WO2016150313A1 - 一种可疑进程的探测方法及装置 - Google Patents

一种可疑进程的探测方法及装置 Download PDF

Info

Publication number
WO2016150313A1
WO2016150313A1 PCT/CN2016/076228 CN2016076228W WO2016150313A1 WO 2016150313 A1 WO2016150313 A1 WO 2016150313A1 CN 2016076228 W CN2016076228 W CN 2016076228W WO 2016150313 A1 WO2016150313 A1 WO 2016150313A1
Authority
WO
WIPO (PCT)
Prior art keywords
application
data
feature
host
detected
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2016/076228
Other languages
English (en)
French (fr)
Inventor
陈艳军
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alibaba Group Holding Ltd
Original Assignee
Alibaba Group Holding Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alibaba Group Holding Ltd filed Critical Alibaba Group Holding Ltd
Priority to US15/559,176 priority Critical patent/US20180075240A1/en
Publication of WO2016150313A1 publication Critical patent/WO2016150313A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00—Commerce
    • G06Q30/06—Buying, selling or leasing transactions
    • G06Q30/0601—Electronic shopping [e-shopping]

Definitions

  • the present application relates to the field of computers, and in particular, to a method and apparatus for detecting a suspicious process.
  • ISV Independent Software Vendors
  • Tmall and Taobao merchants After obtaining the order authorization from Tmall and Taobao merchants, ISV can access the merchants in Tmall and through the TOP. Taobao's sensitive data, such as orders and customer relationships. Any vulnerability in ISV software or cloud resource management may be exploited by cloud backers or applications to deploy backdoors, illegally reading, copying or transmitting such sensitive data, causing large amounts of data leakage.
  • the traditional virus detection method usually designs a defense strategy against the attack behavior of the virus program on the system, and the backdoor program that steals data in the cloud host or application generally aims to acquire data, and does not actively attack the behavior characteristics of the system.
  • the present application provides a method and apparatus for detecting suspicious processes, and aims to solve the problem that a suspicious process in which data is stolen cannot be accurately detected.
  • a method of detecting suspicious processes including:
  • the data flow feature includes at least one of a process list and a network exit feature, and a data source feature, the data source feature is used to indicate a data source of preset type data flowing into the host to be detected, and the process list includes a process of chronologically arranging data flowing out by the data source,
  • the network egress feature is configured to indicate that the data flowing out by the data source flows out of an exit of the host to be detected after being called by a process in the process list;
  • test value of the data source feature is the same as the sample value of the data source feature
  • test value of the process list is different from the sample value of the process list, and/or the network exit feature
  • the test value is different from the sample value of the network exit feature, and it is determined that the suspicious process is detected.
  • the process of establishing the data flow to the library includes:
  • the related to the network event table, the process event table of the to-be-detected host, and the file read/write event table of the to-be-detected host are sequentially obtained.
  • it also includes:
  • the behavior feature includes at least one of the following: an application level The frequency of the data source of the application accessing the preset type of data, the frequency of the external connection of the application, the destination address of the external connection of the application, the port to which the application is externally connected, the user running the application, and the process command of the application Parameters, the running frequency of the application, and the runtime of the application;
  • test value of any one of the behavioral characteristics of any of the applications is not within the preset range of the sample value of the behavior characteristic of the application in the behavior signature database, it is determined that the suspicious process is detected.
  • the method for determining the difference between the test value of the behavior feature and the sample value of the behavior feature in the behavior feature library includes:
  • a distance value between a test value of the item and a sample value of the behavior characteristic of the behavior feature library is calculated.
  • the process of establishing the application behavior library includes:
  • the behavior feature includes a level of the application, and an application accesses data of the preset type of data
  • it also includes:
  • Determining a suspicious process from the process of the host to be detected according to a preset process risk rule where the process risk rule includes: the host to be probe initiates a network connection to itself and the target port of the connection is a remote login end mouth.
  • a detecting device for a suspicious process comprising:
  • a first acquiring module configured to obtain a test value of a data flow direction feature of the host to be detected, and a data flow to a sample value of the data flow direction feature corresponding to the to-be-detected host in the library;
  • the data flow direction feature includes a process list and a network At least one of an exit feature, and a data source feature, the data source feature is used to indicate a data source of preset type data flowing into the host to be probed, and the process list includes chronologically, calling the a process of data flowing out of the data source, where the network egress feature is used to indicate that the data flowing out by the data source flows out of the exit of the host to be detected after being called by the process in the process list;
  • a first determining module configured to: if the test value of the data source feature is the same as the sample value of the data source feature, the test value of the process list is different from the sample value of the process list, and Alternatively, the test value of the network exit feature is different from the sample value of the network exit feature, and it is determined that the suspicious process is detected.
  • it also includes:
  • a data flow to the library establishing module configured to separately establish a data flow direction feature of each data source according to the following manner: determining a network event related to one of the data source features from a pre-acquired network event table of the to-be-detected host; Using the process number and the timestamp of the network event as the search condition, the related to the network event table, the process event table of the to-be-detected host, and the file read/write event table of the to-be-detected host are sequentially obtained.
  • it also includes:
  • a second obtaining module configured to obtain a test value of a behavior characteristic of each application in the host to be detected, and a sample value of a behavior characteristic of the host to be detected in the application behavior library;
  • the behavior feature includes at least one of the following : the level of the application, the frequency of the data source to which the application accesses the preset type of data, the frequency of the external connection of the application, the destination address of the external connection of the application, the port to which the application is externally connected, the user who runs the application, The process command parameters of the application, the running frequency of the application, and the running time of the application;
  • a second determining module configured to determine, if the difference between the test value of any one of the behavior characteristics of any one application and the sample value of the behavior characteristic of the application in the behavior feature database is not within a preset range, A suspicious process was detected.
  • the second determining module is configured to: when the any one of the behavior features is multi-dimensional data, determine a test value of the behavior feature and a sample value of the behavior feature in the behavior feature database.
  • the specific process of the difference includes:
  • the second determining module is specifically configured to calculate a test value of the item and the behavior in the behavior feature database The distance value of the sample value of the sign.
  • it also includes:
  • An application behavior library establishing module configured to acquire behavior characteristics of each application from a pre-acquired network event table and a process event table of the to-be-detected host; the behavior feature includes an application level, and an application accesses the The frequency of the data source of the preset type of data, the frequency of the external connection of the application, the destination address of the external connection of the application, the port to which the application is externally connected, the user running the application, the process command parameters of the application, and the running of the application Frequency and application runtime.
  • it also includes:
  • a third determining module configured to determine a suspicious process from the process of the host to be detected according to a preset process risk rule, where the process risk rule includes: the host to be probe initiates a network connection to the host and the connection The target port is the remote login port.
  • the method and device for detecting a suspicious process according to the present application, the test value of the data flow direction feature of the host to be detected and the sample value of the data flow direction feature corresponding to the host to be detected in the data stream, wherein the data flow feature includes the data source a feature, a process list, and a network exit feature, if the test value of the data source feature is the same as the sample value of the data source feature, the test value of the process list is different from the sample value of the process list or the network exit feature The test value is different from the sample value of the network exit feature, and it is determined that the suspicious process is detected. It can be seen that the suspicious process detection method and device described in the present application detect the suspicious process based on the flow characteristics of the data, rather than the application. The attack behavior, and the flow characteristics of the data change once the data is stolen. Therefore, the suspicious process detection method and apparatus described in the present application can accurately detect the suspicious process in which the data is stolen.
  • FIG. 1 is a flowchart of a method for detecting a suspicious process disclosed in an application embodiment
  • FIG. 2 is a flowchart of still another method for detecting a suspicious process according to an embodiment of the present application
  • FIG. 3 is a flowchart of a method for establishing a data flow library and an application behavior library according to an embodiment of the present application
  • FIG. 4 is a flowchart of a method for collecting event data in a preset time period by using an acquisition client deployed on a host to be detected according to an embodiment of the present disclosure
  • FIG. 5 is a schematic diagram of data flow characteristics of a data source disclosed in an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a detecting device for a suspicious process according to an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of still another detecting device for a suspicious process according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a connection relationship between a detecting device of a suspicious process and a host to be detected according to an embodiment of the present disclosure.
  • the embodiment of the present application discloses a method and a device for detecting a suspicious process, which can be applied to the detection of a suspicious process of a cloud host, so as to be able to accurately discover a suspicious process of stealing data in the cloud host.
  • a method for detecting a suspicious process disclosed in the embodiment of the present application, as shown in FIG. 1, includes the following steps:
  • S101 Acquire a test value of a data flow direction feature of the host to be detected and a sample value of the data flow direction feature corresponding to the data to be detected in the library.
  • the data flow feature may include at least one of a process list and a network exit feature, and a data source feature. That is to say, the data flow feature includes data source features, and may include a process list and a network exit feature, or may include either one. In the case of the process list and the network egress feature, the accuracy of the detection is higher.
  • the data flow feature includes a data source feature, a process list, and a network egress feature as an example.
  • the data source feature is used to indicate a data source of the preset type data flowing into the host to be detected.
  • the process list includes a process in which the data flowing out of the data source is arranged in chronological order, and the network exit feature is used to indicate that the data source flows out. After the data is called by the process in the process list, the data flows out of the exit of the host to be probed.
  • the test value and sample value of the process list can be the name or number of the file contained in the process list.
  • the test value of the process list is different from the sample value, indicating that the progress of the call data has changed.
  • the change may include adding a process, or the process may change according to the time order.
  • the test value and sample value of the data source feature can be the address or port number of the data source, and the network exit feature is measured. Both the trial value and the sample value can be the address or port number of the network exit.
  • test value of the data source feature is the same as the sample value of the data source feature, if the preset condition is met, it is determined that the suspicious process is detected.
  • preset conditions include at least one of the following:
  • test value of the process list is different from the sample value of the process list
  • test value of the network exit feature is different from the sample value of the network exit feature.
  • the above conditions are set to fundamentally discover the data stealing behavior.
  • a suspicious process is a process corresponding to an abnormal feature.
  • the suspicious process can compare the test value of the process list with the sample value, and the process corresponding to the extra name or number is a suspicious process; for the network egress feature, the test sample is different from the sample value.
  • the process of transmitting data outside the probe host through this network exit is a suspicious process.
  • the method described in this embodiment is applied to an e-commerce platform.
  • the preset type data may be sensitive data, such as customer order information.
  • the e-commerce is detected.
  • the data in the cloud host of the platform flows to the test value of the feature, and the sample value of the data flow of the cloud host to the feature is obtained from the data flow to the library. If the test value of the data source feature of the sensitive information is the same as the sample value, and the test value in the process list is different from the sample value, for example, the process of calling sensitive information is one more, and the extra process may be the process of stealing data. . Therefore, it can be determined that there is a risk of data being stolen, and it is determined that a suspicious process is detected.
  • the network operation and maintenance personnel can further determine whether it is a risk process. If it is a risk process, the corresponding measures are taken.
  • the method described in this embodiment takes the feature of data theft as a starting point, and detects the suspicious process based on the characteristics of the data flow direction in the host to be detected. Accurately discover suspicious processes that steal data.
  • Another step may be further added to improve the accuracy of detecting a suspicious process.
  • Another method for detecting a suspicious process disclosed in the embodiment of the present application is compared with the previous embodiment.
  • the basis for detecting suspicious processes is not limited to data flow characteristics, as shown in Figure 2, including the following specific steps:
  • S201 Acquire a test value of a data flow direction feature of the host to be detected and a sample value of the data flow direction feature corresponding to the data to be detected in the library.
  • test value of the data source feature is the same as the sample value of the data source feature, if the test value of the process list is different from the sample value of the process list and/or the test value of the network exit feature and the sample of the network exit feature If the values are different, it is determined that a suspicious process is detected.
  • S203 Obtain a test value of a behavior characteristic of each application in the host to be detected and a sample value of a behavior characteristic of the host to be detected in the application behavior library.
  • the behavior feature is used to indicate the behavior of each application in the host to be detected, and may include at least one of the following: the level of the application, the frequency of the data source of the application accessing the preset type of data, and the application.
  • the frequency of the program's external connection the destination address of the application's external connection, the port to which the application is externally connected, the user running the application, the process command parameters of the application, the running frequency of the application, and the running time of the application.
  • the application program can be divided into four levels, namely: an L1 level program that directly accesses a data source or an intermediate file and initiates a network connection, and accesses a data source or an intermediate file but has no other network connection L2.
  • Level program an L3 level program that does not access data sources or intermediate files but has active outbound behavior
  • an L4 level program that does not access data sources or intermediate files and has no active external behavior.
  • S204 Determine if the difference between the test value of any one of the behavior characteristics of any one application and the sample value of the behavior characteristic of the application in the behavior library is not within a preset range. To the suspicious process.
  • the method for determining the difference between the test value of the behavior feature and the sample value of the behavior feature in the behavior feature database may be: calculating the item The distance between the test value and the sample value of the behavior characteristic in the behavior feature database, the distance value being a difference between the test value of the item and the sample value of the behavior characteristic in the behavior feature database, wherein the distance value It can be a K-nearest distance value; in the case where any one of the behavior characteristics is multi-dimensional data, the difference between the test value and the sample value can be directly calculated.
  • the preset range may be preset, and the larger the range, the greater the tolerance, the more relaxed the condition for detecting the suspicious process, the smaller the range, and the smaller the tolerance, the stricter the condition for detecting the suspicious process, the actual In the application, it can be set according to actual needs.
  • the test value of an application's outgoing connection frequency is significantly larger than its sample value, indicating that the application may be stealing data to determine that a suspicious process is detected.
  • the suspicious process is The process corresponding to the application.
  • S205 Determine a suspicious process from a process of the host to be detected according to a preset process risk rule.
  • the process risk rule may include: the host to be probe initiates a network connection to itself and the target port of the connection is a remote login port.
  • the process risk rule can be obtained by a network maintenance personnel through a priori knowledge.
  • the purpose of setting S205 is to add some features that may cause major security incidents to the process risk rules. Once these features appear in the host to be probed, it is possible to directly determine that there is a suspicious process without detecting the feature and behavior characteristics through the data flow.
  • S201 and S202, S203 and S204, and S205 are respectively three branches for detecting a suspicious process. It should be noted that the sequence numbers of the step marks in this embodiment are only for convenience of explanation, in practice. In the application, the order of execution of these three branches is not limited.
  • the embodiment may further include:
  • the method described in this embodiment is applied to a cloud host of an e-commerce platform, and the suspicious process of stealing data can be detected from three aspects respectively.
  • the application deployed on the cloud host has no human-computer interaction behavior, so the data is The flow within the host, as well as the behavior of the application within the host, is relatively fixed and has obvious features.
  • the method described in this embodiment detects the suspicious process of stealing data from the host to be detected from the data flow to the feature, the behavior feature, and the process risk rule in the host to be detected. Therefore, the detection angle is more diverse. Ability to more accurately and accurately detect anomalies in data access behavior and locate suspicious backdoors or programs. Even if there is a big change in the backdoor itself, as long as the act of stealing data still exists, it can be quickly discovered.
  • the test value may be collected from an event record of the first time period (for example, a certain day) of the host to be detected, and the sample value may be determined according to the host to be detected in the second time period (for example, one month). The data collected in the time record is generated.
  • the method for establishing a data flow library and an application behavior library may include the following specific steps:
  • S301 Collect event data in a preset time period (for example, one month) by using an acquisition client deployed on the host to be detected.
  • the event may specifically include network events, process events, and file read and write events.
  • the network event data may include a label of a process that initiates or receives a network connection, an origination time, a source IP and port, and a destination IP and port.
  • Process event data can include the number of the process, the type of event (including start or stop), activity time, process name, and command line parameters.
  • File read and write event data can include file read The write operation records the number of the process, the type of read and write (including read or write), and the time of the activity.
  • the specific implementation process of S301 may include the following steps:
  • ETF framework uses the Audit framework to fetch network event data, process event data, and file event data from the bottom layer of the operating system.
  • the granularity of the crawl and Event types are controlled and filtered by the event handler to eliminate known risk-free processes, network or file activity.
  • the event processor can organize the data into a unified format. If the current data is insufficient to establish a data flow to the library, the event processor can call the system function to complete the data and upload it to the log collection server in real time.
  • the log collection server After the data collection caches a certain capacity or exceeds a certain time value, the log collection server synchronizes the received data to the big data processing platform for storage and waits for further processing.
  • the event data is written into the network event table, the process event table, and the file read/write event table on the big data processing platform.
  • the above three event tables can be sliced and stored according to the time dimension.
  • S303 Establish a data flow feature of each data source feature in a manner of: determining, from the network event table, a network event related to one of the data source features, and a process number and a timestamp of the network event - For the search condition, the process of invoking the data of the data source and the second flow of the data of the second data source are sequentially obtained by associating the network event table, the process event table, and the file read/write event table. Network exit.
  • Each of the data source features can be obtained by manual extraction.
  • the IP address of the TOP server is a fixed list, and the service port is 80.
  • the data flow direction of a data source is characterized in that the data arrives from the data source (such as TOP in the e-commerce cloud) through the network event to the first process of the cloud host, and then saves the file to the local file through the file write event, and the service
  • the process typically a web server
  • the flow direction feature of a data source represents the flow path of data flowing from the data source in the host to be probed.
  • the file read event is only an intermediate process of connecting the before and after processes.
  • the file read and write event is not regarded as a data flow feature participating in detecting the suspicious process.
  • the application behavior library is established according to the following steps:
  • S304 Obtain a behavior feature of each application from the network event table and the process event table, where the behavior feature includes a level of an application, a frequency of a data source of an application accessing the preset type of data, The frequency of the external connection of the application, the destination address of the external connection of the application, the port to which the application is externally connected, The user running the application, the process command parameters of the application, the running frequency of the application, and the runtime of the application.
  • the data flow to the library and the application behavior signature database are obtained from the schedule running data of the host to be detected. Therefore, the data collection process has the characteristics of high timeliness, and the data collection process does not affect the normal operation of the host to be detected.
  • the embodiment of the present application further discloses a detecting device for a suspicious process, as shown in FIG. 6 , including:
  • the first obtaining module 601 is configured to obtain a test value of a data flow direction feature of the host to be detected and a sample value of the data flow direction feature corresponding to the data to be detected in the library, where the data flow feature includes a process list and a network exit.
  • the data source feature is used to indicate a data source of preset type data flowing into the host to be detected
  • the process list includes chronologically, calling the data a process of the data flowing out of the source
  • the network egress feature is used to indicate that the data flowing out by the data source flows out of the exit of the host to be detected after being called by the process in the process list;
  • the first determining module 602 is configured to: if the test value of the data source feature is the same as the sample value of the data source feature, the test value of the process list is different from the sample value of the process list and/ Or the test value of the network exit feature is different from the sample value of the network exit feature, and it is determined that the suspicious process is detected.
  • the device described in this embodiment takes the characteristics of data theft as a starting point, and detects the suspicious process based on the characteristics of the data flow direction in the host to be detected. Therefore, the suspicious process of stealing data can be accurately found.
  • the first detecting module 701, the first determining module 702, and the second detecting device are further disclosed in the embodiment of the present disclosure.
  • the functions of the first obtaining module 701 and the first determining module 702 are the same as those in the previous embodiment, and details are not described herein again.
  • a second obtaining module 703 configured to acquire a test value of a behavior characteristic of each application in the host to be detected, and a sample value of a behavior characteristic of the host to be detected in the application behavior library, where the behavior feature is at least The following items are included: the level of the application, the frequency of the data source of the application accessing the preset type of data, the frequency of the external connection of the application, the destination address of the external connection of the application, the port to which the application is externally connected, and the operation The user of the application, the process command parameters of the application, the running frequency of the application, and the runtime of the application.
  • the second determining module 704 is configured to: if the test value of any one of the behavior characteristics of any one of the applications is different from the sample value of the behavior characteristic of the application in the behavior feature database, the difference is not within a preset range. , to determine the detection of suspicious processes.
  • the specific process of determining the difference between the test value of the behavior feature and the sample value of the behavior feature in the behavior feature library may be And calculating a distance value between the test value of the item and the sample value of the behavior feature in the behavior feature database, where the distance value is a test value of the item and the behavior characteristic of the behavior feature database The difference in sample values.
  • the third determining module 705 is configured to determine a suspicious process from the process of the to-be-detected host according to a preset process risk rule, where the process risk rule includes: the to-be-detected host initiates a network connection to the host and the connection The target port is the remote login port.
  • the apparatus in this embodiment may further include:
  • the data flow to the library establishing module 706 is configured to separately establish a data flow direction feature of each data source according to the following manner: determining a network event related to one of the data source features from a pre-acquired network event table of the to-be-detected host And obtaining, by using the process number and the timestamp of the network event as a search condition, by associating the network event table, the process event table of the to-be-detected host, and the file read/write event table of the to-be-detected host The process of data of the data source and the second network exit of the data of the second data source.
  • an application behavior library establishing module 707 configured to acquire behavior characteristics of each application from a network event table and a process event table of the to-be-detected host obtained in advance, where the behavior characteristics include an application level, an application The frequency of the data source accessing the preset type of data, the frequency of the external connection of the application, the destination address of the external connection of the application, the port to which the application is externally connected, the user running the application, the process command parameter of the application, and the application The running frequency of the program and the running time of the application.
  • the device described in this embodiment may be disposed on a data processing platform, such as an e-commerce big data processing platform.
  • the data processing platform is connected to the host to be detected.
  • FIG. 8 shows the connection relationship between the device and the host to be detected.
  • the data processing platform can transmit the data in the host to be detected to the data processing platform through the existing data collection module and the data transmission module, and the event data storage module of the data processing platform can store the data, as described in this embodiment.
  • the device analyzes and organizes the data according to the functions described above, and organizes the data according to the analysis. The result detects a suspicious process in the host to be probed.
  • the device described in the embodiment of the present application may be disposed in an electronic device, and the electronic device may be a mobile terminal device in addition to a professional monitoring device.
  • the method for detecting a suspicious process described in this embodiment detects a suspicious process from multiple angles, and thus has higher accuracy and less delay.
  • the functions described in the methods of the embodiments of the present application may be stored in a computing device readable storage medium. Based on such understanding, a portion of the embodiments of the present application that contributes to the prior art or a portion of the technical solution may be embodied in the form of a software product stored in a storage medium, including a plurality of instructions for causing a
  • the computing device (which may be a personal computer, server, mobile computing device, or network device, etc.) performs all or part of the steps of the methods described in various embodiments of the present application.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Medical Informatics (AREA)
  • Databases & Information Systems (AREA)
  • Virology (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Debugging And Monitoring (AREA)

Abstract

一种可疑进程的探测方法及装置，获取待探测主机的数据流向特征的测试值及数据流向库中的待探测主机对应的数据流向特征的样本值(S101)，数据流向特征包括进程列表和网络出口特征中的至少一个、及数据源特征；如果在数据源特征的测试值与数据源特征的样本值相同的情况下，进程列表的测试值与进程列表的样本值不同和/或网络出口特征的测试值与网络出口特征的样本值不同，确定探测到可疑进程(S102)；可见，所述可疑进程探测方法及装置，以数据的流向特征为依据来探测可疑进程，而非依据应用程序的攻击行为，又因为一旦发生数据的盗用，数据的流向特征就会变化，所以所述方法及装置能够准确地检测到数据被盗取的可疑进程。

Description

一种可疑进程的探测方法及装置
本申请要求2015年03月20日递交的申请号为201510124614.5、发明名称为“一种可疑进程的探测方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机领域，尤其涉及一种可疑进程的探测方法及装置。
背景技术
数据安全是云计算和数据开放面临的核心问题之一。以电商云为例，独立软件开发商(Independent Software Vendors，ISV)软件系统部署在电商云环境中，在获得天猫和淘宝商户的订购授权后，ISV能通过TOP访问商户在天猫和淘宝的敏感数据，如订单和客户关系等。ISV任何软件或云资源管理上的漏洞，可能被人利用在云主机或应用中部署后门，非法读取、拷贝或外传这些敏感数据，造成大批量的数据泄漏。
而传统的病毒检测方法，通常针对病毒程序对系统的攻击行为设计防御策略，而在云主机或应用中盗取数据的后门程序，一般以获取数据为目的，并没有主动攻击系统的行为特征。
所以，传统的病毒检测技术，并不能准确地检测到数据被盗取的可疑进程。
发明内容
本申请提供了一种可疑进程的探测方法及装置，目的在于解决不能准确检测到数据被盗取的可疑进程的问题。
为了实现上述目的，本申请提供了以下技术方案：
一种可疑进程的探测方法，包括：
获取待探测主机的数据流向特征的测试值，以及，数据流向库中所述待探测主机对应的数据流向特征的样本值；所述数据流向特征包括进程列表和网络出口特征中的至少一个、以及数据源特征，所述数据源特征用于指示流入所述待探测主机的预设类型数据的数据源，所述进程列表中包括按照时间顺序排列的、调用所述数据源流出的数据的进程，所述网络出口特征用于指示所述数据源流出的数据在被所述进程列表中的进程调用后、流出所述待探测主机的出口；
如果在所述数据源特征的测试值与所述数据源特征的样本值相同的情况下，所述进程列表的测试值与所述进程列表的样本值不同，和/或，所述网络出口特征的测试值与所述网络出口特征的样本值不同，则确定探测到可疑进程。
可选地，所述数据流向库的建立过程包括：
按照以下方式，分别建立每一个数据源的数据流向特征：
从预先获取的所述待探测主机的网络事件表中确定与一个所述数据源特征相关的网络事件；
以所述网络事件的进程编号和时间戳为查找条件，通过关联所述网络事件表、所述待探测主机的进程事件表及所述待探测主机的文件读写事件表，依次获得调用所述数据源的数据的进程，以及，所述第二数据源的数据流出的第二网络出口。
可选地，还包括：
获取所述待探测主机中每一个应用程序的行为特征的测试值，以及，应用行为库中所述待探测主机的行为特征的样本值；所述行为特征至少包括以下一项：应用程序的级别、应用程序访问所述预设类型的数据的数据源的频率、应用程序对外连接的频率、应用程序对外连接的目的地址、应用程序对外连接的端口、运行应用程序的用户、应用程序的进程命令参数、应用程序的运行频率及应用程序的运行时长；
如果任意一个应用程序的行为特征中任意一项的测试值与此应用程序在所述行为特征库中此项行为特征的样本值的差别不在预设范围内，则确定探测到可疑进程。
可选地，在行为特征中的任意一项为多维数据的情况下，此行为特征的测试值与所述行为特征库中的此项行为特征的样本值的差别的确定方法包括：
计算该项的测试值与所述行为特征库中此项行为特征的样本值之间的距离值。
可选地，所述应用行为库的建立过程包括：
从预先获取的所述待探测主机的网络事件表及进程事件表中，获取每一个应用程序的行为特征；所述行为特征包括应用程序的级别、应用程序访问所述预设类型的数据的数据源的频率、应用程序对外连接的频率、应用程序对外连接的目的地址、应用程序对外连接的端口、运行应用程序的用户、应用程序的进程命令参数、应用程序的运行频率及应用程序的运行时长。
可选地，还包括：
按照预设的进程风险规则，从所述待探测主机的进程中确定可疑进程，所述进程风险规则包括：所述待探测主机发起对自身的网络连接及该连接的目标端口为远程登录端 口。
一种可疑进程的探测装置，包括：
第一获取模块，用于获取待探测主机的数据流向特征的测试值，以及，数据流向库中所述待探测主机对应的数据流向特征的样本值；所所述数据流向特征包括进程列表和网络出口特征中的至少一个、以及数据源特征，所述数据源特征用于指示流入所述待探测主机的预设类型数据的数据源，所述进程列表中包括按照时间顺序排列的、调用所述数据源流出的数据的进程，所述网络出口特征用于指示所述数据源流出的数据在被所述进程列表中的进程调用后、流出所述待探测主机的出口；
第一确定模块，用于如果在所述数据源特征的测试值与所述数据源特征的样本值相同的情况下，所述进程列表的测试值与所述进程列表的样本值不同，和/或，所述网络出口特征的测试值与所述网络出口特征的样本值不同，则确定探测到可疑进程。
可选地，还包括：
数据流向库建立模块，用于按照以下方式，分别建立每一个数据源的数据流向特征：从预先获取的所述待探测主机的网络事件表中确定与一个所述数据源特征相关的网络事件；以所述网络事件的进程编号和时间戳为查找条件，通过关联所述网络事件表、所述待探测主机的进程事件表及所述待探测主机的文件读写事件表，依次获得调用所述数据源的数据的进程，以及，所述第二数据源的数据流出的第二网络出口。
可选地，还包括：
第二获取模块，用于获取所述待探测主机中每一个应用程序的行为特征的测试值以及应用行为库中所述待探测主机的行为特征的样本值；所述行为特征至少包括以下一项：应用程序的级别、应用程序访问所述预设类型的数据的数据源的频率、应用程序对外连接的频率、应用程序对外连接的目的地址、应用程序对外连接的端口、运行应用程序的用户、应用程序的进程命令参数、应用程序的运行频率及应用程序的运行时长；
第二确定模块，用于如果任意一个应用程序的行为特征中任意一项的测试值与此应用程序在所述行为特征库中此项行为特征的样本值的差别不在预设范围内，则确定探测到可疑进程。
可选地，所述第二确定模块用于在行为特征中的任意一项为多维数据的情况下，确定此行为特征的测试值与所述行为特征库中的此项行为特征的样本值的差别的具体过程包括：
所述第二确定模块具体用于，计算该项的测试值与所述行为特征库中的此项行为特 征的样本值的距离值。
可选地，还包括：
应用行为库建立模块，用于从预先获取的所述待探测主机的网络事件表及进程事件表中获取每一个应用程序的行为特征；所述行为特征包括应用程序的级别、应用程序访问所述预设类型的数据的数据源的频率、应用程序对外连接的频率、应用程序对外连接的目的地址、应用程序对外连接的端口、运行应用程序的用户、应用程序的进程命令参数、应用程序的运行频率及应用程序的运行时长。
可选地，还包括：
第三确定模块，用于按照预设的进程风险规则，从所述待探测主机的进程中确定可疑进程，所述进程风险规则包括：所述待探测主机发起对自身的网络连接及该连接的目标端口为远程登录端口。
与现有技术相比，本申请实施例具有以下有益效果：
本申请所述的可疑进程的探测方法及装置，获取待探测主机的数据流向特征的测试值及数据流向库中的待探测主机对应的数据流向特征的样本值，其中，数据流向特征包括数据源特征、进程列表以及网络出口特征，如果在所述数据源特征的测试值与所述数据源特征的样本值相同的情况下，进程列表的测试值与进程列表的样本值不同或者网络出口特征的测试值与网络出口特征的样本值不同，则确定探测到可疑进程，可见，本申请所述的可疑进程探测方法及装置，以数据的流向特征为依据来探测可疑进程，而非依据应用程序的攻击行为，又因为一旦发生数据的盗用，数据的流向特征就会变化，所以本申请所述的可疑进程探测方法及装置能够准确地检测到数据被盗取的可疑进程。
当然，实施本申请的任一产品并不一定需要同时达到以上所述的所有优点。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为申请实施例公开的一种可疑进程的探测方法的流程图；
图2为本申请实施例公开的又一种可疑进程的探测方法的流程图；
图3为本申请实施例公开的数据流向库及应用行为库的建立方法的流程图；
图4为本申请实施例公开的通过在待探测主机上部署的采集客户端，采集在预设时间段内的事件数据的方法的流程图；
图5为本申请实施例公开的一个数据源的数据流向特征的示意图；
图6为本申请实施例公开的一种可疑进程的探测装置的结构示意图；
图7为本申请实施例还公开的又一种可疑进程的探测装置的结构示意图；
图8为本申请实施例公开的可疑进程的探测装置与待探测主机的连接关系结构示意图。
具体实施方式
本申请实施例公开了一种可疑进程的探测方法及装置，可以应用在对于云主机的可疑进程的探测上，以便于能够准确发现盗取云主机中的数据的可疑进程。
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本申请一部分实施例，而不是全部的实施例。基于本申请中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本申请保护的范围。
本申请实施例公开的一种可疑进程的探测方法，如图1所示，包括以下步骤：
S101：获取待探测主机的数据流向特征的测试值及数据流向库中的待探测主机对应的数据流向特征的样本值。
本实施例中，数据流向特征可以包括：进程列表和网络出口特征中的至少一个、以及数据源特征。也就是说，数据流向特征中包括数据源特征，除此以外，可以包括进程列表和网络出口特征，也可以包括两者中的任意一个。在包括进程列表和网络出口特征的情况下，探测的准确性更高，本申请以下实施例中，均以数据流向特征中包括数据源特征、进程列表和网络出口特征为例进行描述。
其中，数据源特征用于指示流入待探测主机的预设类型数据的数据源，进程列表中包括按照时间顺序排列的、调用数据源流出的数据的进程，网络出口特征用于指示数据源流出的数据在被进程列表中的进程调用后、流出待探测主机的出口。
进程列表的测试值与样本值均可以为进程列表中包含的文件的名称或者编号。进程列表的测试值与样本值不同，说明调用数据的进行发生了改变，改变可以包括增加了进程，或者，进程按照时间排序发生了变化。
数据源特征的测试值与样本值均可以为数据源的地址或端口号，网络出口特征的测 试值与样本值均可以为网络出口的地址或端口号。
S102：在数据源特征的测试值与数据源特征的样本值相同的情况下，如果满足预设条件，则确定探测到可疑进程。其中预设条件至少包括以下任意一项：
1、进程列表的测试值与进程列表的样本值不同；
2、网络出口特征的测试值与网络出口特征的样本值不同。
因为数据盗取方需要通过后门应用程序读取数据或者将数据引流的方式盗取数据，所以，本实施例中，从这两方面入手，设置以上条件，以便从根本上发现数据盗取行为。
可疑进程即为异常的特征对应的进程。例如，对于进程列表而言，可疑进程可以为进程列表的测试值与样本值相比，多出来的名称或编号对应的进程为可疑进程；对于网络出口特征而言，测试样与样本值不同，则通过此网络出口向得探测主机外传输数据的进程即为可疑进程。
例如，本实施例所述的方法应用在电商平台，对于电商平台而言，预设类型数据可以为敏感数据，例如客户的订单信息，为了防止云主机中的敏感数据泄露，探测电商平台的云主机中的数据流向特征的测试值，并从数据流向库中获取云主机的数据流向特征的样本值。如果敏感信息的数据源特征的测试值与样本值相同，而其进程列表中的测试值与样本值不同，例如，调用敏感信息的进程多了一个，多出的进程可能为盗取数据的进程。因此，可以确定存在数据被盗取的风险，则确定探测到可疑进程。网络运维人员可以进一步确定是否确实为风险进程，如确实为风险进程，则采用相应的处理措施。
可见，与现有的检测病毒的技术相比，本实施例中所述的方法，从数据盗取的特点为出发点，以待探测主机中的数据流向特征为依据进行可疑进程的探测，因此，能够准确发现盗取数据的可疑进程。
在上述实施例所述的方法的基础上，还可以进一步增加其它步骤以提高探测可疑进程的准确性，本申请实施例公开的又一种可疑进程的探测方法，与上一实施例相比，探测可疑进程的依据不仅仅限于数据流向特征，如图2所示，包括以下具体步骤：
S201：获取待探测主机的数据流向特征的测试值及数据流向库中的待探测主机对应的数据流向特征的样本值。
本实施例中，数据流向特征可以参见上一实施例所示，这里不再赘述。
S202：在数据源特征的测试值与数据源特征的样本值相同的情况下，如果进程列表的测试值与进程列表的样本值不同和/或网络出口特征的测试值与网络出口特征的样本 值不同，则确定探测到可疑进程。
S203：获取待探测主机中的每一个应用程序的行为特征的测试值以及应用行为库中的、待探测主机的行为特征的样本值。
本实施例中，行为特征用于表示各个应用程序在待探测主机中的行为，至少可以包括以下一项：应用程序的级别、应用程序访问所述预设类型的数据的数据源的频率、应用程序对外连接的频率、应用程序对外连接的目的地址、应用程序对外连接的端口、运行应用程序的用户、应用程序的进程命令参数、应用程序的运行频率及应用程序的运行时长。
其中，本实施例中，应用程序可以分为四个级别，分别为：直接访问数据源或中间文件并向外发起网络连接的L1级程序，访问数据源或中间文件但无其它网络连接的L2级程序，不访问数据源或中间文件但有主动外连行为的L3级程序，以及，不访问数据源或中间文件且无主动外连行为的L4级程序。
S204：如果任意一个应用程序的行为特征中的任意一项的测试值与此应用程序在所述行为库中的特征中的此项行为特征的样本值的差别不在预设范围内，则确定探测到可疑进程。
本实施例中，在行为特征中的任意一项为多维数据的情况下，此行为特征的测试值与行为特征库中的此项行为特征的样本值的差别的确定方法可以为：计算该项的测试值与行为特征库中的此项行为特征的样本值的距离值，所述距离值为该项的测试值与行为特征库中的此项行为特征的样本值的差别，其中，距离值可以为K近邻距离值；在行为特征中的任意一项为多维数据的情况下，可以直接计算测试值与样本值之间的差别。
本实施例中，预设范围可以预先设定，范围越大，容忍性越大，则探测可疑进程的条件越宽松，范围越小，容忍性越小，则探测可疑进程的条件越严格，实际应用中，可以依据实际需求设定。
例如，在云主机中，某个应用程序向外连接的频率的测试值明显大于其样本值，则说明此应用程序可能在进行数据的盗取，从而确定探测到可疑进程，可疑进程即为此应用程序对应的进程。
S205：按照预设的进程风险规则，从所述待探测主机的进程中确定可疑进程。
其中，进程风险规则可以包括：待探测主机发起对自身的网络连接及该连接的目标端口为远程登录端口。
本实施例中，进程风险规则可以通过由网络维护人员通过先验知识推导得到。
设置S205的目的在于，可以将一些可能导致重大安全事故的特征加入进程风险规则中，一旦待探测主机中出现这些特征，可以直接确定存在可疑进程，而不必通过数据流向特征及行为特征的探测。
从图2中可以看出，S201和S202，S203和S204，以及，S205分别为探测可疑进程的3个分支，需要说明的是，本实施例中为步骤标记的序号仅为便于说明，在实际应用中，这三个分支的执行顺序不做限定。
可选地，在确定探测到可疑进程后，本实施例中还可以包括：
发出预警信号，并将可疑进程的编号加入可疑进程列表中，以便于网络运营人员查看可疑进程列表，并对可疑进程进行审核，如确认无风险，在系统中标定，该标定记录将被加入该主机的应用行为库或数据流向库中。如有风险，能直观地定位有风险的进程，或数据异常流动的模式，启动应急措施控制风险。
本实施例所述的方法应用在电商平台的云主机中，可以分别从三个方面探测盗取数据的可疑进程，云主机上部署的应用程序，由于没有人机交互行为，所以，数据在主机内的流转、以及主机内的应用程序的行为比较固定，有明显的特征。本实施例所述的方法，分别从待探测主机中的数据流向特征、行为特征及进程风险规则三个方面探测待探测主机中盗取数据的可疑进程，因此，探测的角度更为多样化，能够更为及时准确地发现数据访问行为中的异常，定位到可疑的后门或程序。即使后门程序本身发生大的改变，只要盗取数据的行为还存在，就能被快速发现。
需要说明的是，上述实施例中，测试值可以从待探测主机第一时间段(例如某一天)的事件记录中采集，而样本值可以依据待探测主机在第二时间段内(例如一个月)的时间记录中采集的数据而生成。
下面将详细说明数据流向库及应用行为库的建立方法。
如图3所示，数据流向库及应用行为库的建立方法可以包括以下具体步骤：
S301：通过在待探测主机上部署的采集客户端，采集在预设时间段(例如一个月)内的事件数据。
其中，事件可以具体包括网络事件、进程事件以及文件读写事件。
具体地，网络事件数据可以包括发起或接收网络连接的进程的标号、发起时间、来源IP和端口以及目的IP和端口。进程事件数据可以包括进程的编号、事件类型(包括启动或停止)、活动时间、进程名以及命令行参数。文件读写事件数据可以包括文件读 写操作记录进程的编号、读写类型(包括读或写)以及活动时间。
如图4所示，S301的具体实现过程可以包括以下步骤：
1、通过Windows事件收集器使用ETW框架，或者Linux事件收集器使用Audit框架，从操作系统底层抓取网络事件数据、进程事件数据和文件事件数据，为了减小事件数据量，抓取的粒度和事件类型由事件处理器通过配置来控制和过滤，排除已知的无风险进程、网络或文件活动。
2、事件处理器可以将数据整理成统一格式，如果当前数据不足以建立数据流向库，事件处理器可以调用系统函数补全数据后，实时上传到日志收集服务器。
3、日志收集服务器在数据缓存到一定容量或者超过某个时间值后，将已接收的数据同步到大数据处理平台存储、以及等待进一步处理。
S302：依据上述采集到的数据，在大数据处理平台上，事件数据被写入网络事件表、进程事件表及文件读写事件表。
上述三种事件表可以按照时间维度进行分片存储。
S303：按照以下方式，分别建立每一个数据源特征的数据流向特征：从所述网络事件表中确定与一个所述数据源特征相关的网络事件，以所述网络事件的进程编号和时间戳-为查找条件，通过关联所述网络事件表、所述进程事件表及所述文件读写事件表，依次获得调用所述数据源的数据的进程以及所述第二数据源的数据流出的第二网络出口。
其中，每一个数据源特征均可以通过人工提取获得，以电商云TOP数据源为例，TOP服务器的IP地址为一固定列表，且服务端口为80。
如图5所示，一个数据源的数据流向特征为：数据从数据源(如电商云中的TOP)通过网络事件到达云主机第一个进程，再通过文件写事件存到本地文件，服务进程(一般为Web服务器)通过文件读事件读取到数据，随后通过网络事件发送给客户或者第三方系统(如电商云中的物流系统)。可见，一个数据源的流向特征表示的是从此数据源流出的数据在待探测主机中的流动路径。
需要说明的是，文件读事件仅为连接前后进程的中间过程，本申请的实施例中，不将文件读写事件看作参与探测可疑进程的数据流向特征。
本实施例中，依据以下步骤建立应用行为库：
S304：从所述网络事件表及所述进程事件表中获取每一个应用程序的行为特征，所述行为特征包括应用程序的级别、应用程序访问所述预设类型的数据的数据源的频率、应用程序对外连接的频率、应用程序对外连接的目的地址、应用程序对外连接的端口、 运行应用程序的用户、应用程序的进程命令参数、应用程序的运行频率及应用程序的运行时长。
需要说明的是，S303和S304的执行顺序可以互换。
从上述过程可以看出，数据流向库以及应用行为特征库从待探测主机的日程运行数据得到，因此，具有时效性高的特点，并且，数据采集过程不会影响待探测的主机的正常运行。
与图1所示的方法实施例相对应地，本申请实施例还公开了一种可疑进程的探测装置，如图6所示，包括：
第一获取模块601，用于获取待探测主机的数据流向特征的测试值以及数据流向库中的所述待探测主机对应的数据流向特征的样本值，所述数据流向特征包括进程列表和网络出口特征中的至少一个、以及数据源特征，所述数据源特征用于指示流入所述待探测主机的预设类型数据的数据源，所述进程列表中包括按照时间顺序排列的、调用所述数据源流出的数据的进程，所述网络出口特征用于指示所述数据源流出的数据在被所述进程列表中的进程调用后、流出所述待探测主机的出口；
第一确定模块602，用于如果在所述数据源特征的测试值与所述数据源特征的样本值相同的情况下，所述进程列表的测试值与所述进程列表的样本值不同和/或所述网络出口特征的测试值与所述网络出口特征的样本值不同，则确定探测到可疑进程。
本实施例中所述的装置，以数据盗取的特点为出发点，以待探测主机中的数据流向特征为依据进行可疑进程的探测，因此，能够准确发现盗取数据的可疑进程。
与图2所示的方法实施例相对应地，本申请实施例还公开的又一种可疑进程的探测装置如图7所示，包括：第一获取模块701、第一确定模块702、第二获取模块703、第二确定模块704以及第三确定模块705。
其中，第一获取模块701和第一确定模块702的功能与上一实施例相同，这里不再赘述。
第二获取模块703，用于获取所述待探测主机中的每一个应用程序的行为特征的测试值以及应用行为库中的、所述待探测主机的行为特征的样本值，所述行为特征至少包括以下一项：应用程序的级别、应用程序访问所述预设类型的数据的数据源的频率、应用程序对外连接的频率、应用程序对外连接的目的地址、应用程序对外连接的端口、运 行应用程序的用户、应用程序的进程命令参数、应用程序的运行频率及应用程序的运行时长。
第二确定模块704，用于如果任意一个应用程序的行为特征中的任意一项的测试值与此应用程序在所述行为特征库中的此项行为特征的样本值的差别不在预设范围内，则确定探测到可疑进程。
具体地，第二确定模块在行为特征中的任意一项为多维数据的情况下，确定此行为特征的测试值与所述行为特征库中的此项行为特征的样本值的差别的具体过程可以为：计算该项的测试值与所述行为特征库中的此项行为特征的样本值的距离值，所述距离值为该项的测试值与所述行为特征库中的此项行为特征的样本值的差别。
第三确定模块705，用于按照预设的进程风险规则，从所述待探测主机的进程中确定可疑进程，所述进程风险规则包括：所述待探测主机发起对自身的网络连接及该连接的目标端口为远程登录端口。
可选地，本实施例所述装置还可以包括：
数据流向库建立模块706，用于按照以下方式，分别建立每一个数据源的数据流向特征：从预先获取的所述待探测主机的网络事件表中确定与一个所述数据源特征相关的网络事件；以所述网络事件的进程编号和时间戳为查找条件，通过关联所述网络事件表、所述待探测主机的进程事件表及所述待探测主机的文件读写事件表，依次获得调用所述数据源的数据的进程以及所述第二数据源的数据流出的第二网络出口。
以及，应用行为库建立模块707，用于从预先获取的所述待探测主机的网络事件表及进程事件表中获取每一个应用程序的行为特征，所述行为特征包括应用程序的级别、应用程序访问所述预设类型的数据的数据源的频率、应用程序对外连接的频率、应用程序对外连接的目的地址、应用程序对外连接的端口、运行应用程序的用户、应用程序的进程命令参数、应用程序的运行频率及应用程序的运行时长。
数据流向库建立模块和应用行为库建立模块的工作流程可以参见图3所示的方法实施例。
本实施例中所述的装置，可以设置在数据处理平台上，例如电商的大数据处理平台。所述数据处理平台与待探测主机相连，图8所示为本实施例所述的装置与待探测主机的连接关系。数据处理平台可以通过现有的数据采集模块及数据传输模块，将待探测主机中的数据传输到数据处理平台，数据处理平台的事件数据存储模块可以将这些数据进行存储，本实施例所述的装置按照以上所述的功能对数据进行分析整理，并依据分析整理 的结果探测待探测主机中的可疑进程。
需要说明的是，本申请实施例中所述的装置可以设置在电子设备中，所述电子设备除了可以为专业的监测设备外，也可以为移动终端设备。
本实施例所述的可疑进程的探测方法，从多个角度探测可疑进程，因此具有更高的准确性以及更小的时延。
本申请实施例方法所述的功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算设备可读取存储介质中。基于这样的理解，本申请实施例对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该软件产品存储在一个存储介质中，包括若干指令用以使得一台计算设备(可以是个人计算机，服务器，移动计算设备或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本说明书中各个实施例采用递进的方式描述，每个实施例重点说明的都是与其它实施例的不同之处，各个实施例之间相同或相似部分互相参见即可。
对所公开的实施例的上述说明，使本领域专业技术人员能够实现或使用本申请。对这些实施例的多种修改对本领域的专业技术人员来说将是显而易见的，本文中所定义的一般原理可以在不脱离本申请的精神或范围的情况下，在其它实施例中实现。因此，本申请将不会被限制于本文所示的这些实施例，而是要符合与本文所公开的原理和新颖特点相一致的最宽的范围。

Claims (12)

  1. 一种可疑进程的探测方法，其特征在于，包括：
    获取待探测主机的数据流向特征的测试值，以及，数据流向库中所述待探测主机对应的数据流向特征的样本值；所述数据流向特征包括进程列表和网络出口特征中的至少一个、以及数据源特征，所述数据源特征用于指示流入所述待探测主机的预设类型数据的数据源，所述进程列表中包括按照时间顺序排列的、调用所述数据源流出的数据的进程，所述网络出口特征用于指示所述数据源流出的数据在被所述进程列表中的进程调用后、流出所述待探测主机的出口；
    如果在所述数据源特征的测试值与所述数据源特征的样本值相同的情况下，所述进程列表的测试值与所述进程列表的样本值不同，和/或，所述网络出口特征的测试值与所述网络出口特征的样本值不同，则确定探测到可疑进程。
  2. 根据权利要求1所述的方法，其特征在于，所述数据流向库的建立过程包括：
    按照以下方式，分别建立每一个数据源的数据流向特征：
    从预先获取的所述待探测主机的网络事件表中确定与一个所述数据源特征相关的网络事件；
    以所述网络事件的进程编号和时间戳为查找条件，通过关联所述网络事件表、所述待探测主机的进程事件表及所述待探测主机的文件读写事件表，依次获得调用所述数据源的数据的进程，以及，所述第二数据源的数据流出的第二网络出口。
  3. 根据权利要求1或2所述的方法，其特征在于，还包括：
    获取所述待探测主机中每一个应用程序的行为特征的测试值，以及，应用行为库中所述待探测主机的行为特征的样本值；所述行为特征至少包括以下一项：应用程序的级别、应用程序访问所述预设类型的数据的数据源的频率、应用程序对外连接的频率、应用程序对外连接的目的地址、应用程序对外连接的端口、运行应用程序的用户、应用程序的进程命令参数、应用程序的运行频率及应用程序的运行时长；
    如果任意一个应用程序的行为特征中任意一项的测试值与此应用程序在所述行为特征库中此项行为特征的样本值的差别不在预设范围内，则确定探测到可疑进程。
  4. 根据权利要求3所述的方法，其特征在于，在行为特征中的任意一项为多维数据的情况下，此行为特征的测试值与所述行为特征库中的此项行为特征的样本值的差别的确定方法包括：
    计算该项的测试值与所述行为特征库中此项行为特征的样本值之间的距离值。
  5. 根据权利要求4所述的方法，其特征在于，所述应用行为库的建立过程包括：
    从预先获取的所述待探测主机的网络事件表及进程事件表中，获取每一个应用程序的行为特征；所述行为特征包括应用程序的级别、应用程序访问所述预设类型的数据的数据源的频率、应用程序对外连接的频率、应用程序对外连接的目的地址、应用程序对外连接的端口、运行应用程序的用户、应用程序的进程命令参数、应用程序的运行频率及应用程序的运行时长。
  6. 根据权利要求1或2所述的方法，其特征在于，还包括：
    按照预设的进程风险规则，从所述待探测主机的进程中确定可疑进程，所述进程风险规则包括：所述待探测主机发起对自身的网络连接及该连接的目标端口为远程登录端口。
  7. 一种可疑进程的探测装置，其特征在于，包括：
    第一获取模块，用于获取待探测主机的数据流向特征的测试值，以及，数据流向库中所述待探测主机对应的数据流向特征的样本值；所述数据流向特征包括进程列表和网络出口特征中的至少一个、以及数据源特征，所述数据源特征用于指示流入所述待探测主机的预设类型数据的数据源，所述进程列表中包括按照时间顺序排列的、调用所述数据源流出的数据的进程，所述网络出口特征用于指示所述数据源流出的数据在被所述进程列表中的进程调用后、流出所述待探测主机的出口；
    第一确定模块，用于如果在所述数据源特征的测试值与所述数据源特征的样本值相同的情况下，所述进程列表的测试值与所述进程列表的样本值不同，和/或，所述网络出口特征的测试值与所述网络出口特征的样本值不同，则确定探测到可疑进程。
  8. 根据权利要求7所述的装置，其特征在于，还包括：
    数据流向库建立模块，用于按照以下方式，分别建立每一个数据源的数据流向特征：从预先获取的所述待探测主机的网络事件表中确定与一个所述数据源特征相关的网络事件；以所述网络事件的进程编号和时间戳为查找条件，通过关联所述网络事件表、所述待探测主机的进程事件表及所述待探测主机的文件读写事件表，依次获得调用所述数据源的数据的进程，以及，所述第二数据源的数据流出的第二网络出口。
  9. 根据权利要求7所述的装置，其特征在于，还包括：
    第二获取模块，用于获取所述待探测主机中每一个应用程序的行为特征的测试值以及应用行为库中所述待探测主机的行为特征的样本值；所述行为特征至少包括以下一 项：应用程序的级别、应用程序访问所述预设类型的数据的数据源的频率、应用程序对外连接的频率、应用程序对外连接的目的地址、应用程序对外连接的端口、运行应用程序的用户、应用程序的进程命令参数、应用程序的运行频率及应用程序的运行时长；
    第二确定模块，用于如果任意一个应用程序的行为特征中任意一项的测试值与此应用程序在所述行为特征库中此项行为特征的样本值的差别不在预设范围内，则确定探测到可疑进程。
  10. 根据权利要求9所述的装置，其特征在于，所述第二确定模块用于在行为特征中的任意一项为多维数据的情况下，确定此行为特征的测试值与所述行为特征库中的此项行为特征的样本值的差别的具体过程包括：
    所述第二确定模块具体用于，计算该项的测试值与所述行为特征库中的此项行为特征的样本值的距离值。
  11. 根据权利要求10所述的装置，其特征在于，还包括：
    应用行为库建立模块，用于从预先获取的所述待探测主机的网络事件表及进程事件表中获取每一个应用程序的行为特征；所述行为特征包括应用程序的级别、应用程序访问所述预设类型的数据的数据源的频率、应用程序对外连接的频率、应用程序对外连接的目的地址、应用程序对外连接的端口、运行应用程序的用户、应用程序的进程命令参数、应用程序的运行频率及应用程序的运行时长。
  12. 根据权利要求7或8所述的装置，其特征在于，还包括：
    第三确定模块，用于按照预设的进程风险规则，从所述待探测主机的进程中确定可疑进程，所述进程风险规则包括：所述待探测主机发起对自身的网络连接及该连接的目标端口为远程登录端口。
PCT/CN2016/076228 2015-03-20 2016-03-14 一种可疑进程的探测方法及装置 Ceased WO2016150313A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US15/559,176 US20180075240A1 (en) 2015-03-20 2016-03-14 Method and device for detecting a suspicious process by analyzing data flow characteristics of a computing device

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510124614.5 2015-03-20
CN201510124614.5A CN106033514B (zh) 2015-03-20 2015-03-20 一种可疑进程的探测方法及装置

Publications (1)

Publication Number Publication Date
WO2016150313A1 true WO2016150313A1 (zh) 2016-09-29

Family

ID=56977903

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/076228 Ceased WO2016150313A1 (zh) 2015-03-20 2016-03-14 一种可疑进程的探测方法及装置

Country Status (3)

Country Link
US (1) US20180075240A1 (zh)
CN (1) CN106033514B (zh)
WO (1) WO2016150313A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108777679A (zh) * 2018-05-22 2018-11-09 深信服科技股份有限公司 终端的流量访问关系生成方法、装置和可读存储介质

Families Citing this family (28)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10476673B2 (en) 2017-03-22 2019-11-12 Extrahop Networks, Inc. Managing session secrets for continuous packet capture systems
US9967292B1 (en) 2017-10-25 2018-05-08 Extrahop Networks, Inc. Inline secret sharing
US10389574B1 (en) 2018-02-07 2019-08-20 Extrahop Networks, Inc. Ranking alerts based on network monitoring
US10270794B1 (en) 2018-02-09 2019-04-23 Extrahop Networks, Inc. Detection of denial of service attacks
US10411978B1 (en) 2018-08-09 2019-09-10 Extrahop Networks, Inc. Correlating causes and effects associated with network activity
US11070632B2 (en) * 2018-10-17 2021-07-20 Servicenow, Inc. Identifying computing devices in a managed network that are involved in blockchain-based mining
CN109474618B (zh) * 2018-12-17 2021-08-17 广州天懋信息系统股份有限公司 异常视频设备操作信令的识别方法、系统、介质和终端
CN110096363B (zh) * 2019-04-29 2021-11-30 亚信科技（成都）有限公司 一种网络事件与进程的关联方法及装置
CN110245035A (zh) * 2019-05-20 2019-09-17 平安普惠企业管理有限公司 一种链路跟踪方法及装置
US10965702B2 (en) 2019-05-28 2021-03-30 Extrahop Networks, Inc. Detecting injection attacks using passive network monitoring
CN110191004B (zh) * 2019-06-18 2022-05-27 北京搜狐新媒体信息技术有限公司 一种端口检测方法及系统
US11165814B2 (en) 2019-07-29 2021-11-02 Extrahop Networks, Inc. Modifying triage information based on network monitoring
US10742530B1 (en) 2019-08-05 2020-08-11 Extrahop Networks, Inc. Correlating network traffic that crosses opaque endpoints
US11388072B2 (en) 2019-08-05 2022-07-12 Extrahop Networks, Inc. Correlating network traffic that crosses opaque endpoints
US10742677B1 (en) 2019-09-04 2020-08-11 Extrahop Networks, Inc. Automatic determination of user roles and asset types based on network monitoring
US11165823B2 (en) 2019-12-17 2021-11-02 Extrahop Networks, Inc. Automated preemptive polymorphic deception
WO2022066910A1 (en) 2020-09-23 2022-03-31 Extrahop Networks, Inc. Monitoring encrypted network traffic
US11463466B2 (en) 2020-09-23 2022-10-04 Extrahop Networks, Inc. Monitoring encrypted network traffic
CN111913766B (zh) * 2020-09-29 2021-01-15 北京东方通软件有限公司 一种微服务调用链的健康检测方法和健康检测系统
CN112822166B (zh) * 2020-12-30 2022-11-04 绿盟科技集团股份有限公司 一种异常进程检测方法、装置、设备及介质
US11349861B1 (en) 2021-06-18 2022-05-31 Extrahop Networks, Inc. Identifying network entities based on beaconing activity
US11296967B1 (en) 2021-09-23 2022-04-05 Extrahop Networks, Inc. Combining passive network analysis and active probing
US12603896B2 (en) * 2022-02-21 2026-04-14 Palo Alto Networks, Inc. Agent prevention augmentation based on organizational learning
US11843606B2 (en) 2022-03-30 2023-12-12 Extrahop Networks, Inc. Detecting abnormal data access based on data similarity
CN114912111B (zh) * 2022-04-07 2025-06-20 京东科技信息技术有限公司 一种云主机病毒检测方法、装置和系统
CN114500115B (zh) * 2022-04-14 2022-07-29 浙江齐安信息科技有限公司 流量数据包的审计装置、系统及方法
US12615282B2 (en) 2023-07-23 2026-04-28 Palo Alto Networks, Inc. Security incident ranking and ranking explanation
US12483384B1 (en) 2025-04-16 2025-11-25 Extrahop Networks, Inc. Resynchronizing encrypted network traffic

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070272744A1 (en) * 2006-05-24 2007-11-29 Honeywell International Inc. Detection and visualization of patterns and associations in access card data
CN101895521A (zh) * 2009-05-22 2010-11-24 中国科学院研究生院 一种网络蠕虫检测与特征自动提取方法及其系统
CN102629308A (zh) * 2012-03-09 2012-08-08 奇智软件（北京）有限公司 一种防止登录信息被盗取的方法及装置
CN103957205A (zh) * 2014-04-25 2014-07-30 国家电网公司 一种基于终端流量的木马检测方法

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8117659B2 (en) * 2005-12-28 2012-02-14 Microsoft Corporation Malicious code infection cause-and-effect analysis
CN101552779B (zh) * 2009-05-04 2012-05-23 电子科技大学 网络木马的综合检测方法和综合检测装置
CN101546367B (zh) * 2009-05-04 2012-05-23 电子科技大学 带预警功能的网络木马综合检测方法
US20120090027A1 (en) * 2010-10-12 2012-04-12 Electronics And Telecommunications Research Institute Apparatus and method for detecting abnormal host based on session monitoring
US8549648B2 (en) * 2011-03-29 2013-10-01 Mcafee, Inc. Systems and methods for identifying hidden processes
IL219597A0 (en) * 2012-05-03 2012-10-31 Syndrome X Ltd Malicious threat detection, malicious threat prevention, and a learning systems and methods for malicious threat detection and prevention
US9819729B2 (en) * 2012-12-21 2017-11-14 Bmc Software, Inc. Application monitoring for cloud-based architectures
CN103957128B (zh) * 2014-03-28 2017-04-05 山东乾云启创信息科技股份有限公司 云计算环境下监控数据流向的方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20070272744A1 (en) * 2006-05-24 2007-11-29 Honeywell International Inc. Detection and visualization of patterns and associations in access card data
CN101895521A (zh) * 2009-05-22 2010-11-24 中国科学院研究生院 一种网络蠕虫检测与特征自动提取方法及其系统
CN102629308A (zh) * 2012-03-09 2012-08-08 奇智软件（北京）有限公司 一种防止登录信息被盗取的方法及装置
CN103957205A (zh) * 2014-04-25 2014-07-30 国家电网公司 一种基于终端流量的木马检测方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108777679A (zh) * 2018-05-22 2018-11-09 深信服科技股份有限公司 终端的流量访问关系生成方法、装置和可读存储介质
CN108777679B (zh) * 2018-05-22 2021-09-17 深信服科技股份有限公司 终端的流量访问关系生成方法、装置和可读存储介质

Also Published As

Publication number Publication date
CN106033514B (zh) 2019-08-09
CN106033514A (zh) 2016-10-19
US20180075240A1 (en) 2018-03-15

Similar Documents

Publication Publication Date Title
WO2016150313A1 (zh) 一种可疑进程的探测方法及装置
US12563072B1 (en) Monitoring the usage of an application at an edge device
US11909752B1 (en) Detecting deviations from typical user behavior
US20220400129A1 (en) Detecting Anomalous Behavior Of A Device
US12309181B1 (en) Establishing a location profile for a user device
KR101691853B1 (ko) 자동화된 자산 중요도 평가
US9679125B2 (en) Characterizing user behavior via intelligent identity analytics
US20230328086A1 (en) Detecting Anomalous Behavior Using A Browser Extension
JP6703616B2 (ja) セキュリティ脅威を検出するためのシステム及び方法
RU2017118317A (ru) Система и способ автоматического расчета кибер-риска в бизнес-критических приложениях
CN106487775A (zh) 一种基于云平台的业务数据的处理方法和装置
WO2023064007A1 (en) Augmented threat investigation
CN107733902A (zh) 一种目标数据扩散过程的监控方法及装置
US20240414184A1 (en) Network security assessment based upon identification of an adversary
US12463995B1 (en) Tiered risk engine with user cohorts
US20250088521A1 (en) Identifying similarities in complex objects at scale
US20250306740A1 (en) Adding device trust to generate a stronger notion of request origination
CN115913700A (zh) 基于威胁情报的网络安全告警的自动处置方法及相关设备
US12418554B1 (en) Device population anomaly detection
CN109639726A (zh) 入侵检测方法、装置、系统、设备及存储介质
US10614225B2 (en) System and method for tracing data access and detecting abnormality in the same
RU180789U1 (ru) Устройство аудита информационной безопасности в автоматизированных системах
KR102311997B1 (ko) 인공지능 행위분석 기반의 edr 장치 및 방법
WO2025151332A1 (en) Event correlation determination in extended detection and response systems
CN118337403B (zh) 基于ioc的攻击路径还原方法、装置、电子设备及介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16767690

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15559176

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16767690

Country of ref document: EP

Kind code of ref document: A1