WO2017101874A1

WO2017101874A1 - Detection method for apt attack, terminal device, server and system

Info

Publication number: WO2017101874A1
Application number: PCT/CN2016/110469
Authority: WO
Inventors: 江爱军; 张聪
Original assignee: 北京奇虎科技有限公司; 北京奇安信科技有限公司
Priority date: 2015-12-18
Filing date: 2016-12-16
Publication date: 2017-06-22
Also published as: CN105430001A

Abstract

Disclosed are a detection method for an APT attack, a terminal device, a server and a system, which relate to the technical field of information security and are primarily used for realizing rapid and precise detection of APT attacks. The primary technical solution of the present invention comprises: a terminal device recording attribute information about a pre-set file in a local area network, wherein the attribute information about the pre-set file comprises identification information, time information, source information, and transfer target information; determining whether the pre-set file is a grey file according to the attribute information, wherein the grey file neither exists in a white list of the pre-set file nor a black list in the pre-set file; if it is determined that the pre-set file is a grey file, then determining whether the grey file has triggered a pre-set abnormal behaviour rule; and if it is determined that the grey file has triggered the pre-set abnormal behaviour rule, sending to a server abnormality alarm information about the grey file having triggered the pre-set abnormal behaviour rule, wherein the abnormality alarm information contains identification information about the terminal device. The present invention is primarily applied in the process of detecting an APT attack.

Description

APT attack detection method, terminal device, server and system

The present invention relates to the field of information security technologies, and in particular, to a method, a terminal device, a server, and a system for detecting an APT attack. Background technique

With the continuous development of computer technology, the degree of informatization of human society is getting higher and higher, and the degree of dependence of computer society on the whole society is getting higher and higher. At the same time, the threat of security in computer files is growing, and Advanced Persi stent Threat (APT) is one of the most serious threats in information security, and it is a continuous cyber attack.

The principle of APT attack is more advanced and advanced than other forms of attack. Its advanced nature is mainly reflected in the need for APT to accurately collect the business process and target system of the attack object before launching the attack. During this collection, the attack actively exploits the vulnerabilities of the systems and applications trusted by the attacking object. These vulnerabilities are used to build the network required by the attacker and exploit the Oday vulnerability. The means of APT attacks is to hide themselves, steal data from specific objects for a long time, in a planned and organized manner. This kind of stealing of information and intelligence gathering in digital space is a kind of "cyber espionage".

In order to be able to detect hidden APT attacks in order to repair them in time, people have come up with a variety of solutions. The current common technical solutions are: relying on human experience to judge, this kind of judgment method can not detect APT attacks quickly and accurately, and may miss the latent APT attacks, so it may seriously threaten the security of computer data information. Summary of the invention

In view of the above, the present invention provides an APT attack detection method, a terminal device, a server, and a system, and the main purpose thereof is to solve the APT attack when the APT attack is manually detected, and the APT attack cannot be detected quickly and accurately, and the latent APT attack may be missed. Therefore, it may seriously threaten the security of computer data information.

According to an aspect of the present invention, the present invention provides a method for detecting an APT attack, including: the terminal device records attribute information of a preset file in a local area network; wherein, the attribute information of the preset file includes identification information, time information, Source information and transfer target information;

Determining, according to the attribute information, whether the preset file is a gray file; wherein the gray file is neither in the white list of the preset file nor in the blacklist of the preset file;

If it is determined that the preset file is the gray file, determining whether the gray file triggers a preset abnormal behavior rule;

If it is determined that the gray file triggers the preset abnormal behavior rule, sending, to the server, the abnormal warning information of the gray file triggering preset abnormal behavior rule; wherein the abnormal warning information includes the identification information of the terminal device.

According to another aspect of the present invention, the present invention provides a method for detecting an APT attack, including: The server receives the attribute information of the gray file reported by each terminal device in the local area network; wherein the attribute information of the gray file includes the identification information, the source information, the flow destination information, and the time information;

Obtaining the gray file of the terminal device in the preset time period according to the identifier information of the terminal device included in the abnormal warning information when receiving the abnormal warning information sent by the terminal device in the local area network; the abnormal warning The information is generated according to the gray file triggering a preset abnormal behavior rule;

Obtaining attribute information of the gray file reported by each terminal device in the local area network according to the identifier information of the gray file;

Acquiring, according to the attribute information of the gray file reported by each terminal device in the local area network, a flow path of the gray file; wherein, the flow path is to serially source the source information and the flow target information of the gray file in chronological order Forming.

According to still another aspect of the present invention, the present invention provides a terminal device, including:

a first recording unit, configured to record attribute information of a preset file in the local area network, where the attribute information of the preset file includes identification information, time information, source information, and flow target information;

a first determining unit, configured to determine, according to the attribute information recorded by the first recording unit, whether the preset file is a gray file; wherein the gray file is neither in the white list of the preset file , there is also no blacklist of the preset file;

a second determining unit, configured to: when the first determining unit determines that the preset file is the gray file, determine whether the gray file triggers a preset abnormal behavior rule;

a first sending unit, configured to: when the second determining unit determines that the gray file triggers the preset abnormal behavior rule, send, to the server, abnormal warning information that triggers the preset abnormal behavior rule by the gray file; The abnormal warning information includes identification information of the terminal device.

According to still another aspect of the present invention, the present invention provides a server, including:

The first receiving unit is configured to receive the attribute information of the gray file reported by each terminal device in the local area network, where the attribute information of the gray file includes the identification information, the source information, the flow destination information, and the time information;

a first acquiring unit, configured to: when receiving the abnormal warning information sent by the terminal device in the local area network, obtain, according to the identifier information of the terminal device included in the abnormal warning information, the terminal device in a preset time period a gray file; the abnormal warning information is generated according to the gray file triggering preset abnormal behavior rule; the second obtaining unit is configured to acquire, according to the gray file identifier information received by the first receiving unit, the local area network Attribute information of the gray file reported by each terminal device;

a third obtaining unit, configured to acquire a flow path of the gray file according to the attribute information of the gray file reported by each terminal device in the local area network acquired by the second acquiring unit, where the flow path is a The source information of the gray file and the flow target information are formed in tandem in chronological order.

According to still another aspect of the present invention, the present invention provides a detection system for an APT attack, the system comprising: the terminal device as described above and the server as described above.

According to still another aspect of the present invention, a computer program comprising computer readable code, when the computer readable code is run on a computing device, causes the computing device to perform the detection method of the APT attack described above.

According to still another aspect of the present invention, a computer readable medium is provided, wherein the above meter is stored Computer program.

According to the foregoing technical solution, the APT attack detection method, the terminal device, the server, and the system provided by the present invention, when detecting an APT attack, the terminal device records the attribute information of the preset file in the local area network; wherein, the attribute of the preset file The information includes the identification information, the time information, the source information, and the flow destination information. The content of the preset file is determined to be a gray file according to the attribute information. The gray file is neither in the white list of the preset file. If the preset file is determined to be the gray file, determine whether the gray file triggers a preset abnormal behavior rule; if the gray file triggers the preset The abnormal behavior rule sends the abnormal warning information of the gray file to the preset abnormal behavior rule to the server; wherein the abnormal warning information includes the identification information of the terminal device; and the method for manually detecting the APT attack by using the prior art In contrast, when the abnormal behavior of the gray file triggers the preset abnormal behavior rule in the present invention, The terminal sends an abnormal warning message to the server, and the server obtains the flow path of the gray file according to the identification information of the gray file reported by each terminal in the local area network, and obtains the gray file according to the flow path to perform the time information and source information of the local area network, which can be fast, Accurate detection of APT attacks.

The above description is only an overview of the technical solutions of the present invention, and the technical means of the present invention can be more clearly understood, and can be implemented in accordance with the contents of the specification, and the above and other objects, features and advantages of the present invention can be more clearly understood. Specific embodiments of the invention are set forth below.

DRAWINGS

Various other advantages and benefits will become apparent to those skilled in the art in the <RTIgt; The drawings are only for the purpose of illustrating the preferred embodiments and are not intended to limit the invention. Throughout the drawings, the same reference numerals are used to refer to the same parts. In the accompanying drawings, FIG. 1 is a flowchart of a method for detecting an APT attack according to an embodiment of the present invention;

FIG. 2 is a flowchart of a method for detecting an APT attack according to an embodiment of the present invention; FIG. 3 is a block diagram showing a composition of a terminal device according to an embodiment of the present invention;

FIG. 4 is a block diagram showing the composition of another terminal device according to an embodiment of the present invention;

FIG. 5 is a block diagram showing the composition of a server according to an embodiment of the present invention;

FIG. 6 is a block diagram showing the composition of another server according to an embodiment of the present invention;

FIG. 7 is a block diagram showing the composition of an APT attack detection system according to an embodiment of the present invention;

Figure 8 is a block diagram schematically showing a computing device for performing a detection method of an APT attack according to the present invention;

Fig. 9 schematically shows a storage unit for holding or carrying program code for implementing the detection method of the APT attack according to the present invention. detailed description

The invention is further described below in conjunction with the drawings and specific embodiments.

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While the embodiments of the present invention have been shown in the drawings, the embodiments Rather, these embodiments are provided to provide a more thorough understanding of the present disclosure and The scope of the present disclosure is fully conveyed to those skilled in the art.

An embodiment of the present invention provides a method for detecting an APT attack, and the method is applied to a terminal device side. As shown in FIG. 1, the method includes:

101. The terminal device records attribute information of a preset file in the local area network.

In a local area network environment, a plurality of terminal devices are included, and each terminal device records attribute information of the preset file, where the attribute information of the preset file includes identification information, time information, source information, and flow destination information; It is noted that the preset file refers to a file downloaded from a network or obtained by wired or wireless transmission from a USB flash drive, a hard disk, or a smart phone; the network download includes but is not limited to the following contents, for example: website download, mail download, Network sharing and more. The embodiment of the present invention does not limit the source of the preset file and the specific type of the preset file.

To ensure that the terminal device records the accuracy of the preset file attribute information, when the terminal device receives the preset file for the first time, the attribute information of the preset file is recorded, and when the terminal device records the attribute information of the preset file, only Recording once; before the attribute information of the preset file is recorded, the security level of the preset file cannot be determined, therefore, the attribute information of all the preset files in the terminal device needs to be recorded; wherein, the preset file The security level includes: a whitelist file, a blacklist file, and a gray file. The gray file is a file that is neither a whitelist nor a blacklist. The embodiment of the present invention records the attribute information of the preset file in the local area network. The specific timing and security level of the preset file are not limited.

In order to more clearly record the attribute information of the preset file, the following will be described in detail by way of examples. Exemplarily, when the terminal device A contains the preset file I, the preset file I is transmitted to the terminal device A by the user using the U disk on March 4, 2015, and the terminal device A is on May 28, 2015. On the day, the preset file I is sent to the terminal device B and the terminal device C by means of mail. For the same preset file I, the terminal device A records the attribute information of the preset file, including: the preset file identification information is WJ-001, the time information is March 4, 2015, the source information is U disk, and the flow destination information is The terminal device B and the terminal device C; the terminal device B records the attribute information of the preset file, including: the preset file identification information is WJ-001, the time information is May 28, 2015, the source information is the terminal device A, and the flow destination information If the terminal device C records the attribute information of the preset file, the preset file identification information is WJ-001, the time information is May 28, 2015, the source information is terminal device A, and the flow destination information is none. The above is only an exemplary example, and the specific content of the attribute information of the preset file recorded by the terminal device is not limited in the embodiment of the present invention.

102. The terminal device determines, according to the attribute information, whether the preset file is a gray file.

In this step, the security level of the preset file is determined based on the attribute information of the preset file recorded in step 101. If the preset file is a whitelist file, the preset file is safe, and the APT cannot exist in the preset file. If the preset file is a blacklist file, the preset file is a dangerous file, and the preset file is filtered or deleted. If the preset file is a gray file, the risk factor of the preset file is unknown. . Therefore, the gray file needs to be tracked.

103. If it is determined that the preset file is the gray file, the terminal device determines whether the gray file triggers a preset abnormal behavior rule.

After determining that the preset file is a gray file, if there is no abnormal behavior during the flow of the gray file between the terminal devices in the local area network, the APT attack does not exist in the gray file; if the file is in the local area If an abnormal behavior occurs during the process of transferring between terminal devices in the network, the APT attack may exist in the gray file. The APT attack has a high degree of concealment, and the time for initiating an APT attack is uncertain. Therefore, in the embodiment of the present invention, the terminal device monitors the gray file to determine whether the gray file triggers the preset abnormal behavior rule.

The preset abnormal behavior rule is an empirical value. When the abnormal behavior rule is set, the abnormal behavior rule may include, but is not limited to, the following content, for example: access rights of the gray file, execution time of the gray file, and the like.

In the specific implementation, different terminal users will have different access rights. For example, the finance department will have corresponding access rights, and the R&D department will have corresponding access rights. If the gray file in the terminal device of the R&D part is To access the finance department, the gray file triggers the preset abnormal behavior rule. Or, the terminal device has a fixed working time. Assume that the working time of the terminal device is 09: 00-17: 30. If the gray file in the terminal device is automatically executed at 22: 00, the gray file triggers the preset abnormality. Rules of conduct. The specific setting content of the preset abnormal behavior rule is not specifically limited in the embodiment of the present invention.

104. If it is determined that the gray file triggers the preset abnormal behavior rule, the terminal device sends the abnormal warning information of the gray file triggering preset abnormal behavior rule to the server.

When it is determined that the gray file triggers the preset abnormal behavior rule, the terminal device determines that the APT attack may be generated in the gray file, and therefore, the terminal device sends abnormal warning information to the server for the abnormal behavior, where the abnormal warning information includes the terminal device. Identification information.

The APT attack detection method provided by the embodiment of the present invention, when detecting an APT attack, the terminal device records the attribute information of the preset file in the local area network; wherein the attribute information of the preset file includes the identification information, the time information, the source information, and Flowing the target information; determining, according to the attribute information, whether the preset file is a gray file; wherein the gray file is neither in the white list of the preset file, nor is the black of the preset file If it is determined that the preset file is the gray file, determining whether the gray file triggers a preset abnormal behavior rule; if it is determined that the gray file triggers a preset abnormal behavior rule, sending the gray to the server The file triggers the abnormal warning information of the preset abnormal behavior rule; wherein the abnormal warning information includes the identification information of the terminal device; compared with the manner of manually detecting the APT attack in the prior art, the gray file is used in the embodiment of the present invention. When the abnormal behavior triggers the preset abnormal behavior rule, the terminal sends an abnormal warning message to the server. The server obtains the flow path of the gray file according to the identification information of the gray file reported by each terminal in the local area network, and obtains the gray file according to the flow path to perform time information and source information of the local area network, so that the APT attack can be detected quickly and accurately.

Further, as a refinement and extension of the method shown in FIG. 1, the terminal device records the attribute information of the preset file in the local area network in step 101, which can be implemented by using, but not limited to, the following manners:

Method 1: Record the attribute information of the preset file in the local area network based on the preset driver.

When the terminal device is used as the flow destination information and receives the preset file, the preset driver automatically recognizes the preset file and records the attribute information of the preset file; in the specific operation, the preset driver may include The embodiment of the present invention does not limit the specific type of the preset driver.

Manner 2: The attribute information of the preset file in the local area network is recorded based on the preset gateway device. When the terminal device uses the Internet to download the preset file, the preset gateway device automatically recognizes the preset file, and records the attribute information of the preview file.

It should be noted that, when the attribute information of the preset file in the local area network is recorded by the mode 1, if the preset file is a gray file, and the gray file triggers the preset abnormal behavior rule, the terminal device reports the gray file trigger to the server. If the preset file is a gray file and the gray file triggers the preset abnormal behavior rule, the preset gateway device The server reports the gray file to trigger the abnormal warning information of the preset abnormal behavior rule.

Further, in order to enable the server to report the abnormal warning information on the terminal device, the gray file in the terminal device is traced in time. Therefore, before the terminal device sends the gray file to trigger the abnormal warning information of the preset abnormal behavior rule. The terminal device records the time information, the source information, and the flow destination information of the gray file according to the identification information of the gray file, and the terminal device sends the time information, the source information, and the flow destination information of the recorded gray file to the server. It should be noted that a plurality of gray files may exist in the same terminal device, and the terminal device needs to record the time information, the source information, and the flow destination information of the gray file according to different identification information of each gray file. Each terminal device in the local area network reports the time information, source information, and flow destination information of the gray file to the server to ensure the integrity and accuracy of the flow path of the server when it traces the flow path of the gray file.

Further, when the terminal device determines whether the preset file is a gray file according to the attribute information, the specific process is as follows: After the terminal device records the attribute information of the preset file, the attribute information is sent to the cloud killing server, and the cloud killing server The blacklist and the whitelist of the preset file are recorded. After receiving the attribute information of the preset file, the cloud search server obtains the identifier information in the attribute information, and traverses the blacklist and the whitelist based on the identifier information, if the identifier information If the blacklist is in the blacklist, the preset file corresponding to the identifier information is directly filtered. If the identifier information exists in the whitelist, the preset file corresponding to the identifier information is determined to be a security file; if the identifier information does not exist, If the whitelist is not in the blacklist, the preset file corresponding to the identifier information is determined to be a gray file. At this time, the cloud killing server returns the identifier information of the gray file to the terminal device, so that the terminal device can The attribute information of the gray file is recorded and reported to the server.

Further, before the terminal device determines whether the gray file triggers the preset abnormal behavior rule, the preset abnormal behavior rule is generated, and the preset abnormal text rule is used to determine whether the gray file has an abnormal behavior.

Further, after the preset abnormal behavior rule is generated, determining, by the terminal device, whether the gray file triggers the preset abnormal behavior rule specifically includes: acquiring a preset abnormal behavior rule, determining whether the gray file has an abnormal behavior, and determining whether the abnormal behavior triggers the pre-action Set abnormal behavior rules. Exemplarily, it is assumed that the preset abnormal behavior rule includes: When the abnormal execution time of the gray file exceeds one time, the gray file triggers the preset abnormal behavior rule, and the abnormal execution time is 22: 00-day 05 : 00; If the gray file is executed once at 23: 00, the terminal device determines that the execution of the gray file is an abnormal behavior, and checks whether the gray file is abnormally executed more than once within one day; if the gray file is abnormal If the execution is one time, the abnormal warning information will not be reported to the server. If the abnormal execution of the gray file is performed twice, the abnormal warning information is reported to the server.

Another embodiment of the present invention provides a method for detecting an attack. The method is applied to the server side. As shown in FIG. 2, the method includes:

201. The server receives the attribute information of the gray file reported by each terminal device in the local area network. The attribute information of the gray file includes the identifier information, the source information, the flow destination information, and the time information. For a detailed description of the gray file, refer to the detailed description in step 101, which is not described herein again.

202. The server obtains the gray file in the preset time period according to the identifier information of the terminal device included in the abnormal warning information when receiving the abnormal warning information sent by the terminal device in the local area network.

When the terminal device reports an abnormality warning, it indicates that the APT attack may be generated in the gray file in the terminal device, and the abnormal warning information is generated according to the preset abnormal behavior rule triggered by the gray file; When the server receives the abnormal warning information sent by the terminal device, the server obtains the terminal device at the preset time according to the identification information of the terminal device included in the abnormal warning information. All gray files in the segment, and obtain identification information corresponding to all gray files.

The preset time period is manually set by the LAN operation and maintenance personnel. When the preset time period is set, the preset time period may be set to one week; or, the preset time period may be set to one month, and the specific implementation of the present invention is implemented. For example, the setting of the preset time period is not limited.

203. The server obtains, according to the identifier information of the gray file, the attribute information of the gray file reported by each terminal device in the local area network.

Since the flow of the gray file in the local area network is random, and the time information, the source information, and the flow destination information of the terminal device reporting the gray file to the server are separately sent by the terminal devices, the server receives the time information sent by the terminal device. When the source information and the flow destination information are used, only the received information is saved, and the flow path of the gray file in the local area network is not concatenated according to the identification information of the gray file. Only when the terminal device sends an abnormal warning message, the server will concatenate the time information, source information and flow destination information of the gray file in the local area network.

The server obtains a flow path of the gray file according to the attribute information of the gray file reported by each terminal device in the local area network.

After obtaining the attribute information of the gray file reported by each terminal device in the local area network, the server sequentially connects the source information of the gray file and the flow destination information according to the identification information of the gray file according to the time sequence; The file's flow path, and the flow path is output, so that the LAN operation and maintenance personnel can find the source of the APT attack.

As an implementation manner of the embodiment of the present invention, when displaying the flow path, the display is performed in the form of a graph, and the graph includes time information of the gray file flowing in the local area network; or, the flow of the gray file is performed in a time axis manner. The path is displayed. The embodiment of the present invention does not limit the manner in which the output flow path is displayed.

The APT attack detection method provided by the embodiment of the present invention, when detecting an APT attack, the terminal device records the attribute information of the preset file in the local area network; wherein the attribute information of the preset file includes the identification information, the time information, the source information, and Flowing the target information; determining, according to the attribute information, whether the preset file is a gray file; wherein the gray file is neither in the white list of the preset file, nor is the black of the preset file If it is determined that the preset file is the gray file, determining whether the gray file triggers a preset abnormal behavior rule; if it is determined that the gray file triggers a preset abnormal behavior rule, sending the The gray file triggers the abnormal warning information of the preset abnormal behavior rule; wherein the abnormal warning information includes the identification information of the terminal device; compared with the manner of manually detecting the APT attack in the prior art, in the embodiment of the present invention, When the abnormal behavior of the gray file triggers the preset abnormal behavior rule, the terminal sends an abnormal warning message to the server. The server obtains the flow path of the gray file according to the identification information of the gray file reported by each terminal in the local area network, and obtains the gray file according to the flow path. The time information and source information of the local area network can detect APT attacks quickly and accurately.

Further, as a refinement and extension of the method shown in FIG. 2, after obtaining the attribute information of the gray file reported by each terminal device in the local area network according to the identification information of the gray file, the gray file is obtained according to the gray file. The identification information is used to parse the attribute information of the gray file, determine the time information, the source information, and the flow destination information of the gray file, and serialize the source information of the gray file and the flow destination information according to the order of the time information.

Illustratively, if the identification information of the gray file is HWJ-008, the server searches for the attribute information reported by each terminal device according to the identification information HWJ-008, wherein the terminal device that includes the HWJ-008 in the attribute information has a terminal. The device 1, the terminal device 8, the terminal device 45, and the terminal device 12, wherein the recording time information in the terminal device 1 is March 9, 2015, the source information is the terminal device 8, and the flow destination information 12; the recording time in the terminal device 8 The information is February 20, 2015, the source information is XXX website, the flow destination information 1; the time information recorded in the terminal device 12 is March 15, 2015, the source information is the terminal device 1, and the flow destination information is the terminal device 45; The recording time information in the terminal device 45 is April 6, 2015, the source information is the terminal device 12, and the flow destination information is none. According to the time information, the server forms a flow path of the gray file whose identification information is HWJ-008: terminal device 8 (February 20, 2015) → terminal device 1 (March 9, 2015) → terminal device 12 (2015 March 15) → Terminal Equipment 45 (April 6, 2015). The above is only an exemplary example. The embodiment of the present invention does not limit the identification information, the source information of the gray file in the local area network, and the flow destination information.

Further, before receiving the attribute information of the gray file reported by each terminal device in the local area network, the server receives the preset file sent by the terminal device, and receives a database table sent by the cloud killing server, where the database table is based on the cloud killing database. The whitelist and the blacklist of the preset file are generated. The server determines whether the received preset file is a gray file according to the database table. After determining that the preset file is a gray file, the attribute information of the gray file reported by the terminal device is received. The server determines that the preset file is a gray file, and only receives the attribute information of the gray file, and does not receive the attribute information corresponding to the white list determined by the cloud killing server or the preset file in the blacklist, which can save part of the server. Processing resources; At the same time, there is no APT attack on the preset files in the whitelist, so there is no need to track the preset files.

As an implementation manner of the embodiment of the present invention, the cloud killing server checks and kills the preset file recorded by the terminal device in real time, determines the security of the preset file, that is, determines whether the preset file is a whitelist file, and black. a list file or a gray file; after determining the type of the preset file, storing it in a database table, and sending the database table to the server according to a preset period; or, after determining the type of the preset file, sending the database table to the real-time table to The server, the embodiment of the present invention does not limit the timing of sending a database table to the server.

Further, as an implementation of the method shown in FIG. 1 above, another embodiment of the present invention further provides a Terminal Equipment. The device embodiment corresponds to the foregoing method embodiment. For ease of reading, the device embodiment does not describe the details in the foregoing method embodiments one by one, but it should be clear that the device in this embodiment can implement the foregoing method. All the contents of the example.

A terminal device provided by the embodiment of the present invention, as shown in FIG. 3, includes:

The first recording unit 31 is configured to record attribute information of the preset file in the local area network, where the attribute information of the preset file includes identification information, time information, source information, and flow target information;

a first determining unit 32, configured to determine, according to the attribute information recorded by the first recording unit 31, whether the preset file is a gray file; wherein the gray file is neither present in the white of the preset file There is also no blacklist of the preset files in the list;

a second determining unit 33, configured to: when the first determining unit 32 determines that the preset file is the gray file, determine whether the gray file triggers a preset abnormal behavior rule;

The first sending unit 34 is configured to: when the second determining unit 33 determines that the gray file triggers the preset abnormal behavior rule, send the abnormal warning information of the gray file triggering preset abnormal behavior rule to the server; The abnormal warning information includes identification information of the terminal device.

Further, as shown in FIG. 4, the first recording unit 31 includes:

The first recording module 31 1 is configured to record attribute information of the preset file in the local area network based on the preset driver; and the second recording module 312 is configured to record attribute information of the preset file in the local area network based on the preset gateway device. Further, as shown in FIG. 4, the terminal device further includes: a second recording unit 35, configured to: before the first sending unit 34 sends the gray file triggering abnormal warning information of the preset abnormal behavior rule to the server And recording, according to the identification information of the gray file, time information, source information, and flow destination information of the gray file;

The second sending unit 36 is configured to send the time information, the source information, and the flow target information recorded by the second recording unit 35 to the server.

Further, as shown in FIG. 4, the first determining unit 32 includes:

The sending module 321 is configured to send the attribute information to the cloud killing server, so that the cloud checking server determines, according to the attribute information, whether the preset file is the gray file, and when the cloud kills the server When the identifier information of the gray file is returned, determining that the preset file is a gray file;

a determining module 322, configured to determine, after the sending module 321 sends the attribute information to the cloud killing server, whether the preset file is grayed out according to whether the cloud checking server sends the identifier information file.

Further, as shown in FIG. 4, the terminal device further includes: a generating unit 37, configured to generate a preset abnormal behavior rule before the second determining unit 33 determines whether the gray file triggers a preset abnormal behavior rule .

Further, as shown in FIG. 4, the second determining unit 33 includes:

The obtaining module 331, is configured to obtain the preset abnormal behavior rule;

a determining module 332, configured to determine whether the gray file has an abnormal behavior;

The determining module 333 is configured to determine whether the abnormal behavior determined by the determining module 332 triggers the preset abnormal behavior rule acquired by the acquiring module 331. Further, as an implementation of the method shown in FIG. 2, another embodiment of the present invention further provides a server. The device embodiment corresponds to the foregoing method embodiment. For ease of reading, the device embodiment does not describe the details in the foregoing method embodiments one by one, but it should be clear that the device in this embodiment can implement the foregoing method. All the contents of the example.

An embodiment of the present invention provides a server, as shown in FIG. 5, including:

The first receiving unit 51 is configured to receive the attribute information of the gray file reported by each terminal device in the local area network, where the attribute information of the gray file includes the identification information, the source information, the flow destination information, and the time information. The first obtaining unit 52 And acquiring, when receiving the abnormal warning information sent by the terminal device in the local area network, the gray file in the preset time period according to the identification information of the terminal device included in the abnormal warning information; The abnormal warning information is generated according to the gray file triggering preset abnormal behavior rule;

The second obtaining unit 53 is configured to acquire the attribute information of the gray file reported by each terminal device in the local area network according to the identifier information of the gray file received by the first receiving unit 51;

The third obtaining unit 54 is configured to acquire, according to the attribute information of the gray file reported by each terminal device in the local area network, the flow path of the gray file, where the flow path is The source information of the gray file and the flow target information are formed in tandem in chronological order.

Further, as shown in FIG. 6, the server further includes: a parsing unit 55, configured to acquire, according to the identifier information of the gray file, the reported by each terminal device in the local area network, respectively, in the second obtaining unit 53 After the attribute information of the gray file, the attribute information of the gray file is parsed according to the identifier information of the gray file;

The first determining unit 56 is configured to determine, after the parsing unit 55 parses the attribute information of the gray file according to the identifier information of the gray file, time information, source information, and flow target information of the gray file;

The serial unit 57 is configured to serially connect the source information of the gray file and the flow target information according to a sequence of the time information determined by the first determining unit 56;

The forming unit 58, is configured to form the flow path of the gray file.

Further, as shown in FIG. 6, the server further includes a second receiving unit 59, configured to receive the terminal before the first receiving unit 51 receives the attribute information of the gray file reported by each terminal device in the local area network. a preset file sent by the device;

The third receiving unit 510 is configured to receive a database table sent by the cloud killing server, where the database table is generated by the cloud checking server according to the whitelist and the blacklist of the preset file;

a second determining unit 511, configured to determine, according to the database table received by the third receiving unit 510, whether the preset file is the gray file;

The first receiving unit 51 is further configured to: when the second determining unit 511 determines that the preset file is the gray file according to the database table, receive attribute information of a gray file reported by each terminal device in the local area network. .

Further, the embodiment of the present invention further provides an APT attack detection system. As shown in FIG. 7, the system includes: the terminal device 71 as shown in any one of FIG. 3 or FIG. 4, and FIG. 5 or FIG. 6 is shown in any of the figures Server 72.

The terminal device, the server, and the APT attack detection system provided by the embodiment of the present invention, when detecting an APT attack, the terminal device records the attribute information of the preset file in the local area network; wherein the attribute information of the preset file includes the identification information and the time. Information, source information, and flow target information; determining, according to the attribute information, whether the preset file is a gray file; wherein the gray file is neither in the white list of the preset file, nor exists If the preset file is determined to be the gray file, determining whether the gray file triggers the preset abnormal behavior rule; if it is determined that the gray file triggers the preset abnormal behavior rule, The server sends the gray file to trigger the abnormal warning information of the preset abnormal behavior rule; wherein the abnormal warning information includes the identification information of the terminal device; compared with the prior art, the method of the invention detects the APT attack manually, and the implementation of the present invention In the example, when the abnormal behavior of the gray file triggers the preset abnormal behavior rule, the terminal sends the server to the server. Sending abnormal warning information, the server obtains the flow path of the gray file according to the identification information of the gray file reported by each terminal in the local area network, and obtains the gray file according to the flow path to perform time information and source information of the local area network, which can quickly and accurately APT attacks are detected.

In the above embodiments, the descriptions of the various embodiments are different, and the details that are not detailed in an embodiment can be referred to the related descriptions of other embodiments.

Numerous specific details are set forth in the description provided herein. However, it is understood that the embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the description.

Similarly, the various features of the present invention are sometimes grouped together into a single embodiment, in the above description of the exemplary embodiments of the invention, Figure, or a description of it. However, the method of the disclosure should not be construed as reflecting the intention that the claimed invention requires more features than those explicitly recited in each claim. Rather, as the following claims reflect, inventive aspects reside in less than all features of the single embodiments disclosed herein. Therefore, the claims following the specific embodiments are hereby explicitly incorporated into the specific embodiments, and each of the claims as a separate embodiment of the invention.

Those skilled in the art will appreciate that the modules in the devices of the embodiments can be adaptively changed and placed in one or more devices different from the embodiment. The modules or units or components of the embodiments may be combined into one module or unit or component, and further they may be divided into a plurality of sub-modules or sub-units or sub-components. In addition to such features and/or at least some of the processes or units being mutually exclusive, any combination of the features disclosed in the specification, including the accompanying claims, the abstract and the drawings, and any methods so disclosed, or All processes or units of the device are combined. Each feature disclosed in the specification (including the accompanying claims, the abstract and the drawings) may be replaced by an alternative feature that provides the same, equivalent or similar purpose.

In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features that are not included in other embodiments, and other features, combinations of features of different embodiments are intended to be within the scope of the present invention. Different embodiments are formed and formed. For example, in the following claims, any one of the claimed embodiments can be used in any combination.

Various component embodiments of the present invention may be implemented in hardware or on one or more processors The software module implementation of the line, or a combination of them. Those skilled in the art will appreciate that some or all of the functionality of some or all of the components of the display device for map search results in accordance with embodiments of the present invention may be implemented in practice using a microprocessor or digital signal processor (DSP). The invention can also be implemented as a device or device program (e.g., a computer program and a computer program product) for performing some or all of the methods described herein. Such a program implementing the invention may be stored on a computer readable medium or may be in the form of one or more signals. Such signals may be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

For example, Figure 8 illustrates a computing device that can implement a method of detecting an APT attack in accordance with the present invention. The computing device conventionally includes a processor 810 and a computer program product or computer readable medium in the form of a memory 820. Memory 820 can be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read Only Memory), EPROM, hard disk or ROM. Memory 820 has a memory space 830 for program code 831 for performing any of the method steps described above. For example, storage space 830 for program code can include various program code 831 for implementing various steps in the above methods, respectively. The program code can be read from or written to one or more computer program products. These computer program products include program code carriers such as hard disks, compact disks (CDs), memory cards or floppy disks. Such a computer program product is typically a portable or fixed storage unit as described with reference to Figure 9. The storage unit can have storage segments, storage spaces, and the like that are similarly arranged to memory 820 in the computing device of FIG. The program code can be compressed, for example, in an appropriate form. Typically, the storage unit includes computer readable code 83, ie, code readable by a processor, such as 810, that when executed by the computing device causes the computing device to perform each of the methods described above step.

"an embodiment," or "an embodiment," or "one or more embodiments" as used herein means that the particular features, structures, or characteristics described in connection with the embodiments are included in at least one embodiment of the invention. In addition, it should be noted that the phrase "in one embodiment" herein does not necessarily refer to the same embodiment.

It is to be noted that the above-described embodiments are illustrative of the present invention and are not intended to limit the scope of the invention, and those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as a limitation. The word "comprising" does not exclude the presence of the elements or steps that are not recited in the claims. The word "a" or "an" preceding a component does not exclude the presence of a plurality of such elements. The invention can be implemented by means of hardware comprising several distinct elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means can be embodied by the same hardware item. The use of the words first, second, and third does not indicate any order. These words can be interpreted as names.

In addition, it should be noted that the language used in the specification has been selected for the purpose of readability and teaching, and is not intended to be construed as limiting or limiting. Therefore, many modifications and changes will be apparent to those skilled in the art without departing from the scope of the invention. The disclosure of the present invention is intended to be illustrative, and not restrictive, and the scope of the invention is defined by the appended claims.

Claims

Rights request

A method for detecting an APT attack, which is characterized by comprising:

The terminal device records the attribute information of the preset file in the local area network; wherein the attribute information of the preset file includes the identification information, the time information, the source information, and the flow destination information;

The method according to claim 1, wherein the recording, by the terminal device, the attribute information of the preset file in the local area network comprises: recording attribute information of the preset file in the local area network based on the preset driver;

Or, the attribute information of the preset file in the local area network is recorded based on the preset gateway device.

The method according to claim 2, wherein before the sending the gray file to the server to trigger the abnormal warning information of the preset abnormal behavior rule, the method further includes:

Recording, according to the identification information of the gray file, time information, source information, and flow target information of the gray file;

The time information, the source information, and the flow target information are transmitted to the server.

The method according to claim 3, wherein determining whether the preset file is a gray file according to the attribute information comprises:

Sending the attribute information to the cloud killing server, so that the cloud checking server determines, according to the attribute information, whether the preset file is the gray file, and when the cloud checking server returns the gray file When the information is identified, the preset file is determined to be a gray file;

And determining whether the preset file is a gray file according to whether the cloud killing server sends the identifier information.

The method according to any one of claims 1 to 4, wherein, before determining whether the gray file triggers a preset abnormal behavior rule, the method further includes:

Generate preset exception behavior rules.

The method according to claim 5, wherein determining whether the gray file triggers a preset abnormal behavior rule comprises:

Obtaining the preset abnormal behavior rule;

Determining whether the gray file has an abnormal behavior;

Determining whether the abnormal behavior triggers the preset abnormal behavior rule.

7. A method for detecting an APT attack, which is characterized by comprising:

The server receives the attribute information of the gray file reported by each terminal device in the local area network; wherein, the gray file The attribute information includes identification information, time information, source information, and flow destination information;

The method according to claim 7, wherein after the attribute information of the gray file reported by each terminal device in the local area network is obtained according to the identification information of the gray file, the method further includes: Parsing the attribute information of the gray file according to the identifier information of the gray file;

Determining time information, source information, and flow destination information of the gray file;

And serializing the source information of the gray file and the flow target information according to a sequence of the time information;

Forming the flow path of the gray file.

The method according to claim 7 or 8, wherein before the server receives the attribute information of the gray file reported by each terminal device in the local area network, the method further includes: receiving the preset file sent by the terminal device ;

Receiving a database table sent by the cloud killing server, where the database table is generated by the cloud killing server according to a white list and a blacklist of the preset file;

Determining, according to the database table, whether the preset file is the gray file;

The attribute information of the gray file reported by each terminal device in the local area network includes:

And if the preset file is determined to be the gray file according to the database table, the attribute information of the gray file reported by each terminal device in the local area network is received.

10. A terminal device, comprising:

The terminal device according to claim 10, wherein the first recording unit comprises: The first recording module is configured to record attribute information of the preset file in the local area network based on the preset driver; and the second recording module is configured to record attribute information of the preset file in the local area network based on the preset gateway device.

The terminal device according to claim 11, wherein the terminal device further includes: a second recording unit, configured to send, by the first sending unit, the gray file trigger preset abnormal behavior to a server Before the abnormal warning information of the rule, the time information, the source information, and the flow destination information of the gray file are recorded according to the identification information of the gray file;

And a second sending unit, configured to send the time information, the source information, and the flow target information recorded by the second recording unit to the server.

The terminal device according to claim 12, wherein the first determining unit comprises: a sending module, configured to send the attribute information to a cloud killing server, so that the cloud killing server is configured according to Determining, by the attribute information, whether the preset file is the gray file, and when the cloud search server returns the identification information of the gray file, determining that the preset file is a gray file;

And a determining module, configured to determine whether the preset file is a gray file, according to whether the cloud search server sends the identifier information, after the sending module sends the attribute information to the cloud killing server.

The terminal device according to any one of claims 10 to 13, wherein the terminal device further comprises:

And a generating unit, configured to generate a preset abnormal behavior rule before the second determining unit determines whether the gray file triggers a preset abnormal behavior rule.

The terminal device according to claim 14, wherein the second determining unit comprises: an acquiring module, configured to acquire the preset abnormal behavior rule;

a determining module, configured to determine whether the gray file has an abnormal behavior;

The determining module is configured to determine whether the abnormal behavior determined by the determining module triggers the preset abnormal behavior rule acquired by the acquiring module.

A server, comprising: a first receiving unit, configured to receive attribute information of a gray file reported by each terminal device in a local area network; wherein the attribute information of the gray file includes identification information, time information, and source Information and transfer target information;

The server according to claim 16, wherein the server further includes: a parsing unit, configured to acquire, in the second acquiring unit, each terminal device in the local area network according to the identification information of the gray file After the attribute information of the gray file is reported, the attribute information of the gray file is parsed according to the identification information of the gray file; a first determining unit, configured to determine, after the parsing unit parses the attribute information of the gray file according to the identifier information of the gray file, time information, source information, and flow target information of the gray file; And combining the source information of the gray file and the flow target information according to a sequence of the time information determined by the first determining unit;

Forming a unit for forming the flow path of the gray file.

The server according to claim 16 or 17, wherein the server further comprises: a second receiving unit, configured to receive attribute information of the gray file reported by each terminal device in the local area network in the first receiving unit Before receiving the preset file sent by the terminal device;

a third receiving unit, configured to receive a database table sent by the cloud killing server, where the database table is generated by the cloud killing server according to the whitelist and the blacklist of the preset file;

a second determining unit, configured to determine, according to the database table received by the third receiving unit, whether the preset file is the gray file;

The first receiving unit is further configured to: when the second determining unit determines that the preset file is the gray file according to the database table, receive attribute information of a gray file reported by each terminal device in the local area network.

A detection system for an APT attack, characterized in that the system comprises: the terminal device according to any one of claims 10-15 and the server according to any one of claims 16-18.

20. A computer program comprising computer readable code, when said computer readable code is run on a computing device, causing said computing device to perform an APT attack according to any of claims 1-9 Detection method.

A computer readable medium, wherein the computer program according to claim 20 is stored.