WO2017107616A1 - 一种检测终端安全状况方法、装置及系统 - Google Patents

一种检测终端安全状况方法、装置及系统 Download PDF

Info

Publication number
WO2017107616A1
WO2017107616A1 PCT/CN2016/101263 CN2016101263W WO2017107616A1 WO 2017107616 A1 WO2017107616 A1 WO 2017107616A1 CN 2016101263 W CN2016101263 W CN 2016101263W WO 2017107616 A1 WO2017107616 A1 WO 2017107616A1
Authority
WO
WIPO (PCT)
Prior art keywords
behavior
file
terminal
apt
dynamic
Prior art date
Application number
PCT/CN2016/101263
Other languages
English (en)
French (fr)
Inventor
甘永存
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP19214322.0A priority Critical patent/EP3687134B1/en
Priority to ES16877427T priority patent/ES2775874T3/es
Priority to EP16877427.1A priority patent/EP3288231B1/en
Publication of WO2017107616A1 publication Critical patent/WO2017107616A1/zh
Priority to US15/871,308 priority patent/US10735374B2/en
Priority to US16/897,050 priority patent/US11431676B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2101—Auditing as a secondary aspect

Definitions

  • the present application relates to the field of computers, and in particular to the field of computer security protection.
  • APT Advanced Persistent Threat
  • Google Google Inc.
  • Gmail Google's free webmail service
  • the Google brand had a serious impact on the Google brand.
  • the Iranian nuclear facility was attacked by the Stuxnet (seismic network), which caused serious damage to the core components of the nuclear facility, the centrifuge. The attack caused the consequences as much as a fixed-point bombing.
  • Stuxnet semiconductor network
  • RSA suffered a next-generation threat attack against SecureID, resulting in large-scale SecureID data leakage, which seriously affected the security of customers using SecureID.
  • the security of the company seriously affected the public image of the company.
  • antivirus software is generally deployed on the terminal device, and a security sandbox is deployed in front of the gateway or the mail server.
  • the anti-virus software deployed on the terminal device mainly detects the malware through the latest feature database provided by the software vendor, and deploys the security sandbox in front of the gateway or the mail server to detect the APT from the Internet.
  • the prior art solution can detect that the APT attack is inside the network, but it is impossible to determine whether a user is infected with the APT, and which specific users are infected with the APT, the targeted operation cannot be performed.
  • This paper describes a method, device and system for detecting the security status of a terminal, thereby realizing the detection of whether a specific terminal is infected with APT.
  • an embodiment of the present application provides an apparatus for detecting a security status of a terminal.
  • the device is located at the connection between the private network and the public network, and the terminal is located in the private network.
  • the apparatus includes a dynamic behavior result generation module, a dynamic behavior analysis module, and an infected host descriptor generator.
  • the dynamic behavior result generation module is configured to receive a file from a public network and run the file in the device to generate a dynamic behavior result.
  • the dynamic behavior result includes a sequence of behaviors formed in the order in which the behavior occurs.
  • the behaviors in this sequence of behaviors belong to different behavior types, including creating files, modifying the registry, configuring domain names, resolving addresses, connecting to the network, loading processes, and adding users.
  • the dynamic behavior analysis module is configured to determine, according to the dynamic behavior result generated by the dynamic behavior result generation module, whether the file includes an advanced sustainable threat.
  • the infected host descriptor generator is configured to: if the dynamic behavior analysis module determines that the file includes an advanced sustainable threat, obtain a stable behavior characteristic in the dynamic behavior result, generate a corresponding infected host descriptor according to the stable behavior feature, and The infected host descriptor is sent to the terminal.
  • the stable behavioral characteristic refers to the behavior that appears in the sequence of behaviors generated by the file after each run.
  • an embodiment of the present application provides a terminal device.
  • the terminal includes a receiving module, an infected host descriptor interpreter, and a determining module.
  • the receiving module is configured to receive an infected host descriptor from the security device.
  • the host descriptor interpreter is configured to parse the infected host descriptor received by the receiving module to obtain a behavior characteristic corresponding to the advanced sustainable threat included in the infected host descriptor.
  • the determining module is configured to search an operating system and a file system of the terminal, and determine whether the terminal has performed the behavior described by the behavior characteristic corresponding to the advanced sustainable threat. If the terminal has experienced the behavior described by the behavioral characteristics of the advanced sustainable threat, it is determined that the terminal has been infected with the advanced sustainable threat.
  • an embodiment of the present application provides a system for detecting a security status of a terminal, the system comprising the terminal security status detecting apparatus of the first aspect, and the terminal device of the second aspect.
  • an embodiment of the present application provides a method for detecting a security status of a terminal.
  • the method is performed by a security protection device, and the security protection device is located at a connection between the private network and the public network, and the terminal is located in the private network.
  • the security device receives the file from the public network and runs the file in the security device to generate a dynamic behavior result.
  • the dynamic behavior result contains a sequence of behaviors that are formed in chronological order of behavior.
  • the behaviors in this behavior sequence belong to different behavior types.
  • the behavior types include creating files, modifying the registry, configuring domain names, resolving addresses, connecting to the network, loading processes, and adding users.
  • the security protection device determines, according to the generated dynamic behavior result, whether the file includes an advanced sustainable threat situation, and if the advanced sustainable threat is included, obtains a stable behavior characteristic in the dynamic behavior result, and generates according to the stable behavior feature
  • the infected host descriptor is correspondingly sent and the infected host descriptor is sent to the terminal.
  • This stable behavioral characteristic refers to the behavior that occurs in the sequence of behaviors generated by the file after each run.
  • an embodiment of the present application provides a method for detecting a security status of a terminal.
  • the terminal receives an infected host descriptor from the security device.
  • the terminal parses the infected host descriptor to obtain a behavior characteristic corresponding to the advanced persistent threat included in the infected host descriptor. Searching the operating system and file system of the terminal to determine whether the terminal has performed the behavior described by the behavioral characteristics corresponding to the advanced sustainable threat. If the terminal has experienced the behavior described by the behavioral characteristics of the advanced sustainable threat, it is determined that the terminal has been infected with the advanced sustainable threat.
  • the solution provided by the embodiment of the present application can specifically detect whether a user is infected with the APT and which users are infected with the APT.
  • FIG. 1 is a schematic structural diagram of a network for detecting an APT infected by a terminal according to an embodiment of the present disclosure
  • FIG. 2 is a block diagram of a device for detecting a security status of a terminal according to an embodiment of the present application
  • Figure 3 is a schematic diagram of the results of a dynamic behavior
  • FIG. 4 is a schematic diagram of a terminal device according to an embodiment of the present application.
  • FIG. 5 is a schematic diagram of a summary IOC graphical representation of an editor output according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram of a system for detecting a security status of a terminal according to an embodiment of the present disclosure
  • FIG. 7 is a flowchart of a method for detecting a security status of a terminal according to an embodiment of the present application.
  • FIG. 8 is a flowchart of a method for detecting a security status of a terminal according to another embodiment of the present application.
  • FIG. 9 is a schematic diagram of a file class IOC according to an embodiment of the present application.
  • FIG. 10 is a schematic diagram of a registry class IOC according to an embodiment of the present application.
  • FIG. 11 is a schematic diagram of a summary IOC provided by an embodiment of the present application.
  • the network architecture described in the embodiments of the present application is for the purpose of more clearly illustrating the technical solutions of the embodiments of the present application, and does not constitute a limitation of the technical solutions provided by the embodiments of the present application.
  • the technical solutions provided by the embodiments of the present application are equally applicable to similar technical problems.
  • FIG. 1 is a schematic diagram of a network architecture of a system for detecting a security status of a terminal according to an embodiment of the present disclosure.
  • the terminal device 110 acquires data via the Internet, such as receiving an email or the like.
  • the firewall 120 disposed at the gateway restores the corresponding traffic to a file.
  • the firewall restores the traffic to a file through an HTTP (Hyper Text Transfer Protocol) proxy method.
  • the file type includes an exe (executable program) file and a DLL (Dynamic Link Library, Dynamic link library, also known as application extension) file, sys (system, system) file, com file, Doc file (word file), xls (Microsoft Excel worksheet) file, PDF (Portable Document Format) file Wait.
  • DLL Dynamic Link Library
  • Dynamic link library also known as application extension
  • the firewall 120 sends the restored file to the security sandbox 130 for detection.
  • the security sandbox 130 is disposed at the gateway, which detects whether the file from the firewall 120 is a malicious file containing an Advanced Persistent Threat (APT). If the security sandbox 130 detects that a file contains an APT, an IOC (Indicators of Compromised) corresponding to the APT is generated.
  • the security sandbox 130 synchronizes the IOC to each terminal device. Each terminal device parses the IOC to obtain a behavior characteristic included in the APT corresponding to the IOC, and queries an operating system and a file system of the corresponding terminal according to the feature to determine whether the user terminal is infected with the APT.
  • APT Advanced Persistent Threat
  • a security sandbox is a security mechanism that provides an isolated environment for running programs.
  • the sandbox usually strictly controls the resources that can be accessed by the programs running in it.
  • the sandbox can provide disk and memory space that can be recycled after use.
  • network access, access to real operating systems, and exclusive rights to input devices are prohibited or severely restricted. All changes in the sandbox will not cause any damage to the real operating system. Therefore, this technique is generally widely used to test executable files or other malicious code that may carry viruses.
  • the user terminal involved in the present application may include a mobile device, a tablet computer, a notebook computer, a UMPC (Ultra-mobile Personal Computer), a netbook, a PDA (Personal Digital Assistant), and the like.
  • UMPC Ultra-mobile Personal Computer
  • netbook a netbook
  • PDA Personal Digital Assistant
  • the detection terminal security status device 200 is a security protection device, which is located at a connection between a private network and a public network, and the terminal is located in a private network.
  • the device 200 includes a dynamic behavior result generation module 210, a dynamic behavior analysis module 230, a dynamic behavior feature library 220, and an IOC generator 240.
  • the detection terminal security status device 200 is a security sandbox, and further, the security sandbox is disposed at the gateway.
  • the dynamic behavior result generation module 210 is configured to receive a file from the public network and run the file in the detection terminal security status device 200 to generate a dynamic behavior result (see FIG. 3).
  • the dynamic behavior result contains a sequence of behaviors that are formed in chronological order of behavior.
  • the behaviors in this behavior sequence belong to different behavior types, and the behavior types include creating files, modifying the registry, configuring domain names, resolving addresses, connecting to the network, loading processes, and adding users.
  • the dynamic behavior analysis module 230 is configured to generate the motion generated by the module 210 according to the dynamic behavior result.
  • the result of the behavior determines whether the file contains an APT.
  • the IOC generator 240 is configured to: if the dynamic behavior analysis module determines that the file includes an APT, obtain a stable behavior feature in the dynamic behavior result, generate a corresponding IOC according to the stable behavior feature, and send the IOC to the terminal.
  • the stable behavioral characteristic refers to the behavior that appears in the sequence of behaviors generated by the file after each run.
  • files from a public network such as an exe file, a DLL file, a sys file, a com file, a doc file, an xls file, a PDF file, and the like.
  • the dynamic behavior result consists of a series of behavioral operations, each of which contains a sequence of time-based behaviors.
  • the dynamic behavior result generation module 210 includes a heuristic detection engine module and a virtual execution environment module (not shown in FIG. 2) in an existing security sandbox.
  • the heuristic detection engine module includes a Web heuristic detection engine sub-module, a PDF heuristic detection engine sub-module, and a PE heuristic detection engine sub-module (not shown in FIG. 2).
  • the heuristic detection engine module and the virtual execution environment module in the security sandbox are used to generate corresponding dynamic behavior results.
  • Figure 3 is a schematic diagram of the results of dynamic behavior.
  • the dynamic behavior result in Figure 3 contains a sequence of behaviors that are formed in chronological order of behavior.
  • the behavior in this sequence of behaviors belongs to different behavior types.
  • the behavior types include creating files, loading processes, modifying the registry, and connecting to the network.
  • the dynamic behavior feature library 220 includes a plurality of dynamic behavior characteristics related to APT.
  • the dynamic behavior feature library 220 includes a false positive behavior feature database and a threat behavior feature library (not shown in FIG. 2), and the false positive behavior feature
  • the library contains a variety of false positive behavior characteristics
  • the threat behavior signature library contains a variety of threat behavior characteristics.
  • the dynamic behavior analysis module 230 matches the dynamic behavior results from the dynamic behavior result generation module 210 with the various dynamic behavior characteristics in the dynamic behavior signature library 220 to determine whether the dynamic behavior outcome includes an APT.
  • the dynamic behavior analysis module 230 first matches the dynamic behavior result with each false positive behavior feature in the false behavior characteristic database of the dynamic behavior signature library 220, and then performs the threat behavior characteristics in the threat behavior signature database. Match to determine if the dynamic behavior result contains an APT.
  • the dynamic behavior analysis module 230 sends the dynamic behavior result to the IOC generator 240 after determining that the dynamic behavior result includes the APT. Otherwise, the dynamic behavior analysis module 230 The file received by the device 200 (ie, a normal file, a non-infected file) is transmitted to the terminal device. That is, the IOC generator 240 receives the dynamic behavioral result containing the APT.
  • the APT is highly concealed, and its attack method is to hide itself.
  • the APT operates on a specific object through a series of behaviors, and invades the user terminal in a long-term and planned manner.
  • the IOC generator 240 includes a first loader 241, a plurality of IOC generators, and an IOC summary module 243.
  • the plurality of IOC generators include various types of IOC generators, including a file generator (File generator), a registry generator (Regitstry generator), a domain name generator (DNS generator), and an address resolution generator (ARP). Generator), Network Connection Generator (Netword Generator), Process Generator (Process Generator), User Generator (User Generator), and so on.
  • the type of the IOC generator is related to the type of behavior in the APT's stable behavioral characteristics. For example, a behavioral feature of a dynamic behavioral result that contains APT is to create a file, and the IOC generator category contains a file generator.
  • a first loader 241 in the IOC generator 240 loads the dynamic behavior result corresponding program into the memory and assigns each behavioral action in the dynamic behavior result to a different generator.
  • the dynamic behavior result consists of a series of behavioral operations, each of which contains a sequence of time-based behaviors.
  • the first loader 241 analyzes each behavioral action in the dynamic behavior result one by one in chronological order, obtains a corresponding behavior feature, and sends the corresponding behavior operation in the dynamic behavior result to the corresponding generation according to the determined behavior characteristic.
  • the first loader 241 looks at a behavioral action, and a behavioral feature of the behavioral action is that FCreat creates a file, and the first loader 241 sends the behavioral action to the file generator.
  • the first loader 241 includes a lookup table that shows the correspondence of various behavioral features to each of the plurality of types of generators.
  • the first loader 241 acquires a behavior feature from each behavior operation of the dynamic behavior result received by the first loader 241, and retrieves the generator corresponding to each behavior operation by retrieving the comparison table manner, and assigns each behavior operation to the corresponding generation. Device.
  • the first loader 241 checks the behavioral characteristics of a behavioral action in the dynamic behavior result (ie, the dynamic behavior result that has been determined to contain the APT) that includes the creation of the file, and the first loader 241 determines the manner by looking up the lookup table.
  • the generator corresponding to the behavioral operation is a file generator, and the first loader 241 assigns the behavioral operation to the file generator.
  • Dynamic behavioral results from the first loader 241 for each IOC generator in the IOC generator 240 The corresponding behavioral operation is parsed to obtain stable behavioral characteristics in the dynamic behavior result, that is, the trace left by the APT is extracted, and the corresponding IOC is generated according to the stable behavior characteristic; wherein the stable behavior characteristic is a file containing the APT The behavior that occurs in the sequence of behaviors generated after each run.
  • the IOC generator 240 obtains stable behavioral characteristics in the dynamic behavior result, including: running the file at least twice in the device 200, respectively obtaining a sequence of behaviors generated after each run, thereby obtaining at least two Sequence of behavior. Determining the same behavior that exists in the at least two sequences of behaviors, wherein the same behavior refers to behaviors in which both the behavior type and the behavioral content are the same. A set consisting of the same behavior in the at least two sequences of behavior is obtained, the set being taken as a stable behavioral feature.
  • the IOC (indicators of compromised) describes the traces of the captured APT, which are described in the form of an xml document, including the attributes of the virus file, the characteristics of the registry change, virtual memory, and the like.
  • the trace left by an APT described by an IOC is: the file under the search path C: ⁇ WINDOWS ⁇ apocalyps32.exe, and the file length is 108544.
  • the IOC summary module 243 aggregates multiple IOCs from multiple IOC generators (eg, file generators, registry generators, etc.) into one IOC and sends the aggregated IOC to the terminal device.
  • the summary IOC is represented by an XML (Extensible Markup Language) document.
  • the terminal device 400 includes an IOC interpreter 410, a receiving module 430, and a determining module 440.
  • the receiving module 430 is configured to receive an IOC from the security device.
  • the IOC interpreter is configured to parse the IOC received by the receiving module 430 to obtain a behavior characteristic corresponding to the APT included in the IOC.
  • the determining module 440 is configured to search the operating system and file system of the terminal device 400 to determine whether the terminal device 400 has performed the behavior described by the behavior characteristics corresponding to the APT. If the terminal device 400 has performed the behavior described by the behavior characteristics corresponding to the APT, it is determined that the terminal device 400 has infected the APT.
  • the terminal device 400 also includes an editor 420.
  • the editor 420 is used to describe and display the IOCs it receives, such as the summary IOC, in a graphical form, see FIG. Figure 5 is a schematic diagram of a summary IOC graphical representation.
  • the editor 420 is an optional module.
  • the IOC interpreter 410 is in a TSM (Terminal Security Management) module of the terminal device 400.
  • TSM Terminal Security Management
  • terminal device structure shown in FIG. 4 does not constitute a limitation of the terminal device, and may include more or less components than those illustrated, or a combination of certain components, or different component arrangements.
  • the IOC interpreter 410 includes a second loader 411 and a plurality of types of interpreters.
  • the second loader 411 in the IOC interpreter 410 receives the IOC from the receiving module 430, for example, receives the summary IOC, loads the summary IOC corresponding program into the memory, and assigns each IOC in the summary IOC to Different interpreters.
  • the second loader 411 analyzes each IOC in the summary IOC one by one, obtains each IOC type, and allocates each IOC in the summary IOC according to the determined IOC type.
  • the context document contained in the IOC is a file item, that is, a file item, indicating that the IOC is a file class IOC.
  • the second loader 411 includes a lookup table that shows the correspondence of the various IOC types to the various interpreters in the multiple types of interpreters.
  • the second loader 411 obtains the IOC type from the IOC it receives, retrieves the interpreter corresponding to each IOC by retrieving the lookup table mode, and assigns each IOC in the summary IOC to the corresponding interpreter.
  • the IOC interpreter 410 may also include a distributor (not shown in FIG. 4). In this case, each IOC in the summary ICO is allocated by the distributor to the corresponding interpreter, and the second loader 411 is only used to load the summary IOC corresponding program into the memory.
  • the IOC interpreter 410 includes some or all of the following types of interpreters: a file interpreter (File Interpreter), a Registry Interpreter (Regitstry Interpreter), a Domain Name Interpreter (DNS Interpreter), and an Address Resolution Interpreter ( ARP interpreter), network connection interpreter (Netword interpreter), process interpreter (Process interpreter), user interpreter (User interpreter).
  • the type of the interpreter is related to the IOC type.
  • Each interpreter in the IOC interpreter 410 receives the corresponding IOC from the second loader 411 and The IOC performs parsing to obtain a behavior characteristic corresponding to the APT in the IOC, that is, a trace left by the APT.
  • the determining module 440 searches the operating system and the file system of the terminal device 400 according to the feature to determine whether the terminal device 400 has performed the behavior described by the behavior characteristics corresponding to the APT. If the terminal device 400 has performed the behavior described by the behavior characteristics corresponding to the APT, it is determined that the terminal device 400 has infected the APT.
  • the file interpreter parses out one of the features corresponding to the APT in an IOC: path C: ⁇ WINDOWS ⁇ apocalyps32.exe; the second feature is a file with a length of 108544 bytes.
  • the determining module 440 searches the operating system and file system of the terminal device 440 to check whether there is a file of 108544 bytes in length under the directory C: ⁇ WINDOWS ⁇ apocalyps32.exe, thereby determining whether the terminal device 400 is infected with the APT.
  • FIG. 6 is a system for detecting a security status of a terminal according to an embodiment of the present application.
  • the system includes a detection terminal security status device 200 and a terminal device 400, and the detection terminal security status device 200 is located at a private network connection with a public network, and the terminal device 400 is located in a private network.
  • the detecting terminal security status device 200 receives the file from the public network and runs the file to generate a dynamic behavior result; determining whether the file includes an APT according to the dynamic behavior result; if the APT is included in the dynamic behavior result, acquiring the A stable behavioral feature in the dynamic behavioral outcome, based on the stable behavioral characteristics, generates a corresponding IOC.
  • the dynamic behavior result includes a sequence of behaviors formed in the order in which the behavior occurs. The behaviors in this behavior sequence belong to different behavior types.
  • the behavior types include creating files, modifying the registry, configuring domain names, resolving addresses, connecting to the network, loading processes, and adding users.
  • This stable behavioral characteristic refers to the behavior that occurs in the sequence of behaviors generated by the file after each run.
  • the terminal device 400 receives the IOC from the detection terminal security status device 200, and parses the IOC to obtain a behavior characteristic corresponding to the APT included in the IOC, searches the operating system and the file system of the terminal device 400 according to the behavior feature, and determines the terminal. Whether the device 400 has performed the behavior described by the behavioral characteristics corresponding to the APT. If the terminal device 400 has performed the behavior described by the behavior characteristics corresponding to the APT, it is determined that the terminal device 400 has infected the APT.
  • FIG. 7 is a flowchart of a method for detecting a security status of a terminal according to an embodiment of the present application.
  • the execution subject of the method for detecting the security status of the terminal is a security protection device.
  • the security device is located at the connection between the private network and the public network, and the terminal is located in the private network.
  • the execution body of the method for detecting a terminal security condition is a security sandbox, and the security sandbox is disposed at the gateway.
  • the security device receives the file from the public network and runs the file in the security device to generate a dynamic behavior result, see FIG.
  • the dynamic behavior result includes a sequence of behaviors formed according to the time sequence of the behavior; the behaviors in the behavior sequence belong to different behavior types, and the behavior types include creating a file, modifying a registry, configuring a domain name, resolving an address, connecting a network, loading a process, and adding user.
  • the dynamic behavior result consists of a series of behavioral actions, and each behavioral action includes a time-based behavioral feature.
  • the files from the Internet are exe files, DLL files, sys files, com files, Ddc files, xls files, PDF files, and the like.
  • the security device determines whether the file contains an APT based on the generated dynamic behavior result.
  • the dynamic behavior result is matched with each dynamic behavior feature in the dynamic behavior signature library to determine whether the dynamic behavior result includes an APT.
  • step 730 in the case that the dynamic behavior result includes the APT, each behavioral operation in the dynamic behavior result is analyzed one by one, and a stable behavior characteristic in each behavior operation is obtained, that is, the trace left by the APT is extracted, according to the stable Behavioral characteristics generate corresponding IOCs.
  • the stable behavioral characteristic refers to the behavior that appears in the sequence of behaviors generated by the file after each run.
  • obtaining a stable behavioral characteristic in the dynamic behavior result includes running the file at least twice in the security protection device to obtain a sequence of behaviors generated after each run, thereby obtaining at least two behavior sequences. Determining the same behavior that exists in the at least two behavioral sequences, the same behavior being the behavior of the same behavior type and behavioral content. A set consisting of the same behavior in the at least two sequences of behavior is obtained, the set being taken as a stable behavioral feature.
  • the plurality of IOCs generated based on the dynamic behavior result are aggregated into one IOC.
  • the summary IOC is represented by an XML (Extensible Markup Language) document.
  • This step 740 is an optional step. When an IOC is obtained according to the dynamic behavior result, the IOC is not required to be aggregated, that is, step 740 does not need to be performed.
  • the summary IOC is sent to the terminal device.
  • FIG. 8 is a flowchart of a method for detecting a security status of a terminal according to another embodiment of the present application.
  • the terminal device receives an IOC from the security device, such as a summary IOC, which includes a plurality of IOCs.
  • step 820 the terminal device parses the IOC to obtain a behavior characteristic corresponding to the APT included in the IOC.
  • the IOC is a summary IOC, and each IOC in the summary IOC is parsed one by one, and the behavior characteristics corresponding to the APT in each IOC are obtained.
  • step 830 the operating system and the file system of the terminal device are searched according to the obtained behavior characteristics, and it is determined whether the terminal device has performed the behavior described by the behavior characteristics corresponding to the APT. If the terminal device has performed the behavior described by the behavior characteristic corresponding to the APT, it is determined that the terminal device has infected the APT.
  • one of the features corresponding to APT in an IOC is: path C: ⁇ WINDOWS ⁇ apocalyps32.exe.
  • the second feature corresponding to the APT is a file with a length of 108,544 bytes. Therefore, the user terminal searches for the path C: ⁇ WINDOWS ⁇ apocalyps32.exe in the operating system and file system of the terminal, and checks whether there is a file of 108544 bytes in length under the path. If a file of 108544 bytes in length is included in the path, it is determined that the terminal has been infected with the APT.
  • the IOC generator is explained in detail how the dynamic behavior of the infected APT is converted into an IOC, and how the terminal device determines whether it infects the APT based on the received IOC.
  • the first loader 241 in the IOC generator 240 analyzes the dynamic behavior result it receives one by one, firstly checks the first behavior operation in the dynamic behavior result, that is, sees "a sample releases a PE in FIG. File "behavior action.
  • the first loader 241 learns that the behavior feature is FCreate, that is, creates a file, according to the field action in the first behavioral operation.
  • the first loader 241 assigns the first behavioral operation, that is, the behavior of viewing a sample to release a PE file, to the file generator.
  • This stable behavioral characteristic refers to the behavior that occurs in the sequence of behaviors generated after each run of a file containing APT.
  • the file generator generates a file class IOC according to the stable behavior feature, and the file class IOC can be seen in FIG. Therefore, the first behavioral action in the dynamic behavior result is converted into an IOC.
  • Figure 9 is a schematic diagram of a file class IOC.
  • the file class IOC indicates that the trace left by the APT is a file containing a length of 108544 bytes under the path C: ⁇ windows ⁇ apocalyps32.exe.
  • the first loader 241 looks at the second behavioral action in the dynamic behavior result, that is, the behavioral operation of running the sample.
  • the first loader 241 knows that the behavior operation is CreateProcess in the path C: ⁇ windows ⁇ apocalyps32.exe:1252 according to the field action, that is, the creation process.
  • the first loader 241 assigns the behavioral action to the process generator.
  • the process generator analyzes the second behavior operation, and learns that the behavior operation is in the path C: ⁇ windows ⁇ apocalyps32.exe:1252, CreateProcess is the loading process, and the pid value is 1448; then FOpen, the file is opened, and the pid is The process identifier) value is 1488. Since pid is an unstable feature, its value will vary with different terminal devices. Therefore, the run sample behavior operation is an unstable behavior operation and does not generate an IOC.
  • the first loader 241 looks at the third behavioral action in the dynamic behavior result, that is, views the behavior of creating a thread and injecting it into the IEXPLORE.EXE process to hide itself.
  • the first loader 241 knows that the behavior operation is OpenProcess explorer.exe according to the field action to open the browser.
  • the first loader 241 assigns the behavioral action to the process generator.
  • the process generator analyzes the third behavior, and learns that the action is OpenProcess explorer.exe to open the browser, and its pid (process identifier) value is 1244; then WriteOtherProcMem writes the IE thread, and its pid value is 1488. Since pid is an unstable feature, its value will vary with different terminal devices. Therefore, behavioral actions are an unstable behavioral operation that does not generate an IOC.
  • the first loader 241 views the fourth behavior operation in the dynamic behavior result, that is, viewing Modify the registry to increase the behavior of the action from the startup item.
  • the first loader 241 knows that the behavior operation is in the path according to the field action
  • RegCreateKey which creates a registry key.
  • the first loader 241 sends the strip behavior operation to the registry generator.
  • the registry generator analyzes the fourth behavior, and learns that the behavior is: RegCreateKey under HKLM ⁇ SOFTWARE ⁇ Microsoft ⁇ Windows ⁇ CurrentVersion ⁇ Run, which creates a registry key. And set the registry key key value to C: ⁇ WINDOWS ⁇ apocalyps32.exe. Therefore, the registry generator analyzes the behavior, so that the corresponding behavior characteristics are in the directory.
  • Added self-startup item C ⁇ WINDOWS ⁇ apocalyps32.exe under HKLM ⁇ SOFTWARE ⁇ Microsoft ⁇ Windows ⁇ CurrentVersion ⁇ Run ⁇ apocalyps32.
  • Such behavioral characteristics are stable and do not change with different terminal devices. As long as the terminal device is infected with the corresponding APT, it will leave traces of the behavioral characteristics.
  • This stable behavioral characteristic refers to the behavior that occurs in the sequence of behaviors generated after each run of a file containing APT.
  • the registry generator converts the behavioral action into a registry class IOC, see Figure 10.
  • Figure 10 is a schematic diagram of a registry class IOC.
  • the trace left by the APT is: Find the registry path
  • the first loader 241 views the fifth behavioral operation in the dynamic behavior result, that is, the behavioral operation connected to the external network.
  • the first loader 241 knows that the behavior operation is connect according to the field action, that is, connects to the external network.
  • the first loader 241 assigns the behavioral operation to the network connection generator.
  • the network connection generator analyzes the fifth behavior operation, and learns that the behavior operation is connected to the external network, and the IP address is 5.5.66.111:1453. Since 1453 in the IP address is an unstable feature, its value will vary with the terminal device. Therefore, the run sample behavior operation is an unstable behavior operation and does not generate an IOC.
  • the APT execution operation process in FIG. 3 is: first releasing an executable file, then running the executable file, and then hiding the APT execution process in the IE browser, so that It can not be found in the task manager, and then add the self-starting registry key, so that the APT will exist in the system every time the system is restarted, and finally steal information or damage the system by connecting to the external network.
  • the IOC summary module 243 receives the file class IOC from the file generator (as shown in FIG. 9), and receives the registry class IOC from the registry generator (as shown in FIG. 10), and the file class IOC,
  • the registry class IOC is aggregated to form a summary IOC, and the summary IOC is represented in the form of an XLM document, see Figure 11.
  • Figure 11 is a summary IOC diagram, the summary IOC is represented in the form of an XML file that includes a brief description of the IOC, the author, the date of creation, and the like, as well as a description of the APT trace: in the path C: ⁇ windows ⁇ apocalyps32 Executable file with a length of 108544 under .exe; or in the path
  • the receiving module 430 in the terminal device receives the summary IOC (including the file class IOC and the registry class IOC) from the terminal security status device 200 (ie, the security protection device), and the specific summary IOC is shown in FIG. 11, and the summary IOC is Send to the second loader 411.
  • the summary IOC including the file class IOC and the registry class IOC
  • the second loader 411 analyzes each IOC in the summary IOC one by one, and first checks the first IOC in the summary IOC, that is, the file class IOC.
  • the second loader 411 knows that it is a feature FileItem, that is, a file item, according to the field Context document.
  • the second loader 411 assigns the first IOC, the file class IOC, to the file interpreter.
  • the file interpreter parses the file class IOC to obtain two behavioral characteristics of the APT included in the IOC: one behavior characteristic is to determine whether C: ⁇ WINDOWS ⁇ apocalyps32.exe exists; another behavior characteristic is a file Whether the length is 108544 bytes, and the two behavioral characteristics are "and (ie, and)", see Figure 9.
  • the determining module 440 searches the operating system and the file system of the terminal device 400 to determine whether the terminal device 400 has performed the behavior described by the behavior characteristics corresponding to the APT, if the terminal device 400 has described the behavior characteristics corresponding to the APT.
  • the behavior determines that the terminal device 400 has infected the APT. That is, if the determination module 400 finds a file having 108544 bytes under the path C: ⁇ WINDOWS ⁇ apocalyps32.exe, it is determined that the terminal device 400 is infected with the APT.
  • the second loader 411 looks at the second IOC in the summary IOC, the registry class IOC.
  • the second loader 411 knows that the feature is a RegistryItem, that is, a registry key, according to the field Context document.
  • the second loader 411 assigns the second IOC, the registry key IOC, to the registry interpreter.
  • the registry interpreter parses the registry key IOC to obtain two behavioral characteristics of the APT included in the IOC: a behavioral feature is to determine whether a registry path exists "HKLM ⁇ SOFTWARE ⁇ Microsoft ⁇ Windows ⁇ CurrentVersion ⁇ Run ⁇ Apocalyps32"; Another behavioral feature is whether the registry key content is "C: ⁇ WINDOWS ⁇ apocalyps32.exe”, and the two behavioral characteristics are "and (ie, and)", see Figure 10.
  • the steps of a method or algorithm described in connection with the present disclosure may be implemented in a hardware or may be implemented by a processor executing software instructions.
  • the software instructions may be comprised of corresponding software modules that may be stored in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable hard disk, CD-ROM, or any other form of storage well known in the art.
  • An exemplary storage medium is coupled to the processor to enable the processor to read information from, and write information to, the storage medium.
  • the storage medium can also be an integral part of the processor.
  • the processor and the storage medium can be located in an ASIC. Additionally, the ASIC can be located in the user equipment.
  • the processor and the storage medium may also reside as discrete components in the user equipment.
  • the functions described herein can be implemented in hardware, software, firmware, or any combination thereof.
  • the functions may be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium.
  • Computer readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one location to another.
  • a storage medium may be any available media that can be accessed by a general purpose or special purpose computer.

Abstract

一种检测终端安全状况方法、装置及系统。该方法包括：安全防护设备接收文件，并运行该文件，生成动态行为结果。该动态行为结果包含按照行为发生时间顺序形成的行为序列。在该文件包含APT情况下，该安全防护设备获取该动态行为结果中稳定的行为特征，根据该稳定的行为特征生成相应IOC，并将其发送至终端。该稳定的行为特征是指该文件在每次运行后所生成行为序列中均出现的行为。通过本申请提供的方案能够检测出网络内部是否有用户感染了APT，以及哪些用户感染了APT。

Description

一种检测终端安全状况方法、装置及系统
本申请要求于2015年12月24日提交中国专利局、申请号为201510988051.4、发明名称为“一种检测终端安全状况方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机领域，尤其涉及计算机安全防护领域。
背景技术
随着以APT(Advanced Persistent Threat，高级可持续威胁)为代表的下一代威胁登场，传统安全防护手段面临挑战。一次APT攻击，轻则造成公司核心商业机密泄漏，给公司造成不可估计得损失，重则导致金融行业、能源行业、交通行业等涉及国计民生的行业陷入瘫痪，其效果不亚于一场战争。
2010年Google(谷歌公司)遭受Aurora下一代威胁攻击，导致大规模的Gmail(Google的免费网络邮件服务)邮件泄漏，对Google品牌造成严重影响。2010年伊朗核设施遭受Stuxnet(震网)攻击，导致核设施核心部件-离心机受损严重，此次攻击造成后果不亚于一次定点轰炸。2011年RSA遭受针对SecureID的下一代威胁攻击，导致大规模的SecureID数据泄漏，严重影响使用SecureID的客户安全，对公司的安全性质疑严重影响公司的公众形象。2013年3月韩国银行业遭受一次定向型APT攻击，导致大面积的银行主机系统宕机，严重影响银行在客户心中的形象。未来如何应对以APT为代表的下一代威胁，如何应对未来可能的网络战，是人们将要面临的重大问题。
现有的用户网络，一般在终端设备上部署防病毒软件，同时在网关或者是邮件服务器前部署安全沙箱。终端设备上部署的杀毒软件主要通过软件供应商提供的最新的特征库检测恶意软件，而在网关或者是邮件服务器前部署安全沙箱主要用来检测来自于互联网的APT。
现有的安全沙箱可以检测来自互联网的APT。现有技术能够监测到内部网络遭受了APT攻击，却无法检测到是否有用户感染APT，以及哪些用户已 经被APT感染。例如，某安全沙箱检测到其所属内网遭受到APT攻击，且该APT攻击是通过邮件方式发送给用户。有些用户由于打开了这封含有APT附件的邮件而感染了APT，而有些用户则并未打开此邮件，也就没有感染APT。又如，某安全沙箱检测到其所属内网遭受到APT攻击，且该APT攻击是通过某版本应用软件的漏洞而实现的。有些用户使用了该版本应用软件，因此遭受到了该APT攻击，而有些用户由于使用的是该应用软件的更高级版本，并没有相应漏洞，因此也就并没有遭受到APT攻击。
现有技术方案虽然能够检测出网络内部遭受到了APT攻击，但是却无法判断出是否有用户感染了APT，以及具体哪些用户感染了APT，也就无法采取针对性的操作。
发明内容
本文描述了一种检测终端安全状况的方法、装置及系统，从而实现了检测出具体终端是否感染到APT。
在第一方面，本申请实施例提供了一种检测终端安全状况的装置。该装置位于私有网络与公有网络连接处，终端位于私有网络中。该装置包括动态行为结果生成模块、动态行为分析模块和被感染主机描述符生成器。
该动态行为结果生成模块用于接收来自公有网络的文件，并在该装置中运行该文件，从而生成动态行为结果。其中，该动态行为结果包含按照行为发生时间顺序形成的行为序列。该行为序列中的行为属于不同的行为类型，该行为类型包括创建文件、修改注册表、配置域名、解析地址、连接网络、加载进程、添加用户。该动态行为分析模块用于根据该动态行为结果生成模块生成的该动态行为结果判断该文件是否包含高级可持续威胁。该被感染主机描述符生成器用于如果该动态行为分析模块确定该文件包含高级可持续威胁，获取该动态行为结果中稳定的行为特征，根据该稳定的行为特征生成相应被感染主机描述符，并将该被感染主机描述符发送至该终端。其中，该稳定的行为特征是指该文件在每次运行后所生成行为序列中均出现的行为。
在第二方面，本申请实施例提供了一种终端设备。该终端包括接收模块、被感染主机描述符解释器、确定模块。
该接收模块用于接收来自安全防护设备的被感染主机描述符。该被感染 主机描述符解释器用于对该接收模块接收到的该被感染主机描述符进行解析，得到该被感染主机描述符中包含的高级可持续威胁对应的行为特征。该确定模块用于搜索该终端的操作系统和文件系统，确定该终端是否已发生该高级可持续威胁对应的行为特征所描述的行为。如果该终端已发生该高级可持续威胁对应的行为特征所描述的行为，确定该终端已感染该高级可持续威胁。
在第三方面，本申请实施例提供了一种检测终端安全状况的系统，该系统包括上述第一方面的终端安全状况检测装置以及上述第二方面的终端设备。
在第四方面，本申请实施例提供了一种检测终端安全状况的方法。该方法由安全防护设备执行，且该安全防护设备位于私有网络与公有网络连接处，终端位于私有网络中。
首先该安全防护设备接收来自公有网络的文件，并在该安全防护设备中运行该文件，从而生成动态行为结果。该动态行为结果包含按照行为发生时间顺序形成的行为序列。该行为序列中的行为属于不同的行为类型，行为类型包括创建文件、修改注册表、配置域名、解析地址、连接网络、加载进程、添加用户。该安全防护设备根据生成的该动态行为结果判断该文件是否包含高级可持续威胁情况，若包含所述高级可持续威胁，则获取该动态行为结果中稳定的行为特征，根据该稳定的行为特征生成相应被感染主机描述符，并将该被感染主机描述符发送至该终端。该稳定的行为特征是指该文件在每次运行后所生成行为序列中均出现的行为。
在第五方面，本申请实施例提供了一种检测终端安全状况的方法。
该终端接收来自安全防护设备的被感染主机描述符。该终端对该被感染主机描述符进行解析，得到该被感染主机描述符中包含的高级可持续威胁对应的行为特征。搜索该终端的操作系统和文件系统，确定该终端是否已发生该高级可持续威胁对应的行为特征所描述的行为。如果该终端已发生该高级可持续威胁对应的行为特征所描述的行为，确定该终端已感染该高级可持续威胁。
相较于现有技术，本申请实施例提供的方案能够具体检测出网络内部是否有用户感染了APT，以及哪些用户感染了APT。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍。
图1为本申请实施例提供的一种检测终端感染APT的网络构架示意图；
图2为本申请实施例提供的一种检测终端安全状况的装置框图；
图3为一个动态行为结果示意图；
图4为本申请实施例提供的终端设备示意图；
图5为本申请实施例提供的编辑器输出的汇总IOC图形化示意图；
图6为本申请实施例提供的一种检测终端安全状况的系统示意图；
图7为本申请实施例一个实施例提供的一种检测终端安全状况的方法流程图；
图8为本申请实施例另一个实施例提供的一种检测终端安全状况的方法流程图；
图9为本申请实施例提供的一个文件类IOC示意图；
图10为本申请实施例提供的一个注册表类IOC示意图；
图11为本申请实施例提供的一个汇总IOC示意图。
具体实施方式
下面将结合附图，对本申请实施例中的技术方案进行清楚、完整地描述。
本申请实施例描述的网络架构是为了更加清楚的说明本申请实施例的技术方案，并不构成对于本申请实施例提供的技术方案的限定，本领域普通技术人员可知，随着网络架构的演变和新业务场景的出现，本申请实施例提供的技术方案对于类似的技术问题，同样适用。
图1为本申请实施例提供的一种检测终端安全状况的系统的网络构架示意图。终端设备110通过互联网获取数据，如接收一封邮件等。布置于网关处的防火墙120将相应流量还原成文件，例如，防火墙通过HTTP(Hyper Text Transfer Protocol，超文本传输协议)代理方法将流量还原成文件。该文件种类包含exe(executable program，可执行程度)文件、DLL(Dynamic Link Library， 动态链接库，又称应用程序扩展)文件、sys(system，系统)文件、com文件、Doc文件(word文件)、xls(Microsoft Excel工作表)文件、PDF(Portable Document Format，便携式文档格式)文件等。防火墙120将还原出的文件送交至安全沙箱130检测。安全沙箱130布置于网关处，其检测来自防火墙120的文件是否为包含APT(Advanced Persistent Threat，高级可持续威胁)的恶意文件。如果安全沙箱130检测出有文件包含APT，则生成与该APT相对应的IOC(Indicators of Compromised，被感染主机描述符)。安全沙箱130将该IOC同步至各终端设备。各终端设备对该IOC进行解析，得到与该IOC相对应APT所包含的行为特征，依据该特征查询相应终端的操作系统和文件系统，以确定该用户终端是否感染APT。安全沙箱是一种安全机制，为运行中的程序提供的隔离环境。沙箱通常严格控制其中运行的程序所能访问的资源，例如，沙箱可以提供用后可被回收的磁盘及内存空间。在沙箱中，网络访问、对真实操作系统的访问、对输入设备的独权被禁止或者严格限制。沙箱中的所有改动对真实操作系统不会造成任何损失。因此，这种技术通常被广泛适用于测试可能带有病毒的可执行文件或者其他恶意代码。
本申请所涉及到的用户终端可以包括手机、平板电脑、笔记本电脑、UMPC(Ultra-mobile Personal Computer，超级移动个人计算机)、上网本、PDA(Personal Digital Assistant，个人数字助理)等终端设备。
图2是本申请实施例提供的一种检测终端安全状态的装置框图。该检测终端安全状况装置200即安全防护装置，其位于私有网络与公有网络连接处，终端位于私有网络中。该装置200包括动态行为结果生成模块210、动态行为分析模块230、动态行为特征库220、IOC生成器240。
在一个示例中，该检测终端安全状况装置200为安全沙箱，进一步地，该安全沙箱布置于网关处。
动态行为结果生成模块210用于接收来自公有网络的文件，并在检测终端安全状况装置200中运行该文件，从而生成动态行为结果(参见图3)。该动态行为结果包含按照行为发生时间顺序形成的行为序列。该行为序列中的行为属于不同的行为类型，且该行为类型包括创建文件、修改注册表、配置域名、解析地址、连接网络、加载进程、添加用户。
动态行为分析模块230用于根据动态行为结果生成模块210生成的该动 态行为结果判断该文件是否包含APT。
IOC生成器240用于如果该动态行为分析模块确定该文件包含APT，获取该动态行为结果中稳定的行为特征，根据该稳定的行为特征生成相应IOC，并将该IOC发送至终端。其中，该稳定的行为特征是指该文件在每次运行后所生成行为序列中均出现的行为。
在一个示例中，来自公有网络的文件如exe文件、DLL文件、sys文件、com文件、doc文件、xls文件、PDF文件等文件。
在一个示例中，该动态行为结果由一系列行为操作组成，各行为操作包含基于时间的行为序列。
在一个示例中，动态行为结果生成模块210包括现有安全沙箱中的启发式检测引擎模块和虚拟执行环境模块(图2未示出)。该启发式检测引擎模块包括Web启发式检测引擎子模块、PDF启发式检测引擎子模块、PE启发式检测引擎子模块(图2未示出)。该安全沙箱中的启发式检测引擎模块及虚拟执行环境模块均用于生成相应动态行为结果。
如图3所示，图3是一个动态行为结果示意图。图3中的该动态行为结果包含按照行为发生时间顺序形成的行为序列。该行为序列中的行为属于不同的行为类型。图3中，该行为类型包括创建文件、加载进程、修改注册表、连接网络。
图2中，动态行为特征库220包含多种与APT相关的动态行为特征，如动态行为特征库220包含误报行为特征库及威胁行为特征库(图2未示出)，该误报行为特征库包含多种误报行为特征，该威胁行为特征库包含多种威胁行为特征。
在一个示例中，动态行为分析模块230将来自动态行为结果生成模块210的动态行为结果与动态行为特征库220中的各动态行为特征进行匹配，从而确定该动态行为结果是否包含APT。
在一个示例中，动态行为分析模块230先将该动态行为结果与动态行为特征库220的误报行为特征库中各误报行为特征进行匹配，再与威胁行为特征库中的各威胁行为特征进行匹配，从而判定该动态行为结果是否包含APT。
在一个示例中，动态行为分析模块230在判定出该动态行为结果包含APT后，将该动态行为结果发送至IOC生成器240。否则，动态行为分析模块230 将该装置200接收到的文件(即正常文件，非感染文件)发送至终端设备。也就是说，IOC生成器240接收到的是包含APT的动态行为结果。
该APT具备高隐蔽性，其攻击手法在于隐匿自己，该APT通过一系列行为操作针对特定对象，长期、有计划性地侵入用户终端中。
在一个示例中，IOC生成器240包括第一加载器241、多个IOC生成器、IOC汇总模块243。该多个IOC生成器包括多种类型IOC生成器，如包括文件生成器(File生成器)、注册表生成器(Regitstry生成器)、域名生成器(DNS生成器)、地址解析生成器(ARP生成器)、网络连接生成器(Netword生成器)、进程生成器(Process生成器)、用户生成器(User生成器)等。该IOC生成器的类型与APT稳定的行为特征中行为的类型有关。例如，某包含APT的动态行为结果的一个行为特征是创建文件，则IOC生成器种类包含文件生成器。
IOC生成器240中的第一加载器(loader)241将该动态行为结果相应程序加载至内存中，并将该动态行为结果中的各条行为操作分配给不同的生成器。其中，该动态行为结果由一系列行为操作组成，各行为操作包含基于时间的行为序列。
在一个示例中，第一加载器241按照时间先后顺序逐条分析该动态行为结果中各条行为操作，得到相应行为特征，根据所确定的行为特征将该动态行为结果中相应行为操作发送至相应生成器中。例如，第一加载器241查看某行为操作，得到该行为操作的一个行为特征是FCreat即创建文件，则第一加载器241将该行为操作发送至文件生成器中。
在一个示例中，第一加载器241包含一个对照表，该对照表示出了各行为特征与多种类型生成器中各生成器的对应关系。第一加载器241从其接收到的动态行为结果的各条行为操作中获取行为特征，通过检索该对照表方式，确定各条行为操作所对应的生成器，并将各行为操作分配给相应生成器。
例如，第一加载器241查看其接收到的动态行为结果(即已经确定包含APT的动态行为结果)中一条行为操作的行为特征包含创建文件，则第一加载器241通过查找对照表方式确定该行为操作所对应的生成器是文件生成器，该第一加载器241将该行为操作分配给文件生成器。
IOC生成器240中各IOC生成器对来自第一加载器241的动态行为结果 中相应行为操作进行解析，获取该动态行为结果中稳定的行为特征，即提取出APT所留下的痕迹，根据该稳定的行为特征生成相应IOC；其中，该稳定的行为特征是包含APT的文件在每次运行后所生成行为序列中均出现的行为。
在一个示例中，IOC生成器240获取该动态行为结果中稳定的行为特征，包括：在该装置200中运行至少两次该文件，分别得到每次运行后生成的行为序列，从而获得至少两个行为序列。确定该至少两个行为序列中存在的相同的行为，其中，相同的行为是指行为类型和行为内容均相同的行为。获得由该至少两个行为序列中相同的行为构成的集合，将该集合作为稳定的行为特征。
显然，在获得稳定的行为特征的过程中，文件运行的次数越多，最终得到的稳定的行为特征，继而根据稳定的行为特征生成的IOC在识别是否感染APT时的准确性就越高。
IOC(indicators of compromised，被感染主机描述符)描述了捕获到的APT所留下的痕迹，其通过xml文档形式描述出，内容包括病毒文件的属性、注册表改变的特征、虚拟内存等。例如，一个IOC描述的APT所留下的痕迹为：搜索路径C:\WINDOWS\apocalyps32.exe下的文件，且文件长度是108544。IOC汇总模块243将来自多个IOC生成器(如文件生成器、注册表生成器等)的多个IOC汇总成一个IOC，并将该汇总IOC发送至终端设备。其中，该汇总IOC通过一个XML(可扩展标记语言)文档表示。
图4是本申请实施例提供的终端设备示意图。该终端设备400包括IOC解释器410、接收模块430、确定模块440。
接收模块430用于接收来自安全防护设备的IOC。
IOC解释器用于对接收模块430接收到的该IOC进行解析，得到该IOC中包含的APT对应的行为特征。
确定模块440用于搜索终端设备400的操作系统和文件系统，确定终端设备400是否已发生该APT对应的行为特征所描述的行为。如果终端设备400已发生该APT对应的行为特征所描述的行为，确定终端设备400已感染该APT。
在一个示例中，该终端设备400还包括编辑器420。编辑器420用于将其接收到的IOC，如汇总IOC，以图形化形式描述并显示出来，参见图5。图5是一个汇总IOC图形化表现形式示意图。该编辑器420是一个可选模块。
在一个示例中，IOC解释器410在终端设备400的TSM(Terminal Security Management，终端安全管理软件)模块中。
本领域技术人员可以理解，图4中示出的终端设备结构并不构成对终端设备的限定，可以包括比图示更多或更少的部件，或者组合某些部件，或者不同的部件布置。
在一个示例中，IOC解释器410包括第二加载器411以及多种类型解释器。
图4中，IOC解释器410中的第二加载器411接收来自接收模块430的IOC，例如接收汇总IOC，将该汇总IOC相应程序加载至内存中，并将该汇总IOC中的各IOC分配给不同的解释器。
在一个示例中，第二加载器411逐条分析该汇总IOC中的各IOC，获取各IOC类型，依据所确定的IOC类型分配该汇总IOC中的各IOC。例如，在一个IOC中，其所包含的context document即上下文文档类型为FileItem即文件项，则说明该IOC为文件类IOC。
在一个示例中，第二加载器411包含一个对照表，该对照表示出了各IOC类型与多种类型解释器中各解释器的对应关系。第二加载器411从其接收到的IOC中获取该IOC类型，通过检索该对照表方式，确定各IOC所对应的解释器，并将汇总IOC中各IOC分配给相应解释器。
需要说明的是，IOC解释器410也可以包括一个分配器(图4未示出)。此种情况下，由该分配器将该汇总ICO中的各IOC分配至相应解释器中，而第二加载器411仅用于将汇总IOC相应程序加载至内存中。
IOC解释器410包括以下多种类型解释器中的部分或者全部：文件解释器(File解释器)、注册表解释器(Regitstry解释器)、域名解释器(DNS解释器)、地址解析解释器(ARP解释器)、网络连接解释器(Netword解释器)、进程解释器(Process解释器)、用户解释器(User解释器)。该解释器的类型与IOC类型有关。
IOC解释器410中各解释器，接收来自第二加载器411的相应IOC，并对 该IOC进行解析，得到该IOC中包含APT对应的行为特征，即得到APT所留下的痕迹。确定模块440根据该特征搜索终端设备400的操作系统和文件系统，确定终端设备400是否已发生该APT对应的行为特征所描述的行为。如果终端设备400已发生该APT对应的行为特征所描述的行为，确定终端设备400已感染APT。例如，该文件解释器解析出某IOC中APT所对应特征之一是：路径C:\WINDOWS\apocalyps32.exe；特征之二是：长度为108544字节的文件。确定模块440通过搜索终端设备440的操作系统和文件系统，查询目录C:\WINDOWS\apocalyps32.exe下是否存在108544字节长度的文件，从而确定终端设备400是否感染APT。
图6是本申请实施例提供的一种检测终端安全状况的系统。该系统包括检测终端安全状况装置200和终端设备400，且检测终端安全状况装置200位于私有网络与公有网络连接处，终端设备400位于私有网络中。
检测终端安全状况装置200接收来自公有网络的文件，并运行所述文件，从而生成动态行为结果；根据该动态行为结果判断所述文件是否包含APT；如果在该动态行为结果中包含APT，获取该动态行为结果中稳定的行为特征，根据该稳定的行为特征，生成相应IOC。其中，该动态行为结果包含按照行为发生时间顺序形成的行为序列。该行为序列中的行为属于不同的行为类型，行为类型包括创建文件、修改注册表、配置域名、解析地址、连接网络、加载进程、添加用户。该稳定的行为特征是指该文件在每次运行后所生成行为序列中均出现的行为。
终端设备400接收来自检测终端安全状况装置200的IOC，并对该IOC进行解析，得到该IOC中包含的APT对应的行为特征，依据该行为特征搜索终端设备400的操作系统和文件系统，确定终端设备400是否已发生该APT对应的行为特征所描述的行为。如果终端设备400已发生该APT对应的行为特征所描述的行为，确定终端设备400已感染APT。
需要说明的是，检测终端安全状况装置200及终端设备400所包含的各模块以及各模块功能作用参见图2、图4及相关内容表述，在此不再赘述。
图7为本申请一个实施例提供的检测终端安全状况方法流程图。该检测终端安全状况方法的执行主体是安全防护设备。且该安全防护设备位于私有网络与公有网络连接处，终端位于私有网络中。
在一个示例中，该检测终端安全状况方法的执行主体是安全沙箱，且该安全沙箱布置于网关处。
在步骤710，安全防护设备接收来自公有网络的文件，并在所述安全防护设备中运行所述文件，从而生成动态行为结果，参见图3。该动态行为结果包含按照行为发生时间顺序形成的行为序列；该行为序列中的行为属于不同的行为类型，行为类型包括创建文件、修改注册表、配置域名、解析地址、连接网络、加载进程、添加用户。
在一个示例中，该动态行为结果由一系列行为操作构成，且各行为操作包含基于时间的行为特征。
在一个示例中，该来自互联网的文件如exe文件、DLL文件、sys文件、com文件、Ddc文件、xls文件、PDF文件等。
在步骤720，该安全防护设备根据生成的所述动态行为结果判断该文件是否包含APT。
在一个示例中，将该动态行为结果与动态行为特征库中的各动态行为特征进行匹配，从而确定该动态行为结果是否包含APT。
在步骤730，在该动态行为结果包含APT情况下，逐条分析该动态行为结果中的各行为操作，获取各行为操作中稳定的行为特征，即提取出APT所留下的痕迹，根据该稳定的行为特征生成相应IOC。其中，该稳定的行为特征是指在该文件在每次运行后所生成行为序列中均出现的行为。
在一个示例中，获取该动态行为结果中稳定的行为特征包括，在该安全防护设备中运行至少两次该文件，分别得到每次运行后生成的行为序列，从而获得至少两个行为序列。确定该至少两个行为序列中存在的相同的行为，该相同的行为是指行为类型和行为内容均相同的行为。获得由该至少两个行为序列中相同的行为构成的集合，将该集合作为稳定的行为特征。
在步骤740，将根据该动态行为结果生成的多个IOC，汇总成一个IOC。且该汇总IOC通过一个XML(可扩展标记语言)文档表示。
该步骤740是一个可选步骤，当根据该动态行为结果得到一个IOC时，则不需要汇总IOC，即不需要执行步骤740。
在步骤750，将该汇总IOC发送至终端设备。
图8是本申请另一个实施例提供的检测终端安全状况方法流程图。
在步骤810，该终端设备接收来自安全防护设备的IOC，例如汇总IOC，该汇总IOC包含多个IOC。
在步骤820，该终端设备对该IOC进行解析，得到该IOC中包含的APT对应的行为特征。
在一个示例中，该IOC是一个汇总IOC，对该汇总IOC中的各IOC逐条解析，得到各IOC中包含APT对应的行为特征。
在步骤830，根据得到的行为特征搜索该终端设备的操作系统和文件系统，确定该终端设备是否已发生该APT对应的行为特征所描述的行为。如果该终端设备已发生该APT对应的行为特征所描述的行为，确定该终端设备已感染该APT。
举例说明，某IOC中APT所对应特征之一是：路径C:\WINDOWS\apocalyps32.exe。该APT所对应的特征之二是：长度为108544字节的文件。因此该用户终端通过搜索该终端的操作系统和文件系统中的路径C:\WINDOWS\apocalyps32.exe，并查看该路径下是否存在108544字节长度的文件。如果在该路径下包含108544字节长度的文件，则确定该终端已感染APT。
在一个示例中，该终端设备在搜索到该汇总IOC中的一个IOC包含有APT时，则确定该终端设备感染了APT。
现以图3一个典型的感染APT的动态行为结果为例，详细阐述IOC生成器如何将感染APT的动态行为结果转换成IOC，以及该终端设备如何根据接收到的IOC确定其是否感染APT。
(1)IOC生成器240中的第一加载器241逐条分析其接收到的动态行为结果，首先查看该动态行为结果中的第一条行为操作，即查看图3中“某个样本释放一个PE文件”行为操作。第一加载器241根据该第一条行为操作中的字段action得知该行为特征是FCreate，即创建文件。第一加载器241将该第一条行为操作，即查看某个样本释放一个PE文件的行为操作，分配给文件生成器。
该文件生成器分析该第一条行为操作，获知该行为操作是在路径C:\windows\apocalyps32.exe下FCreate，即创建文件；并且FWritePE，即写入可执行文件；且length是43008，即文件长度43008；offset是65536，即偏移 是65536，进而文件总长度是43008+65536＝108544。因此，该文件生成器通过对该行为操作进行分析，从而得到相应行为特征是在C:\windows\目录下创建一个可执行文件apocalyps32.exe，且该可执行文件长度是108544。此类行为特征是稳定的，不会随着不同终端而变化，只要终端设备感染了相应APT，就会留下具有该行为特征的痕迹。该稳定的行为特征是指在包含APT的文件在每次运行后所生成行为序列中均出现的行为。该文件生成器依据该稳定的行为特征生成了文件类IOC，该文件类IOC可参见图9。因此，实现了将该动态行为结果中的第一条行为操作转换成一个IOC。
图9是一个文件类IOC示意图。图9中，该文件类IOC表示：APT所留下的痕迹是在路径C:\windows\apocalyps32.exe下包含长度为108544字节的文件。
(2)第一加载器241查看该动态行为结果中的第二条行为操作，即查看运行此样本的行为操作。第一加载器241根据字段action得知该行为操作是在路径C:\windows\apocalyps32.exe：1252下CreateProcess，即创建进程。第一加载器241将该行为操作分配给进程生成器中。
该进程生成器分析该第二条行为操作，获知该行为操作是在路径C:\windows\apocalyps32.exe：1252下CreateProcess即加载进程，pid值为1448；然后FOpen，即打开文件，且pid(进程标识符)值为1488。由于pid是一个不稳定特征，其值会随着不同终端设备而变化。因此该运行样本行为操作是一个不稳定行为操作，不生成IOC。
(3)第一加载器241查看该动态行为结果中的第三条行为操作，即查看创建一个线程并将其注入到IEXPLORE.EXE进程中隐藏自己的行为操作。第一加载器241根据字段action得知该行为操作是OpenProcess explorer.exe即打开浏览器。第一加载器241将该行为操作分配给进程生成器。
该进程生成器分析该第三条行为操作，获知该行为操作是先OpenProcess explorer.exe即打开浏览器，其pid(进程标识符)值为1244；然后WriteOtherProcMem即写IE线程，其pid值1488。由于pid是一个不稳定特征，其值会随着不同终端设备而变化。因此行为操作是一个不稳定行为操作，不生成IOC。
(4)第一加载器241查看该动态行为结果中的第四条行为操作，即查看 修改注册表增加自启动项的行为操作。第一加载器241根据字段action得知该行为操作是在路径
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run下
RegCreateKey，即创建注册表项。第一加载器241将该条行为操作发送至注册表生成器中。
该注册表生成器分析该第四条行为操作，获知该行为操作是，在HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run下RegCreateKey，即创建注册表项。且设置注册表项键值为C:\WINDOWS\apocalyps32.exe。因此，该注册表生成器通过对该行为操作进行分析，从而得到相应行为特征是在目录
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apocalyps32下新增自启动项C:\WINDOWS\apocalyps32.exe。此类行为特征是稳定的，不会随着不同终端设备而变化，只要终端设备感染了相应APT，就会留下具有该行为特征的痕迹。该稳定的行为特征是指在包含APT的文件在每次运行后所生成行为序列中均出现的行为。该注册表生成器将该行为操作转换成一个注册表类IOC，参见图10。
图10是一个注册表类IOC示意图。图10中，APT留下的痕迹是：查找注册表路径
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apocalyps32，是否存在，如果存在其对应的值为C:\windows\apocalyps32.exe。
(5)第一加载器241查看该动态行为结果中的第五条行为操作，即查看连接到外部网络的行为操作。第一加载器241根据字段action得知该行为操作是connect，即连接至外网。第一加载器241将该行为操作分配给网络连接生成器。
该网络连接生成器分析该第五条行为操作，获知该行为操作是在连接外网，且IP地址5.5.66.101:1453。由于IP地址中的1453是不稳定特征，其值会随着不能终端设备而变化。因此该运行样本行为操作是一个不稳定行为操作，不生成IOC。
由上述分析可知，图3中的APT执行操作过程是：先释放一个可执行文件，然后运行该可执行文件，再将该APT执行过程隐匿在IE浏览器里面，使 得其在任务管理器里面查找不到，再增加自启动注册表项，使得该APT在每次重启系统后都会存在于系统中，最后通过连接外网的方式窃取信息或破坏系统。
(6)IOC汇总模块243接收来自文件生成器的文件类IOC(如图9所示)，以及接收来自注册表生成器的注册表类IOC(如图10所示)，将该文件类IOC、注册表类IOC进行汇总，形成一个汇总IOC，并将该汇总IOC以一个XLM文档形式表示出来，参见图11。
图11是一个汇总IOC示意图，该汇总IOC以XML文件形式表示，该XLM文件包括对该IOC简要描述、作者、创建日期等信息，以及包括对APT痕迹的描述：在路径C:\windows\apocalyps32.exe下长度为108544的可执行文件；或者在路径
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apocalyps32下新增自启动项C:\WINDOWS\apocalyps32.exe。
(7)终端设备中的接收模块430接收来自终端安全状况装置200(即安全防护设备)的汇总IOC(包含文件类IOC和注册表类IOC)，具体汇总IOC参见图11，并将该汇总IOC发送至第二加载器411。
(8)该第二加载器411对该汇总IOC中的各IOC逐个进行分析，首先查看该汇总IOC中的第一个IOC，即文件类IOC。第二加载器411根据字段Context document得知是特征FileItem，即文件项。第二加载器411将该第一个IOC，即文件类IOC，分配给文件解释器。
(9)该文件解释器对该文件类IOC进行解析，得到该IOC中包含的APT的两个行为特征：一个行为特征是判断是否存在C:\WINDOWS\apocalyps32.exe；另一个行为特征是文件长度是否为108544字节，且该两个行为特征是“和(即and)”的关系，参见图9。
(10)确定模块440搜索终端设备400的操作系统和文件系统，确定终端设备400是否已发生该APT对应的行为特征所描述的行为，如果终端设备400已发生该APT对应的行为特征所描述的行为，则确定终端设备400已感染该APT。即确定模块400如果在路径C:\WINDOWS\apocalyps32.exe下找到有108544字节文件，则判定终端设备400感染了APT。
(11)第二加载器411查看该汇总IOC中的第二个IOC，即注册表类IOC。 第二加载器411根据字段Context document得知特征是RegistryItem，即注册表项。第二加载器411将该第二个IOC，即注册表项IOC，分配给注册表解释器。
该注册表解释器对该注册表项IOC进行解析，得到该IOC中包含的APT的两个行为特征：一个行为特征是判断是否存在注册表路径"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apocalyps32"；另一个行为特征是注册表项内容是否为"C:\WINDOWS\apocalyps32.exe"，且该两个行为特征是“和(即and)”的关系，参见图10。
(12)确定模块440搜索终端设备400的操作系统和文件系统，确定终端设备400是否已发生该APT对应的行为特征所描述的行为，如果终端设备400已发生该APT对应的行为特征所描述的行为，则确定终端设备400已感染该APT。即确定模块400如果在路径
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\apocalyps32下查找是否包含C:\WINDOWS\apocalyps32.exe内容，如果包含，则说明终端设备400感染了APT。
结合本申请公开内容所描述的方法或者算法的步骤可以硬件的方式来实现，也可以是由处理器执行软件指令的方式来实现。软件指令可以由相应的软件模块组成，软件模块可以被存放于RAM存储器、闪存、ROM存储器、EPROM存储器、EEPROM存储器、寄存器、硬盘、移动硬盘、CD-ROM或者本领域熟知的任何其它形式的存储介质中。一种示例性的存储介质耦合至处理器，从而使处理器能够从该存储介质读取信息，且可向该存储介质写入信息。当然，存储介质也可以是处理器的组成部分。处理器和存储介质可以位于ASIC中。另外，该ASIC可以位于用户设备中。当然，处理器和存储介质也可以作为分立组件存在于用户设备中。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本申请所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上所述的具体实施方式，对本申请的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本申请的具体实施方式而已，并不用于限定本申请的保护范围，凡在本申请的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本申请的保护范围之内。

Claims (10)

  1. 一种检测终端安全状况的装置，其中，所述装置位于私有网络与公有网络连接处，终端位于私有网络中，包括：
    动态行为结果生成模块，用于接收来自公有网络的文件，并在所述装置中运行所述文件，从而生成动态行为结果；其中，所述动态行为结果包含按照行为发生时间顺序形成的行为序列；所述行为序列中的行为属于不同的行为类型，所述行为类型包括创建文件、修改注册表、配置域名、解析地址、连接网络、加载进程、添加用户；
    动态行为分析模块，用于根据所述动态行为结果生成模块生成的所述动态行为结果判断所述文件是否包含高级可持续威胁；
    被感染主机描述符生成器，用于如果所述动态行为分析模块确定所述文件包含高级可持续威胁，获取所述动态行为结果中稳定的行为特征，根据所述稳定的行为特征生成相应被感染主机描述符，并将所述被感染主机描述符发送至所述终端；其中，所述稳定的行为特征是指所述文件在每次运行后所生成行为序列中均出现的行为。
  2. 如权利要求1所述的装置，其特征在于，所述装置还包括动态行为特征库；所述动态行为特征库包含多种误报行为特征及多种威胁行为特征；
    所述动态行为分析模块，用于接收所述动态行为结果，并将所述动态行为结果与所述动态行为特征库中的多种误报行为特征及多种威胁行为特征进行匹配，从而确定所述文件是否包含所述高级可持续威胁。
  3. 如权利要求1或2所述的装置，其特征在于，所述被感染主机描述符生成器包括多种类型生成器，且所述生成器的类型与所述稳定的行为特征中行为的类型有关。
  4. 如权利要求1至3任意一项所述的装置，其特征在于，所述被感染主机描述符生成器包括文件生成器、注册表生成器、域名生成器、地址解析生成器、网络连接生成器、进程生成器、用户生成器中的一个或多个。
  5. 一种终端设备，包括：
    接收模块，用于接收来自安全防护设备的被感染主机描述符；
    被感染主机描述符解释器，用于对所述接收模块接收到的所述被感染主机描述符进行解析，得到所述被感染主机描述符中包含的高级可持续威胁APT对应的行为特征；
    确定模块，用于搜索所述终端的操作系统和文件系统，确定所述终端是否已发生所述APT对应的行为特征所描述的行为；如果所述终端已发生所述APT对应的行为特征所描述的行为，确定所述终端已感染所述APT。
  6. 如权利要求5所述的终端设备，其特征在于，所述被感染主机描述符解释器包括文件解释器、注册表解释器、域名解释器、地址解析解释器、网络连接解释器、进程解释器、用户解释器中的一个或多个。
  7. 一种检测终端安全状况的系统，其中，安全防护设备位于私有网络与公有网络连接处，终端位于私有网络中，包括：
    安全防护设备，用于接收来自公有网络的文件，并运行所述文件，从而生成动态行为结果；根据所述动态行为结果判断所述文件是否包含高级可持续威胁；如果在所述动态行为结果中包含高级可持续威胁，获取所述动态行为结果中稳定的行为特征，根据所述稳定的行为特征生成相应被感染主机描述符；其中，所述动态行为结果包含按照行为发生时间顺序形成的行为序列；所述行为序列中的行为属于不同的行为类型，行为类型包括创建文件、修改注册表、配置域名、解析地址、连接网络、加载进程、添加用户；所述稳定的行为特征是指所述文件在每次运行后所生成行为序列中均出现的行为；
    终端设备，用于接收来自所述安全防护设备的被感染主机描述符；对所述被感染主机描述符进行解析，得到所述被感染主机描述符中包含的高级可持续威胁APT对应的行为特征；搜索所述终端的操作系统和文件系统，确定所述终端是否已发生所述APT对应的行为特征所描述的行为；如果所述终端已发生所述APT对应的行为特征所描述的行为，确定所述终端已感染所述APT。
  8. 一种检测终端安全状况的方法，其中，所述方法由安全防护设备执行，且所述安全防护设备位于私有网络与公有网络连接处，终端位于私有网络中；包括：
    所述安全防护设备接收来自所述公有网络的文件，并在所述安全防护设备中运行所述文件，从而生成动态行为结果；其中，所述动态行为结果包含按照行为发生时间顺序形成的行为序列；所述行为序列中的行为属于不同的行为类型，行为类型包括创建文件、修改注册表、配置域名、解析地址、连接网络、加载进程、添加用户；
    所述安全防护设备根据生成的所述动态行为结果判断所述文件是否包含高级可持续威胁，若包含所述高级可持续威胁，则获取所述动态行为结果中稳定的行为特征，根据所述稳定的行为特征生成相应被感染主机描述符，并将所述被感染主机描述符发送至所述终端；其中，所述稳定的行为特征是指在所述文件在每次运行后所生成行为序列中均出现的行为。
  9. 根据权利要求8所述的方法，其特征在于，所述获取所述动态行为结果中稳定的行为特征，包括：
    在所述安全防护设备中运行至少两次所述文件，分别得到每次运行后生成的行为序列，从而获得至少两个行为序列；
    确定所述至少两个行为序列中存在的相同的行为，其中，相同的行为是指行为类型和行为内容均相同的行为；
    获得由所述至少两个行为序列中相同的行为构成的集合，将所述集合作为稳定的行为特征。
  10. 一种检测终端安全状况的方法，包括：
    终端接收来自安全防护设备的被感染主机描述符；
    所述终端对所述被感染主机描述符进行解析，得到所述被感染主机描述符中包含的高级可持续威胁APT对应的行为特征；
    搜索所述终端的操作系统和文件系统，确定所述终端是否已发生所述APT对应的行为特征所描述的行为；
    如果所述终端已发生所述APT对应的行为特征所描述的行为，确定所述终端已感染所述APT。
PCT/CN2016/101263 2015-12-24 2016-09-30 一种检测终端安全状况方法、装置及系统 WO2017107616A1 (zh)

Priority Applications (5)

Application Number Priority Date Filing Date Title
EP19214322.0A EP3687134B1 (en) 2015-12-24 2016-09-30 Method, apparatus, and system for detecting terminal security status
ES16877427T ES2775874T3 (es) 2015-12-24 2016-09-30 Método, aparato y sistema para detectar condiciones de seguridad de un terminal
EP16877427.1A EP3288231B1 (en) 2015-12-24 2016-09-30 Method, apparatus and system for detecting security conditions of terminal
US15/871,308 US10735374B2 (en) 2015-12-24 2018-01-15 Method, apparatus, and system for detecting terminal security status
US16/897,050 US11431676B2 (en) 2015-12-24 2020-06-09 Method, apparatus, and system for detecting terminal security status

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510988051.4A CN106921608B (zh) 2015-12-24 2015-12-24 一种检测终端安全状况方法、装置及系统
CN201510988051.4 2015-12-24

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US15/871,308 Continuation US10735374B2 (en) 2015-12-24 2018-01-15 Method, apparatus, and system for detecting terminal security status

Publications (1)

Publication Number Publication Date
WO2017107616A1 true WO2017107616A1 (zh) 2017-06-29

Family

ID=59088989

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/101263 WO2017107616A1 (zh) 2015-12-24 2016-09-30 一种检测终端安全状况方法、装置及系统

Country Status (5)

Country Link
US (2) US10735374B2 (zh)
EP (2) EP3687134B1 (zh)
CN (2) CN110891048B (zh)
ES (1) ES2775874T3 (zh)
WO (1) WO2017107616A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112104726A (zh) * 2020-09-09 2020-12-18 上海微亿智造科技有限公司 一种工业物联网对象存储实时监测系统

Families Citing this family (23)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11240207B2 (en) * 2017-08-11 2022-02-01 L3 Technologies, Inc. Network isolation
US11601467B2 (en) 2017-08-24 2023-03-07 L3 Technologies, Inc. Service provider advanced threat protection
US11178104B2 (en) 2017-09-26 2021-11-16 L3 Technologies, Inc. Network isolation with cloud networks
US11552987B2 (en) 2017-09-28 2023-01-10 L3 Technologies, Inc. Systems and methods for command and control protection
US11374906B2 (en) 2017-09-28 2022-06-28 L3 Technologies, Inc. Data exfiltration system and methods
US11223601B2 (en) 2017-09-28 2022-01-11 L3 Technologies, Inc. Network isolation for collaboration software
US11184323B2 (en) 2017-09-28 2021-11-23 L3 Technologies, Inc Threat isolation using a plurality of containers
US11336619B2 (en) 2017-09-28 2022-05-17 L3 Technologies, Inc. Host process and memory separation
US11550898B2 (en) 2017-10-23 2023-01-10 L3 Technologies, Inc. Browser application implementing sandbox based internet isolation
US11170096B2 (en) 2017-10-23 2021-11-09 L3 Technologies, Inc. Configurable internet isolation and security for mobile devices
US11120125B2 (en) 2017-10-23 2021-09-14 L3 Technologies, Inc. Configurable internet isolation and security for laptops and similar devices
CN108460278B (zh) * 2018-02-13 2020-07-14 奇安信科技集团股份有限公司 一种威胁情报处理方法及装置
CN108563951B (zh) * 2018-04-13 2023-03-24 腾讯科技（深圳）有限公司 病毒检测方法及装置
CN109688092A (zh) * 2018-04-25 2019-04-26 北京微步在线科技有限公司 失陷设备检测方法及装置
CN109040136A (zh) * 2018-09-29 2018-12-18 成都亚信网络安全产业技术研究院有限公司 一种网络攻击的检测方法及电子设备
US10880328B2 (en) * 2018-11-16 2020-12-29 Accenture Global Solutions Limited Malware detection
CN110224975B (zh) * 2019-04-26 2021-10-22 奇安信科技集团股份有限公司 Apt信息的确定方法及装置、存储介质、电子装置
CN110222318B (zh) * 2019-06-05 2023-03-24 卡斯柯信号(成都)有限公司 基于xml的数据生成工具开发方法
US10789354B1 (en) * 2019-10-01 2020-09-29 Capital One Services, Llc Computer-based systems configured for detecting and sandboxing external resources and methods of use thereof
US11336690B1 (en) * 2019-11-15 2022-05-17 National Technology & Engineering Solutions Of Sandia, Llc Threat emulation framework
CN113746781A (zh) * 2020-05-28 2021-12-03 深信服科技股份有限公司 一种网络安全检测方法、装置、设备及可读存储介质
CN112906011B (zh) * 2021-05-07 2021-08-03 北京安普诺信息技术有限公司 漏洞发现方法、测试方法、安全测试方法及相关装置、平台
CN115408696B (zh) * 2022-11-02 2023-04-07 荣耀终端有限公司 应用识别方法及电子设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060259967A1 (en) * 2005-05-13 2006-11-16 Microsoft Corporation Proactively protecting computers in a networking environment from malware
CN101572691A (zh) * 2008-04-30 2009-11-04 华为技术有限公司 一种入侵检测方法、系统和装置
CN102457495A (zh) * 2010-10-21 2012-05-16 中华电信股份有限公司 网络病毒防护方法及系统
CN102970309A (zh) * 2012-12-25 2013-03-13 苏州山石网络有限公司 僵尸主机的检测方法、检测装置及防火墙
CN103051627A (zh) * 2012-12-21 2013-04-17 公安部第一研究所 一种反弹式木马的检测方法

Family Cites Families (78)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6792543B2 (en) * 2001-08-01 2004-09-14 Networks Associates Technology, Inc. Virus scanning on thin client devices using programmable assembly language
US20050273858A1 (en) * 2004-06-07 2005-12-08 Erez Zadok Stackable file systems and methods thereof
CN100374972C (zh) * 2005-08-03 2008-03-12 珠海金山软件股份有限公司 一种检测和防御计算机恶意程序的系统和方法
CN1760883A (zh) * 2005-11-10 2006-04-19 上海交通大学 支持大规模多用户并发控制的计算机病毒实验方法
US20120167164A1 (en) * 2005-11-16 2012-06-28 Azos Ai, Llc System, method, and apparatus for encryption key cognition incorporating autonomous security protection
US20080016339A1 (en) * 2006-06-29 2008-01-17 Jayant Shukla Application Sandbox to Detect, Remove, and Prevent Malware
CN101034974A (zh) * 2007-03-29 2007-09-12 北京启明星辰信息技术有限公司 基于时间序列和事件序列的关联分析攻击检测方法和装置
US8370932B2 (en) * 2008-09-23 2013-02-05 Webroot Inc. Method and apparatus for detecting malware in network traffic
US8276202B1 (en) * 2009-06-30 2012-09-25 Aleksandr Dubrovsky Cloud-based gateway security scanning
US8938800B2 (en) * 2010-07-28 2015-01-20 Mcafee, Inc. System and method for network level protection against malicious software
US9245114B2 (en) * 2010-08-26 2016-01-26 Verisign, Inc. Method and system for automatic detection and analysis of malware
US9690915B2 (en) * 2010-11-29 2017-06-27 Biocatch Ltd. Device, method, and system of detecting remote access users and differentiating among users
US8949992B2 (en) * 2011-05-31 2015-02-03 International Business Machines Corporation Detecting persistent vulnerabilities in web applications
US8904531B1 (en) * 2011-06-30 2014-12-02 Emc Corporation Detecting advanced persistent threats
US9686293B2 (en) * 2011-11-03 2017-06-20 Cyphort Inc. Systems and methods for malware detection and mitigation
US9081959B2 (en) * 2011-12-02 2015-07-14 Invincea, Inc. Methods and apparatus for control and detection of malicious content using a sandbox environment
CN103312679B (zh) * 2012-03-15 2016-07-27 北京启明星辰信息技术股份有限公司 高级持续威胁的检测方法和系统
US8776236B2 (en) * 2012-04-11 2014-07-08 Northrop Grumman Systems Corporation System and method for providing storage device-based advanced persistent threat (APT) protection
US9223962B1 (en) * 2012-07-03 2015-12-29 Bromium, Inc. Micro-virtual machine forensics and detection
CN103634264A (zh) * 2012-08-20 2014-03-12 江苏中科慧创信息安全技术有限公司 一种基于行为分析的主动诱捕方法
US9191399B2 (en) * 2012-09-11 2015-11-17 The Boeing Company Detection of infected network devices via analysis of responseless outgoing network traffic
CN102930210B (zh) * 2012-10-14 2015-11-25 江苏金陵科技集团有限公司 恶意程序行为自动化分析、检测与分类系统及方法
US9378361B1 (en) * 2012-12-31 2016-06-28 Emc Corporation Anomaly sensor framework for detecting advanced persistent threat attacks
CN103916365B (zh) * 2012-12-31 2018-09-11 西门子公司 导出和验证恶意代码的网络行为特征的方法和装置
US9165142B1 (en) * 2013-01-30 2015-10-20 Palo Alto Networks, Inc. Malware family identification using profile signatures
US9690931B1 (en) * 2013-03-11 2017-06-27 Facebook, Inc. Database attack detection tool
US9774620B2 (en) * 2013-06-18 2017-09-26 Microsoft Technology Licensing, Llc Automatic code and data separation of web application
CN103354548B (zh) * 2013-06-28 2016-05-25 华为数字技术（苏州）有限公司 高持续性威胁攻击的检测方法、设备及系统
US9065849B1 (en) * 2013-09-18 2015-06-23 Symantec Corporation Systems and methods for determining trustworthiness of software programs
US9628507B2 (en) * 2013-09-30 2017-04-18 Fireeye, Inc. Advanced persistent threat (APT) detection center
US10515214B1 (en) * 2013-09-30 2019-12-24 Fireeye, Inc. System and method for classifying malware within content created during analysis of a specimen
WO2015066604A1 (en) * 2013-11-04 2015-05-07 Crypteia Networks S.A. Systems and methods for identifying infected network infrastructure
CN103905418B (zh) * 2013-11-12 2017-02-15 北京安天电子设备有限公司 一种多维度检测防御apt的系统及方法
US9258324B2 (en) * 2013-11-26 2016-02-09 At&T Intellectual Property I, L.P. Methods, systems, and computer program products for protecting a communication network against internet enabled cyber attacks through use of screen replication from controlled internet access points
US9355246B1 (en) * 2013-12-05 2016-05-31 Trend Micro Inc. Tuning sandbox behavior based on static characteristics of malware
US9665715B1 (en) * 2013-12-23 2017-05-30 Symantec Corporation Systems and methods for detecting malware-induced crashes
US9747446B1 (en) * 2013-12-26 2017-08-29 Fireeye, Inc. System and method for run-time object classification
JP6248649B2 (ja) 2014-01-23 2017-12-20 株式会社デンソー 絶縁通信装置
US9171154B2 (en) * 2014-02-12 2015-10-27 Symantec Corporation Systems and methods for scanning packed programs in response to detecting suspicious behaviors
US10225280B2 (en) * 2014-02-24 2019-03-05 Cyphort Inc. System and method for verifying and detecting malware
US9294486B1 (en) * 2014-03-05 2016-03-22 Sandia Corporation Malware detection and analysis
US20160078365A1 (en) * 2014-03-21 2016-03-17 Philippe Baumard Autonomous detection of incongruous behaviors
US9392015B2 (en) * 2014-04-28 2016-07-12 Sophos Limited Advanced persistent threat detection
US9917851B2 (en) * 2014-04-28 2018-03-13 Sophos Limited Intrusion detection using a heartbeat
US10447710B1 (en) * 2014-06-03 2019-10-15 Cryptonite, LLC Self-shielding dynamic network architecture
US9332022B1 (en) * 2014-07-07 2016-05-03 Symantec Corporation Systems and methods for detecting suspicious internet addresses
US10230747B2 (en) * 2014-07-15 2019-03-12 Cisco Technology, Inc. Explaining network anomalies using decision trees
US9892270B2 (en) * 2014-07-18 2018-02-13 Empow Cyber Security Ltd. System and method for programmably creating and customizing security applications via a graphical user interface
US9565204B2 (en) * 2014-07-18 2017-02-07 Empow Cyber Security Ltd. Cyber-security system and methods thereof
US9596266B1 (en) * 2014-07-23 2017-03-14 Lookingglass Cyber Solutions, Inc. Apparatuses, methods and systems for a real-time cyber threat indicator verification mechanism
US20160065594A1 (en) * 2014-08-29 2016-03-03 Verizon Patent And Licensing Inc. Intrusion detection platform
US9807114B2 (en) * 2014-09-05 2017-10-31 Topspin Securtiy Ltd System and a method for identifying the presence of malware using mini-traps set at network endpoints
US9860208B1 (en) * 2014-09-30 2018-01-02 Palo Alto Networks, Inc. Bridging a virtual clone of a target device in a honey network to a suspicious device in an enterprise network
US9411959B2 (en) * 2014-09-30 2016-08-09 Juniper Networks, Inc. Identifying an evasive malicious object based on a behavior delta
US9882929B1 (en) * 2014-09-30 2018-01-30 Palo Alto Networks, Inc. Dynamic selection and generation of a virtual clone for detonation of suspicious content within a honey network
US9690928B2 (en) * 2014-10-25 2017-06-27 Mcafee, Inc. Computing platform security methods and apparatus
EP3213207A4 (en) * 2014-10-31 2018-04-25 Cyber Crucible Inc. A system and method for network intrusion detection of covert channels based on off-line network traffic
US11212255B2 (en) * 2015-10-30 2021-12-28 Melih Abdulhayoglu System and method of protecting a network
US9338175B1 (en) * 2014-11-24 2016-05-10 At&T Intellectual Property I, L.P. Methods and systems for providing comprehensive cyber-security protection using an open application programming interface based platform solution
CN104506495A (zh) * 2014-12-11 2015-04-08 国家电网公司 一种智能化网络apt攻击威胁分析方法
US9800605B2 (en) * 2015-01-30 2017-10-24 Securonix, Inc. Risk scoring for threat assessment
US9769201B2 (en) * 2015-03-06 2017-09-19 Radware, Ltd. System and method thereof for multi-tiered mitigation of cyber-attacks
CN104657915B (zh) 2015-03-10 2018-12-18 全球能源互联网研究院 一种动态自适应的电力系统终端安全威胁评估方法
US9819689B2 (en) * 2015-03-13 2017-11-14 Microsoft Technology Licensing, Llc Large scale malicious process detection
US10708296B2 (en) * 2015-03-16 2020-07-07 Threattrack Security, Inc. Malware detection based on training using automatic feature pruning with anomaly detection of execution graphs
CN104766006B (zh) * 2015-03-18 2019-03-12 百度在线网络技术（北京）有限公司 一种确定危险文件所对应的行为信息的方法和装置
CN104850780A (zh) * 2015-04-27 2015-08-19 北京北信源软件股份有限公司 一种高级持续性威胁攻击的判别方法
US9954871B2 (en) * 2015-05-06 2018-04-24 Hand Held Products, Inc. Method and system to protect software-based network-connected devices from advanced persistent threat
US10084816B2 (en) * 2015-06-26 2018-09-25 Fortinet, Inc. Protocol based detection of suspicious network traffic
US20160381049A1 (en) * 2015-06-26 2016-12-29 Ss8 Networks, Inc. Identifying network intrusions and analytical insight into the same
US9390268B1 (en) * 2015-08-04 2016-07-12 Iboss, Inc. Software program identification based on program behavior
US9811659B1 (en) * 2015-08-25 2017-11-07 Symantec Corporation Systems and methods for time-shifted detection of security threats
US9742796B1 (en) * 2015-09-18 2017-08-22 Palo Alto Networks, Inc. Automatic repair of corrupt files for a detonation engine
US9825989B1 (en) * 2015-09-30 2017-11-21 Fireeye, Inc. Cyber attack early warning system
US9961093B1 (en) * 2015-09-30 2018-05-01 EMC IP Holding Company LLC Monitoring for reverse-connection network activity to detect a remote-administration tool
US9917854B2 (en) * 2015-09-30 2018-03-13 Emc Corporation Security detection
US10320814B2 (en) * 2015-10-02 2019-06-11 Trend Micro Incorporated Detection of advanced persistent threat attack on a private computer network
US9894036B2 (en) * 2015-11-17 2018-02-13 Cyber Adapt, Inc. Cyber threat attenuation using multi-source threat data analysis

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060259967A1 (en) * 2005-05-13 2006-11-16 Microsoft Corporation Proactively protecting computers in a networking environment from malware
CN101572691A (zh) * 2008-04-30 2009-11-04 华为技术有限公司 一种入侵检测方法、系统和装置
CN102457495A (zh) * 2010-10-21 2012-05-16 中华电信股份有限公司 网络病毒防护方法及系统
CN103051627A (zh) * 2012-12-21 2013-04-17 公安部第一研究所 一种反弹式木马的检测方法
CN102970309A (zh) * 2012-12-25 2013-03-13 苏州山石网络有限公司 僵尸主机的检测方法、检测装置及防火墙

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3288231A4 *

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112104726A (zh) * 2020-09-09 2020-12-18 上海微亿智造科技有限公司 一种工业物联网对象存储实时监测系统

Also Published As

Publication number Publication date
CN110891048A (zh) 2020-03-17
EP3288231A4 (en) 2018-07-04
ES2775874T3 (es) 2020-07-28
US20200304463A1 (en) 2020-09-24
EP3288231A1 (en) 2018-02-28
CN106921608B (zh) 2019-11-22
US11431676B2 (en) 2022-08-30
US20180139178A1 (en) 2018-05-17
US10735374B2 (en) 2020-08-04
EP3687134A1 (en) 2020-07-29
EP3288231B1 (en) 2020-02-05
CN106921608A (zh) 2017-07-04
CN110891048B (zh) 2021-09-03
EP3687134B1 (en) 2021-11-24

Similar Documents

Publication Publication Date Title
WO2017107616A1 (zh) 一种检测终端安全状况方法、装置及系统
Kok et al. Early detection of crypto-ransomware using pre-encryption detection algorithm
US11188650B2 (en) Detection of malware using feature hashing
US9135443B2 (en) Identifying malicious threads
US7779472B1 (en) Application behavior based malware detection
US9239922B1 (en) Document exploit detection using baseline comparison
JP6726429B2 (ja) ドメイン生成アルゴリズム（ｄｇａ）のマルウェアを検出するためのシステムおよび方法
KR20150018626A (ko) 소프트웨어 보호 메커니즘
Ali et al. Trust in IoT: dynamic remote attestation through efficient behavior capture
US8910281B1 (en) Identifying malware sources using phishing kit templates
WO2023151257A1 (zh) 模拟攻击杀伤链的方法、装置、存储介质及电子设备
Li et al. LogKernel: A threat hunting approach based on behaviour provenance graph and graph kernel clustering
Pan et al. PMCAP: a threat model of process memory data on the windows operating system
Sohail Macro Based Malware Detection System
CN108256327A (zh) 一种文件检测方法及装置
WO2021212739A1 (zh) 网络攻击的防御方法、装置、设备、系统和存储介质
Fatima et al. Malware Detection Using Cuckoo And ML Techniques
US11962618B2 (en) Systems and methods for protection against theft of user credentials by email phishing attacks
Chia-Mei et al. Research on classification of malware source code
Gundoor Identification Of Dominant Features in Non-Portable Executable Malicious File
Summerville et al. Prevention of information attacks by run-time detection of self-replication in computer codes
Tripathi et al. Defending Web Applications Against JavaScript Worms on Core Network of Cloud Platforms
KR20240019738A (ko) 사이버 위협 정보 처리 장치, 사이버 위협 정보 처리방법 및 사이버 위협 정보 처리하는 프로그램을 저장하는 저장매체
WO2023003565A1 (en) Kill chain identifications
Javaji FIREFOX ADD-ON FOR METAMORPHIC JAVASCRIPT MALWARE DETECTION

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16877427

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2016877427

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE