, event name, event type, virus name, file name, APT organizations, countries, etc. The log display module 370 can read the intercepted and blocked log information from the database of the log recording module 360 and display it, so as to prevent the same or similar advanced sustainable threat attacks and continuously improve the security of the network.

The above-mentioned advanced sustainable threat detection system 300 can detect APT attacks in multiple directions, provide strong data support for operators to APT detection and provide detailed traceability information, and can block network attacks at the same time to protect the interests of users.

It can be understood that the advanced sustainable threat detection system provided by the embodiment of the present invention can execute the advanced sustainable threat detection method provided by any embodiment of the present invention, and has corresponding functional modules and beneficial effects of the execution method. The units and modules included in the advanced sustainable threat detection system in the above embodiment are only divided according to functional logic, but are not limited to the division in the above embodiment, as long as the corresponding functions can be realized; in addition, each functional unit The specific names are only for the convenience of distinguishing from each other, and are not used to limit the protection scope of the present invention.

In one embodiment, a computer apparatus is provided that includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When running the program, the processor can perform the following steps: analyze the traffic of the operator's backbone network and restore the files transmitted in the backbone network; filter the traffic in the backbone network to filter out normal traffic and files; Detect the filtered files; detect the intrusion attack traffic in the backbone network; process the detection results, intercept and block the corresponding intrusion attack traffic; log the detected attacks; record the recorded logs Display it for forensics and traceability of subsequent advanced persistent threat attacks.

It can be understood that, in the computer device provided by the embodiments of the present invention, the execution of the program stored in the memory by the processor of the computer is not limited to the above-mentioned method operations, and can also execute the high-level sustainable operation provided by any embodiment of the present invention. Related actions in the threat detection method.

Further, the number of processors in the above computer may be one or more, and the processors and the memory may be connected by a bus or in other ways. The memory may mainly include a stored program area and a stored data area, wherein the stored program area may store an operating system and an application program required for at least one function; the stored data area may store data created according to the use of the terminal, and the like. Additionally, the memory may include high speed random access memory, and may also include nonvolatile memory, such as at least one magnetic disk storage device, flash memory device, or other nonvolatile solid state storage device. In some instances, the memory may further include memory located remotely from the processor, and these remote memories may be connected to the device/terminal/server through a network. Examples of such networks include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

In one embodiment, the present invention also provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by the processor, the processor can cause the processor to perform the following steps: to filter the normal traffic and files; to detect the filtered files; to detect the intrusion attack traffic in the backbone network; to process the detection results, and to intercept and block the corresponding intrusion attack traffic ; Log the detected attacks; display the recorded logs for evidence collection and source tracing of subsequent advanced sustainable threat attacks.

It can be understood that, for a computer-readable storage medium containing a computer program provided by the embodiments of the present invention, the computer-executable program of the computer-executable program is not limited to the above-mentioned method operations, and can also execute the methods provided by any embodiment of the present invention. Related actions in advanced sustainable threat detection methods.

From the above description of the embodiments, those skilled in the art can clearly understand that the present invention can be realized by software and necessary general-purpose hardware, and of course can also be realized by hardware, but in many cases the former is a better embodiment . Based on such understanding, the technical solutions of the present invention can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in a computer-readable storage medium, such as a floppy disk of a computer , read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc., including several instructions to make a computer device (which can be a personal computer, A server, or a network device, etc.) executes the methods described in the various embodiments of the present invention.

The technical features of the above-described embodiments can be combined arbitrarily. For the sake of brevity, all possible combinations of the technical features in the above-described embodiments are not described. However, as long as there is no contradiction between the combinations of these technical features, All should be regarded as the scope described in this specification.

The above-mentioned embodiments only represent the preferred embodiments of the present invention and the applied technical principles, and the descriptions thereof are specific and detailed, but should not be construed as limiting the scope of the invention patent. Various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the protection scope of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and can also include more other equivalent embodiments without departing from the concept of the present invention. The scope of protection of a patent is determined by the scope of the appended claims.

Claims (10)

1. An advanced sustainable threat detection method, comprising:

analyzing the flow of a backbone network of an operator and restoring files transmitted in the backbone network;

filtering the flow in the backbone network to filter out normal flow and files;

detecting the filtered file;

detecting intrusion attack flow in a backbone network;

processing the detection result, and intercepting and plugging the corresponding intrusion attack flow;

logging the detected attacks;

and displaying the recorded log for evidence obtaining and tracing of subsequent high-level sustainable threat attack.

2. The method of claim 1, wherein the step of filtering traffic in the backbone network to filter out normal traffic and files comprises:

acquiring identification information of normal flow and files;

generating a mapping library of the identification information according to a bloom filter algorithm;

and matching the mapping library with the flow, and filtering the flow containing the normal identification information.

3. The method of claim 2, wherein the identification information comprises at least one of IP information, URL information, DNS information, and MD5 information.

4. The method of claim 1, wherein the step of detecting the filtered file comprises:

initializing a scanning engine library;

creating a scanning engine;

loading a virus library;

compiling a scanning engine;

initializing file monitoring and monitoring a filtered file path;

adding the newly written file in the file path into a monitoring queue;

and scanning the files in the monitoring queue in a hyperscan mode.

5. The method of claim 1, wherein the step of detecting intrusion attack traffic in the backbone network comprises:

loading an intrusion detection rule base;

compiling an intrusion detection rule and establishing a rule mapping relation;

and scanning the flow in a hyperscan mode and outputting a scanning result.

6. An advanced sustainable threat detection system, comprising:

the analysis and restoration module is used for analyzing the flow of the backbone network of the operator and restoring the files transmitted in the backbone network;

the information filtering module is used for filtering the flow in the backbone network so as to filter the normal flow and files;

the file detection module is used for detecting the file filtered by the information filtering module;

the attack detection module is used for detecting the intrusion attack flow in the backbone network;

the interception and blocking module is used for processing the detection results of the file detection module and the attack detection module and intercepting and blocking corresponding invasion attack flow;

the log recording module is used for carrying out log recording on the detected attack;

and the log display module is used for displaying the recorded logs for evidence obtaining and source tracing of subsequent high-level sustainable threat attacks.

7. The advanced sustainable threat detection system of claim 6, wherein the analytics recovery module has carrier-level processing capabilities and uses a dpdk development kit to perform network traffic processing.

8. The advanced sustainable threat detection system of claim 6, wherein the file detection module employs a multi-thread model, wherein one thread monitors a path of a generated file and writes the path into a monitoring queue in real time, and the remaining threads retrieve the file from the monitoring queue in real time for scanning.

9. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the advanced sustainable threat detection method according to any one of claims 1 to 5 when executing the program.

10. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the advanced sustainable threat detection method as claimed in any one of claims 1 to 5.

Images