WO2017185827A1

WO2017185827A1 - Method and apparatus for determining suspicious activity of application program

Info

Publication number: WO2017185827A1
Application number: PCT/CN2017/070468
Authority: WO
Inventors: 刘振华
Original assignee: 华为技术有限公司
Priority date: 2016-04-26
Filing date: 2017-01-06
Publication date: 2017-11-02
Also published as: CN107315952A

Abstract

A method and an apparatus for determining suspicious activity of an application program. The method comprises: when determining that the data accessed by a process activity of a first application program belongs to a second application program that is different to the first application program, a terminal device (110) determines that the process activity is candidate suspicious activity, the data comprising at least one of a process, a thread, a file, a directory, or a registry entry; the terminal device (110) sends activity characteristics information of the process activity to a data analysis server (120), such that the data analysis server (120), on the basis of the activity characteristics information of the process activity, determines whether the process activity is suspicious activity. On this basis, the suspicious activity of illegal access to application program data in the terminal device (110) can be determined; compared to the prior art, the present method does not need to rely on security software and does not require the user to participate in the determination, and can improve the accuracy and reliability of determining suspicious activity, thereby improving overall system performance.

Description

Method and apparatus for determining suspicious behavior of an application

The present application claims priority to Chinese Patent Application No. 201610266466.5, entitled "Method and Apparatus for Determining Suspicious Behavior of Application", filed on April 26, 2016, the entire contents of which are incorporated by reference. In this application.

Technical field

Embodiments of the present invention relate to the field of computers and, more particularly, to a method and apparatus for determining suspicious behavior of an application.

Background technique

Intra-enterprise checks for Advanced Persistent Threat (APT) attacks generally favor the use of big data analytics, including traffic analysis in enterprise networks, using sandboxes to analyze files and attempting to discover patterns that use traditional signature matching. An unrecognized advanced threat that analyzes the early warning logs of various traditional security inspection devices. The purpose of these analyses is to timely identify security issues within the enterprise and minimize the damage that high-level threats bring to the enterprise.

The traditional host-based defense method is mainly to prevent suspicious behavior from attacking the system. This defense method must rely on security software to monitor the process behavior of all applications in the host through security software. The IT staff pre-sets an access control policy in the security software to control the application's access to system data. If a process behavior does not satisfy the above access control policy, then the security software determines that the process behavior is suspicious. After monitoring suspicious behavior, the security software will directly alert the user who is using the host to let the user choose whether to intercept the suspicious behavior.

However, the traditional defense method only involves the application's access rules to system data, and does not prevent suspicious behavior of illegal access to application data, such as suspicious behavior of stealing or tampering with application data. In addition, because ordinary users do not have much computer knowledge, the way in which traditional defense methods let users judge whether to intercept suspicious behavior is not very appropriate.

Summary of the invention

Embodiments of the present invention provide a method and apparatus for determining suspicious behavior of an application, which can determine suspicious behavior of illegally accessing application data, thereby improving overall system performance.

In a first aspect, a method for determining suspicious behavior of an application is provided, comprising: when determining, by the terminal device, that data accessed by a process behavior of the first application belongs to a second application different from the first application, Determining the behavior of the process as a candidate suspicious behavior, the data including at least one of a process, a thread, a file, a directory, and a registry item; the terminal device transmitting behavior characteristic information of the process behavior to the data analysis server to facilitate the data analysis The server determines whether the behavior of the process is suspicious according to the behavior characteristic information of the behavior of the process.

Specifically, when the data accessed by the process behavior of the first application of the terminal device belongs to the second application, the terminal device determines that the process behavior is a candidate suspicious behavior. For example, the second application includes the process P1 and the process P2. If the file F is created during the execution of the file F1, the file F belongs to the second application. If the process P2 accesses the file F during execution, Then the behavior of the process P2 can be regarded as legal. If the process P3 in the first application different from the second application accesses the file F, the behavior of the process P3 is a candidate suspicious behavior.

In this way, the embodiment of the present invention determines the candidate suspicious behavior from all detected process behaviors by the terminal device based on the data access rule between the application and the application, and sends the determined behavior characteristic information of the candidate suspicious behavior to the data. The analysis server determines, by the data analysis server, whether the candidate suspicious behavior is a suspicious behavior according to the behavior characteristic information of the candidate suspicious behavior, thereby determining a suspicious behavior of the terminal device illegally accessing the application data. Compared with the prior art, the method does not need to rely on security software, and does not require user participation in the determination, can improve the accuracy and reliability of the determination of suspicious behavior, thereby improving the overall performance of the system.

Alternatively, the terminal device may be a host or a client.

Optionally, before the terminal device determines the behavior of the process as a candidate suspicious behavior, the terminal device may determine relationship information between the application and the data in the system in multiple manners. The terminal device can acquire the relationship information between the existing application program and the data in the system by collecting system information; the terminal device can obtain real-time monitoring manner between each application in the system and the data created by the system in real time. Relationship information; the terminal device can also determine whether the system is installing an application, and if the system is installing an application, the data created during the installation process is associated with the application. In this way, after determining the relationship information between the application and the data in the system, the terminal device can according to the relationship between the application and the data. Information, determine the application to which the data accessed by the process behavior of the first application belongs, thereby further determining the candidate suspicious behavior.

In a first possible implementation manner of the first aspect, the terminal device determines the behavior of the process when determining that the data accessed by the process behavior of the first application belongs to the second application different from the first application The candidate suspicious behavior includes: if the process behavior is a dynamic link library DLL file loading behavior of the first application, the terminal device determines whether the DLL file loaded by the process behavior is a system DLL file; if the DLL file is not a system DLL file, the terminal device determines an application to which the DLL file belongs; if the DLL file belongs to the second application different from the first application, the terminal device determines the behavior of the process as the candidate suspicious behavior .

With reference to the foregoing possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, the terminal device determines that the data accessed by the process behavior of the first application belongs to the first application The second application determines the behavior of the process as a candidate suspicious behavior, including: if the process behavior is a registry access behavior of the first application, the terminal device determines a path to create a registry accessed by the process behavior An application; if the path of the registry is created by the second application different from the first application, the terminal device determines whether the path of the registry is a publicly accessible path; if the path of the registry is not The publicly accessible path, the terminal device determines the behavior of the process as the candidate suspicious behavior.

With reference to the foregoing possible implementation manner of the first aspect, in a third possible implementation manner of the first aspect, the terminal device determines that the data accessed by the process behavior of the first application belongs to the first application. The second application determines the behavior of the process as a candidate suspicious behavior, including: if the process behavior is a file access behavior of the first application, the terminal device determines an application that creates a file accessed by the process behavior; If the file accessed by the process behavior is created by the second application different from the first application, the terminal device determines the type of the file accessed by the process behavior; if the type of the file accessed by the process behavior is The program file, the terminal device determines the behavior of the process as the candidate suspicious behavior.

With reference to the foregoing possible implementation manner of the first aspect, in a fourth possible implementation manner of the first aspect, if the type of the file accessed by the process behavior is a non-program file, the terminal device determines that the process behavior is accessed by the process An application registered with the extension of the file; if the extension of the file accessed by the process is registered, the application registered is a third application different from the first application In sequence, the terminal device determines the behavior of the process as the candidate suspicious behavior.

With reference to the foregoing possible implementation manner of the first aspect, in a fifth possible implementation manner of the first aspect, if the first process behavior is a process creation behavior, the terminal device determines a process created by the first process behavior Whether the process belongs to the first application; if the process created by the first process behavior does not belong to the first application, the terminal device determines whether the process is a system process of the first terminal device; if the process is not the first A system process of the terminal device, the first terminal device determining the first process behavior as the first candidate suspicious behavior.

With reference to the foregoing possible implementation manner of the first aspect, in a sixth possible implementation manner of the first aspect, if the first process behavior is a thread creation behavior, the terminal device determines the thread created by the first process behavior The application; if the thread created by the first process behavior belongs to the second application different from the first application, the first terminal device determines the first process behavior as the first candidate suspicious behavior .

It should be understood that there are many types of suspicious behaviors of an application, which may include but are not limited to the following types: inter-process thread injection, loading of unknown DLL files, accessing files that are not their own, accessing a registry that is not their own, modifying system files, Delete system files, modify the system registry, delete the system registry, and more. Therefore, the above is just a description of some of the cases, and the other cases are similar.

With reference to the foregoing possible implementation manner of the first aspect, in a seventh possible implementation manner of the first aspect, the behavior characteristic information includes: application information to which the process behavior belongs, information about data accessed by the process behavior, and The application information to which the data accessed by the process behaves.

With reference to the foregoing possible implementation manner of the first aspect, in an eighth possible implementation manner of the first aspect, after the terminal device sends the behavior characteristic information of the process behavior to the data analysis server, the method further includes: the terminal The device receives the indication information sent by the data analysis server, where the indication information is used to indicate that the process behavior is a normal behavior; and the terminal device determines, according to the indication message, that the process behavior is a normal behavior.

In this way, if the terminal device detects the behavior of the process again, the terminal does not send the behavior characteristic information of the process behavior to the data analysis server. Therefore, the method can not only improve the accuracy of detecting the candidate suspicious behavior of the terminal device, but also avoid the transmission of unnecessary behavior feature information, thereby saving signaling overhead.

In conjunction with the above possible implementation of the first aspect, the ninth possible implementation in the first aspect In the mode, after the terminal device sends the behavior characteristic information of the process behavior to the data analysis server, the method further includes: the terminal device receiving the request message sent by the data analysis server, where the request message is used to request traceability of the process behavior Information, the traceability information includes at least one of the following information: process information of the process behavior, information of a program file corresponding to the behavior of the process, relationship information between a process creator of the process behavior and a program file creator; The terminal device sends the traceability information to the data analysis server according to the request message.

Specifically, after determining that the process behavior is suspicious, the data analysis server may request the terminal device to trace the source behavior of the process behavior. The terminal device sends the traceability information of the suspicious behavior to the data analysis server, so that the IT manager obtains the traceability information through the data analysis server, and can restore the suspicious behavior according to the traceability information, and how the occurrence of the suspicious behavior occurs, which is beneficial to Investigation and evidence collection of late attack events.

In a second aspect, a method for determining suspicious behavior of an application is provided, comprising: receiving, by a data analysis server, behavior characteristic information of a first process behavior sent by a first terminal device, where the first process behavior belongs to the first An application, and the data accessed by the first process behavior belongs to a second application different from the first application, the data including at least one of a process, a thread, a file, a directory, and a registry entry; the data analysis server Determining whether the first process behavior is a suspicious behavior according to behavior characteristic information of the first process behavior.

In a first possible implementation manner of the second aspect, the data analysis server determines, according to behavior characteristic information of the first process behavior, whether the first process behavior is a suspicious behavior, including: the data analysis server is configured according to the first The behavior characteristic information of the process behavior, determining whether the first process behavior belongs to a set of trusted behaviors, wherein the trusted behavior set includes at least one trusted behavior; if it is determined that the first process behavior does not belong to the trusted behavior set, The data analysis server determines that the first process behaves as suspicious.

With reference to the foregoing possible implementation manner of the second aspect, in a second possible implementation manner of the second aspect, the data analysis server determines, according to behavior characteristic information of the first process behavior, whether the first process behavior belongs to Before the set of trust behaviors, the method further includes: the data analysis server receiving behavior characteristic information of the plurality of second process behaviors sent by each of the at least one second terminal device; the data analysis server according to the at least one The behavior characteristic information of the plurality of second process behaviors sent by the second terminal device, the data mining algorithm is used to determine the set of trusted behaviors, wherein the set of trusted behaviors includes at least one of the plurality of second process behaviors Process behavior.

Optionally, the data mining algorithm may be a frequent item set algorithm, a support vector machine algorithm or a decision tree algorithm, or the like.

With reference to the foregoing possible implementation manner of the second aspect, in a third possible implementation manner of the second aspect, the behavior characteristic information of the first process behavior includes: application information to which the first process behavior belongs, the first The information of the data accessed by the process behavior and the application information of the data accessed by the behavior of the first process; the behavior characteristic information of the behavior of the plurality of second processes includes: application information of the behavior of the plurality of second processes, The information of the data accessed by the plurality of second processes and the application information to which the data accessed by the plurality of second process behaviors belongs.

With reference to the foregoing possible implementation manner of the second aspect, in a fourth possible implementation manner of the second aspect, the method further includes: if the data analysis server determines that the first process behavior is a normal behavior, the data analysis server And transmitting, to the first terminal device, indication information, where the indication information is used to indicate that the first process behavior is a normal behavior.

With reference to the foregoing possible implementation manner of the second aspect, in a fifth possible implementation manner of the second aspect, the method further includes: if the data analysis server determines that the first process behavior is a suspicious behavior, the data analysis server Sending a request message to the first terminal device, where the request message is used to request traceability information of the first process behavior, where the traceability information includes process information of the first process behavior, and information about a program file corresponding to the first process behavior. At least one of the relationship information of the process creator and the program file creator of the first process behavior; the data analysis server receives the traceability information sent by the first terminal device according to the request message; the data analysis server passes through the background The management interface displays the traceability information.

Specifically, the data analysis server can display the traceability information of the suspicious behavior to the IT manager through the background management interface, so that the IT manager can restore the suspicious behavior according to the traceability information and how it occurs, which is beneficial to the later attack. Investigation and evidence collection of the incident.

In a third aspect, an apparatus for determining suspicious behavior of an application for performing the method of any of the above-described first aspect or any of the possible implementations of the first aspect is provided.

In particular, the apparatus may comprise means for performing the method of any of the above-described first aspect or any of the possible implementations of the first aspect.

In a fourth aspect, an apparatus for determining suspicious behavior of an application for performing the method of any of the above-described second aspect or any of the possible implementations of the second aspect is provided.

In particular, the apparatus may comprise means for performing the method of any of the possible implementations of the second aspect or the second aspect described above.

In a fifth aspect, an apparatus for determining suspicious behavior of an application is provided, the apparatus comprising: a receiver, a transmitter, a memory, a processor, and a bus system. Wherein the receiver, the transmitter, the memory and the processor are connected by the bus system, the memory is for storing instructions for executing the instructions stored by the memory to control the receiver to receive signals and control the sending The transmitter transmits a signal, and when the processor executes the memory stored instructions, the execution causes the processor to perform the method of the first aspect or any of the possible implementations of the first aspect.

In a sixth aspect, an apparatus for determining suspicious behavior of an application is provided, the apparatus comprising: a receiver, a transmitter, a memory, a processor, and a bus system. Wherein the receiver, the transmitter, the memory and the processor are connected by the bus system, the memory is for storing instructions for executing the instructions stored by the memory to control the receiver to receive signals and control the sending The transmitter transmits a signal, and when the processor executes the memory stored instructions, the execution causes the processor to perform the method of any of the second aspect or any of the possible implementations of the second aspect.

A seventh aspect, a system for determining suspicious behavior of an application, the system comprising the apparatus of any of the possible implementations of the third aspect or the third aspect, and the fourth or fourth aspect a device in a possible implementation; or

The system comprises the apparatus of any of the possible implementations of the fifth or fifth aspect, and the apparatus of any of the sixth or sixth aspect of the possible implementation.

In an eighth aspect, a computer readable medium is provided for storing a computer program, the computer program comprising instructions for performing the method of the first aspect or any of the possible implementations of the first aspect.

A ninth aspect, a computer readable medium for storing a computer program, the computer program comprising instructions for performing the method of any of the second aspect or the second aspect of the second aspect.

DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings to be used in the embodiments of the present invention will be briefly described below. It is obvious that the drawings described below are only some embodiments of the present invention, One of ordinary skill in the art, without creative labor Further drawings can also be obtained from these drawings.

1 is a schematic diagram of a system to which an embodiment of the present invention is applied.

FIG. 2 is a schematic flowchart of a method for determining suspicious behavior of an application according to an embodiment of the present invention.

FIG. 3 is a schematic diagram of another system for determining suspicious behavior of an application according to an embodiment of the present invention.

FIG. 4 is a schematic block diagram of an apparatus for determining suspicious behavior of an application according to an embodiment of the present invention.

FIG. 5 is a schematic block diagram of another apparatus for determining suspicious behavior of an application according to an embodiment of the present invention.

FIG. 6 is a schematic block diagram of another apparatus for determining suspicious behavior of an application according to an embodiment of the present invention.

FIG. 7 is a schematic block diagram of another apparatus for determining suspicious behavior of an application according to an embodiment of the present invention.

detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts shall fall within the scope of the present invention.

First, a brief introduction to some of the technologies involved in the application in the operating system. It should be understood that an application is composed of a plurality of program files, which are also referred to as executable program files.

The program file initiates a system service request to the operating system during runtime. A system service request can also be called an application programming interface (API) call. The API call may include reading and writing of a file, allocation of a memory, input and output (IO) of a network, operation of a hardware device, reading and writing of a system configuration, and the like, which are not limited by the embodiment of the present invention. Once the program file is run, the process will be generated in the system, so the program file has a one-to-one correspondence with the process. In this article, the API files of the application's program files during runtime are collectively referred to as the "process behavior" of the program files. It should be understood that each process behavior corresponds to one behavior characteristic information, and each behavior characteristic information includes a path involved in executing the corresponding process behavior.

In addition, this article refers to the application-related processes, threads, files, directories, and registry keys, etc., collectively referred to as the "data" of the application. Every time an application is installed and every time the application is run, the corresponding data is generated. It should be understood that the data other than the system data belongs to a specific application.

FIG. 1 shows a system 100 to which an embodiment of the present invention is applied. The system 100 can include at least one terminal device 110 and one data analysis server 120. The terminal device 110 can be mobile or fixed. The terminal device 110 can refer to an access terminal, a user equipment (User Equipment, referred to as "UE"), a subscriber unit, a subscriber station, a mobile station, a mobile station, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, and a wireless device. Communication device, user agent or user device. The access terminal may be a cellular phone, a cordless phone, a Session Initiation Protocol ("SSIP") phone, a Wireless Local Loop (WLL) station, and a personal digital processing (Personal Digital) Assistant, referred to as "PDA"), a handheld device with wireless communication capabilities, a computing device or other processing device connected to a wireless modem, an in-vehicle device, a wearable device, a terminal device in a future 5G network, or a future evolving public land mobile A terminal device or the like in a network (Public Land Mobile Network, abbreviated as "PLMN"). In the embodiment of the present invention, optionally, the terminal device 100 is a host or a client.

The data analysis server 120 may be a file server, a database server, an application server, a WEB server, etc., which is not limited by the embodiment of the present invention.

FIG. 1 exemplarily shows a terminal device and a data analysis server. Alternatively, the system 100 may include a plurality of terminal devices, which is not limited by the embodiment of the present invention.

In the embodiment of the present invention, multiple terminal devices can independently exchange information with the data analysis server. Therefore, the data analysis server may transmit information with a plurality of terminal devices at the same time, thereby determining an application suspicious behavior of each of the plurality of terminal devices. The process of determining the suspicious behavior of the application in each terminal device by the data analysis server is similar. For ease of understanding and description, the following is an example of the process of determining, by the data analysis server, the suspicious behavior of the application in the first terminal device among the plurality of terminal devices. Description.

FIG. 2 is a schematic flowchart of a method for determining suspicious behavior of an application provided by an embodiment of the present invention. The method 200 can be applied to the system 100 shown in FIG. 1, but the embodiment of the invention is not limited thereto. The method 200 includes:

S210. The first terminal device determines data accessed by the first process behavior of the first application. When the second application is different from the first application, the first process behavior is determined as candidate suspicious behavior, and the data includes at least one of a process, a thread, a file, a directory, and a registry key.

The first terminal device can learn that the application has a process behavior through a mechanism provided by the existing operating system. For example, the Windows operating system provides a filter driver mechanism that allows users to implement extended functions without affecting the normal functionality of the operating system. First the user can write a driver module and register the driver module with the operating system. The driver module can implement additional functions based on interfaces and points of interest provided by the filter driver mechanism, such as obtaining information about file operations and the like. After that, the operating system will operate related information, such as the process name and operation object, when the file input/output (I/O) operation, registry I/O operation, network I/O operation, etc. occur in each process. The identifier of the file, registry entry, etc. is sent to the driver module.

Specifically, a plurality of applications may be installed in the first terminal device, and when the first terminal device detects a process behavior, the process behavior belongs to a first application among the multiple applications, but the process behavior is accessed. The data belongs to the second application in the plurality of applications, where the first application is different from the second application, and the first terminal device considers that the process behavior accesses data that is not its own, and the process is Behavior is determined to be candidate suspicious behavior.

It should be understood that, in the embodiment of the present invention, the first terminal device does not simply detect the process behavior of all applications in the system, but filters all the process behaviors detected, and whether the data accessed according to the process behavior belongs to the The application to which the process behavior belongs, filters suspected suspicious process behavior from all process behavior.

It should also be understood that, in this embodiment, only a process of determining a process behavior is taken as an example. For the determination of all process behaviors detected by the first terminal device, the foregoing method may be adopted.

Optionally, before the first terminal device determines the first process behavior as a candidate suspicious behavior, the first terminal device determines relationship information between the application and the data in the system. Here, the determination of the relationship information between the application and the data can be specifically divided into the following three cases:

(1) The first terminal device can acquire relationship information between the existing application program and the data in the system by collecting system information. For example, the first terminal device may locate the application directory of the application through the registry, classify the program file and the non-program according to the file creation time with the directory creation time as the application, and collect the program file of the application. Product name, The company's copyright name, digital signature information, etc. are stored in the information database.

(2) The first terminal device can acquire the relationship information between each application in the system and the data created by the system in real time through real-time monitoring. For example, if the first terminal device detects a data creation action of a process, the relationship between the created data and the creator's relationship information is stored in the information database.

(3) The first terminal device can determine whether the system is installing an application, and if the system is installing an application, the data created during the installation process is associated with the application. For example, if a process is detected or a child process of the process creates a plurality of program files in a fixed directory, the first terminal device can determine whether the process or the child process registers an application, and if so, then The first terminal device establishes a relationship between the application program and the program file and the registry, and stores the corresponding relationship information in the information database.

After the relationship information between the application and the data is determined, the first terminal device can filter the detected process behavior according to the relationship information between the application and the data. Specifically, for example, the first application includes a process P1 and a process P2. If the file F is created during the execution of the P1, the file F belongs to the first application, and if the process P2 accesses the file during execution. F, the behavior of the process P2 can be regarded as legal. If the process P3 in the second application different from the first application accesses the file F, the behavior of the process P3 is a candidate suspicious behavior.

S220. The first terminal device sends behavior characteristic information of the first process behavior to the data analysis server.

Specifically, in the embodiment of the present invention, the first terminal device directly reports the behavior characteristic information of the selected candidate suspicious behavior (ie, the first process behavior) to the data analysis server, and the data analysis server analyzes the behavior of the first process. And processing.

S230. The data analysis server receives the behavior characteristic information of the first process behavior, and determines, according to the behavior characteristic information of the first process behavior, whether the first process behavior is a suspicious behavior.

Specifically, the data analysis server may receive behavior characteristic information of the first process behavior that the first terminal device considers suspicious, and then determine, according to the behavior characteristic information, whether the first process behavior is a suspicious behavior.

As an optional embodiment, the data analysis server determines, according to the behavior characteristic information of the first process behavior, whether the behavior of the first process is a suspicious behavior, including:

Determining, by the data analysis server, whether the first process behavior belongs to a set of trusted behaviors according to behavior characteristic information of the first process behavior, where the trusted behavior set includes at least one trusted behavior;

If it is determined that the first process behavior does not belong to the set of trusted behaviors, the data analysis server determines that the first process behavior is suspicious.

Specifically, the data analysis server may determine whether the first process behavior belongs to a set of trusted behaviors, and the set of trusted behaviors includes at least one trusted behavior. If the first process behavior belongs to the set of trusted behaviors, the data analysis server determines that the first process behavior is a normal behavior; if the first process behavior does not belong to the trusted behavior set, then the data analysis server determines the first A process behavior is suspicious. Specifically, the data analysis server confirms that the first process behavior belongs to the trusted behavior set when the behavior characteristic information of the first process behavior is the same as the behavior characteristic information of one trusted behavior in the trusted behavior set; otherwise, in the first When the behavior characteristic information of the process behavior is different from the behavior characteristic information of each trusted behavior in the trusted behavior set, it is confirmed that the first process behavior does not belong to the trusted behavior set.

In this way, the embodiment of the present invention determines the candidate suspicious behavior from all detected process behaviors by the terminal device based on the data access rule between the application and the application, and sends the determined behavior characteristic information of the candidate suspicious behavior to the data. An analysis server that determines whether the candidate suspicious behavior is suspicious. The method for determining suspicious behavior of an application of an embodiment of the present invention is capable of determining suspicious behavior of illegally accessing application data without relying on security software and requiring no user involvement.

It should be understood that the size of the sequence numbers of the above processes does not imply a sequence of executions, and the order of execution of the processes should be determined by its function and internal logic, and should not be construed as limiting the implementation process of the embodiments of the present invention.

In the prior art, the host determines the suspicious behavior directly by using security software, and the security software monitors the process behavior of all applications in the system. The IT staff pre-sets an access control policy in the security software to control access to the system data by the process behavior of the application in the system. If a process behavior does not satisfy the above access control policy, then the security software determines that the process behavior is suspicious. After monitoring suspicious behavior, the security software will directly alert the user who is using the host to let the user choose whether to intercept the suspicious behavior. Therefore, the traditional host-based defense method is mainly to prevent suspicious behavior from attacking the system, and this defense method must Rely on security software.

However, the traditional defense method only involves the application's access rules to the system data, does not consider the data access rules between the application and the application, and cannot prevent the suspicious behavior of illegal access to the application data, for example, stealing or tampering with the application. Suspicious behavior of program data. In addition, because ordinary users do not have much computer knowledge, the way in which traditional defense methods let users judge whether to intercept suspicious behavior is not very appropriate.

Therefore, the embodiment of the present invention determines the candidate suspicious behavior from the detected process behavior by the terminal device based on the data access rule between the application and the application, and sends the determined behavior characteristic information of the candidate suspicious behavior to the data analysis server. And determining, by the data analysis server, whether the candidate suspicious behavior is a suspicious behavior, thereby being able to determine a suspicious behavior of illegally accessing application data in the terminal device, and the method does not need to rely on the security software, and does not require the user, compared with the prior art. Participation in the determination can improve the accuracy and reliability of the judgment of suspicious behavior, thereby improving the overall performance of the system.

As an optional embodiment, in S210, the first terminal device determines that the candidate suspicious behavior may be classified into multiple cases according to the specific type of the process behavior.

Optionally, if the first process behavior is a dynamic link library (DLL) file loading behavior of the first application, the first terminal device determines whether the DLL file loaded by the first process behavior is a system DLL file; if the DLL file is not a system DLL file, the first terminal device determines an application to which the DLL file belongs; and if the DLL file belongs to the second application different from the first application, the A terminal device determines the first process behavior as the candidate suspicious behavior.

Optionally, if the first process behavior is a registry access behavior of the first application, the first terminal device determines an application that creates a path of a registry accessed by the first process behavior; if the registry The path is created by the second application different from the first application, the first terminal device determines whether the path of the registry is a publicly accessible path; if the path of the registry is not a publicly accessible path, then The first terminal device determines the first process behavior as a candidate suspicious behavior.

Optionally, if the first process behavior is a file access behavior of the first application, the first terminal device determines an application that creates a file accessed by the first process behavior; if the first process behavior is accessed The file is created by the second application different from the first application, then the file Determining, by the first terminal device, a type of the file accessed by the first process behavior; if the type of the file accessed by the first process behavior is a program file, the first terminal device may directly determine the first process behavior as a candidate Suspicious behavior.

Optionally, if the type of the file accessed by the first process behavior is a non-program file, the first terminal device determines an application registered by the extension of the file accessed by the first process behavior; if the first process behavior If the application registered by the extension of the accessed file is a third application different from the first application, the first terminal device determines the first process behavior as a candidate suspicious behavior;

Optionally, if the first process behavior is a process creation behavior, the terminal device determines whether the process created by the first process behavior belongs to the first application; if the process created by the first process behavior does not belong to the a first application, the terminal device determines whether the process is a system process of the first terminal device; if the process is not a system process of the first terminal device, the first terminal device determines the first process behavior as The first candidate suspicious behavior.

Here, the first process behavior should be understood as the behavior of the virus. The program file of the first application carries the virus. When the system runs the program file, the virus creates a new process, but the process does not belong to the first application. Therefore, based on the above judgment conditions, it can be determined whether the application carries a virus.

Optionally, if the first process behavior is a thread creation behavior, the terminal device determines an application of the thread created by the first process behavior; if the thread created by the first process behavior is different from the first The second application of the application, the first terminal device determines the first process behavior as the first candidate suspicious behavior.

It should be understood that there are many types of suspicious behaviors of an application, which may include but are not limited to the following types: inter-process thread injection, loading of unknown DLL files, accessing files that are not their own, accessing a registry that is not their own, modifying system files, Delete system files, modify the system registry, delete the system registry, and more. Therefore, the above is just a list of some of the cases to describe, other situations are similar, and will not be repeated here.

As an optional embodiment, before the data analysis server determines, according to the behavior characteristic information of the first process behavior, whether the first process behavior is a suspicious behavior, the method further includes:

The data analysis server receives behavior characteristic information of a plurality of second process behaviors sent by each of the at least one second terminal device;

The data analysis server determines the set of trusted behaviors by using a data mining algorithm according to the behavior characteristic information of the plurality of second process behaviors sent by the at least one second terminal device, where the trusted behavior set includes the multiple second processes At least one second process behavior in the behavior.

It should be understood that the second terminal device in this embodiment may be the same as or different from the foregoing first terminal device; the second process behavior may be the same as or different from the foregoing first process behavior, and the embodiment of the present invention may Not limited.

As an optional embodiment, the behavior characteristic information of the first process behavior includes: application information to which the first process behavior belongs, information of data accessed by the first process behavior, and access by the first process behavior. Application information to which the data belongs;

The behavior characteristic information of the plurality of second process behaviors includes: application information to which the plurality of second process actions belong, information of data accessed by the plurality of second process actions, and access by the plurality of second process actions The application information to which the data belongs.

Specifically, the generation of the set of trusted behavior feature information may adopt a data mining method. Therefore, the second terminal device is required to send the behavior characteristic information that the data mining algorithm can use to the data analysis server. After determining the second process behavior, the second terminal device preprocesses the information of the second process behavior, and converts the information of the second process behavior into the behavior feature information. Optionally, the behavior characteristic information may be sent to the data analysis server by the second terminal device as a set, and the set may include: a behavior of the second process behavior, a destination path of the second process behavior, and a second process behavior The file name path information of the application, the copyright information of the application, the version information of the application, the header hash of the application file of the application, the digital signature information of the program file of the application, and the like.

Since the inspection of APT attacks generally tends to use big data analysis, data mining algorithms can be used to uncover suspicious behaviors that are not recognized by security software. Optionally, the data mining algorithm herein may be a frequent item set algorithm, a support vector machine algorithm, a decision tree algorithm, or the like, which is not limited by the embodiment of the present invention.

As an optional embodiment, after the data analysis server determines, according to the behavior characteristic information of the first process behavior, whether the first process behavior is a suspicious behavior, the method further includes:

And if the data analysis server determines that the first process behavior is a normal behavior, the data analysis server sends the indication information to the first terminal device, where the indication information is used to indicate that the first process behavior is a normal behavior.

The first terminal device receives the indication information sent by the data analysis server, and determines, according to the indication message, that the first process behavior is a normal behavior.

In this way, if the first terminal device detects the first process behavior again, the behavior information of the first process behavior is not sent to the data analysis server.

If the data analysis server determines that the first process behavior is a suspicious behavior, the data analysis server sends a request message to the first terminal device, where the request message is used to request traceability information of the first process behavior, and the traceability information includes the At least one of process information of a first process behavior, information of a program file corresponding to the behavior of the first process, relationship information between a process creator of the first process behavior, and a program file creator;

Receiving, by the first terminal device, the request message sent by the data analysis server, and sending the traceability information to the data analysis server according to the request message;

The data analysis server receives the traceability information sent by the first terminal device according to the request message, and displays the traceability information through a background management interface.

In this embodiment, after determining the suspicious behavior, the data analysis server may display the traceability information of the suspicious behavior through the background management interface, so that the information technology (IT) management personnel determine the suspicious behavior through the traceability information. origin of.

In a specific embodiment, the foregoing terminal device may specifically be a client, and the foregoing method for determining a suspicious program may be applied to an enterprise including multiple clients. As shown in FIG. 3, for example, the enterprise includes a client 301, a client 302, and a client 303, and a monitoring program such as a probe program 304, a probe program 305, and a probe program 306 are separately deployed in each client. These probe programs are responsible for implementing the monitoring of all process behaviors in the enterprise client and filtering the monitored process behavior. If a process behavior accesses data that is not its own, the probe program determines that the process behavior is a candidate suspicious. behavior.

After the candidate suspicious behavior is determined, each client separately extracts behavior characteristic information of each candidate suspicious behavior.

The probe program in the client transmits the determined behavior characteristic information of the candidate suspicious behavior to the data analysis server 307. The data analysis server 307 continuously receives behavior characteristic information of candidate suspicious behaviors sent from different clients, and uses the data mining algorithm to perform the received behavior characteristic information. Statistical analysis, generating a set of trusted behaviors including at least one trusted behavior. After the data analysis server 307 generates the set of trusted behaviors, it can determine whether the candidate suspicious behavior is suspicious according to the behavior characteristic information of the candidate suspicious behavior.

For example, the data analysis server 307 receives the behavior characteristic information of the process behavior sent by the client 301, that is, the behavior characteristic information of the candidate suspicious behavior, and can determine the behavior of the process according to the behavior characteristic information.

If the data analysis server 307 determines that the process behavior is a normal behavior, it sends an indication message to the client 301 indicating that the process behavior is a normal behavior. After receiving the indication information, the client 301 determines the behavior of the process as a normal behavior. If the client 301 detects the behavior of the process again, the behavior characteristic information of the process behavior is not sent to the data analysis server 307.

If the data analysis server 307 determines that the process behavior is suspicious, it sends a request message to the client 301 requesting traceability information of the process behavior. After receiving the request message, the client 301 sends the traceability information of the process behavior to the data analysis server 307. The data analysis server 307 receives the traceability information sent by the client 301, and displays the traceability information through the background management interface.

Alternatively, the data analysis server 307 can send the traceability information to the system management server 308. The system management server 308 can display the traceability information to related personnel of the enterprise, such as an IT manager, in real time, so that the IT manager can restore the suspicious behavior according to the traceability information when and how the suspicious behavior occurs, which will be beneficial to the Investigation and evidence collection of late attack events.

It should be understood that in the establishment phase of the above-mentioned trusted set, the data analysis server does not necessarily judge the suspicious behavior. Because this kind of statistical analysis relies on the process behavior accumulated over a period of time, it is possible that a certain behavior is rarely counted at the beginning, but the subsequent number is gradually increased. Therefore, the data analysis server is required to process the previously received process. Perform backtracking iterations to improve the accuracy of the judgment results.

The method for determining suspicious behavior of an application according to an embodiment of the present invention determines a candidate suspicious behavior from a detected process behavior by a terminal device based on a data access rule between the application and the application, and determines the candidate suspicious behavior. The behavior characteristic information is sent to the data analysis server, and the data analysis server determines whether the candidate suspicious behavior is a suspicious behavior, thereby being able to determine a suspicious behavior of illegally accessing the application data, and the method does not need to rely on security compared with the prior art. Software, and does not require user participation in the determination, can improve the accuracy and reliability of the judgment of suspicious behavior, thereby improving the overall performance of the system. On the basis of this, the embodiment of the present invention can display the traceability information of the suspicious behavior to the IT management personnel through the background management interface, so that the IT management personnel can restore the suspicious behavior when and how to appear according to the traceability information. Conducive to the investigation and evidence collection of later attacks.

A method for determining suspicious behavior of an application according to an embodiment of the present invention is described in detail above with reference to FIGS. 1 through 3. Hereinafter, an application for determining an application according to an embodiment of the present invention will be described in detail with reference to FIGS. 4 through 7. A device for suspicious behavior.

FIG. 4 shows an apparatus 400 for determining suspicious behavior of an application provided by an embodiment of the present invention. The apparatus 400 includes:

The determining unit 410 is configured to determine the process behavior as a candidate suspicious behavior when determining that the data accessed by the process behavior of the first application belongs to a second application different from the first application, where the data includes a process, a thread At least one of a file, a directory, and a registry key;

The sending unit 420 is configured to send behavior characteristic information of the process behavior to the data analysis server, so that the data analysis server determines, according to the behavior characteristic information of the process behavior, whether the process behavior is suspicious behavior.

Optionally, the determining unit 410 is specifically configured to:

If the process behavior is the dynamic link library DLL file loading behavior of the first application, determining whether the DLL file loaded by the process behavior is a system DLL file;

If the DLL file is not a system DLL file, determine an application to which the DLL file belongs;

If the DLL file belongs to the second application different from the first application, the process behavior is determined as the candidate suspicious behavior.

Optionally, the determining unit 410 is specifically configured to:

If the process behavior is a registry access behavior of the first application, determining an application that creates a path to a registry accessed by the process behavior;

If the path of the registry is created by the second application different from the first application, determining whether the path of the registry is a publicly accessible path;

If the path to the registry is not a publicly accessible path, the process behavior is determined to be the candidate suspicious behavior.

Optionally, the determining unit 410 is specifically configured to:

If the process behavior is a file access behavior of the first application, determining an application that creates a file accessed by the process behavior;

If the file accessed by the process behavior is created by the second application different from the first application, determining the type of the file accessed by the process behavior;

If the type of file accessed by the process behavior is a program file, the process behavior is determined to be the candidate suspicious behavior.

Optionally, the determining unit 410 is specifically configured to:

If the type of the file accessed by the process behavior is a non-program file, it is determined whether the application registered by the extension of the file accessed by the process behavior is the first application;

If the application registered by the extension of the file accessed by the process behavior is a third application different from the first application, the process behavior is determined as the candidate suspicious behavior.

Optionally, the behavior characteristic information includes: application information to which the process behavior belongs, information of data accessed by the process behavior, and application information to which the data accessed by the process behavior belongs.

Optionally, the apparatus 400 further includes:

a first receiving unit, configured to: after the sending the behavior characteristic information of the process behavior to the data analysis server, receive the indication information sent by the data analysis server, where the indication information is used to indicate that the process behavior is a normal behavior;

The determining unit 410 is further configured to:

According to the indication message, it is determined that the behavior of the process is a normal behavior.

Optionally, the apparatus 400 further includes:

a second receiving unit, configured to: after sending the behavior characteristic information of the process behavior to the data analysis server, receive a request message sent by the data analysis server, where the request message is used to request traceability information of the process behavior, where the traceability information includes At least one of the following information: process information of the process behavior, information of a program file corresponding to the behavior of the process, relationship information between a process creator of the process behavior and a program file creator;

The sending unit 420 is further configured to send the data to the data analysis server according to the request message. Traceability information.

It should be understood that the apparatus 400 herein is embodied in the form of a functional unit. The term "unit" herein may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor for executing one or more software or firmware programs (eg, a shared processor, a proprietary processor, or a group). Processors, etc.) and memory, merge logic, and/or other suitable components that support the described functionality. In an optional example, those skilled in the art may understand that the device 400 may be specifically the first terminal device in the foregoing embodiment, and the device 400 may be used to perform various processes corresponding to the first terminal device in the foregoing method embodiment. / or steps, in order to avoid repetition, will not repeat them here.

FIG. 5 shows an apparatus 500 for determining suspicious behavior of an application provided by an embodiment of the present invention. The apparatus 500 includes:

The receiving unit 510 is configured to receive behavior characteristic information of the first process behavior sent by the first terminal device, where the first process behavior belongs to the first application, and the data accessed by the first process behavior is different from the first a second application of an application, the data including at least one of a process, a thread, a file, a directory, and a registry entry;

The determining unit 520 is configured to determine, according to the behavior characteristic information of the first process behavior, whether the first process behavior is a suspicious behavior.

Optionally, the determining unit 520 is specifically configured to:

Determining, according to behavior characteristic information of the first process behavior, whether the first process behavior belongs to a set of trusted behaviors, wherein the trusted behavior set includes at least one trusted behavior;

If the first process behavior does not belong to the set of trusted behaviors, it is determined that the first process behavior is suspicious.

Optionally, the receiving unit 510 is further configured to:

Receiving, by the data analysis server, the plurality of the second terminal devices sent by the at least one second terminal device before determining whether the first process behavior belongs to the trusted behavior set according to the behavior characteristic information of the first process behavior Behavioral characteristics information of the second process behavior;

The determining unit 520 is further configured to:

Determining, by the data mining algorithm, the set of trusted behaviors according to behavior characteristic information of the plurality of second process behaviors sent by each second terminal device, where the set of trusted behaviors includes at least one of the plurality of second process behaviors A second process behavior.

Optionally, the behavior characteristic information of the first process behavior includes: application information to which the first process behavior belongs, information of data accessed by the first process behavior, and an application to which the data accessed by the first process behavior belongs Program information;

Optionally, the device further includes:

The first sending unit is configured to send, to the first terminal device, indication information, after the determining unit determines that the first process behavior is a normal behavior, the indication information is used to indicate that the first process behavior is a normal behavior.

Optionally, the device further includes:

a second sending unit, configured to: after the determining unit determines that the first process behavior is a suspicious behavior, send a request message to the first terminal device, where the request message is used to request traceability information of the first process behavior, the traceability information At least one of process information including the behavior of the first process, program file information of the first process behavior, process creator of the first process behavior, and relationship information of the program file creator;

The receiving unit 510 is further configured to: receive the traceability information that is sent by the first terminal device according to the request message;

The device further includes: a display unit, configured to display the traceability information through a background management interface.

It should be understood that the apparatus 500 herein is embodied in the form of a functional unit. The term "unit" herein may refer to an application specific integrated circuit (ASIC), an electronic circuit, a processor for executing one or more software or firmware programs (eg, a shared processor, a proprietary processor, or a group). Processors, etc.) and memory, merge logic, and/or other suitable components that support the described functionality. In an alternative example, those skilled in the art may understand that the device 500 may be specifically the data analysis server in the foregoing embodiment, and the device 500 may be used to execute various processes and/or corresponding to the data analysis server in the foregoing method embodiments. Steps, to avoid repetition, will not be repeated here.

FIG. 6 illustrates an apparatus 600 for determining suspicious behavior of an application provided by an embodiment of the present invention. The apparatus 600 includes a processor 610, a transmitter 620, a receiver 630, a memory 640, and a bus system 650. Wherein, the processor 610, the transmitter 620, the receiver 630, and the memory 640 pass through the bus. A system 650 is coupled to the memory 640 for storing instructions for executing instructions stored by the memory 640 to control the transmitter 620 to transmit signals and to control the receiver 630 to receive signals.

The processor 610 is configured to determine the process behavior as candidate suspicious behavior when determining that the data accessed by the process behavior of the first application belongs to a second application different from the first application, where the data includes a process. At least one of a thread, a file, a directory, and a registry key;

The transmitter 620 is configured to send the behavior characteristic information of the process behavior to the data analysis server, so that the data analysis server determines whether the process behavior is suspicious according to the behavior characteristic information of the process behavior.

Optionally, the processor 610 is specifically configured to:

Optionally, the receiver 630 is configured to: after the sending the behavior characteristic information of the process behavior to the data analysis server, receive the indication information sent by the data analysis server, where the indication information is used to indicate that the process behavior is a normal behavior;

The processor 610 is further configured to: according to the indication message, determine that the process behavior is a normal behavior.

Optionally, the receiver 630 is configured to: after sending the behavior characteristic information of the process behavior to the data analysis server, receive a request message sent by the data analysis server, where the request message is used to request traceability information of the process behavior, where The traceability information includes at least one of the following information: process information of the process behavior, information of a program file corresponding to the behavior of the process, relationship information between a process creator of the process behavior and a program file creator;

The transmitter 620 is further configured to: send the traceability information to the data analysis server according to the request message.

It should be understood that the device 600 may be specifically the terminal device in the foregoing embodiment, and may be used to perform various steps and/or processes corresponding to the terminal device in the foregoing method embodiments. Optionally, the memory 640 can include read only memory and random access memory and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory can also store information of the device type. The processor 630 can be configured to execute instructions stored in a memory, and when the processor executes instructions stored in the memory, the processor is operative to perform various steps and/or processes of the method embodiments described above.

FIG. 7 illustrates an apparatus 700 for determining suspicious behavior of an application provided by an embodiment of the present invention. The apparatus 700 includes a receiver 710, a processor 720, a transmitter 730, a memory 740, and a bus system 750. The receiver 710, the processor 720, the transmitter 730 and the memory 740 are connected by a bus system 750 for storing instructions for executing instructions stored in the memory 740 to control the receiver 710. Receiving a signal and controlling the transmitter 730 to send Send instructions.

The receiver 710 is configured to receive behavior characteristic information of the first process behavior sent by the first terminal device, where the first process behavior belongs to the first application, and the data accessed by the first process behavior is different. a second application of the first application, the data comprising at least one of a process, a thread, a file, a directory, and a registry entry;

The processor 720 is configured to determine, according to behavior characteristic information of the first process behavior, whether the first process behavior is a suspicious behavior.

Optionally, the processor 720 is specifically configured to:

Optionally, the receiver 710 is further configured to:

The processor 720 is also configured to:

Optionally, the transmitter 730 is configured to send, to the first terminal device, indication information, after the determining unit determines that the first process behavior is a normal behavior, the indication information is used to indicate that the first process behavior is a normal behavior.

Optionally, the transmitter 730 is configured to determine, at the determining unit, that the first process behavior is a suspicious line Afterwards, the request message is sent to the first terminal device, where the request message is used to request traceability information of the first process behavior, where the traceability information includes process information of the first process behavior, and a program corresponding to the first process behavior. At least one of information of the file, process creator of the first process behavior, and relationship information of the program file creator;

The receiver 710 is further configured to: receive the traceability information that is sent by the first terminal device according to the request message;

The processor 720 is configured to display the traceability information through a background management interface.

It should be understood that the apparatus 700 may be specifically the data analysis server in the foregoing embodiment, and may be used to perform various steps and/or processes corresponding to the data analysis server in the foregoing method embodiment. Alternatively, the memory 740 can include read only memory and random access memory and provide instructions and data to the processor. A portion of the memory may also include a non-volatile random access memory. For example, the memory can also store information of the device type. The processor 720 can be configured to execute instructions stored in a memory, and when the processor executes the instructions, the processor can perform various steps and/or processes corresponding to the data analysis server in the above method embodiments.

It should be understood that, in the embodiment of the present invention, the processor may be a central processing unit (CPU), and the processor may also be other general purpose processors, digital signal processors (DSPs), and application specific integrated circuits (ASICs). ), Field Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general purpose processor may be a microprocessor or the processor or any conventional processor or the like.

In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in a processor or an instruction in a form of software. The steps of the method disclosed in the embodiments of the present invention may be directly implemented as a hardware processor, or may be performed by a combination of hardware and software modules in the processor. The software module can be located in a conventional storage medium such as random access memory, flash memory, read only memory, programmable read only memory or electrically erasable programmable memory, registers, and the like. The storage medium is located in a memory, and the processor executes instructions in the memory, in combination with hardware to perform the steps of the above method. To avoid repetition, it will not be described in detail here.

Those skilled in the art will appreciate that the various method steps and elements described in connection with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both, in order to clearly illustrate hardware and software. Interchangeability, the steps and composition of the various embodiments have been generally described in terms of function in the foregoing description. Whether these functions are implemented in hardware or software, Depending on the specific application and design constraints of the technical solution. Different methods may be used to implement the described functionality for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

A person skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the system, the device and the unit described above can refer to the corresponding process in the foregoing method embodiment, and details are not described herein again.

In the several embodiments provided by the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, or an electrical, mechanical or other form of connection.

The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the embodiments of the present invention.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit can be implemented in the form of hardware or in the form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a standalone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention contributes in essence or to the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium. A number of instructions are included to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a USB flash drive, a mobile hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a disk or a CD. A variety of media that can store program code.

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any equivalent person can be easily conceived within the technical scope of the present invention by any person skilled in the art. Modifications or substitutions are intended to be included within the scope of the invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

A method for determining suspicious behavior of an application, comprising:

The terminal device determines the process behavior as candidate suspicious behavior when determining that the data accessed by the process behavior of the first application belongs to a second application different from the first application, the data including files, directories, and At least one of the registry keys;

The terminal device sends the behavior characteristic information of the process behavior to the data analysis server, so that the data analysis server determines whether the process behavior is a suspicious behavior according to the behavior characteristic information of the process behavior.
The method according to claim 1, wherein the terminal device determines the process when the data accessed by the process behavior of the first application belongs to a second application different from the first application. Behavior is determined to be candidate suspicious behavior, including:

If the process behavior is a dynamic link library DLL file loading behavior of the first application, the terminal device determines whether the DLL file loaded by the process behavior is a system DLL file;

If the DLL file is not a system DLL file, the terminal device determines an application to which the DLL file belongs;

If the DLL file belongs to the second application different from the first application, the terminal device determines the process behavior as the candidate suspicious behavior.
The method according to claim 1, wherein the terminal device determines the process when the data accessed by the process behavior of the first application belongs to a second application different from the first application. Behavior is determined to be candidate suspicious behavior, including:

And if the process behavior is a registry access behavior of the first application, the terminal device determines an application that creates a path of a registry accessed by the process behavior;

If the path of the registry is created by the second application different from the first application, the terminal device determines whether the path of the registry is a publicly accessible path;

If the path of the registry is not a publicly accessible path, the terminal device determines the process behavior as the candidate suspicious behavior.
The method according to claim 1, wherein the terminal device determines the process when the data accessed by the process behavior of the first application belongs to a second application different from the first application. Behavior is determined to be candidate suspicious behavior, including:

And if the process behavior is a file access behavior of the first application, the terminal device determines an application that creates a file accessed by the process behavior;

And if the file accessed by the process behavior is created by the second application different from the first application, the terminal device determines a type of a file accessed by the process behavior;

If the type of the file accessed by the process behavior is a program file, the terminal device determines the process behavior as the candidate suspicious behavior.
The method according to claim 4, wherein if the type of the file accessed by the process behavior is a non-program file, the terminal device determines an application registered by the extension of the file accessed by the process behavior;

And if the application registered by the extension of the file accessed by the process behavior is a third application different from the first application, the terminal device determines the process behavior as the candidate suspicious behavior.
The method according to any one of claims 1 to 5, wherein the behavior characteristic information comprises:

The application information to which the process behavior belongs, the information of the data accessed by the process behavior, and the application information to which the data accessed by the process behavior belongs.
The method according to any one of claims 1 to 6, wherein after the terminal device sends the behavior characteristic information of the process behavior to the data analysis server, the method further includes:

The terminal device receives the indication information sent by the data analysis server, where the indication information is used to indicate that the process behavior is a normal behavior;

The terminal device determines, according to the indication message, that the process behavior is a normal behavior.
The method according to any one of claims 1 to 6, wherein after the terminal device transmits behavior characteristic information of the process behavior to a data analysis server, the method further include:

The terminal device receives a request message sent by the data analysis server, where the request message is used to request traceability information of the process behavior, and the traceability information includes at least one of the following information: process information of the process behavior Information about a program file corresponding to the behavior of the process, relationship information between a process creator of the process behavior and a program file creator;

And the terminal device sends the traceability information to the data analysis server according to the request message.
A method for determining suspicious behavior of an application, comprising:

The data analysis server receives the behavior characteristic information of the first process behavior sent by the first terminal device, where the first process behavior belongs to the first application, and the data accessed by the first process behavior is different from the first a second application of an application, the data comprising at least one of a file, a directory, and a registry entry;

Determining, by the data analysis server, that the first process behavior is based on behavior characteristic information of the first process behavior and a saved set of trusted behaviors, when the first process behavior does not belong to the trusted behavior set Suspicious behavior, the set of trusted behaviors is: before the data analysis server receives the behavior characteristic information of the first process behavior, according to the received behavior characteristic information sent by the at least one other terminal device to send the plurality of second processes, Generated by the data mining algorithm, wherein the other terminal device refers to a terminal device other than the first terminal device, and the set of trusted behavior includes at least one second process behavior of the plurality of second process behaviors .
The method according to claim 9, wherein the behavior characteristic information of the first process behavior comprises:

The application information to which the first process behavior belongs, the information of the data accessed by the first process behavior, and the application information to which the data accessed by the first process behavior belongs;

The behavior characteristic information of the plurality of second process behaviors includes:

The application information to which the plurality of second process actions belong, the information of the data accessed by the plurality of second process actions, and the application information to which the data accessed by the plurality of second process actions belongs.
The method according to claim 9 or 10, wherein the method further comprises:

Determining that the first process behavior is a normal behavior when the first process behavior belongs to the set of trusted behaviors;

And if the data analysis server determines that the first process behavior is a normal behavior, the data analysis server sends the indication information to the first terminal device, where the indication information is used to indicate that the first process behavior is a normal behavior. .
The method according to claim 9 or 10, wherein the method further comprises:

If the data analysis server determines that the first process behavior is a suspicious behavior, the data analysis server sends a request message to the first terminal device, where the request message is used to request traceability information of the first process behavior. The traceability information includes process information of the first process behavior, information of a program file corresponding to the first process behavior, and relationship information between a process creator of the first process behavior and a program file creator. At least one

The data analysis server receives the traceability information that is sent by the first terminal device according to the request message;

The data analysis server displays the traceability information through a background management interface.
An apparatus for determining suspicious behavior of an application, comprising:

a determining unit, configured to determine the process behavior as a candidate suspicious behavior when determining that the data accessed by the process behavior of the first application belongs to a second application different from the first application, the data including a file At least one of a directory, a registry key, and a registry key;

And a sending unit, configured to send behavior characteristic information of the process behavior to the data analysis server, so that the data analysis server determines, according to the behavior characteristic information of the process behavior, whether the process behavior is a suspicious behavior.
The device according to claim 13, wherein the determining unit is specifically configured to:

If the process behavior is a dynamic link library DLL file loading behavior of the first application, determining whether the DLL file loaded by the process behavior is a system DLL file;

If the DLL file is not a system DLL file, determining an application to which the DLL file belongs;

If the DLL file belongs to the second application different from the first application, the process behavior is determined as the candidate suspicious behavior.
The device according to claim 13, wherein the determining unit is specifically configured to:

And if the process behavior is a registry access behavior of the first application, determining an application that creates a path of a registry accessed by the process behavior;

If the path of the registry is created by the second application different from the first application, determining whether the path of the registry is a publicly accessible path;

If the path of the registry is not a publicly accessible path, the process behavior is determined to be the candidate suspicious behavior.
The device according to claim 13, wherein the determining unit is specifically configured to:

And if the process behavior is a file access behavior of the first application, determining an application that creates a file accessed by the process behavior;

Determining, if the file accessed by the process behavior is created by the second application different from the first application, determining a type of a file accessed by the process behavior;

If the type of the file accessed by the process behavior is a program file, the process behavior is determined as the candidate suspicious behavior.
The apparatus according to claim 16, wherein if the type of the file accessed by the process behavior is a non-program file, determining whether the application registered by the extension of the file accessed by the process behavior is the An application;

If the application registered by the extension of the file accessed by the process behavior is a third application different from the first application, the process behavior is determined as the candidate suspicious behavior.
The device according to any one of claims 13 to 17, wherein the device further comprises:

a first receiving unit, configured to receive, after the sending unit sends the behavior characteristic information of the process behavior to the data analysis server, the indication information sent by the data analysis server, where the indication information is used to indicate the process Behavior is normal behavior;

The determining unit is further configured to:

Determining that the process behavior is a normal behavior according to the indication message.
The device according to any one of claims 13 to 17, wherein the device further comprises:

a second receiving unit, configured to: after sending the behavior characteristic information of the process behavior to the data analysis server, receive a request message sent by the data analysis server, where the request message is used to request traceability information of the process behavior The traceability information includes at least one of the following information: process information of the process behavior, information of a program file corresponding to the process behavior, process creator of the process behavior, and a program file creator Relationship information;

The sending unit is further configured to:

And sending the traceability information to the data analysis server according to the request message.
An apparatus for determining suspicious behavior of an application, comprising:

a receiving unit, configured to receive behavior characteristic information of the first process behavior sent by the first terminal device, where the first process behavior belongs to the first application, and the data accessed by the first process behavior is different from the a second application of the first application, the data comprising at least one of a file, a directory, and a registry entry;

a determining unit, configured to determine, according to behavior characteristic information of the first process behavior, and the saved set of trusted behaviors, when the first process behavior does not belong to the trusted behavior set, determining that the first process behavior is Suspicious behavior, the set of trusted behaviors is: before the data analysis server receives the behavior characteristic information of the first process behavior, according to the received behavior characteristic information sent by the at least one other terminal device to send the plurality of second processes, Generated by the data mining algorithm, wherein the other terminal device refers to a terminal device other than the first terminal device, and the set of trusted behavior includes at least one second process behavior of the plurality of second process behaviors .
The device of claim 20 wherein:

The determining unit is further configured to: when the first process behavior belongs to the set of trusted behaviors, determine that the first process behavior is a normal behavior;

The device also includes:

a first sending unit, configured to determine, in the determining unit, that the first process behavior is a normal behavior Then, the indication information is sent to the first terminal device, where the indication information is used to indicate that the first process behavior is a normal behavior.
The device of claim 20, wherein the device further comprises:

a second sending unit, configured to: after the determining unit determines that the first process behavior is a suspicious behavior, send a request message to the first terminal device, where the request message is used to request traceability of the first process behavior Information, the traceability information includes process information of the first process behavior, information of a program file corresponding to the behavior of the first process, relationship information between a process creator of the first process behavior, and a program file creator At least one type;

The receiving unit is further configured to:

Receiving the traceability information sent by the first terminal device according to the request message;

The device also includes:

a display unit, configured to display the traceability information through a background management interface.