WO2018076697A1 - 僵尸特征的检测方法和装置 - Google Patents

僵尸特征的检测方法和装置 Download PDF

Info

Publication number
WO2018076697A1
WO2018076697A1 PCT/CN2017/087170 CN2017087170W WO2018076697A1 WO 2018076697 A1 WO2018076697 A1 WO 2018076697A1 CN 2017087170 W CN2017087170 W CN 2017087170W WO 2018076697 A1 WO2018076697 A1 WO 2018076697A1
Authority
WO
WIPO (PCT)
Prior art keywords
file
dynamic behavior
sandbox
feature
zombie
Prior art date
Application number
PCT/CN2017/087170
Other languages
English (en)
French (fr)
Inventor
蒋武
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to ES17863527T priority Critical patent/ES2829600T3/es
Priority to EP17863527.2A priority patent/EP3509001B1/en
Publication of WO2018076697A1 publication Critical patent/WO2018076697A1/zh
Priority to US16/372,923 priority patent/US10757135B2/en
Priority to US16/897,707 priority patent/US11290484B2/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
    • G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/033—Test or assess software
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/144—Detection or countermeasures against botnets

Definitions

  • the present invention relates to the field of computer security technologies, and in particular, to a method and apparatus for detecting zombie features.
  • Botnet refers to an attacker using one or more means of communication to infect a large number of hosts with bots, such as by sending malicious files to a large number of hosts, causing the host to infect the bot while receiving and running the malicious file.
  • a one-to-many control network formed between the attacker and the infected host, wherein the infected host is a zombie host, and the attacker can control one-to-many through Command and Control (C&C) channels.
  • C&C Command and Control
  • Zombie host The botnet constitutes an attack platform, which can be used to initiate a variety of cyber attacks, resulting in flaws in certain applications of the attacking object, leakage of personal privacy, and the like. For example, using botnets to send spam, steal secrets and other cyber attacks to attackers.
  • a botnet can cause more damage to an attacking object than a traditional attacker uses a single host to attack an attacking object.
  • the zombie feature is usually identified and extracted from the malicious file by manual analysis, and the subsequently received malicious file is filtered and blocked according to the zombie feature.
  • an attacker often modifies malicious files more frequently, and can easily generate a large number of malicious files. The above method of extracting zombie features is inefficient and cannot be widely used.
  • Embodiments of the present invention provide a method and apparatus for detecting zombie features, which can improve the efficiency of extracting zombie features.
  • the embodiment provides a method for detecting a zombie feature, and the method for detecting the zombie feature includes:
  • Step A acquiring a first dynamic behavior file and a second dynamic behavior file
  • the first dynamic behavior file is a behavior file generated by the dynamic behavior detection of the malicious file in the first sandbox
  • the second dynamic behavior file is a behavior file generated by the dynamic behavior detection of the malicious file in the second sandbox.
  • the dynamic behavior detection refers to initiating a system service request, a file read/write, a registry modification, an application programming interface (API) call to the operating system during a malicious file operation, and a call to the application programming interface (API).
  • API application programming interface
  • a series of behaviors such as network access, and record information corresponding to each behavior in the dynamic behavior file, such as file read and write behavior, and the behavior information of the behavior includes the operator that performs the action, the path involved, and the like;
  • Step B determining a malicious file zombie according to a common feature of the first dynamic behavior file and the second dynamic behavior file feature.
  • the malicious file is simulated in a sandbox, and the behavior file of the network behavior of the malicious file during the running process, that is, the dynamic behavior file is collected, to extract from the dynamic behavior file.
  • the zombie feature the whole process can be automated to improve the efficiency of extracting zombie features.
  • the dynamic behavior detection of the same malicious file is performed in at least two sandboxes, at least two sandboxes are extracted from the zombie feature.
  • the zombie feature is extracted from the common features between the dynamically outputted dynamic behavior files, which can avoid the extracted zombie features containing strings randomly filled in the dynamic behavior file by different sandboxes and a string for describing the information of the sandbox (for example The sandbox's network protocol address and port address) improve the accuracy of the zombie feature.
  • the first dynamic behavior file includes a first session message
  • the second dynamic behavior file includes a second session message
  • the first session message is The destination network protocol (IP) address is the same as the destination IP address of the second session packet
  • the destination port of the first session packet is the same as the destination port of the second session packet.
  • IP network protocol
  • the step B includes:
  • Step B11 Determine a zombie feature of the malicious file according to the common feature of the first session packet and the second session packet.
  • the step B11 includes:
  • Step B21 The first preset field is obtained.
  • the method for obtaining the first preset field is different.
  • the first preset field is pre-stored in the first configuration table in the gateway device, and the first configuration table is read.
  • the configuration table is configured to determine a first preset field.
  • the first preset field included in the first configuration table may be updated at any time; optionally, when the session message is Hypertext Transfer Protocol (Hyper Text Transfer Protocol) , HTTP) protocol application layer message encapsulated, the first preset field includes a payload field and/or a request field;
  • Hypertext Transfer Protocol Hyper Text Transfer Protocol
  • HTTP Hyper Text Transfer Protocol
  • Step B22 Determine whether the content in the first preset field of the first session message and the content in the first preset field of the second session message contain the same character string, if yes Determining that the zombie feature of the malicious file includes the character string and a location of the character string in the first preset field.
  • the step B11 includes:
  • Step B31 Obtain a preset content of the second preset field and the second preset field.
  • the preset content of the second preset field and the second preset field is pre-stored in a second configuration table in the gateway device, by reading the second configuration table. Determining the second preset field and the preset content of the second preset field; optionally, the content of the second configuration table may be updated at any time; optionally, when the session packet is an application layer packet encapsulated by HTTP
  • the second preset field includes an agent field, and the preset content of the agent field includes the user information that issues the request;
  • Step B32 The second preset field exists in a common feature of the first session packet and the second session packet, and content of the second preset field in the shared feature and the preset When the content is different, determining that the zombie feature includes content of a second preset field of the shared feature.
  • the step B11 includes:
  • Step B41 Obtain a pre-processing operation rule, where the pre-processing operation rule indicates that the specified character in the packet is removed.
  • the pre-processing operation rule is pre-stored in the gateway.
  • the pre-processing operation rule is determined by reading the third configuration table; optionally, the content of the third configuration table may be updated at any time;
  • the pre-processing operation rule may be used in the following manner.
  • the pre-processing operation rule is used to indicate that at least one of the following is included: the HTTP keyword in the session packet, and the session packet.
  • the HTTP keyword can be a string such as GET or HTTP1.1.
  • Step B42 Obtain, according to the pre-processing rule, the first remaining content from the first session packet, and obtain the second remaining content from the second session packet, where the first remaining content is the The content of the message in the first session message other than the specified character, and the second remaining content is the content of the message in the second session message other than the specified character;
  • Step B43 Determine a zombie feature of the malicious file according to the common feature of the first remaining content and the second remaining content.
  • the step A includes:
  • Step A11 Obtain a static behavior file and a dynamic behavior file outputted by the first sandbox, and a static behavior file and a dynamic behavior file output by the second sandbox;
  • the static behavior file outputted by the first sandbox is a behavior file generated by the static behavior detection of the to-be-detected file in the first sandbox
  • the static behavior file output by the second sandbox is the to-be-detected a behavior file generated by the static behavior detection in the second sandbox
  • the dynamic behavior file of the first sandbox output is the file to be detected in the first sandbox in the first sandbox
  • the dynamic behavior file output by the second sandbox is a behavior file generated by the dynamic behavior detection of the to-be-detected file in the second sandbox
  • Step A12 determining, according to the static behavior file and the dynamic behavior file output by the first sandbox, and the static behavior file and the dynamic behavior file output by the second sandbox, whether the file to be detected is a malicious file;
  • weighting at least one of the four files outputted by the first sandbox and the second sandbox is performed, and determining whether the network packet is a malicious file according to the score result;
  • Step A13 When it is determined that the to-be-detected file is a malicious file, determine that the dynamic behavior file output by the first sandbox is the first dynamic behavior file, and the dynamic behavior file output by the second sandbox is The second dynamic behavior file is described.
  • the step A includes:
  • Step A21 Obtaining a malicious file
  • Step A22 Input the malicious file into the first sandbox and the second sandbox respectively for dynamic behavior detection
  • Step A23 Obtain a dynamic behavior file of the first sandbox output, and a dynamic behavior file of the second sandbox output.
  • a second aspect of the embodiments of the present invention provides a device for detecting a zombie feature, including:
  • An acquiring module configured to acquire a first dynamic behavior file and a second dynamic behavior file, where the first dynamic behavior file is a behavior file generated by a malicious file in a first sandbox for dynamic behavior detection, and the second dynamic behavior file is a behavior file generated by the dynamic behavior detection of the malicious file in a second sandbox;
  • a determining module configured to determine a zombie feature of the malicious file according to the common feature of the first dynamic behavior file and the second dynamic behavior file.
  • the obtaining module provided in this embodiment is used to perform step A of the first aspect of the embodiment of the present invention.
  • the determining module provided in this embodiment is used to perform the first aspect of the embodiment of the present invention. Step B.
  • the first dynamic behavior file includes a first session message
  • the second dynamic behavior file includes a second session message
  • the first session message is The destination network protocol IP address is the same as the destination IP address of the second session packet
  • the destination port of the first session packet is the same as the destination port of the second session packet.
  • the determining module is specifically configured to determine a zombie feature of the malicious file according to a common feature of the first session packet and the second session packet.
  • the determining module provided in this embodiment is used to perform step B11 of the first aspect of the embodiment of the present invention.
  • step B11 the determining module provided in this embodiment is used to perform step B11 of the first aspect of the embodiment of the present invention.
  • the first aspect of the embodiment of the present invention which is not described in detail in this embodiment.
  • the determining module is specifically configured to:
  • the zombie feature of the malicious file includes the character string and the location of the character string in the first preset field.
  • the determining module provided in this embodiment is used to perform step B21 and step B22 of the first aspect of the embodiment of the present invention.
  • step B21 and the step B22 please refer to the first aspect of the embodiment of the present invention, and details are not repeatedly described in this embodiment.
  • the determining module is specifically configured to:
  • the second preset field exists in the common feature of the first session packet and the second session packet, and the content of the second preset field and the preset content in the shared feature are not At the same time, it is determined that the zombie feature includes content of a second preset field of the common features.
  • the determining module provided in this embodiment is used to perform step B31 and step B32 of the first aspect of the embodiment of the present invention.
  • the specific implementation process of the step B31 and the step B32 is shown in the first aspect of the embodiment of the present invention, and details are not repeatedly described in this embodiment.
  • the determining module is specifically configured to:
  • the first remaining content is the first session
  • the second remaining content is the content of the message other than the specified character in the second session message
  • the zombie feature of the malicious file is determined according to a common feature of the first remaining content and the second remaining content.
  • the determining module provided in this embodiment is used to perform step B41, step B42 and step B43 of the first aspect of the embodiment of the present invention.
  • the specific implementation process of the step B41, the step B42, and the step B43 is shown in the first aspect of the embodiment of the present invention, and details are not repeatedly described in this embodiment.
  • the acquiring module is specifically configured to:
  • the dynamic behavior file of the first sandbox output is a behavior file generated by the dynamic behavior detection of the to-be-detected file in the first sandbox in the first sandbox, and the dynamic behavior file of the second sandbox output a behavior file generated by the dynamic behavior detection in the second sandbox for the file to be detected;
  • the determining module provided in this embodiment is used to perform step A11, step A12 and step A13 of the first aspect of the embodiment of the present invention.
  • the specific implementation process of the step A11, the step A12, and the step A13 is shown in the first aspect of the embodiment of the present invention, and details are not repeatedly described in this embodiment.
  • the acquiring module is specifically configured to:
  • the malicious files are respectively input into the first sandbox and the second sandbox for dynamic behavior detection;
  • the determining module provided in this embodiment is used to perform step A21, step A22 and step A23 of the first aspect of the embodiment of the present invention.
  • the specific implementation process of the step A21, the step A22, and the step A23 is shown in the first aspect of the embodiment of the present invention, and details are not repeatedly described in this embodiment.
  • the detecting device of the zombie feature performs dynamic behavior detection on the malicious file in the sandbox, collects all network behaviors of the malicious file during the running process through the sandbox, and outputs a dynamic behavior file of the network behavior, and
  • the zombie feature is extracted from the dynamic behavior file, so that the signature of the zombie communication can be extracted, which helps to detect malicious files based on the signature of the communication feature, and avoids false positives and false negatives caused by interference of various zombie deformation versions.
  • the zombies are extracted from the common features between the dynamic behavior files respectively outputted by the at least two sandboxes when extracting the zombie features
  • a third aspect of the embodiments of the present invention provides a gateway device, including:
  • One or more processors, memory, communication bus, and one or more programs, the processor and the The reservoirs are connected by the communication bus;
  • the one or more programs are stored in the memory, the one or more programs comprising instructions that, when executed by the gateway device, cause the gateway device to perform the first embodiment of the present invention.
  • a fourth aspect of an embodiment of the present invention provides a computer readable storage medium storing one or more programs, the one or more programs including instructions that, when executed by a gateway device, cause the gateway device to perform The method according to any one of the first aspect of the first aspect of the present invention.
  • FIG. 1 is a schematic flow chart of an embodiment of a method for detecting zombie features according to the present invention
  • FIG. 2 is a schematic structural diagram of an embodiment of a communication system according to the present invention.
  • FIG. 3 is a schematic structural diagram of a module for performing zombie Trojan detection in a gateway device
  • FIG. 4 is a schematic structural view of an embodiment of a zombie feature detecting apparatus according to the present invention.
  • FIG. 5 is a schematic structural diagram of an embodiment of a gateway device according to the present invention.
  • FIG. 1 is a schematic flow chart of an embodiment of a method for detecting a zombie feature according to the present invention.
  • the executive body of the embodiment of the present invention is a computer device.
  • the computer device can be a universal gateway device, a home gateway device, a router, a gateway device manager, and the like.
  • the universal gateway device may be a gateway device of an access network, an enterprise gateway device firewall, a switch, etc., and is not limited herein. This embodiment refers to the above devices as "gateway devices".
  • the scheme is introduced by taking the execution entity as a gateway device as an example.
  • the gateway device determines a series of service packets for carrying the same file, and can also be called a session for carrying the same file, and reassembles and restores the series of service packets.
  • the zombie feature detection method in the embodiment is used to detect the zombie feature of the malicious file, so as to synchronize the obtained zombie feature to other hardware firewall devices in the network, or Anti-virus software installed on personal computers to improve the detection of malicious files and improve the security level of the network.
  • the method for detecting a zombie feature of this embodiment includes the following steps.
  • the gateway device acquires a first dynamic behavior file and a second dynamic behavior file.
  • the first dynamic behavior file is a behavior file generated by the dynamic behavior detection of the malicious file in the first sandbox
  • the second dynamic behavior file is a behavior generated by the dynamic behavior detection of the malicious file in the second sandbox. file.
  • the malicious file refers to a file used by an attacker in a botnet to infect the attacked host as a zombie host.
  • a sandbox is a virtual system program whose purpose is to provide a security mechanism that provides an isolated environment for executing programs. Programs running in the sandbox do not have a permanent impact on the hardware.
  • the gateway device first detects a malicious file. How to detect malicious files One of them is described below by way of example.
  • the gateway device obtains the to-be-detected file, and inputs the to-be-detected file into the first sandbox and the second sandbox respectively.
  • the first sandbox and the second sandbox may be located in the gateway device, or may be located in other devices than the gateway device, and are not limited herein.
  • the gateway device obtains a file to be detected. For example, the gateway device reassembles and restores multiple network packets received in the same session to generate a complete file, and uses the file as the file to be detected.
  • the file to be detected may be a file that is sent as an email attachment through a mail protocol message, or may be a file that is sent as a webpage plug-in through a hypertext transfer protocol.
  • the gateway device determines whether the file is a suspected malicious file, and if so, determines the file to be detected. There are various methods for determining whether a file is a suspected malicious file.
  • the gateway device determines whether the file is a Portable Executable (PE) file, and if so, determines that the file is a suspected malicious file. For another example, the gateway device matches the Uniform Resource Locator (URL) of the file with the locally pre-stored bot URL. If the matching succeeds, the file can be directly determined to be a malicious file, that is, the file is to be detected. Excluded from the file. In this way, the number of files to be detected can be reduced, and the efficiency of zombie feature detection is improved.
  • PE Portable Executable
  • the sandbox performs two types of tests on the detected files, namely static behavior detection and dynamic behavior detection.
  • the static behavior detection refers to obtaining the parameters of the file to be detected by analyzing the code content and code structure of the file to be detected when the file to be detected is not running.
  • a common way to detect the static behavior is to determine the file type to which the file to be detected belongs, and to read the data in the predetermined location of the file to be detected according to the data structure corresponding to the file type. In this way, information such as file name, file size, version information, and digital signature of the file to be detected can be obtained.
  • Another common way to detect static behavior is to match the code of the file to be detected with known features stored in advance, and if the match is consistent, confirm that the known feature is included in the file to be detected.
  • Dynamic behavior detection refers to a series of behaviors such as system service request, file read and write, registry modification, API call, and network access initiated by the operating system during the running of the file to be detected, and dynamic behavior.
  • the file records information corresponding to each behavior, such as file read and write behavior, and the behavior information of the behavior includes the operator that performs the action, the path involved, and the like.
  • the to-be-detected file performs static behavior detection in each sandbox, and outputs a behavior file generated by the to-be-detected file in the static behavior detection, that is, a static behavior file.
  • the to-be-detected file also performs dynamic behavior detection in each sandbox, and outputs a behavior file generated by the to-be-detected file in the behavior detection, that is, a dynamic behavior file.
  • the dynamic behavior file output by each sandbox includes network packet data that is sent by the to-be-detected file.
  • the dynamic behavior file further includes a task ID, a file name, a dynamic behavior sequence, and a dynamic Other data such as behavioral operations objects.
  • the to-be-detected file After obtaining the static behavior file and the dynamic behavior file of the first sandbox output, and the static behavior file and the dynamic behavior file output by the second sandbox, determining whether the to-be-detected file is a malicious file according to the four files. Specifically, at least one abnormal item in the four files output by the first sandbox and the second sandbox is weighted, and the network packet is determined to be a malicious file according to the score result. The method of determining a malicious file is prior art, and will not be repeated here. When it is determined that the to-be-detected file is a malicious file, determining that the dynamic behavior file output by the first sandbox is the first dynamic behavior file, and the dynamic behavior file output by the second sandbox is the second dynamic behavior file.
  • the sandbox does not output a dynamic behavior file when detecting dynamic behavior of a malicious file, which means that the malicious file has no network behavior in the sandbox. Therefore, optionally, the malicious file can be changed to a non-malicious file.
  • the gateway device first uses other methods to detect the file to determine that Whether it is a malicious file, for example, by manual analysis.
  • the malicious file is input into the first sandbox and the second sandbox for dynamic behavior detection, and the dynamic behavior file of the first sandbox output is obtained as the first dynamic behavior file. And obtaining a dynamic behavior file of the second sandbox output as the second dynamic behavior file.
  • the gateway device determines a zombie feature of the malicious file according to the common feature of the first dynamic behavior file and the second dynamic behavior file.
  • obtaining the first preset field determining whether the content in the first preset field of the first dynamic behavior file and the content in the first preset field of the second dynamic behavior file contain the same string, and if so, determining The zombie feature of the malicious file includes the same string and the location of the string in the first preset field.
  • the method for obtaining the first preset field is different.
  • the first preset field is pre-stored in the first configuration table in the gateway device, and the first preset field is determined by reading the first configuration table.
  • the first preset field included in the first configuration table may be updated at any time.
  • the field in this embodiment may refer to a specified storage location of a dynamic behavior file having a fixed structure.
  • the field may refer to a task ID, a dynamic behavior sequence, a dynamic behavior operation object, and the like in the first-level project.
  • the field may also refer to a field in the session packet encapsulated according to the specified protocol.
  • the first preset field includes a payload field and/or a request field.
  • the second preset field and the preset content of the second preset field are acquired. There are a plurality of methods for obtaining.
  • the preset content of the second preset field and the second preset field is pre-stored in a second configuration table in the gateway device, and the second configuration table is read to determine the first Two preset fields and preset contents of the second preset field.
  • the content of the second configuration table may be updated at any time.
  • the second preset field is a field that may be modified by the bot, and the preset content of the second preset field is a regular content of the second preset field in a normal message.
  • the feature includes the content of the second preset field of the common feature.
  • the second preset field includes an agent field, and the preset content of the agent field includes the requested user information.
  • the payload fields of the same type of malicious file are the same. Since the hacker can configure the request field and/or the agent field, the request field and/or agent in different botnets. The fields may be different. Therefore, when detecting zombie features, the zombie feature can be determined by matching the payload field, and then the detected zombie features are classified into zombie features of different botnets by matching the request field and/or the agent field.
  • the dynamic behavior file output by each sandbox includes network packet data, and the network packet data is included in the sandbox and different communication objects generated during the dynamic behavior detection process of the malicious file. Session message between. When determining zombie features, zombie features can be looked up from multiple session messages in the dynamic behavior file.
  • each session message in the two dynamic behavior files is the first sandbox and the second Session packets between the sandbox and the same batch of communication objects.
  • the same batch of session objects includes n communication objects, and n is a positive integer.
  • the i-th communication object (i is any positive integer greater than or equal to 1 and less than or equal to n), and the first dynamic behavior file includes a session message between the first sandbox and the i-th object, and the session message
  • the source IP address and the source port of the quintuple of the session packet are respectively the IP address and port of the first sandbox, and the destination IP address and the destination port are respectively the IP address and port of the i-th object;
  • the second dynamic behavior The file includes a session packet between the second sandbox and the i-th object, and the source IP address and the source port of the quintuple of the session packet are respectively the IP address and port of the second sandbox.
  • the IP address and destination port are the IP address and port of the i-th object, respectively.
  • the session message carries a string with a sandbox randomly filled string and a string for describing the information of the sandbox (such as the sandbox's IP address and port address), these strings are determined not to be zombie features. Therefore, preferably, when the zombie feature is searched, the zombie feature of the malicious file is determined according to the common feature of the first dynamic behavior file and the second dynamic behavior file, and the determined zombie feature is included in the determined zombie feature.
  • determining a zombie feature of the malicious file according to a common feature of the first session message in the first dynamic behavior file and the second session message in the second dynamic behavior file, where the first session message and The second session message is the session message of the same communication object in the first sandbox and the second sandbox, that is, the destination IP address in the first session message is the same as the destination IP address of the second session message.
  • the destination port of the first session packet is the same as the destination port of the second session packet.
  • first matching each session message in the first dynamic behavior file with each session message in the second dynamic behavior file to determine the first dynamic behavior file and the second A session message corresponding to the same communication object in the dynamic behavior file.
  • the common features of the first session message and the second session message are obtained first, and then the zombie feature is searched from the common feature.
  • a location where a zombie feature appears in the first session message referred to as a first location for convenience of description
  • a location where a zombie feature appears in the second session message referred to as a second location for convenience of description
  • acquiring a common feature of the message content at the first location and the message content at the second location and determining the zombie feature according to the shared feature.
  • the first location and the second location may be at least one of a payload field, a request field, and an agent field described above.
  • the step of determining the zombie feature according to the common feature of the first session packet and the second session packet includes: preprocessing the first session packet and the second session packet, Marking, in the first session message and the second session message, some strings that are not zombie features, so as to compare the first session message with the second session message to obtain the two session messages.
  • the common feature does not compare the characters of the mark, improving the efficiency of acquiring the common feature.
  • the content of the message other than the specified character in the message, the second remaining content is the content of the message other than the specified character in the second session message.
  • the zombie feature of the malicious file is determined according to a common feature of the first remaining content and the second remaining content.
  • the pre-processing operation rule is pre-stored in a third configuration table in the gateway device, and the pre-processing operation rule is determined by reading the third configuration table; The third match The contents of the table can be updated at any time.
  • the pre-processing operation rule may be used in the following manner.
  • the pre-processing operation rule is used to indicate that at least one of the following is included: the HTTP keyword in the session packet, and the session packet.
  • the HTTP keyword can be a string such as GET or HTTP1.1. There are no restrictions here.
  • a protocol whitelist is preset in the gateway device, and the protocol whitelist stores at least one transport layer protocol.
  • the protocol whitelist can be updated at any time.
  • the malicious file is simulated in the sandbox, and the behavior file of the network behavior of the malicious file during the running process, that is, the dynamic behavior file is collected, to extract the zombie feature from the dynamic behavior file.
  • the whole process can be automated to improve the efficiency of extracting zombie features.
  • the zombie features are extracted from the at least two sandboxes respectively.
  • the zombie feature is extracted from the common features between the dynamic behavior files, which can avoid the extracted zombie features containing strings randomly filled in the dynamic behavior file by different sandboxes and strings for describing the information of the sandbox (for example, sandbox Network protocol address and port address) to improve the accuracy of zombie features.
  • FIG. 2 is a schematic structural diagram of an embodiment of a communication system according to the present invention.
  • the communication system includes at least one gateway device and one network security device 202.
  • the gateway device 201 determines a series of service packets for carrying the same file, and may also be referred to as a session for carrying the same file, and reassembles the series of service packets. Restore to get the file carried in the payload part of the series of messages.
  • the gateway device 201 determines that a file is suspected to be a malicious file, the file is input as a file to be detected into at least two local sandboxes.
  • the gateway device 201 determines that a file is a suspected malicious file. For example, the gateway device 201 first matches the URL of the file carried in the session with the locally stored zombie URL. If the matching is successful, the network packet can be directly determined to be a malicious file; if the matching is unsuccessful, the network report is further determined. Whether the file is a Portable Executable (PE) file, and if so, the file is determined to be a malicious file.
  • PE Portable Executable
  • FIG. 3 is a schematic structural diagram of a module for performing zombie Trojan detection in the gateway device 201.
  • the gateway device 201 includes at least two sandboxes, a threat determination module, a zombie feature detection module, a management module, and a sandbox management module.
  • the sandbox, the threat determination module, the zombie feature detection module, the management module, and the sandbox management module are functional modules implemented by using a software program.
  • the management module is used to manage the threat determination module and the zombie feature detection module, and the sandbox management module is used to perform operations such as creating, closing, and monitoring a sandbox.
  • the sandbox management module creates a sandbox 1 and a sandbox 2, and the gateway device inputs the files to be detected into the sandbox 1 and the sandbox 2, respectively.
  • the sandbox 1 and the sandbox 2 of the gateway device 201 respectively perform static behavior detection and dynamic behavior detection on the network packet, and input the detection result.
  • the threat determination module Specifically, the sandbox 1 inputs the static behavior file 1 and the dynamic behavior file 1 of the network packet into the threat determination module, and the sandbox 2 outputs the static behavior file 2 and the dynamic behavior file 2 of the network packet to the threat determination.
  • the module the module.
  • Table 1 below is a schematic diagram of one embodiment of the structure of a static behavior file, as shown in Table 1 below.
  • Table 2 below is a schematic diagram of one embodiment of the structure of a dynamic behavior file, as shown in Table 2 below.
  • the threat determination module determines whether the file to be detected is a malicious file according to the static behavior files 1 and 2 and the dynamic behavior files 1 and 2. Specifically, the threat determination module performs weighting on the abnormal items in the four files, and determines whether the network packet is a malicious file according to the score result. Specifically, how the weight is divided into existing technologies will not be described here.
  • the threat determination module sends the determination result to the management module, so that the management module notifies the determination result to the sandbox management module. If the result of the determination indicates that the network message is not a malicious file, the sandbox management module closes the sandbox 1 and the sandbox 2. If the determination result indicates that the network message is a malicious file, the threat determination module sends the dynamic behavior files 1 and 2 of the received malicious file to the management module, so that the management module forwards the two files to the zombie feature detection module.
  • the dynamic behavior file 1 After the zombie feature engine receives the dynamic behavior files 1 and 2 of the malicious file, the dynamic behavior file 1 is obtained. There are session messages and all session messages in the dynamic behavior file 2.
  • the zombie feature engine obtains a protocol whitelist that stores at least one transport layer protocol on the whitelist.
  • the zombie feature engine marks the session messages of all the transport layer protocols in the dynamic behavior files 1 and 2 located on the white list of the protocol, and sequentially numbers the unmarked session messages in the dynamic behavior file 1 and the dynamic behavior.
  • the unmarked session packets in the file 2 are numbered in sequence, wherein the dynamic behavior files 1 and 2 have the same destination IP address and the session packets having the same destination port have the same number.
  • the key features in each session message are parsed for the two session messages of the same number in the dynamic behavior files 1 and 2, and the key features include a payload field, a request field, and an agent field.
  • the two session messages numbered 1 in the dynamic behavior file 1 and numbered 1 in the dynamic behavior file 2 are taken as an example.
  • the content of the session message numbered 1 in the dynamic behavior file 1 is as follows:
  • the content of the session message numbered 1 in the dynamic behavior file 2 is as follows:
  • the protocol identification is performed on the two session messages, and the payload field is parsed as follows:
  • the payload field is pre-processed according to the pre-processing operation rule, wherein the pre-processing operation rule indicates that the type of the IP address of the sandbox in the field: port "2.2.2.60:8000" is removed, specifically, The string "2.2.2.60:8000" is removed when the common features of the two messages are obtained.
  • the two session packets For the payload field in the two session packets, compare whether the two fields contain the same string, and obtain the string as kvo and kid, and the position of kvo in the payload field is the starting address is 0. Where, and the position of the kid in the payload field is the reciprocal address is 0. Then the zombie feature contains kvo and kid in the payload field, and the position of the two strings in the payload field.
  • the protocol identification is performed on the two session messages, and the request field is parsed as follows:
  • the request field is pre-processed according to the pre-processing operation rule, wherein the pre-processing operation rule indicates that the HTTP keywords "GET” and “HTTP/1.1” in the field are removed, and specifically, the two messages are subsequently acquired.
  • the common feature is to remove the two strings "GET” and "HTTP/1.1".
  • the zombie feature contains the string /ip.txt in the request field and the location of the string in the request field.
  • the protocol identification is performed on the two session packets, and the agent field is parsed as follows:
  • the agent field in the two session packets is compared with the same feature string in the two fields, and the string is Huai_Huai.
  • the default content of the string and the agent field is different, so the zombie feature is determined. Contains the string Huai_Huai in the agent field.
  • the zombie feature detection module will freeze the two session messages of the same number in any of the dynamic behavior files 1 and 2. After the corpse feature is detected, the zombie feature is described to form a rule entry and sent to the control module.
  • the governance module sends the rule entry to the network security device 202.
  • the network security device 202 collects rule entries from the various gateway devices and provides a function of zombie feature data downloading so that other devices can download zombie feature data from the network security device 202 and store it so that the gateway device can identify the file based on the zombie feature data. Whether it is a malicious file.
  • the detection method of the zombie feature of the present embodiment has been described above, and the detection device of the zombie feature of the present embodiment will be described below.
  • FIG. 4 is a schematic structural diagram of an embodiment of a zombie feature detecting apparatus according to an embodiment of the present invention.
  • the zombie feature detecting apparatus 400 includes:
  • the obtaining module 401 is configured to obtain a first dynamic behavior file and a second dynamic behavior file, where the first dynamic behavior file is a behavior file generated by a malicious file in a first sandbox for dynamic behavior detection, and the second dynamic behavior is The file is a behavior file generated by the malicious behavior detection of the malicious file in the second sandbox;
  • the determining module 402 is configured to determine a zombie feature of the malicious file according to the common feature of the first dynamic behavior file and the second dynamic behavior file.
  • the first dynamic behavior file includes a first session message
  • the second dynamic behavior file includes a second session message
  • the first session message is The destination network protocol IP address is the same as the destination IP address of the second session packet
  • the destination port of the first session packet is the same as the destination port of the second session packet.
  • the determining module 402 is specifically configured to determine a zombie feature of the malicious file according to the common feature of the first session packet and the second session packet.
  • the determining module 402 is specifically configured to:
  • the first remaining content is the first session
  • the second remaining content is the content of the message other than the specified character in the second session message
  • the zombie feature of the malicious file is determined according to a common feature of the first remaining content and the second remaining content.
  • the determining module 402 is specifically configured to:
  • the zombie feature of the malicious file includes the character string and the location of the character string in the first preset field.
  • the determining module 402 is specifically configured to:
  • the second preset field exists in the common feature of the first session packet and the second session packet, and the content of the second preset field and the preset content in the shared feature are not At the same time, it is determined that the zombie feature includes content of a second preset field of the common features.
  • the obtaining module 401 is specifically configured to:
  • the dynamic behavior file outputted by the box is a behavior file generated by the dynamic behavior detection of the to-be-detected file in the first sandbox in the first sandbox, and the dynamic behavior file output by the second sandbox is a behavior file generated by the dynamic behavior detection of the to-be-detected file in the second sandbox;
  • the obtaining module 401 is specifically configured to:
  • the malicious files are respectively input into the first sandbox and the second sandbox for dynamic behavior detection;
  • the detection device of the zombie feature shown in FIG. 4 can be implemented by software or hardware integrated in the computer device.
  • the detecting device of the zombie feature performs dynamic behavior detection on the malicious file in the sandbox, collects all network behaviors of the malicious file during the running process through the sandbox, and outputs a dynamic behavior file of the network behavior, and
  • the zombie feature is extracted from the dynamic behavior file, so that the signature of the zombie communication can be extracted, which helps to detect malicious files based on the signature of the communication feature, and avoids false positives and false negatives caused by interference of various zombie deformation versions.
  • the zombies are extracted from the common features between the dynamic behavior files respectively outputted by the at least two sandboxes when extracting the zombie features
  • the apparatus for detecting zombie features in the present embodiment has been described above from the perspective of a unitized functional entity.
  • the apparatus for detecting zombie features in this embodiment will be described below from the perspective of hardware processing.
  • FIG. 5 is a schematic structural diagram of an embodiment of a gateway device according to an embodiment of the present disclosure.
  • the gateway device 500 includes:
  • One or more processors 502, a memory 501, a communication bus 503, and the processor 502 and the memory 501 are connected by the communication bus 503;
  • One or more programs are stored in the memory 501, the one or more programs including instructions that, when executed by the gateway device, cause the gateway device to perform the following operations:
  • the first dynamic behavior file is a behavior file generated by the malicious behavior detection of the malicious file in the first sandbox
  • the second dynamic behavior file is the malicious file a behavior file generated by dynamic behavior detection in a second sandbox
  • the first dynamic behavior file includes a first session message
  • the second dynamic behavior file includes a second session message, where the destination network protocol IP address of the first session message is The destination IP address of the second session packet is the same, and the destination port of the first session packet is the same as the destination port of the second session packet.
  • the zombie features of the file including:
  • the determining, according to the common feature of the first session packet and the second session packet, the zombie feature of the malicious file including:
  • the first remaining content is the first session
  • the second remaining content is the content of the message other than the specified character in the second session message
  • Determining a zombie feature of the malicious file according to a common feature of the first remaining content and the second remaining content.
  • the determining, according to the common feature of the first dynamic behavior file and the second dynamic behavior file, the zombie feature of the malicious file including:
  • the zombie feature of the malicious file includes the character string and the location of the character string in the first preset field.
  • the determining, according to the common feature of the first dynamic behavior file and the second dynamic behavior file, the zombie feature of the malicious file including:
  • the second preset field exists in the common feature of the first session packet and the second session packet, and the content of the second preset field and the preset content in the shared feature are not At the same time, it is determined that the zombie feature includes content of a second preset field of the common features.
  • the acquiring the first dynamic behavior file and the second dynamic behavior file includes:
  • the dynamic behavior file of the first sandbox output is a behavior file generated by the dynamic behavior detection of the to-be-detected file in the first sandbox in the first sandbox, and the dynamic behavior file of the second sandbox output a behavior file generated by the dynamic behavior detection in the second sandbox for the file to be detected;
  • the acquiring the first dynamic behavior file and the second dynamic behavior file includes:
  • the malicious files are respectively input into the first sandbox and the second sandbox for dynamic behavior detection;
  • gateway device 500 may refer to the related description of the gateway device in the foregoing method embodiment, and details are not described herein again.
  • the technical solution of the present embodiment may be embodied in the form of a software product in the form of a software product, or a part of the technical solution, which is stored in a storage medium, including several instructions.
  • a computer device which may be a personal computer, server, or network device, etc.
  • the foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Virology (AREA)
  • Computer And Data Communications (AREA)
  • Information Transfer Between Computers (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明实施例公开了一种僵尸特征的检测方法和装置。本发明实施例方法包括：获取第一动态行为文件和第二动态行为文件，所述第一动态行为文件为恶意文件在第一沙箱中进行动态行为检测产生的行为文件，所述第二动态行为文件为所述恶意文件在第二沙箱中进行动态行为检测产生的行为文件；根据所述第一动态行为文件和所述第二动态行为文件的共有特征确定所述恶意文件的僵尸特征。

Description

僵尸特征的检测方法和装置
本申请要求于2016年10月25日提交中国专利局、申请号为201610948753.4、发明名称为“僵尸特征的检测方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及计算机安全技术领域，尤其涉及一种僵尸特征的检测方法和装置。
背景技术
僵尸网络(Botnet)是指攻击者使用一种或多种传播手段将大量主机感染僵尸(bot)程序，例如通过向大量主机发送恶意文件，使得主机在接收并运行该恶意文件时感染僵尸程序，从而在攻击者和被感染主机之间形成的一个一对多的控制网络，其中，被感染主机即为僵尸主机，攻击者可以通过命令与控制(Command and Control，C&C)信道一对多地控制僵尸主机。僵尸网络构成一个攻击平台，利用这个平台可以发起各种各样的网络攻击行为，从而导致攻击对象的某些应用系统的瘫痪、个人隐私的泄漏等。比如，利用僵尸网络向攻击对象发送垃圾邮件、窃取机密等网络攻击行为。比起传统的攻击者使用单一主机对攻击对象攻击的行为，僵尸网络可以对攻击对象造成更严重的破坏。
现有技术中，在检测到恶意文件后，通常通过人工分析从恶意文件中识别并提取出僵尸特征，并根据该僵尸特征来对后续接收到的恶意文件进行过滤和阻断。然而，攻击者为了逃避检测，往往较为频繁地修改恶意文件，可以很容易地生成大量变型的恶意文件的。上述提取僵尸特征的方法效率较低，无法大规模普及。
发明内容
本发明实施例提供了一种僵尸特征的检测方法和装置，能够提高提取僵尸特征的效率。
第一方面，本实施例提供一种僵尸特征的检测方法，该僵尸特征的检测方法包括：
步骤A、获取第一动态行为文件和第二动态行为文件；
其中，该第一动态行为文件为恶意文件在第一沙箱中进行动态行为检测产生的行为文件，该第二动态行为文件为该恶意文件在第二沙箱中进行动态行为检测产生的行为文件；
其中，该动态行为检测是指在恶意文件运行的情况下，获取恶意文件运行期间对操作系统发起系统服务请求、文件读写、注册表修改、应用程序编程接口(Application Programming Interface，API)调用、网络访问等一系列行为，并在动态行为文件中记录有每个行为对应的信息，例如文件读写行为，该行为的行为信息包括在执行动作的操作符、涉及的路径等等；
步骤B、根据第一动态行为文件和第二动态行为文件的共有特征确定恶意文件的僵尸 特征。
第一方面的实现方案中，通过恶意文件在沙箱中模拟运行，并收集该恶意文件在该运行过程中发生的网络行为的行为文件，也即动态行为文件，以从该动态行为文件中提取出僵尸特征，整个过程可以实现自动化，提高提取僵尸特征的效率；另外，由于是在至少两个沙箱中对同一个恶意文件进行动态行为检测，在提取僵尸特征时从该至少两个沙箱分别输出的动态行为文件之间的共同特征中提取僵尸特征，可以避免提取出的僵尸特征包含不同沙箱在动态行为文件中随机填充的字符串以及用于描述沙箱的信息的字符串(例如沙箱的网络协议地址和端口地址)，提高僵尸特征的准确度。
在第一方面的第一种实现方式中，所述第一动态行为文件包括第一会话报文，所述第二动态行为文件包括第二会话报文，其中，所述第一会话报文的目的网络协议(Internet Protocol，IP)地址与所述第二会话报文的目的IP地址相同、且所述第一会话报文的目的端口与所述第二会话报文的目的端口相同；
所述步骤B包括：
步骤B11、根据所述第一会话报文和所述第二会话报文的共有特征确定所述恶意文件的僵尸特征。
结合第一方面的第一种实现方式，在本第一方面的第二种实现方式中，所述步骤B11包括：
步骤B21、获取第一预置字段；其中，获取第一预置字段的方法有多种，例如，该第一预置字段预先存储在网关设备内的第一配置表中，通过读取第一配置表来确定第一预置字段，可选的，该第一配置表所包括的第一预置字段可以随时更新；可选的，当会话报文为采用超文本传输协议(Hyper Text Transfer Protocol，HTTP)协议封装的应用层报文时，第一预置字段包括payload字段和/或request字段；
步骤B22、判断所述第一会话报文的所述第一预置字段中的内容和所述第二会话报文的所述第一预置字段中的内容是否包含相同的字符串，若包含，确定所述恶意文件的僵尸特征包括所述字符串以及所述字符串在所述第一预置字段中的位置。
结合第一方面的第一种实现方式，在第一方面的第三种实现方式中，所述步骤B11包括：
步骤B31、获取第二预置字段以及所述第二预置字段的预设内容；
其中，获取的方法有多种，可选的，该第二预置字段以及第二预置字段的预设内容预先存储在网关设备内的第二配置表中，通过读取第二配置表来确定第二预置字段以及该第二预置字段的预设内容；可选的，该第二配置表的内容可以随时更新；可选的，当会话报文为采用HTTP封装的应用层报文时，该第二预置字段包括agent字段，agent字段的预设内容包括发出请求的用户信息；
步骤B32、当所述第一会话报文和所述第二会话报文的共有特征中存在所述第二预置字段，且所述共有特征中的第二预置字段的内容和所述预设内容不同时，确定所述僵尸特征包括所述共有特征中的第二预置字段的内容。
结合第一方面的第一种实现方式，在第一方面的第四种实现方式中，所述步骤B11包括：
步骤B41、获取预处理操作规则，所述预处理操作规则指示去除报文中的指定字符；
其中，获取预处理操作规则的方法有多种，例如，该预处理操作规则预先存储在网关 设备内的第三配置表中，通过读取第三配置表来确定预处理操作规则；可选的，该第三配置表的内容可以随时更新；
其中，该预处理操作规则可以有多种，例如，在会话报文为HTTP报文时，预处理操作规则用于指示去除以下至少一种：会话报文中的HTTP关键字、会话报文中的沙箱的IP地址和端口、会话报文中的中央处理器(Central Processing Unit，CPU)类型这样格式的字符串，其中，HTTP关键字可以为GET、HTTP1.1等字符串；
步骤B42、根据所述预处理操作规则，从所述第一会话报文中获得第一剩余内容，从所述第二会话报文中获得第二剩余内容，所述第一剩余内容为所述第一会话报文中除所述指定字符以外的报文内容，所述第二剩余内容为所述第二会话报文中除所述指定字符以外的报文内容；
步骤B43、根据所述第一剩余内容和所述第二剩余内容的共有特征确定所述恶意文件的僵尸特征。
结合第一方面、第一方面的第一种实现方式、第一方面的第二种实现方式、第一方面的第三种实现方式或者第一方面的第四种实现方式，在第一方面的第五种实现方式中，所述步骤A包括：
步骤A11、获取第一沙箱输出的静态行为文件和动态行为文件，以及第二沙箱输出的静态行为文件和动态行为文件；
其中，所述第一沙箱输出的静态行为文件为待检测文件在所述第一沙箱中进行静态行为检测产生的行为文件，所述第二沙箱输出的静态行为文件为所述待检测文件在所述第二沙箱中进行静态行为检测产生的行为文件，所述第一沙箱输出的动态行为文件为所述待检测文件在所述第一沙箱在所述第一沙箱中进行动态行为检测产生的行为文件，所述第二沙箱输出的动态行为文件为所述待检测文件在所述第二沙箱中进行动态行为检测产生的行为文件；
步骤A12、根据所述第一沙箱输出的静态行为文件和动态行为文件，以及所述第二沙箱输出的静态行为文件和动态行为文件判断所述待检测文件是否为恶意文件；
例如，对第一沙箱和第二沙箱输出的该四个文件中的至少一个异常项进行权重打分，根据打分结果来确定该网络报文是否为恶意文件；
步骤A13、当确定所述待检测文件为恶意文件时，确定所述第一沙箱输出的动态行为文件为所述第一动态行为文件，以及所述第二沙箱输出的动态行为文件为所述第二动态行为文件。
结合第一方面、第一方面的第一种实现方式、第一方面的第二种实现方式、第一方面的第三种实现方式或者第一方面的第四种实现方式，在第一方面的第六种实现方式中，所述步骤A包括：
步骤A21、获取恶意文件；
其中，获取的方法有多种，例如，通过人工分析确定待检测文件为恶意文件，或者，接收其他设备发送的恶意文件；
步骤A22、将所述恶意文件分别输入到第一沙箱和第二沙箱中进行动态行为检测；
步骤A23、获取所述第一沙箱输出的动态行为文件，以及所述第二沙箱输出的动态行为文件。
本发明实施例第二方面提供了一种僵尸特征的检测装置，包括：
获取模块，用于获取第一动态行为文件和第二动态行为文件，所述第一动态行为文件为恶意文件在第一沙箱中进行动态行为检测产生的行为文件，所述第二动态行为文件为所述恶意文件在第二沙箱中进行动态行为检测产生的行为文件；
确定模块，用于根据所述第一动态行为文件和所述第二动态行为文件的共有特征确定所述恶意文件的僵尸特征。
需明确的是，本实施例所提供的所述获取模块用于执行本发明实施例第一方面的步骤A，本实施例所提供的所述确定模块用于执行本发明实施例第一方面的步骤B。
步骤A以及步骤B的具体执行过程请详见本发明实施例第一方面所示，具体在本实施例中不再赘述。
在第二方面的第一种实现方式中，所述第一动态行为文件包括第一会话报文，所述第二动态行为文件包括第二会话报文，其中，所述第一会话报文的目的网络协议IP地址与所述第二会话报文的目的IP地址相同、且所述第一会话报文的目的端口与所述第二会话报文的目的端口相同；
所述确定模块具体用于根据所述第一会话报文和所述第二会话报文的共有特征确定所述恶意文件的僵尸特征。
需明确的是，本实施例所提供的所述确定模块用于执行本发明实施例第一方面的步骤B11。步骤B11的具体执行过程请详见本发明实施例第一方面所示，具体在本实施例中不再赘述。
在第二方面的第二种实现方式中，所述确定模块具体用于：
获取第一预置字段；
判断所述第一会话报文的所述第一预置字段中的内容和所述第二会话报文的所述第一预置字段中的内容是否包含相同的字符串，若包含，确定所述恶意文件的僵尸特征包括所述字符串以及所述字符串在所述第一预置字段中的位置。
需明确的是，本实施例所提供的所述确定模块用于执行本发明实施例第一方面的步骤B21和步骤B22。步骤B21和步骤B22的具体执行过程请详见本发明实施例第一方面所示，具体在本实施例中不再赘述。
在第二方面的第三种实现方式中，所述确定模块具体用于：
获取第二预置字段以及所述第二预置字段的预设内容；
当所述第一会话报文和所述第二会话报文的共有特征中存在所述第二预置字段，且所述共有特征中的第二预置字段的内容和所述预设内容不同时，确定所述僵尸特征包括所述共有特征中的第二预置字段的内容。
需明确的是，本实施例所提供的所述确定模块用于执行本发明实施例第一方面的步骤B31和步骤B32。步骤B31和步骤B32的具体执行过程请详见本发明实施例第一方面所示，具体在本实施例中不再赘述。
在第二方面的第四种实现方式中，所述确定模块具体用于：
获取预处理操作规则，所述预处理操作规则指示去除报文中的指定字符；
根据所述预处理操作规则，从所述第一会话报文中获得第一剩余内容，从所述第二会话报文中获得第二剩余内容，所述第一剩余内容为所述第一会话报文中除所述指定字符以外的报文内容，所述第二剩余内容为所述第二会话报文中除所述指定字符以外的报文内容；
根据第一剩余内容和第二剩余内容的共有特征确定所述恶意文件的僵尸特征。
需明确的是，本实施例所提供的所述确定模块用于执行本发明实施例第一方面的步骤B41、步骤B42和步骤B43。步骤B41、步骤B42和步骤B43的具体执行过程请详见本发明实施例第一方面所示，具体在本实施例中不再赘述。
结合第二方面、第二方面的第一种实现方式、第二方面的第二种实现方式、第二方面的第三种实现方式或者第二方面的第四种实现方式，在第二方面的第五种实现方式中，所述获取模块具体用于：
获取第一沙箱输出的静态行为文件和动态行为文件，以及第二沙箱输出的静态行为文件和动态行为文件，其中，所述第一沙箱输出的静态行为文件为待检测文件在所述第一沙箱中进行静态行为检测产生的行为文件，所述第二沙箱输出的静态行为文件为所述待检测文件在所述第二沙箱中进行静态行为检测产生的行为文件，所述第一沙箱输出的动态行为文件为所述待检测文件在所述第一沙箱在所述第一沙箱中进行动态行为检测产生的行为文件，所述第二沙箱输出的动态行为文件为所述待检测文件在所述第二沙箱中进行动态行为检测产生的行为文件；
根据所述第一沙箱输出的静态行为文件和动态行为文件，以及所述第二沙箱输出的静态行为文件和动态行为文件判断所述待检测文件是否为恶意文件；
当确定所述待检测文件为恶意文件时，确定所述第一沙箱输出的动态行为文件为所述第一动态行为文件，以及所述第二沙箱输出的动态行为文件为所述第二动态行为文件。
需明确的是，本实施例所提供的所述确定模块用于执行本发明实施例第一方面的步骤A11、步骤A12和步骤A13。步骤A11、步骤A12和步骤A13的具体执行过程请详见本发明实施例第一方面所示，具体在本实施例中不再赘述。
结合第二方面、第二方面的第一种实现方式、第二方面的第二种实现方式、第二方面的第三种实现方式或者第二方面的第四种实现方式，在第二方面的第六种实现方式中，所述获取模块具体用于：
获取恶意文件；
将所述恶意文件分别输入到第一沙箱和第二沙箱中进行动态行为检测；
获取所述第一沙箱输出的动态行为文件，以及所述第二沙箱输出的动态行为文件。
需明确的是，本实施例所提供的所述确定模块用于执行本发明实施例第一方面的步骤A21、步骤A22和步骤A23。步骤A21、步骤A22和步骤A23的具体执行过程请详见本发明实施例第一方面所示，具体在本实施例中不再赘述。
本实施例中，僵尸特征的检测装置在沙箱中对恶意文件进行动态行为检测，通过沙箱收集该恶意文件在运行过程中发生的所有网络行为并输出该网络行为的动态行为文件，并从该动态行为文件中提取出僵尸特征，这样可以提取出僵尸通信的签名，有助于实现基于通信特征签名来检测恶意文件，避免了各种僵尸变形版本文件的干扰而导致的误报和漏报的情况；另外，由于是在至少两个沙箱中对同一个恶意文件进行动态行为检测，在提取僵尸特征时从该至少两个沙箱分别输出的动态行为文件之间的共同特征中提取僵尸特征，可以避免提取出的僵尸特征包含不同沙箱在动态行为文件中随机填充的字符串以及用于描述沙箱的信息的字符串(例如沙箱的IP地址和端口地址)，提高僵尸特征的准确度。
本发明实施例第三方面提供了一种网关设备，包括：
一个或多个处理器、存储器、通信总线、以及一个或多个程序，所述处理器和所述存 储器通过所述通信总线相连；
其中所述一个或多个程序被存储在所述存储器中，所述一个或多个程序包括指令，所述指令当被所述网关设备执行时使所述网关设备执行如本发明实施例第一方面至本发明实施例第一方面第六种实现方式任一项所述的方法。
本发明实施例第四方面提供了一种存储一个或多个程序的计算机可读存储介质，所述一个或多个程序包括指令，所述指令当被网关设备执行时使所述网关设备执行如本发明实施例第一方面至本发明实施例第一方面第六种实现方式任一项所述的方法。
附图说明
图1为本发明的僵尸特征的检测方法的一个实施例的流程示意图；
图2为本发明的通信系统的一个实施例的结构示意图；
图3为网关设备中用于进行僵尸木马检测的模块的结构示意图；
图4为本发明的僵尸特征的检测装置的一个实施例的结构示意图；
图5为本发明的网关设备的一个实施例的结构示意图。
具体实施方式
下面以图1为例对本实施例提供的僵尸特征的检测方法进行解释说明。请参阅图1，图1为本发明的僵尸特征的检测方法的一个实施例的流程示意图。本发明实施例的执行主体为一种计算机设备。可选地，该计算机设备可以是通用网关设备、家庭网关设备、路由器、网关设备管理器等等。通用网关设备可以为接入网的网关设备、企业网关设备防火墙、交换机等等，在此不做限制。本实施例将上述设备统称为“网关设备”。
本实施例中，以执行主体为网关设备为例对方案进行介绍。网关设备在接收到业务报文后，从中确定出用以承载同一个文件的一系列业务报文，也可以称之为用以承载同一个文件的会话，并对该系列业务报文进行重组还原，以得到该系列报文的载荷部分携带的文件。当网关设备确定一个文件为恶意文件后，采用本实施例中的僵尸特征的检测方法来检测出该恶意文件的僵尸特征，以便于将得到的僵尸特征同步给网络中的其他硬件防火墙设备、或者安装于个人计算机中的杀毒软件，从而提高对恶意文件的检测效果，提升网络的安全防护水平。
如图1所示，本实施例的僵尸特征的检测方法包括以下步骤。
101、网关设备获取第一动态行为文件和第二动态行为文件。
本实施例中，第一动态行为文件为恶意文件在第一沙箱中进行动态行为检测产生的行为文件，第二动态行为文件为该恶意文件在第二沙箱中进行动态行为检测产生的行为文件。其中，恶意文件指的是僵尸网络中攻击者用于将被攻击主机感染为僵尸主机的文件。沙箱是一种虚拟系统程序，沙箱的目的是提供一种安全机制，为执行中的程序提供隔离环境。在沙箱中运行的程序不会对硬件产生永久性的影响。本实施例中，通过在沙箱中对恶意文件进行动态行为检测，模拟运行恶意文件后该恶意文件对被攻击主机所产生的网络行为，并在该网络行为中所产生的行为文件中查找该恶意文件的僵尸特征。
其中，获取第一动态行为文件和第二动态行为的方法有多种。
在一种可能的实施方式中，网关设备首先检测出恶意文件。检测恶意文件的方法有多 种，下面对其中的一种进行举例描述。网关设备获取待检测文件，将待检测文件分别输入到第一沙箱和第二沙箱中。其中，该第一沙箱和第二沙箱可以位于网关设备内，也可以位于网关设备以外的其他设备之内，在此不做限制。
其中，网关设备获取待检测文件的方法有多种。例如，网关设备将接收到的同一个会话的多个网络报文进行重组还原，生成一个完整的文件，将该文件作为待检测文件。待检测文件可以是通过邮件协议报文发送的作为邮件附件的文件，也可以是通过超文本传输协议发送的作为网页插件的文件。可替代地，网关设备在生成一个完整的文件后，判断该文件是否为疑似恶意文件，若是，则确定该文件待检测文件。其中，判断文件是否为疑似恶意文件的方法有多种，例如，网关设备确定该文件是否为可移植的可执行的(Portable Executable，PE)文件，若是，确定该文件为疑似恶意文件。又例如，网关设备将文件的统一资源定位符(Uniform Resource Locator，URL)和本地预存有的僵尸URL进行匹配，若匹配成功，则可直接确定该文件为恶意文件，也即将该文件从待检测文件中排除。这样，可以减少待检测文件的数量，提高僵尸特征检测的效率。
沙箱对待检测文件进行两类检测，分别为静态行为检测和动态行为检测。静态行为检测是指在待检测文件未运行的情况下，通过分析待检测文件的代码内容和代码结构来获得待检测文件的参数。静态行为检测的一种常见方式为确定待检测文件代码所属文件类型，并依照该文件类型对应数据结构，读取待检测文件预定位置中的数据。采用这种方式可以得到待检测文件的文件名称、文件大小、版本信息、数字签名等信息。静态行为检测的另一种常见方式是将待检测文件的代码与预先存储的已知特征进行匹配，如果匹配一致，则确认待检测文件中包含该已知特征。
动态行为检测是指在待检测文件运行的情况下，获取待检测文件运行期间对操作系统发起系统服务请求、文件读写、注册表修改、API调用、网络访问等一系列行为，并在动态行为文件中记录有每个行为对应的信息，例如文件读写行为，该行为的行为信息包括在执行动作的操作符、涉及的路径等等。
该待检测文件在每一个沙箱中进行静态行为检测，并输出待检测文件在静态行为检测中产生的行为文件，也即静态行为文件。
该待检测文件还在每一个沙箱中进行动态行为检测，并输出该待检测文件在动行为检测中产生的行为文件，也即动态行为文件。可选的，每个沙箱所输出的动态行为文件中包含有待检测文件发送过接收的网络报文数据，可选的，该动态行为文件还包含有任务ID、文件名称、动态行为序列、动态行为操作对象等其他数据。
获取到第一沙箱输出的静态行为文件和动态行为文件，以及第二沙箱输出的静态行为文件和动态行为文件后，根据该四个文件判断该待检测文件是否为恶意文件。具体的，对第一沙箱和第二沙箱输出的该四个文件中的至少一个异常项进行权重打分，根据打分结果来确定该网络报文是否为恶意文件。确定恶意文件的方法为现有技术，在此不多做赘述。当确定该待检测文件为恶意文件时，确定第一沙箱输出的动态行为文件为第一动态行为文件，以及第二沙箱输出的动态行为文件为第二动态行为文件。
实际应用中，可能存在沙箱对恶意文件进行动态行为检测时没有输出动态行为文件的情况，这表示该恶意文件在沙箱中没有网络行为。因此，可选的，可将该恶意文件改判为非恶意文件。
在本实施例的另一种可能的实施方式中，网关设备先采用其他方法检测文件以判断是 否为恶意文件，例如通过人工分析等。当确定该文件为恶意文件时，将该恶意文件分别输入到第一沙箱和第二沙箱中进行动态行为检测，并获取该第一沙箱输出的动态行为文件，作为第一动态行为文件，以及获取第二沙箱输出的动态行为文件，作为第二动态行为文件。
102、网关设备根据第一动态行为文件和第二动态行为文件的共有特征确定恶意文件的僵尸特征。
本实施例中，根据第一动态行为文件和第二动态行为文件的共有特征确定僵尸特征的方法有多种。
例如，获取第一预置字段，判断第一动态行为文件的第一预置字段中的内容和第二动态行为文件的第一预置字段中的内容是否包含相同的字符串，若包含，确定恶意文件的僵尸特征包括该相同的字符串以及该字符串在第一预置字段中的位置。其中，获取第一预置字段的方法有多种，例如，该第一预置字段预先存储在网关设备内的第一配置表中，通过读取第一配置表来确定第一预置字段，可选的，该第一配置表所包括的第一预置字段可以随时更新。
本实施例中的字段可以是指有固定结构的动态行为文件的指定存储位置。在表2所示结构的动态行为文件中，字段可以是指一级项目中的任务ID、动态行为序列、动态行为操作对象等等。当动态行为文件中包含网络报文数据时，字段也可以是指按照规定协议封装的会话报文中的字段。
例如，当会话报文为采用HTTP协议封装的应用层报文时，第一预置字段包括payload字段和/或request字段。
又例如，获取第二预置字段以及该第二预置字段的预设内容。获取的方法有多种，可选的，该第二预置字段以及第二预置字段的预设内容预先存储在网关设备内的第二配置表中，通过读取第二配置表来确定第二预置字段以及该第二预置字段的预设内容。可选的，该第二配置表的内容可以随时更新。可选的，该第二预置字段为可能被僵尸程序所修改的字段，该第二预置字段的预设内容为该第二预置字段在正常报文中的常规内容。
当在第一动态行为文件和第二动态行为文件的共有特征中存在该第二预置字段，且该共有特征中的第二预置字段的内容和预设内容不同时，确定恶意文件的僵尸特征包括该共有特征中的第二预置字段的内容。
可选的，当会话报文为采用HTTP协议封装的应用层报文时，该第二预置字段包括agent字段，agent字段的预设内容包括发出请求的用户信息。
实际应用中，僵尸网络中在生成恶意文件时，同一类恶意文件的payload字段都是一样的，由于黑客可以配置定义request字段和/或agent字段，因此不同的僵尸网络中request字段和/或agent字段可能不同。因此，在检测僵尸特征时，可先通过匹配payload字段来确定僵尸特征，然后再通过匹配request字段和/或agent字段，来将检测到的僵尸特征归为不同僵尸网络的僵尸特征。
本实施例中，每个沙箱所输出的动态行为文件中包含有网络报文数据，，该网络报文数据包含在恶意文件动态行为检测过程中所产生的、沙箱与不同的通信对象之间的会话报文。在确定僵尸特征时，可以从动态行为文件的多个会话报文中查找僵尸特征。
由于第一动态行为文件和第二动态行为文件是同一个恶意文件在不同沙箱中进行动态行为检测的结果文件，该两个动态行为文件中的各会话报文为第一沙箱和第二沙箱与同一批通信对象之间的会话报文。该同一批会话对象包括n个通信对象，n为正整数。对于 其中的第i个通信对象(i为大于等于1且小于等于n的任意一个正整数)，第一动态行为文件中包括第一沙箱与该第i个对象之间的会话报文，且该会话报文的五元组中的源IP地址和源端口分别为第一沙箱的IP地址和端口，目的IP地址和目的端口分别为该第i个对象的IP地址和端口；第二动态行为文件中包括第二沙箱与该第i个对象之间的会话报文，且该会话报文的五元组中的源IP地址和源端口分别为第二沙箱的IP地址和端口，目的IP地址和目的端口分别为该第i个对象的IP地址和端口。
由于会话报文中携带有沙箱随机填充的字符串以及用于描述沙箱的信息的字符串(例如沙箱的IP地址和端口地址)等等字符串，这些字符串确定不会是僵尸特征，因此，优选的，在查找僵尸特征时，根据第一动态行为文件和第二动态行为文件的共有特征确定恶意文件的僵尸特征，避免了确定出的僵尸特征中包含这些字符串。具体的，根据第一动态行为文件中的第一会话报文和第二动态行为文件中的第二会话报文的共有特征确定所述恶意文件的僵尸特征，其中，该第一会话报文和第二会话报文分别为在第一沙箱和第二沙箱与同一个通信对象的会话报文，也即第一会话报文中的目的IP地址与第二会话报文的目的IP地址相同，且第一会话报文的目的端口与第二会话报文的目的端口相同。
因此，在确定恶意文件的僵尸特征之前，首先对第一动态行为文件中的各会话报文与第二动态行为文件中的各会话报文进行配对，以确定出第一动态行为文件和第二动态行为文件中对应同一个通信对象的会话报文。配对的方法有多种，例如，对第一动态行为文件中的第一会话报文，获取该第一会话报文的目的IP地址和目的端口后，在第二动态行为文件中遍历所有会话报文，以查找出具有相同的目的IP地址和目的端口的会话报文，也即第二会话报文。
本实施例中，根据第一会话报文和第二会话报文的共有特征确恶意文件的僵尸特征的方法有多种。例如，首先获取第一会话报文和第二会话报文的共有特征，再从该共有特征中查找僵尸特征。又例如，首先确定第一会话报文中出现僵尸特征的位置(为描述方便，称为第一位置)和第二会话报文中出现僵尸特征的位置(为描述方便，称为第二位置)，再获取第一位置处的报文内容和第二位置处的报文内容的共有特征，根据该共有特征确定僵尸特征。其中，该第一位置和第二位置可以为上文所描述的payload字段、request字段、agent字段中的至少一项。
优选的，本实施例中，在根据第一会话报文和第二会话报文的共有特征确定僵尸特征的过程中，包括对第一会话报文和第二会话报文进行预处理的步骤，以对第一会话报文和第二会话报文中明确不是僵尸特征的一些字符串先进行标记，以便在对第一会话报文和第二会话报文进行比较以获取该两个会话报文的共有特征时不对该标记的字符进行比较，提高获取共有特征的效率。下面对根据第一会话报文和第二会话报文的共有特征确定僵尸特征的其中的一种方法进行举例说明。
获取预处理操作规则，所述预处理操作规则指示去除报文中的指定字符。根据所述预处理操作规则，从所述第一会话报文中获得第一剩余内容，从所述第二会话报文中获得第二剩余内容，所述第一剩余内容为所述第一会话报文中除所述指定字符以外的报文内容，所述第二剩余内容为所述第二会话报文中除所述指定字符以外的报文内容。根据第一剩余内容和第二剩余内容的共有特征确定所述恶意文件的僵尸特征。
其中，获取预处理操作规则的方法有多种，例如，该预处理操作规则预先存储在网关设备内的第三配置表中，通过读取第三配置表来确定预处理操作规则；可选的，该第三配 置表的内容可以随时更新。
其中，该预处理操作规则可以有多种，例如，在会话报文为HTTP报文时，预处理操作规则用于指示去除以下至少一种：会话报文中的HTTP关键字、会话报文中的沙箱的IP地址和端口、会话报文中的CPU类型这样格式的字符串，其中，HTTP关键字可以为GET、HTTP1.1等字符串。在此不作限制。
可选地，本实施例中，网关设备内还预先设置有协议白名单，该协议白名单上存储有至少一条传输层协议。可选的，该协议白名单可以随时更新。在获取第一动态行为文件和第二动态行为文件的共有特征之前，当确定该两个动态行为文件中存在特定会话报文时，确定该特定会话报文中不包括僵尸特征，在获取第一动态行为文件和第二动态行为文件的共有特征时将该特定会话报文排除，其中，该特定会话报文指的是五元组中的传输层协议位于该协议白名单内的会话报文。这样，可以减少用于获取共有特征的会话报文，提高确定僵尸特征的效率。
本实施例中，通过恶意文件在沙箱中模拟运行，并收集该恶意文件在该运行过程中发生的网络行为的行为文件，也即动态行为文件，以从该动态行为文件中提取出僵尸特征，整个过程可以实现自动化，提高提取僵尸特征的效率；另外，由于是在至少两个沙箱中对同一个恶意文件进行动态行为检测，在提取僵尸特征时从该至少两个沙箱分别输出的动态行为文件之间的共同特征中提取僵尸特征，可以避免提取出的僵尸特征包含不同沙箱在动态行为文件中随机填充的字符串以及用于描述沙箱的信息的字符串(例如沙箱的网络协议地址和端口地址)，提高僵尸特征的准确度。
为方便理解，下面结合一个实际应用场景对本实施例的僵尸特征的检测方法进行举例描述。
请参阅图2，图2为本发明的通信系统的一个实施例的结构示意图。本实施例中，通信系统包括至少一个网关设备和一个网络安全设备202。为描述方便，下面以该至少一个网关设备中的网关设备201进行举例描述。网关设备201在接收到业务报文后，从中确定出用以承载同一个文件的一系列业务报文，也可以称之为用以承载同一个文件的会话，并对该系列业务报文进行重组还原，以得到该系列报文的载荷部分携带的文件。当网关设备201确定一个文件疑似为恶意文件时，将该文件作为待检测文件，分别输入到至少两个本地沙箱中。
其中，网关设备201确定一个文件为疑似恶意文件的方法有多种。例如，网关设备201首先对会话中携带的文件的URL和本地预存有的僵尸URL进行匹配，若匹配成功，则可直接确定该网络报文为恶意文件；若匹配不成功，进一步确定该网络报文是否为可移植的可执行的(Portable Executable，PE)文件，若是，确定该文件为疑似恶意文件。
请参阅图3，图3为网关设备201中用于进行僵尸木马检测的模块的结构示意图。网关设备201包括至少两个沙箱、威胁判定模块、僵尸特征检测模块、管控模块和沙箱管理模块。沙箱、威胁判定模块、僵尸特征检测模块、管控模块和沙箱管理模块为利用软件程序实现的功能模块。其中，管控模块用于管理威胁判定模块和僵尸特征检测模块，沙箱管理模块用于执行创建、关闭和监控沙箱等操作。
当网关设备201得到待检测文件后，沙箱管理模块创建沙箱1和沙箱2，网关设备将该待检测文件分别输入到沙箱1和沙箱2中。网关设备201的沙箱1和沙箱2分别接收到待检测文件后，对该网络报文执行静态行为检测和动态行为检测，并将检测结果输入得到 威胁判定模块中。具体的，沙箱1将该网络报文的静态行为文件1和动态行为文件1输入到威胁判定模块中，沙箱2输出该网络报文的静态行为文件2和动态行为文件2输入到威胁判定模块中。
如下表1所示，下表1为静态行为文件的结构的一种实施例的示意图。
表1
Figure PCTCN2017087170-appb-000001
如下表2所示，下表2为动态行为文件的结构的一种实施例的示意图。
表2
Figure PCTCN2017087170-appb-000002
威胁判定模块根据该静态行为文件1和2、动态行为文件1和2确定待检测文件是否为恶意文件。具体的，威胁判定模块对该四个文件中的异常项进行权重打分，根据打分结果判定网络报文是否为恶意文件。具体如何权重打分为现有技术，在此不再赘述。
威胁判定模块将判定结果发送给管控模块，以便管控模块将该判定结果通知至沙箱管理模块。若判定结果指示该网络报文不是恶意文件，那么沙箱管理模块将沙箱1和沙箱2关闭。若判定结果指示该网络报文是恶意文件，那么威胁判定模块将所接收到的恶意文件的动态行为文件1和2发送至管控模块，以便管控模块将该两个文件转发至僵尸特征检测模块。
僵尸特征引擎接收到恶意文件的动态行为文件1和2后，获取动态行为文件1中的所 有会话报文，以及动态行为文件2中的所有会话报文。僵尸特征引擎获取协议白名单，该协议白名单上存储有至少一条传输层协议。僵尸特征引擎标记出动态行为文件1和2中所有传输层协议位于该协议白名单上的会话报文，并对动态行为文件1中的未被标记的会话报文依次进行编号，以及对动态行为文件2中未被标记的会话报文依次进行编号，其中，动态行为文件1和2之间具有相同的目的IP地址且具有相同的目的端口的会话报文的编号相同。在检测僵尸特征时，对动态行为文件1和2中任意一个编号相同的两个会话报文，解析出每个会话报文中的关键特征，该关键特征包括payload字段、request字段和agent字段。具体的，下面以动态行为文件1中编号为1和动态行为文件2中编号为1的两个会话报文为例进行说明。
动态行为文件1中编号为1的会话报文的内容如下：
GET/ip.txt HTTP1.1
User-Agent:Huai_Huai
Host:2.2.2.3
Cache-Control：no-cache
HTTP/1.1 200 OK
Content-Type：text/plain
Content-Range：bytes 0-18/19
Content-Length：19
Server：HFS 2.1d
Accept-Ranges：bytes
Content-Disposition：filename＝“ip.txt”
Last-Modified:Sat,12 May 2007
02:16:42 GMT
kvo2.2.2.60:8000kid
动态行为文件2中编号为1的会话报文的内容如下：
GET/ip.txt HTTP1.1
User-Agent:Huai_Huai
Host:2.2.2.3
Cache-Control：no-cache
HTTP/1.1 200 OK
Content-Type：text/plain
Content-Range：bytes 0-18/19
Content-Length：19
Server：HFS 2.1d
Accept-Ranges：bytes
Content-Disposition：filename＝“ip.txt”
Last-Modified:Sat,12 May 2007
02:17:15 GMT
kvo2.2.2.18:8000kid
对上述两个会话报文，采用以下几种方式来检测会话报文中的僵尸特征。
方式一：
对上述两个会话报文进行协议识别，解析出payload字段如下：
动态行为文件1中编号为1的会话报文：Packet1.HTTP.payload＝kvo2.2.2.60:8000kid；
动态行为文件2中编号为1的会话报文：Packet2.HTTP.payload＝kvo2.2.2.18:8000kid。
根据预处理操作规则对payload字段进行预处理，其中，预处理操作规则指示去除将该字段中的沙箱的IP：端口“2.2.2.60:8000”这类型字符串，具体的，也即在后续获取该两个报文的共有特征时去除“2.2.2.60:8000”这段字符串。
对该两个会话报文中的payload字段，比较该两个字段中是否分别包含相同的字符串，可以得到该字符串为kvo和kid，以及kvo在payload字段中的位置为起始地址为0处，以及kid在payload字段中的位置为倒数地址为0处。那么僵尸特征包含payload字段中的kvo和kid，以及该两个字符串的在payload字段中的位置。
方式二：
对上述两个会话报文进行协议识别，解析出request字段如下：
动态行为文件1中编号为1的会话报文：Packet1.HTTP.requst＝GET/ip.txt HTTP/1.1。
动态行为文件2中编号为1的会话报文：Packet2.HTTP.requst＝GET/ip.txt HTTP/1.1。
根据预处理操作规则对request字段进行预处理，其中，预处理操作规则指示去除该字段中的HTTP关键字“GET”和“HTTP/1.1”，具体的，也即在后续获取该两个报文的共有特征时去除“GET”和“HTTP/1.1”这两段字符串。
对该两个会话报文中的request字段，比较该两个字段中是否存在相同的特征串，可以得到该字符串为/ip.txt，以及该字符串在request字段中的位置为起始地址为0处，那么僵尸特征包含request字段中的字符串/ip.txt，以及该字符串在request字段中的位置。
方式三：
对上述两个会话报文进行协议识别，解析出agent字段如下：
动态行为文件1中编号为1的会话报文：Packet1.HTTP.Agent＝Huai_Huai。
动态行为文件2中编号为1的会话报文：Packet2.HTTP.Agent＝Huai_Huai。
对该两个会话报文中的agent字段，比较该两个字段中是否存在相同的特征串，可以得到该字符串为Huai_Huai，由于该字符串和agent字段的预设内容不同，因此确定僵尸特征包含agent字段中的字符串Huai_Huai。
僵尸特征检测模块将动态行为文件1和2中任意一个编号相同的两个会话报文中的僵 尸特征检测出来后，将该僵尸特征描述出来，形成规则条目，并发送给管控模块。
管控模块将规则条目发送至网络安全设备202。网络安全设备202收集来自各个网关设备的规则条目，并提供僵尸特征数据下载的功能，以便其他设备能够从该网络安全设备202下载僵尸特征数据并存储，使得网关设备可以根据该僵尸特征数据识别文件是否为恶意文件。
上面对本实施例的僵尸特征的检测方法进行了描述，下面将对本实施例的僵尸特征的检测装置进行描述。
请参阅图4，图4为本实施例的僵尸特征的检测装置的一个实施例的结构示意图。本实施例中，僵尸特征的检测装置400包括：
获取模块401，用于获取第一动态行为文件和第二动态行为文件，所述第一动态行为文件为恶意文件在第一沙箱中进行动态行为检测产生的行为文件，所述第二动态行为文件为所述恶意文件在第二沙箱中进行动态行为检测产生的行为文件；
确定模块402，用于根据所述第一动态行为文件和所述第二动态行为文件的共有特征确定所述恶意文件的僵尸特征。
在本实施例的一些可能的实施方式中，所述第一动态行为文件包括第一会话报文，所述第二动态行为文件包括第二会话报文，其中，所述第一会话报文的目的网络协议IP地址与所述第二会话报文的目的IP地址相同、且所述第一会话报文的目的端口与所述第二会话报文的目的端口相同；
确定模块402具体用于根据所述第一会话报文和所述第二会话报文的共有特征确定所述恶意文件的僵尸特征。
在上述实施方式中，可选的，确定模块402具体用于：
获取预处理操作规则，所述预处理操作规则指示去除报文中的指定字符；
根据所述预处理操作规则，从所述第一会话报文中获得第一剩余内容，从所述第二会话报文中获得第二剩余内容，所述第一剩余内容为所述第一会话报文中除所述指定字符以外的报文内容，所述第二剩余内容为所述第二会话报文中除所述指定字符以外的报文内容；
根据第一剩余内容和第二剩余内容的共有特征确定所述恶意文件的僵尸特征。
在上述实施方式中，可选的，确定模块402具体用于：
获取第一预置字段；
判断所述第一会话报文的所述第一预置字段中的内容和所述第二会话报文的所述第一预置字段中的内容是否包含相同的字符串，若包含，确定所述恶意文件的僵尸特征包括所述字符串以及所述字符串在所述第一预置字段中的位置。
在上述实施方式中，可选的，确定模块402具体用于：
获取第二预置字段以及所述第二预置字段的预设内容；
当所述第一会话报文和所述第二会话报文的共有特征中存在所述第二预置字段，且所述共有特征中的第二预置字段的内容和所述预设内容不同时，确定所述僵尸特征包括所述共有特征中的第二预置字段的内容。
在本实施例的一些可能的实施方式中，获取模块401具体用于：
获取第一沙箱输出的静态行为文件和动态行为文件，以及第二沙箱输出的静态行为文件和动态行为文件，其中，所述第一沙箱输出的静态行为文件为待检测文件在所述第一沙 箱中进行静态行为检测产生的行为文件，所述第二沙箱输出的静态行为文件为所述待检测文件在所述第二沙箱中进行静态行为检测产生的行为文件，所述第一沙箱输出的动态行为文件为所述待检测文件在所述第一沙箱在所述第一沙箱中进行动态行为检测产生的行为文件，所述第二沙箱输出的动态行为文件为所述待检测文件在所述第二沙箱中进行动态行为检测产生的行为文件；
根据所述第一沙箱输出的静态行为文件和动态行为文件，以及所述第二沙箱输出的静态行为文件和动态行为文件判断所述待检测文件是否为恶意文件；
当确定所述待检测文件为恶意文件时，确定所述第一沙箱输出的动态行为文件为所述第一动态行为文件，以及所述第二沙箱输出的动态行为文件为所述第二动态行为文件。
在本实施例的一些可能的实施方式中，获取模块401具体用于：
获取恶意文件；
将所述恶意文件分别输入到第一沙箱和第二沙箱中进行动态行为检测；
获取所述第一沙箱输出的动态行为文件，以及所述第二沙箱输出的动态行为文件。
图4所示的僵尸特征的检测装置可以通过集成于计算机设备中的软件或硬件实现，该装置可以实现的其他附加功能请参照方法实施例中对网关设备的描述，在这里不再赘述。
本实施例中，僵尸特征的检测装置在沙箱中对恶意文件进行动态行为检测，通过沙箱收集该恶意文件在运行过程中发生的所有网络行为并输出该网络行为的动态行为文件，并从该动态行为文件中提取出僵尸特征，这样可以提取出僵尸通信的签名，有助于实现基于通信特征签名来检测恶意文件，避免了各种僵尸变形版本文件的干扰而导致的误报和漏报的情况；另外，由于是在至少两个沙箱中对同一个恶意文件进行动态行为检测，在提取僵尸特征时从该至少两个沙箱分别输出的动态行为文件之间的共同特征中提取僵尸特征，可以避免提取出的僵尸特征包含不同沙箱在动态行为文件中随机填充的字符串以及用于描述沙箱的信息的字符串(例如沙箱的IP地址和端口地址)，提高僵尸特征的准确度。
上面从单元化功能实体的角度对本实施例中的僵尸特征的检测装置进行了描述，下面从硬件处理的角度对本实施例中的僵尸特征的检测装置进行描述。
请参阅图5，图5为本实施例的网关设备的一个实施例的结构示意图。本实施例中，网关设备500包括：
一个或多个处理器502、存储器501、通信总线503，所述处理器502和所述存储器501通过所述通信总线503相连；
其中一个或多个程序被存储在所述存储器501中，所述一个或多个程序包括指令，所述指令当被所述网关设备执行时使所述网关设备执行以下操作：
获取第一动态行为文件和第二动态行为文件，所述第一动态行为文件为恶意文件在第一沙箱中进行动态行为检测产生的行为文件，所述第二动态行为文件为所述恶意文件在第二沙箱中进行动态行为检测产生的行为文件；
根据所述第一动态行为文件和所述第二动态行为文件的共有特征确定所述恶意文件的僵尸特征。
可选的，所述第一动态行为文件包括第一会话报文，所述第二动态行为文件包括第二会话报文，其中，所述第一会话报文的目的网络协议IP地址与所述第二会话报文的目的IP地址相同、且所述第一会话报文的目的端口与所述第二会话报文的目的端口相同；
所述根据所述第一动态行为文件和所述第二动态行为文件的共有特征确定所述恶意 文件的僵尸特征，包括：
根据所述第一会话报文和所述第二会话报文的共有特征确定所述恶意文件的僵尸特征。
可选的，所述根据所述第一会话报文和所述第二会话报文的共有特征确定所述恶意文件的僵尸特征，包括：
获取预处理操作规则，所述预处理操作规则指示去除报文中的指定字符；
根据所述预处理操作规则，从所述第一会话报文中获得第一剩余内容，从所述第二会话报文中获得第二剩余内容，所述第一剩余内容为所述第一会话报文中除所述指定字符以外的报文内容，所述第二剩余内容为所述第二会话报文中除所述指定字符以外的报文内容；
根据所述第一剩余内容和所述第二剩余内容的共有特征确定所述恶意文件的僵尸特征。
可选的，所述根据所述第一动态行为文件和所述第二动态行为文件的共有特征确定所述恶意文件的僵尸特征，包括：
获取第一预置字段；
判断所述第一会话报文的所述第一预置字段中的内容和所述第二会话报文的所述第一预置字段中的内容是否包含相同的字符串，若包含，确定所述恶意文件的僵尸特征包括所述字符串以及所述字符串在所述第一预置字段中的位置。
可选的，所述根据所述第一动态行为文件和所述第二动态行为文件的共有特征确定所述恶意文件的僵尸特征，包括：
获取第二预置字段以及所述第二预置字段的预设内容；
当所述第一会话报文和所述第二会话报文的共有特征中存在所述第二预置字段，且所述共有特征中的第二预置字段的内容和所述预设内容不同时，确定所述僵尸特征包括所述共有特征中的第二预置字段的内容。
可选的，所述获取第一动态行为文件和第二动态行为文件，包括：
获取第一沙箱输出的静态行为文件和动态行为文件，以及第二沙箱输出的静态行为文件和动态行为文件，其中，所述第一沙箱输出的静态行为文件为待检测文件在所述第一沙箱中进行静态行为检测产生的行为文件，所述第二沙箱输出的静态行为文件为所述待检测文件在所述第二沙箱中进行静态行为检测产生的行为文件，所述第一沙箱输出的动态行为文件为所述待检测文件在所述第一沙箱在所述第一沙箱中进行动态行为检测产生的行为文件，所述第二沙箱输出的动态行为文件为所述待检测文件在所述第二沙箱中进行动态行为检测产生的行为文件；
根据所述第一沙箱输出的静态行为文件和动态行为文件，以及所述第二沙箱输出的静态行为文件和动态行为文件判断所述待检测文件是否为恶意文件；
当确定所述待检测文件为恶意文件时，确定所述第一沙箱输出的动态行为文件为所述第一动态行为文件，以及所述第二沙箱输出的动态行为文件为所述第二动态行为文件。
可选的，所述获取第一动态行为文件和第二动态行为文件，包括：
获取恶意文件；
将所述恶意文件分别输入到第一沙箱和第二沙箱中进行动态行为检测；
获取所述第一沙箱输出的动态行为文件，以及所述第二沙箱输出的动态行为文件。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的网关设备500的具体工作过程，可以参考前述方法实施例中对网关设备的相关描述，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。
本实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本发明各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
以上实施例仅用以说明本实施例的技术方案，而非对其限制。尽管参照前述实施例的详细说明，本领域的普通技术人员可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离各实施例技术方案的范围。

Claims (14)

  1. 一种僵尸特征的检测方法，其特征在于，包括：
    获取第一动态行为文件和第二动态行为文件，所述第一动态行为文件为恶意文件在第一沙箱中进行动态行为检测产生的行为文件，所述第二动态行为文件为所述恶意文件在第二沙箱中进行动态行为检测产生的行为文件；
    根据所述第一动态行为文件和所述第二动态行为文件的共有特征确定所述恶意文件的僵尸特征。
  2. 根据权利要求1所述的僵尸特征的检测方法，其特征在于，所述第一动态行为文件包括第一会话报文，所述第二动态行为文件包括第二会话报文，其中，所述第一会话报文的目的网络协议IP地址与所述第二会话报文的目的IP地址相同、且所述第一会话报文的目的端口与所述第二会话报文的目的端口相同；
    所述根据所述第一动态行为文件和所述第二动态行为文件的共有特征确定所述恶意文件的僵尸特征，包括：
    根据所述第一会话报文和所述第二会话报文的共有特征确定所述恶意文件的僵尸特征。
  3. 根据权利要求2所述的僵尸特征的检测方法，其特征在于，所述根据所述第一会话报文和所述第二会话报文的共有特征确定所述恶意文件的僵尸特征，包括：
    获取预处理操作规则，所述预处理操作规则指示去除报文中的指定字符；
    根据所述预处理操作规则，从所述第一会话报文中获得第一剩余内容，从所述第二会话报文中获得第二剩余内容，所述第一剩余内容为所述第一会话报文中除所述指定字符以外的报文内容，所述第二剩余内容为所述第二会话报文中除所述指定字符以外的报文内容；
    根据所述第一剩余内容和所述第二剩余内容的共有特征确定所述恶意文件的僵尸特征。
  4. 根据权利要求2所述的僵尸特征的检测方法，其特征在于，所述根据所述第一会话报文和所述第二会话报文的共有特征确定所述恶意文件的僵尸特征，包括：
    获取第一预置字段；
    判断所述第一会话报文的所述第一预置字段中的内容和所述第二会话报文的所述第一预置字段中的内容是否包含相同的字符串，若包含，确定所述恶意文件的僵尸特征包括所述字符串以及所述字符串在所述第一预置字段中的位置。
  5. 根据权利要求2所述的僵尸特征的检测方法，其特征在于，所述根据所述第一会话报文和所述第二会话报文的共有特征确定所述恶意文件的僵尸特征，包括：
    获取第二预置字段以及所述第二预置字段的预设内容；
    当所述第一会话报文和所述第二会话报文的共有特征中存在所述第二预置字段，且所述共有特征中的第二预置字段的内容和所述预设内容不同时，确定所述僵尸特征包括所述共有特征中的第二预置字段的内容。
  6. 根据权利要求1至5任一项所述的僵尸特征的检测方法，其特征在于，所述获取第一动态行为文件和第二动态行为文件，包括：
    获取第一沙箱输出的静态行为文件和动态行为文件，以及第二沙箱输出的静态行为文 件和动态行为文件，其中，所述第一沙箱输出的静态行为文件为待检测文件在所述第一沙箱中进行静态行为检测产生的行为文件，所述第二沙箱输出的静态行为文件为所述待检测文件在所述第二沙箱中进行静态行为检测产生的行为文件，所述第一沙箱输出的动态行为文件为所述待检测文件在所述第一沙箱在所述第一沙箱中进行动态行为检测产生的行为文件，所述第二沙箱输出的动态行为文件为所述待检测文件在所述第二沙箱中进行动态行为检测产生的行为文件；
    根据所述第一沙箱输出的静态行为文件和动态行为文件，以及所述第二沙箱输出的静态行为文件和动态行为文件判断所述待检测文件是否为恶意文件；
    当确定所述待检测文件为恶意文件时，确定所述第一沙箱输出的动态行为文件为所述第一动态行为文件，以及所述第二沙箱输出的动态行为文件为所述第二动态行为文件。
  7. 根据权利要求1至5任一项所述的僵尸特征的检测方法，其特征在于，所述获取第一动态行为文件和第二动态行为文件，包括：
    获取恶意文件；
    将所述恶意文件分别输入到第一沙箱和第二沙箱中进行动态行为检测；
    获取所述第一沙箱输出的动态行为文件，以及所述第二沙箱输出的动态行为文件。
  8. 一种僵尸特征的检测装置，其特征在于，包括：
    获取模块，用于获取第一动态行为文件和第二动态行为文件，所述第一动态行为文件为恶意文件在第一沙箱中进行动态行为检测产生的行为文件，所述第二动态行为文件为所述恶意文件在第二沙箱中进行动态行为检测产生的行为文件；
    确定模块，用于根据所述第一动态行为文件和所述第二动态行为文件的共有特征确定所述恶意文件的僵尸特征。
  9. 根据权利要求8所述的僵尸特征的检测装置，其特征在于，所述第一动态行为文件包括第一会话报文，所述第二动态行为文件包括第二会话报文，其中，所述第一会话报文的目的网络协议IP地址与所述第二会话报文的目的IP地址相同、且所述第一会话报文的目的端口与所述第二会话报文的目的端口相同；
    所述确定模块具体用于根据所述第一会话报文和所述第二会话报文的共有特征确定所述恶意文件的僵尸特征。
  10. 根据权利要求9所述的僵尸特征的检测装置，其特征在于，所述确定模块具体用于：
    获取预处理操作规则，所述预处理操作规则指示去除报文中的指定字符；
    根据所述预处理操作规则，从所述第一会话报文中获得第一剩余内容，从所述第二会话报文中获得第二剩余内容，所述第一剩余内容为所述第一会话报文中除所述指定字符以外的报文内容，所述第二剩余内容为所述第二会话报文中除所述指定字符以外的报文内容；
    根据第一剩余内容和第二剩余内容的共有特征确定所述恶意文件的僵尸特征。
  11. 根据权利要求9所述的僵尸特征的检测装置，其特征在于，所述确定模块具体用于：
    获取第一预置字段；
    判断所述第一会话报文的所述第一预置字段中的内容和所述第二会话报文的所述第一预置字段中的内容是否包含相同的字符串，若包含，确定所述恶意文件的僵尸特征包括 所述字符串以及所述字符串在所述第一预置字段中的位置。
  12. 根据权利要求9所述的僵尸特征的检测装置，其特征在于，所述确定模块具体用于：
    获取第二预置字段以及所述第二预置字段的预设内容；
    当所述第一会话报文和所述第二会话报文的共有特征中存在所述第二预置字段，且所述共有特征中的第二预置字段的内容和所述预设内容不同时，确定所述僵尸特征包括所述共有特征中的第二预置字段的内容。
  13. 根据权利要求8至12任一项所述的僵尸特征的检测装置，其特征在于，所述获取模块具体用于：
    获取第一沙箱输出的静态行为文件和动态行为文件，以及第二沙箱输出的静态行为文件和动态行为文件，其中，所述第一沙箱输出的静态行为文件为待检测文件在所述第一沙箱中进行静态行为检测产生的行为文件，所述第二沙箱输出的静态行为文件为所述待检测文件在所述第二沙箱中进行静态行为检测产生的行为文件，所述第一沙箱输出的动态行为文件为所述待检测文件在所述第一沙箱在所述第一沙箱中进行动态行为检测产生的行为文件，所述第二沙箱输出的动态行为文件为所述待检测文件在所述第二沙箱中进行动态行为检测产生的行为文件；
    根据所述第一沙箱输出的静态行为文件和动态行为文件，以及所述第二沙箱输出的静态行为文件和动态行为文件判断所述待检测文件是否为恶意文件；
    当确定所述待检测文件为恶意文件时，确定所述第一沙箱输出的动态行为文件为所述第一动态行为文件，以及所述第二沙箱输出的动态行为文件为所述第二动态行为文件。
  14. 根据权利要求8至12任一项所述的僵尸特征的检测装置，其特征在于，所述获取模块具体用于：
    获取恶意文件；
    将所述恶意文件分别输入到第一沙箱和第二沙箱中进行动态行为检测；
    获取所述第一沙箱输出的动态行为文件，以及所述第二沙箱输出的动态行为文件。
PCT/CN2017/087170 2016-10-25 2017-06-05 僵尸特征的检测方法和装置 WO2018076697A1 (zh)

Priority Applications (4)

Application Number Priority Date Filing Date Title
ES17863527T ES2829600T3 (es) 2016-10-25 2017-06-05 Método y aparato para detectar el comportamiento zombi
EP17863527.2A EP3509001B1 (en) 2016-10-25 2017-06-05 Method and apparatus for detecting zombie feature
US16/372,923 US10757135B2 (en) 2016-10-25 2019-04-02 Bot characteristic detection method and apparatus
US16/897,707 US11290484B2 (en) 2016-10-25 2020-06-10 Bot characteristic detection method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610948753.4 2016-10-25
CN201610948753.4A CN107979581B (zh) 2016-10-25 2016-10-25 僵尸特征的检测方法和装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/372,923 Continuation US10757135B2 (en) 2016-10-25 2019-04-02 Bot characteristic detection method and apparatus

Publications (1)

Publication Number Publication Date
WO2018076697A1 true WO2018076697A1 (zh) 2018-05-03

Family

ID=62004198

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/087170 WO2018076697A1 (zh) 2016-10-25 2017-06-05 僵尸特征的检测方法和装置

Country Status (5)

Country Link
US (2) US10757135B2 (zh)
EP (1) EP3509001B1 (zh)
CN (1) CN107979581B (zh)
ES (1) ES2829600T3 (zh)
WO (1) WO2018076697A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11811811B1 (en) * 2018-03-16 2023-11-07 United Services Automobile Association (Usaa) File scanner to detect malicious electronic files

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108418844B (zh) * 2018-06-19 2020-09-01 北京云枢网络科技有限公司 一种应用层攻击的防护方法及攻击防护端
CN109684845B (zh) * 2018-12-27 2021-04-06 北京天融信网络安全技术有限公司 一种检测方法和装置
CN111859381A (zh) * 2019-04-29 2020-10-30 深信服科技股份有限公司 一种文件检测方法、装置、设备及介质
CN112507331A (zh) * 2020-12-03 2021-03-16 北京微步在线科技有限公司 一种模型训练方法、文件识别方法及电子装置
US11386197B1 (en) 2021-01-11 2022-07-12 Bank Of America Corporation System and method for securing a network against malicious communications through peer-based cooperation
US11641366B2 (en) 2021-01-11 2023-05-02 Bank Of America Corporation Centralized tool for identifying and blocking malicious communications transmitted within a network
CN113987486B (zh) * 2021-10-14 2024-09-27 北京天融信网络安全技术有限公司 一种恶意程序检测方法、装置及电子设备
US20230140706A1 (en) * 2021-11-01 2023-05-04 Recorded Future, Inc. Pipelined Malware Infrastructure Identification

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102902924A (zh) * 2012-09-29 2013-01-30 北京奇虎科技有限公司 对文件行为特征进行检测的方法及装置
CN104134019A (zh) * 2014-07-25 2014-11-05 北京奇虎科技有限公司 检测脚本病毒的方法和装置
CN104866765A (zh) * 2015-06-03 2015-08-26 康绯 基于行为特征相似性的恶意代码同源性分析方法
US20160292419A1 (en) * 2015-03-31 2016-10-06 Juniper Networks, Inc. Multi-file malware analysis

Family Cites Families (32)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100611741B1 (ko) * 2004-10-19 2006-08-11 한국전자통신연구원 네트워크 침입 탐지 및 방지 시스템 및 그 방법
KR100639969B1 (ko) * 2004-12-02 2006-11-01 한국전자통신연구원 이상 트래픽 제어 장치 및 그 제어 방법
US8495743B2 (en) * 2005-12-16 2013-07-23 Cisco Technology, Inc. Methods and apparatus providing automatic signature generation and enforcement
US8613088B2 (en) * 2006-02-03 2013-12-17 Cisco Technology, Inc. Methods and systems to detect an evasion attack
US9349134B1 (en) * 2007-05-31 2016-05-24 Google Inc. Detecting illegitimate network traffic
US20100031353A1 (en) * 2008-02-04 2010-02-04 Microsoft Corporation Malware Detection Using Code Analysis and Behavior Monitoring
US8572717B2 (en) * 2008-10-09 2013-10-29 Juniper Networks, Inc. Dynamic access control policy with port restrictions for a network security appliance
US8381301B1 (en) * 2009-02-11 2013-02-19 Sprint Communications Company L.P. Split-flow attack detection
CN102045214B (zh) * 2009-10-20 2013-06-26 成都市华为赛门铁克科技有限公司 僵尸网络检测方法、装置和系统
US9270690B2 (en) * 2010-07-21 2016-02-23 Seculert Ltd. Network protection system and method
TWI419003B (zh) * 2010-11-12 2013-12-11 Univ Nat Chiao Tung 自動化分析與分類惡意程式之方法及系統
US8782791B2 (en) * 2010-12-01 2014-07-15 Symantec Corporation Computer virus detection systems and methods
KR20120072266A (ko) * 2010-12-23 2012-07-03 한국전자통신연구원 전역 네트워크 보안상황 제어 장치 및 방법
US8516595B2 (en) * 2010-12-28 2013-08-20 Caixa d'Estalvis I Pensions de Barcelona “La Caixa” Method and system for estimating the reliability of blacklists of botnet-infected computers
CN102254120B (zh) * 2011-08-09 2014-05-21 华为数字技术（成都）有限公司 恶意代码的检测方法、系统及相关装置
US8561188B1 (en) * 2011-09-30 2013-10-15 Trend Micro, Inc. Command and control channel detection with query string signature
US9792430B2 (en) * 2011-11-03 2017-10-17 Cyphort Inc. Systems and methods for virtualized malware detection
US9519781B2 (en) * 2011-11-03 2016-12-13 Cyphort Inc. Systems and methods for virtualization and emulation assisted malware detection
US20140181975A1 (en) * 2012-11-06 2014-06-26 William Spernow Method to scan a forensic image of a computer system with multiple malicious code detection engines simultaneously from a master control point
US9171151B2 (en) * 2012-11-16 2015-10-27 Microsoft Technology Licensing, Llc Reputation-based in-network filtering of client event information
US9106692B2 (en) * 2013-01-31 2015-08-11 Northrop Grumman Systems Corporation System and method for advanced malware analysis
US9495180B2 (en) * 2013-05-10 2016-11-15 Fireeye, Inc. Optimized resource allocation for virtual machines within a malware content detection system
US9171160B2 (en) * 2013-09-30 2015-10-27 Fireeye, Inc. Dynamically adaptive framework and method for classifying malware using intelligent static, emulation, and dynamic analyses
US9241010B1 (en) * 2014-03-20 2016-01-19 Fireeye, Inc. System and method for network behavior detection
US9609019B2 (en) * 2014-05-07 2017-03-28 Attivo Networks Inc. System and method for directing malicous activity to a monitoring system
US9769204B2 (en) * 2014-05-07 2017-09-19 Attivo Networks Inc. Distributed system for Bot detection
US9542554B1 (en) * 2014-12-18 2017-01-10 Palo Alto Networks, Inc. Deduplicating malware
US10075455B2 (en) * 2014-12-26 2018-09-11 Fireeye, Inc. Zero-day rotating guest image profile
US10621613B2 (en) * 2015-05-05 2020-04-14 The Nielsen Company (Us), Llc Systems and methods for monitoring malicious software engaging in online advertising fraud or other form of deceit
US9942270B2 (en) * 2015-12-10 2018-04-10 Attivo Networks Inc. Database deception in directory services
US10050998B1 (en) * 2015-12-30 2018-08-14 Fireeye, Inc. Malicious message analysis system
US10911472B2 (en) * 2016-02-25 2021-02-02 Imperva, Inc. Techniques for targeted botnet protection

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102902924A (zh) * 2012-09-29 2013-01-30 北京奇虎科技有限公司 对文件行为特征进行检测的方法及装置
CN104134019A (zh) * 2014-07-25 2014-11-05 北京奇虎科技有限公司 检测脚本病毒的方法和装置
US20160292419A1 (en) * 2015-03-31 2016-10-06 Juniper Networks, Inc. Multi-file malware analysis
CN104866765A (zh) * 2015-06-03 2015-08-26 康绯 基于行为特征相似性的恶意代码同源性分析方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3509001A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11811811B1 (en) * 2018-03-16 2023-11-07 United Services Automobile Association (Usaa) File scanner to detect malicious electronic files

Also Published As

Publication number Publication date
US20190230097A1 (en) 2019-07-25
CN107979581B (zh) 2020-10-27
US10757135B2 (en) 2020-08-25
EP3509001A4 (en) 2019-08-28
US20200304521A1 (en) 2020-09-24
EP3509001A1 (en) 2019-07-10
EP3509001B1 (en) 2020-09-16
US11290484B2 (en) 2022-03-29
ES2829600T3 (es) 2021-06-01
CN107979581A (zh) 2018-05-01

Similar Documents

Publication Publication Date Title
WO2018076697A1 (zh) 僵尸特征的检测方法和装置
US10225280B2 (en) System and method for verifying and detecting malware
CN107066883B (zh) 用于阻断脚本执行的系统和方法
US8893278B1 (en) Detecting malware communication on an infected computing device
RU2680736C1 (ru) Сервер и способ для определения вредоносных файлов в сетевом трафике
EP3591558A1 (en) System and method for detection of malicious hypertext transfer protocol chains
US12069076B2 (en) System and method for detecting and classifying malware
US11636208B2 (en) Generating models for performing inline malware detection
JP7388613B2 (ja) パケット処理方法及び装置、デバイス、並びに、コンピュータ可読ストレージ媒体
US11374946B2 (en) Inline malware detection
CN112600852A (zh) 漏洞攻击处理方法、装置、设备及存储介质
US10645107B2 (en) System and method for detecting and classifying malware
JP6592196B2 (ja) 悪性イベント検出装置、悪性イベント検出方法および悪性イベント検出プログラム
CN118302764A (zh) 用“非托管imphash”标识.net恶意软件
US20230344861A1 (en) Combination rule mining for malware signature generation
US12061696B2 (en) Sample traffic based self-learning malware detection
US20220245249A1 (en) Specific file detection baked into machine learning pipelines
KR102676386B1 (ko) 인라인 멀웨어 검출
JP6676790B2 (ja) リクエスト制御装置、リクエスト制御方法、および、リクエスト制御プログラム
RU2757330C1 (ru) Способ выявления несогласованного использования ресурсов вычислительного устройства пользователя
CN114697057A (zh) 获取编排剧本信息的方法、装置及存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17863527

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2017863527

Country of ref document: EP

Effective date: 20190403

NENP Non-entry into the national phase

Ref country code: DE