TW202213142A - System and method for information security protection and computer readable medium - Google Patents

Abstract

A system and a corresponding method for information security protection are provided. The system includes a plurality of behavior collection modules and a behavior analysis module. Each of the behavior collection modules is respectively installed on a corresponding terminal device. The protection modes of each terminal device includes at least a user mode. Each behavior collection module is configured to detect and collect behavior information of each process executed by the corresponding terminal device in the user mode. The behavior analysis module is configured to determine whether an abnormal behavior occurs in each terminal device according to the behavior information collected by the behavior collection modules, and record the abnormal behavior and sends an alert when the abnormal behavior occurs. The present invention further provides a computer-readable medium for performing the method for information security protection.

Description

Information security protection system, method and computer readable medium

The present invention relates to information security protection, and in particular, to an information security protection system and method.

With the prosperity of open source software, while enjoying the convenience of open source software, it will also face various information security loopholes. The open software loopholes can still be exploited by hackers for a few years. The reason may be that maintenance personnel cannot Determine whether a software security update affects operation, or whether the cost of a version update is worth it. Therefore, how to effectively track down vulnerabilities and possible intrusions is a great challenge.

In the prior art, static code scanning (also known as white box scanning) is performed on all files in the host to check which programs have vulnerabilities, which is a method of tracking vulnerabilities and intrusions, but such scanning and identification will consume a lot of time , especially for service hosts that store a large amount of data, scanning the entire file system is more effective. Therefore, there is a need for a technique to track vulnerabilities and possible intrusions efficiently, quickly, and accurately, while consuming less time and resources.

In order to solve the above problems, the present invention provides an information security protection system, which includes a plurality of behavior collection modules and a behavior analysis module. Each of the behavior collection modules is installed with a corresponding endpoint device, wherein the protection mode of each endpoint device has at least a user mode, and each behavior collection module is used for detecting and collecting corresponding information in the user mode. The behavior information of each program executed by the endpoint device. The behavior analysis module is used to determine whether each of the endpoint devices has abnormal behavior according to the behavior information collected by the behavior collection module, so as to record the abnormal behavior and issue an alarm when the abnormal behavior occurs.

The present invention further provides an information security protection method, comprising: detecting and collecting behavior information of each program executed by each of the end-point devices in a user mode of each of the end-point devices; The behavior information determines whether each of the endpoint devices has abnormal behavior; and when the abnormal behavior occurs, records the abnormal behavior and issues an alarm.

The present invention further provides a computer-readable medium, which is applied to a computing device or a computer and stores instructions for executing the above-mentioned information security protection method.

The present invention continuously collects the execution program in each endpoint device and its related behavior information in the user mode, and transmits it to the behavior analysis module in the cloud for centralized analysis, so as to provide lightweight monitoring of abnormal execution behavior. In addition, the present invention can also compare the vulnerability information with the program behavior information recorded in the past to check whether the vulnerable program is or has been executed, and then effectively identify the running state of the vulnerable program, thereby judging the real information security risk.

100: Information Security Protection System

110: Behavior Collection Module

115: Endpoint device

120: Behavior Analysis Module

122: Behavioural Benchmarking Module

124: Abnormal behavior judgment module

130: Vulnerability Analysis Module

140: Vulnerability Information Database

S210~S270: Method steps

S310~S370: method steps

S410~S460: method steps

FIG. 1 is a block diagram of an information security protection system according to an embodiment of the present invention.

2 to 4 are flowcharts of an information security protection method according to an embodiment of the present invention.

The embodiments of the present invention are described below by means of specific embodiments, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification.

FIG. 1 is a block diagram of an information security protection system 100 according to an embodiment of the present invention. The information security protection system 100 includes a plurality of behavior collection modules 110 , a behavior analysis module 120 and a vulnerability analysis module 130 . Each of the behavior collection modules 110 is installed on each of the endpoint devices 115 respectively. The endpoint device 115 can be any electronic device capable of executing programs, such as a server, a computer, or an Internet of Things device. The protection modes of each of the endpoint devices 115 include a kernel mode (or ring 0) and a user mode (user mode, or ring 3). Each of the behavior collection modules 110 is used to detect and collect behavior information of each program executed by the corresponding endpoint device 115 in the user mode, and transmit the behavior information to the behavior analysis module 120 in the cloud for centralization analyze.

In one embodiment, the behavior collection module 110 monitors the changes of the virtual file system of the endpoint device 115 in a very lightweight manner for subsequent operations, so it is effective and consumes little power consumption, and can be applied to different operations. capable machine or equipment.

For example, the endpoint device 115 uses Linux as the operating system, and the behavior collection module 110 monitors the changes of its virtual file system in user mode to detect whether a new program is executed, and detects and collects the new program when the new program is executed. The behavior information during execution is sent to the behavior analysis module 120 . In one embodiment, the behavior information may include a process identifier of the new program. ID), parent process ID, program name (such as the name of the executable file of the new program), the complete command to execute the new program (including the execution command and execution parameters), the file loaded or executed by the new program The file and its file type (such as executable file or shared library) and the hash value of the file content, the file descriptor used by the new program and the corresponding file information, the file used by the new program ( Such as read and write files) and the hash value of the file content, as well as the service ports of various communication protocols opened by the new program, such as Transmission Control Protocol (TCP) and User Datagram Protocol (User Datagram Protocol, UDP) service port, wherein the hash value can be generated by any known algorithm, such as Secure Hash Algorithm 1 (SHA-1).

In another embodiment, the endpoint device 115 can execute other kinds of operating systems, and the above-mentioned virtual file systems can be replaced with other kinds of file systems.

The behavior analysis module 120 is used to receive and record the behavior information sent by the behavior collection module 110, and determine whether each of the endpoint devices 115 has abnormal behavior according to the behavior information, so as to record the abnormal behavior and record the abnormal behavior when the abnormal behavior occurs. Send out a warning.

The vulnerability analysis module 130 is configured to receive vulnerability information from the vulnerability information database 140 and compare the vulnerability information with the behavior information recorded by the behavior analysis module 120 to determine whether the endpoint device 115 has the vulnerability information. The vulnerable program in the fund is being executed or has been executed, and an alert is issued when the vulnerable program is executing or has been executed.

In this embodiment, the vulnerability information database 140 is an external database independent of the information security protection system 100 . In another embodiment, the vulnerability information database 140 may be an internal database subordinate to the information security protection system 100 .

The behavior collection module 110 , the behavior analysis module 120 and the vulnerability analysis module 130 can all be software, hardware or firmware; if they are hardware, they can be processing units, processors, computers with data processing and computing capabilities or server; in the case of software or firmware, it may include instructions executable by a processing unit, processor, computer or server.

In one embodiment, the behavior analysis module 120, the vulnerability analysis module 130, and the vulnerability information database 140 may be installed on or implemented as the same hardware or as a plurality of discrete hardware.

The behavior analysis module 120 includes a behavior benchmark establishing module 122 and a behavior abnormality judging module 124 . When the behavior analysis module 120 receives the behavior information from the behavior collection module 110, it will record the behavior information, and check whether the endpoint device 115 that generates the behavior information has completed the behavior benchmark establishment by the behavior benchmark establishment module 122; If not completed, the endpoint device 115 is a newly added new endpoint device, and the behavior benchmark establishing module 122 executes the process of FIG. 2 to establish a behavior benchmark for the new endpoint device 115 according to the behavior information; if completed, then The endpoint device 115 is a known endpoint device that has been added, and the abnormal behavior determination module 124 executes the process of FIG. 3 to determine whether the known endpoint device 115 has an abnormal behavior according to the behavior information.

FIG. 2 is a flowchart of an information security protection method according to an embodiment of the present invention, and its description is as follows:

In step S210, the behavior collection module 110 continuously detects and collects behavior information of the programs executed by the new endpoint device 115, and then proceeds to step S220.

In step S220 , the behavior collecting module 110 transmits the behavior information to the behavior benchmark establishing module 122 , and then proceeds to step S230 , wherein the subsequent steps S230 to S270 are all executed by the behavior benchmark establishing module 122 .

In step S230 , the behavior benchmark establishing module 122 removes the received behavior information from the list of trusted programs (also referred to as program whitelist), the malicious program list (also referred to as program blacklist), and the analysis endpoint device 115 The known behavior types (eg, known normal behavior and known abnormal behavior) obtained from behavior information of other endpoint devices 115 other than the new endpoint device 115 are compared to classify the behavior information as all endpoint devices 115 common baseline, autonomous behavior of the new endpoint device 115, or anomalous behavior.

In one embodiment, the list of trusted programs may include, for example, programs included in the operating system and programs of well-known application software, and the list of malicious programs may include known malicious programs such as virus programs, Trojan horse programs, and kidnapping programs.

In detail, if the trusted program list includes the program corresponding to the behavior information, or the behavior information conforms to the known normal behavior, the behavior benchmark establishing module 122 classifies the behavior information as all endpoint devices 115 . A common benchmark is added, and all or part of the behavior information is added to the common benchmark in step S240. On the contrary, if the malicious program list includes the program corresponding to the behavior information, or the behavior information conforms to the known abnormal behavior, the behavior benchmark establishing module 122 classifies the behavior information as abnormal behavior, and records the behavior information in step S260. abnormal behavior, and issue an alarm to notify the management or maintenance personnel of the information security protection system 100, wherein the step of recording the abnormal behavior includes recording the behavior information and the activation time of the program corresponding to the behavior information.

On the other hand, if neither the trusted program list nor the malicious program list includes the program corresponding to the behavior information, and the behavior information does not conform to the known normal behavior or the known abnormal behavior, for example, only the The procedure to be executed by the new endpoint device 115, the behavior benchmark establishing module 122 classifies the behavior information as an autonomous behavior unique to the new endpoint device 115, and notifies the administrator of the information security protection system 100 or the information security protection system 100 in step S250. Maintenance personnel, for the personnel to determine whether the behavior information is It is a normal behavior; if the person is determined to be an abnormal behavior, the process goes to step S260; if the person is determined to be a normal behavior, the behavior benchmark establishing module 122 adds all or part of the behavior information to the new endpoint in step S270 Autonomous behavior specific to device 115.

The behavior benchmark establishing module 122 will continue to execute the process of FIG. 2 for the new endpoint device 115, and continuously observe the regularity of the program execution of the new endpoint device 115. If a predetermined period of time has elapsed, the new endpoint device 115 will execute the program. If the rule does not change, the behavior benchmark establishing module 122 determines that the new endpoint device 115 has completed the behavior benchmark establishment, and stops executing the process of FIG. 2 for the new endpoint device 115 .

FIG. 3 is a flowchart of an information security protection method according to an embodiment of the present invention, and its description is as follows:

In step S310, the behavior collection module 110 continuously detects and collects behavior information of the programs executed by the known endpoint device 115, and then proceeds to step S320.

In step S320 , the behavior collection module 110 transmits the behavior information to the abnormal behavior judgment module 124 , and then proceeds to step S330 , wherein the subsequent steps S330 to S370 are executed by the abnormal behavior judgment module 124 .

In step S330, the abnormal behavior judgment module 124 receives the behavior information, and then judges whether the behavior information is normal according to the common benchmark previously established by the behavior benchmark establishment module 122 and the autonomous behavior of the known endpoint device 115 that generates the behavior information Behavior.

Step S330 includes at least one condition. The behavior abnormality determination module 124 compares the received behavior information with the common benchmark and the autonomous behavior in step S330 to determine whether the behavior information meets the above conditions; if the behavior information meets each If a condition is met, the behavior information is a normal behavior, and the process ends; if the behavior information does not meet any of the conditions, the process proceeds to step S340.

For example, since attackers often implant malicious control programs after intrusion, executing unknown programs is a high-risk behavior. Therefore, one of the above conditions is that the program name in the behavior information must be the same as the program name that has been added to the common benchmark or the autonomous behavior. At least one behavioral information is the same.

In addition, the attacker may not implant a new program, but change the execution command to cause the mutation of normal behavior, so as to achieve the purpose of malicious control. For example, an endpoint device uses the Netcat network management tool to execute the command "'nc' 'target machine' 'target service port'" originally used to determine whether the service of the terminal device is normal, but if the attacker executes "'nc' ' -1' 'specific service port'" becomes the abnormal behavior of the victim terminal device opening services that can be accessed externally or externally transmitting data. Therefore, one of the above conditions is that the execution instructions and execution parameters of the program corresponding to the behavior information must be completely consistent with at least one behavior information that has been added to the common benchmark or the autonomous behavior.

Similarly, in order to prevent the original normal program's execution file from being tampered with by an attacker or loading additional unknown programs, one of the above conditions is that the file loaded or executed by the program corresponding to the behavior information and its hash value must be the same as the one that has been added. At least one behavior information in the common benchmark or the autonomous behavior is completely consistent. If the hash value is inconsistent, it means that the corresponding file has been tampered with, and there may be an information security loophole.

In addition, one of the above conditions is that the service port opened by the program corresponding to the behavior information and its corresponding communication protocol must be completely consistent with at least one behavior information that has been added to the common benchmark or the autonomous behavior. If there is any inconsistency, it means that the program has a newly opened or changed service port, which may be a back door that can be remotely controlled.

Furthermore, one of the above conditions is that the program tree relationship loaded or executed by the program corresponding to the behavior information must have the same program tree relationship in the common benchmark or the autonomous behavior. The abnormal behavior judging module 124 can be based on the association between the program identifier and the parent program identifier in the behavior information, to check whether the received behavioral information meets this condition. For example, the abnormal behavior judging module 124 analyzes that the new program Telnet of a certain endpoint device 115 is loaded and executed through the bash program through the association of the above identification codes, and the bash program is loaded and executed by the Apache ActiveMQ program. Although the common benchmark includes the behavior information of Apache ActiveMQ executing bash and the behavior information of bash executing Telnet, it does not include the behavior information of Apache ActiveMQ executing bash and then executing Telnet, so the abnormal behavior judgment module 124 uses the new program Telnet as the behavior information. The behavior information is judged as abnormal behavior.

The present invention is not limited to the above-mentioned conditions. In another embodiment, some of the above conditions may be omitted. Alternatively, in yet another embodiment, more conditions may be defined according to the content of the program's behavior information.

Next, in step S340, the abnormal behavior determination module 124 checks whether there is any behavior information similar to the behavior information determined by the abnormal behavior determination module 124 in step S330 in the behavior information of other endpoint devices 115 recorded by the behavior analysis module 120. And the behavior information that has been judged to be normal behavior; if there is, the process ends; if not, the process goes to step S350. The other endpoint devices 115 mentioned above are all endpoint devices 115 except the known endpoint device 115 that generates the behavior information determined in step S330. The above "similar" means that in the two behavior information, the program names, execution instructions and execution parameters involved in all the above conditions in step S330 are the same.

In step S350, the behavior abnormality judging module 124 checks whether the behavior information of the other endpoint devices 115 recorded by the behavior analysis module 120 is similar to the behavior information judged by the behavior abnormality judging module 124 in step S330 and has been Behavior information judged to be abnormal behavior; if there is, the process goes to step S370; if not, the process goes to step S360.

In step S360, the abnormal behavior determination module 124 notifies the management personnel or maintenance personnel of the information security protection system 100 for the personnel to determine whether the behavior information is a normal behavior; If the employee determines that the behavior is abnormal, the process proceeds to step S370; if the employee determines that the behavior is normal, the process ends. In step S370, the behavior abnormality determination module 124 determines that the behavior information is abnormal behavior, so records the abnormal behavior, and issues an alarm to notify the management personnel or maintenance personnel of the information security protection system 100.

FIG. 4 is a flowchart of an information security protection method executed by the vulnerability analysis module 130 of FIG. 1 .

In step S410 , the vulnerability analysis module 130 receives the latest vulnerability information from the vulnerability information database 140 . The vulnerability analysis module 130 can analyze the vulnerability information to confirm the hash value of the version, the program name and the file of the program that will generate the information security vulnerability (hereinafter referred to as the vulnerability program). For example, the vulnerability information number received by the vulnerability analysis module 130 from the vulnerability information database 140 is CVE-2019-17571. After analyzing the vulnerability information, the vulnerability analysis module 130 learns that Apache Log4j versions 1.2 to 1.2.17 It is a vulnerability program, which can be remotely controlled to execute arbitrary code, and the vulnerability analysis module 130 can obtain the hash value of the Apache Log4j file with information security vulnerabilities from the vulnerability information, such as the executable file of Apache Log4j version 1.2.17 The hash value is "5af35056b4d257e4b64b9e8069c0746e8b08629f", and the hash value of the executable file of version 1.2.16 is "0278c9d0ae02132ab6d00e709926c227022e85a4", and so on, and then proceeds to step S420.

In step S420, the vulnerability analysis module 130 obtains the behavior information recorded by the behavior analysis module 120, and then proceeds to step S430.

In step S430, the vulnerability analysis module 130 compares the file hash value of the vulnerability program with the hash value of the files loaded or executed by all the programs that have been or are running in the behavior information recorded by the behavior analysis module 120 to determine Whether a vulnerable program is being executed or has been Execute; if no vulnerable program is being executed or has been executed, the flow returns to step S420 to continuously track whether the new endpoint device or the newly executed program has an information security vulnerability; if any vulnerable program is being executed or has been executed, the flow enters Step S440.

In step S440, the vulnerability analysis module 130 determines whether the vulnerability program has opened external services, such as whether it has opened external services through a TCP or UDP service port, according to the behavior information recorded by the behavior analysis module 120, and then proceeds to step S450.

In step S450 , the vulnerability analysis module 130 determines whether the vulnerability program is related to the abnormal behavior recorded by the abnormal behavior determination module 124 . Taking the abnormal execution relationship between Apache ActiveMQ and Telnet and the vulnerability information CVE-2019-17571 as an example, the vulnerability analysis module 130 compares the vulnerability information CVE-2019-17571 with the abnormal behavior, and it can be found that Apache ActiveMQ has been opened to the outside world. The service used the vulnerability program Apache Log4j and exhibited abnormal behavior. Based on this, it can be judged that the attacker may have used the CVE-2019-17571 vulnerability to conduct a zero-day attack and opened the Telnet service as a backdoor to facilitate future survival. Take control, and then proceed to step S460.

In step S460, the vulnerability analysis module 130 issues an alarm to notify the management or maintenance personnel of the information security protection system 100. The content of the alarm may include relevant information of the vulnerability program, and the execution status of the vulnerability program (being executed or previously executed). ), the endpoint device 115 executing the vulnerable program and the program, whether the vulnerable program has opened external services, and whether the vulnerable program is related to abnormal behavior.

In addition, the present invention also discloses a computer-readable medium, which is applied to a computing device or computer having a processor (eg, CPU, GPU, etc.) and/or memory, and stores instructions, and can utilize the computing device or computer. The computer executes the computer-readable medium through a processor and/or a memory, so as to execute the above-mentioned methods and steps when executing the computer-readable medium.

To sum up, the present invention can continuously collect the execution program and its behavior information in each endpoint device, and transmit it to the cloud for centralized analysis, so as to monitor whether abnormal behavior occurs and grasp the real-time execution status. When the newly disclosed vulnerability information is received, the present invention can also analyze the vulnerability information and compare the behavior information recorded in the past to check whether a vulnerable program is being executed or has been executed, so it can effectively identify the running state of the vulnerable program to determine Real information security risks and reduce information security management costs. The present invention can also backtrack after the vulnerability is disclosed through the abnormal behaviors recorded previously, so as to reveal the zero-day attack that occurred previously.

The present invention performs monitoring in user mode, and only monitors newly executed programs. If the vulnerable program has not been executed, there is no need to analyze and track the exact location of the vulnerability. Therefore, the monitoring of the present invention is very lightweight, and is suitable for endpoint devices. The burden is extremely small, and it can effectively reduce the cost of monitoring loopholes. For example, in the end-point device environment test with a quad-core processor and 1GB memory, the present invention monitors the changes of the virtual file system and judges whether there is a new program in only 0.00015 seconds. Compared with the same clean environment, Hello World written in C language The average single execution time of the program is 0.0032 seconds. It can be seen that the monitoring of the present invention is not only effective, but also has little performance loss, and can also be applied to devices or equipment with different computing capabilities. Compared with performing white box scanning on all files in the endpoint device to search for information security vulnerabilities, the present invention can more accurately and efficiently find out which vulnerable programs are at risk of being executed.

The above-mentioned embodiments are only used to illustrate the principle and effect of the present invention, but are not intended to limit the present invention. Anyone with ordinary knowledge in the technical field can modify and change the above-mentioned embodiments without departing from the spirit and scope of the present invention. Therefore, the protection scope of the present invention should be as listed in the patent application scope described later.

100: Information Security Protection System

110: Behavior Collection Module

115: Endpoint device

120: Behavior Analysis Module

122: Behavioural Benchmarking Module

124: Abnormal behavior judgment module

130: Vulnerability Analysis Module

140: Vulnerability Information Database

Claims (12)

An information security protection system, comprising: A plurality of behavior collection modules, each installed in a corresponding endpoint device, wherein the protection mode of each endpoint device has at least a user mode, and each behavior collection module is used for detecting and collecting data in the user mode Corresponding behavior information for each program executed by the endpoint device; and The behavior analysis module is used for judging whether each of the endpoint devices has abnormal behavior according to the behavior information collected by the behavior collection module, so as to record the abnormal behavior and issue an alarm when the abnormal behavior occurs. The information security protection system according to claim 1, wherein the behavior analysis module includes: The behavioral benchmark establishes a sub-module for when a new endpoint device is newly added to the endpoint device, the behavior information of the new endpoint device and the list of trusted programs and malicious programs, and analyzing the endpoints Compare the known behavior types obtained from the behavior information of other endpoint devices in the device except the new endpoint device, so as to classify the behavior information of the new endpoint device as the common benchmark of these endpoint devices , the autonomous behavior or abnormal behavior of the new endpoint device, so as to record the abnormal behavior and issue an alarm when the abnormal behavior occurs. The information security protection system according to claim 2, wherein the behavior analysis module further comprises: An abnormal behavior judgment sub-module, after the new endpoint device is added to the endpoint devices, according to the common benchmark, the autonomous behavior of the new endpoint device, and the endpoint devices other than the new endpoint device Similar behavior information of other end-point devices is used to determine whether the behavior information is normal behavior or the abnormal behavior, so as to record the abnormal behavior and issue an alarm when the abnormal behavior occurs. The information security protection system as described in claim 1, further includes: The vulnerability analysis module is used to receive vulnerability information and compare the vulnerability information with the behavior information to determine whether the vulnerable program in the vulnerability information is being executed or has been executed in the endpoint devices, To alert when the vulnerable program is executing or has been executed. The information security protection system according to claim 4, wherein the vulnerability analysis module is reused to determine whether the vulnerable program has opened external services according to the behavior information, so as to include the result of the determination in the alert. The information security protection system according to claim 4, wherein the vulnerability analysis module is reused to determine whether the vulnerability program is related to the abnormal behavior recorded by the behavior analysis module, so as to include the judgment result in the on alert. An information security protection method, comprising: Detecting and collecting behavior information of each program executed by each of the endpoint devices using the user mode of each of the endpoint devices; Determine whether each of the endpoint devices has abnormal behavior according to the behavior information; and When the abnormal behavior occurs, the abnormal behavior is recorded and an alarm is issued. The information security protection method according to claim 7, wherein the step of judging whether each of the endpoint devices has the abnormal behavior according to the behavior information includes: When a new endpoint device is newly added to the endpoint devices, the behavior information of the new endpoint device and the list of trusted programs and malicious programs, and analyze the endpoint devices other than the new endpoint device. Compare the known behavior types obtained from the behavior information of the other endpoint devices to classify the behavior information of the new endpoint device as the common benchmark of the endpoint devices, the autonomous behavior or abnormality of the new endpoint device Behavior. The information security protection method according to claim 8, wherein the step of judging whether each of the endpoint devices has the abnormal behavior according to the behavior information further comprises: After the new end-point device is added to the end-point device, according to the common benchmark, the autonomous behavior of the new end-point device, and the similar behavior information of other end-point devices in the end-point device, determine that the behavior information is a normal behavior or the abnormal behavior. The information security protection method as described in claim 7, further includes: receive vulnerability information; Compare the vulnerability information with the behavior information to determine whether the vulnerable program in the vulnerability information is executing or has been executed on the endpoint devices; and Alerts when the vulnerable program is executing or has been executed. The information security protection method as described in claim 10 further includes: According to the behavior information, determine whether the vulnerable program has opened external services, so as to include the judgment result in the alert, or determine whether the vulnerable program is related to the abnormal behavior recorded by the behavior analysis module, so as to identify whether the vulnerable program is related to the abnormal behavior recorded by the behavior analysis module. The result of this judgment is included in the alert. A computer-readable medium, applied in a computing device or a computer, stores instructions for executing the information security protection method described in any one of claims 7 to 11.

Images