WO2018099206A1 - 一种apt检测方法、系统及装置 - Google Patents

一种apt检测方法、系统及装置 Download PDF

Info

Publication number
WO2018099206A1
WO2018099206A1 PCT/CN2017/107406 CN2017107406W WO2018099206A1 WO 2018099206 A1 WO2018099206 A1 WO 2018099206A1 CN 2017107406 W CN2017107406 W CN 2017107406W WO 2018099206 A1 WO2018099206 A1 WO 2018099206A1
Authority
WO
WIPO (PCT)
Prior art keywords
malicious
apt
malicious network
unit
analysis unit
Prior art date
Application number
PCT/CN2017/107406
Other languages
English (en)
French (fr)
Inventor
吴建华
王继刚
成黎
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018099206A1 publication Critical patent/WO2018099206A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis

Definitions

  • the invention relates to a safety monitoring technology, in particular to an APT detection method, system and device.
  • APT Advanced Persistent Threat
  • APT Advanced phenylcholine
  • P Persistent
  • the traditional security detection technologies mainly include: signature-based detection technologies, such as network intrusion detection and malicious code detection, which are mainly effective for attacks that are known and long-term mass propagation; active behavior defense detection technologies, such as antivirus vendors' desktop defense systems. , anti-virus software, etc., can monitor the behavior of the process in real time, but it will affect the user's use, and there are a large number of false positives.
  • signature-based detection technologies such as network intrusion detection and malicious code detection, which are mainly effective for attacks that are known and long-term mass propagation
  • active behavior defense detection technologies such as antivirus vendors' desktop defense systems. , anti-virus software, etc.
  • Traditional detection methods mainly target known threats, and cannot detect unknown vulnerabilities, Trojans, and attack techniques. Obviously, traditional detection methods are even more powerless when dealing with APT attack detection.
  • APT detection technology is summarized as follows: dynamic analysis detection, abnormal flow detection, and terminal defense detection. among them,
  • the typical representative of dynamic analysis and detection is sandbox detection technology, which mainly determines whether it is a malicious attack based on the running result by performing detection on the virtual environment.
  • dynamic analysis detection can only detect malware and provide early warning, and it cannot block the operation of malware from the source. After the dynamic analysis detection is performed, the malware may continue to run on the terminal device due to lack of linkage with the terminal device.
  • Abnormal traffic detection is similar to firewall technology. It mainly detects protocol behavior by parsing and parsing the traffic packets passing through the device and comparing them with pre-defined rules (such as black and white lists).
  • Abnormal Traffic Detection The APT detection system based on abnormal traffic analysis can detect networked malware. However, because the accuracy of abnormal traffic detection depends largely on the rule base, many first-time network viruses do not visit malicious websites. The rule base is listed, therefore, there is a problem of poor accuracy in abnormal traffic detection. Moreover, abnormal traffic detection can only block malicious traffic on the device. Due to the lack of linkage with the terminal device, after the malicious traffic is blocked, the malware and malicious processes on the terminal device may continue locally. run.
  • the terminal defense detection function on the traditional terminal only implements the function of the static anti-virus software, and cannot be cleared for viruses that are not included in the static virus database. Moreover, due to the lack of real-time linkage with other devices, it is impossible to block and clear local malicious files detected by other devices in time.
  • the current APT defense detection technology either the detection accuracy of malicious traffic is not good; or the malicious process can not be blocked from the source to run and remove malware, thereby reducing the accuracy and effectiveness of APT defense technology.
  • an embodiment of the present invention provides an APT detection method, system, and device, which can improve the accuracy and effectiveness of APT detection.
  • an embodiment of the present invention provides an advanced persistent threat APT detection system, including: an abnormal traffic analysis unit, a terminal defense unit, and a dynamic analysis unit, where
  • a terminal defense unit configured to output a suspicious file sample to the dynamic analysis unit;
  • the notification message from the abnormal traffic analysis unit processes the related malicious network behavior;
  • the dynamic analysis unit is configured to perform dynamic analysis on the received file samples, and output the analyzed malicious network information to the abnormal traffic analysis unit;
  • the abnormal traffic analysis unit is configured to optimize its own policy configuration according to the received malicious network information; and send a notification message to the terminal defense unit after detecting abnormal traffic from the terminal.
  • the dynamic analysis unit is further configured to: detect a malicious network behavior reported by another system in the network, dynamically analyze the reported malicious network behavior, and output the dynamic analysis result to the terminal defense unit, and analyze the The malicious network information is output to the abnormal traffic analysis unit.
  • the dynamic analysis unit is further configured to: output the dynamic analysis result to the terminal defense unit;
  • the terminal defense unit is further configured to: obtain the malicious network information according to the dynamic analysis result from the dynamic analysis unit, and output the malicious network information to the abnormal traffic analysis unit.
  • the notification message carries malicious network information.
  • the malicious network information includes: a domain name of a malicious website, and/or an IP address, and/or a port number, and/or malicious process information.
  • the abnormal traffic analysis unit, the terminal defense unit, and the dynamic analysis unit query the address of the interaction peer through the management center to initiate information interaction;
  • the abnormal traffic analysis unit, the terminal defense unit, and the dynamic analysis unit forward the interactive information to the opposite end via the management center.
  • the present invention also provides an APT detecting device, which is disposed at a terminal, and includes a first interaction module, a first processing module, wherein
  • a first interaction module configured to output a suspicious file sample to the dynamic analysis module
  • the first processing module is configured to process the related malicious network behavior according to the notification message from the abnormal traffic analysis unit.
  • the first processing module is further configured to: according to dynamics from the dynamic analysis unit The analysis result obtains malicious network information and outputs it to the abnormal traffic analysis unit.
  • the invention further provides an APT detecting device, which is disposed at the server; and includes a second interaction module and a second processing module; wherein
  • a second processing module configured to perform dynamic analysis on the received file samples
  • the second interaction module is configured to output the analyzed malicious network information to the abnormal traffic analysis unit.
  • the second processing module is further configured to: detect that the malicious network behavior is reported by other systems in the network, and perform dynamic analysis on the reported malicious network behavior;
  • the second interaction module is further configured to: output the dynamic analysis result to the terminal defense unit, and output the analyzed malicious network information to the abnormal traffic analysis unit.
  • the second interaction module is further configured to output the dynamic analysis result to the terminal defense unit.
  • the present invention further provides an APT detecting device, which is disposed at a server, and includes a third interaction module and a third processing module.
  • the third processing module is configured to optimize its own policy configuration according to the received malicious network information
  • the third interaction module is configured to send a notification message to the terminal defense unit after detecting abnormal traffic from the terminal.
  • the invention also provides an advanced persistent threat APT detection method, comprising:
  • the APT detection device dynamically analyzes suspicious file samples to obtain malicious network information
  • the APT detection device optimizes the policy configuration for abnormal traffic analysis based on the analyzed malicious network information.
  • it also includes:
  • the APT detecting device detects abnormal traffic from the terminal, and processes related malicious network behavior according to malicious network information.
  • the processing the related malicious network behavior according to the malicious network information comprises: stopping the malicious process and deleting the malicious software on the terminal.
  • it also includes:
  • the APT detecting device detects the malicious network behavior reported by other systems in the network, and dynamically analyzes the reported malicious network behavior to obtain the malicious network information.
  • the malicious network information includes: a domain name of a malicious website, and/or an IP address, and/or a port number, and/or malicious process information.
  • the technical solution of the present application includes: the APT detecting device dynamically analyzes suspicious file samples to obtain malicious network information; and optimizes the malicious network information according to the analysis to set a policy configuration for abnormal traffic analysis.
  • the abnormal traffic analysis function quickly improves the accuracy of the traffic analysis, and helps to improve the accuracy and effectiveness of the APT detection.
  • the APT detecting device detects the abnormal traffic from the terminal, and processes the related malicious network behavior according to the malicious network information, so as to stop the malicious process and delete the malware on the terminal, so that the system blocks the malware from the source. Operation improves inspection accuracy and protection, which improves the accuracy and effectiveness of APT detection.
  • a storage medium comprising a stored program, wherein the program is executed to perform the method of any of the above.
  • a processor for running a program wherein the program is executed to perform the method of any of the above.
  • FIG. 1 is a schematic structural diagram of an APT detecting device of the present invention
  • FIG. 2 is a flow chart of a method for detecting an APT according to the present invention
  • FIG. 3 is a schematic flow chart of a first embodiment of an APT detecting method according to the present invention.
  • FIG. 4 is a schematic flow chart of a second embodiment of an APT detecting method according to the present invention.
  • FIG. 5 is a schematic flowchart diagram of a third embodiment of an APT detecting method according to the present invention.
  • FIG. 6 is a schematic flow chart of a fourth embodiment of an APT detecting method according to the present invention.
  • FIG. 7 is a schematic flow chart of a fifth embodiment of an APT detecting method according to the present invention.
  • FIG. 1 is a schematic structural diagram of an APT detection system of the present invention, as shown in FIG. 1 , which includes at least an abnormal traffic analysis unit, a terminal defense unit, and a dynamic analysis unit, where
  • a terminal defense unit configured to output the suspicious file sample to the dynamic analysis unit; and process the related malicious network behavior according to the notification message from the abnormal traffic analysis unit;
  • the dynamic analysis unit is configured to perform dynamic analysis on the received file samples, and output the analyzed malicious network information to the abnormal traffic analysis unit;
  • the abnormal traffic analysis unit is configured to optimize its own policy configuration according to the received malicious network information; and send a notification message to the terminal defense unit after detecting abnormal traffic from the terminal.
  • the dynamic analysis unit is further configured to detect that other systems in the network, such as a mail server, report malicious network behavior (such as reporting malware, etc.), dynamically analyze the reported malicious network behavior, and output the dynamic analysis result to the terminal defense unit, Analysis of malicious network information output Give the abnormal traffic analysis unit.
  • the dynamic analysis unit is further configured to: output the dynamic analysis result to the terminal defense unit;
  • the terminal defense unit is further configured to: obtain the malicious network information according to the dynamic analysis result from the dynamic analysis unit, and output the malicious network information to the abnormal traffic analysis unit.
  • the notification message carries malicious network information.
  • the malicious network information includes, but is not limited to, a domain name of a malicious website, and/or an IP address, and/or a port number, and/or malicious process information.
  • the abnormal traffic analysis unit optimizes its own policy configuration according to the received malicious network information, including: adding a domain name, and/or an IP address, and/or a port number, and/or malicious process information of the malicious website. Go to the blacklist.
  • the terminal defense unit processes the related malicious network behavior, including but not limited to: suspending the malicious process and deleting the malware on the terminal.
  • the abnormal traffic analysis unit, the terminal defense unit, and the dynamic analysis unit may query the address of the interaction peer to initiate information interaction through a unified management center, or may forward the interaction information to the peer end through the management center.
  • the file dynamic behavior analysis function, the abnormal traffic analysis function and the terminal defense function are integrated as a whole, and the three are effectively cooperated, effectively preventing the malicious network behavior from the source and improving the detection precision.
  • Degree and protection which improves the accuracy and effectiveness of APT detection.
  • the terminal defense unit is also configured to have static defense functions such as process monitoring and file scanning and killing.
  • the abnormal traffic analysis unit is further configured to: perform traffic monitoring and traffic analysis, and filter out Abnormal traffic and traffic blocking based on policy.
  • the dynamic analysis unit is further configured to: dynamically analyze the received file and obtain an analysis result.
  • the terminal defense unit of the present invention is disposed at the terminal, and includes at least: a first interaction module, a first processing module, where
  • a first interaction module configured to output a suspicious file sample to the dynamic analysis module
  • the first processing module is configured to process the related malicious network behavior according to the notification message from the abnormal traffic analysis unit.
  • the first processing module is further configured to: obtain the malicious network information according to the dynamic analysis result from the dynamic analysis unit, and output the malicious network information to the abnormal traffic analysis unit.
  • the dynamic analysis unit of the present invention is disposed at the server, and includes at least: a second interaction module, and a second processing module;
  • a second processing module configured to perform dynamic analysis on the received file samples
  • the second interaction module is configured to output the analyzed malicious network information to the abnormal traffic analysis unit.
  • the second processing module is further configured to: detect that the malicious network behavior is reported by other systems in the network, and perform dynamic analysis on the reported malicious network behavior;
  • the second interaction module is further configured to: output the dynamic analysis result to the terminal defense unit, and output the analyzed malicious network information to the abnormal traffic analysis unit.
  • the second interaction module is further configured to output the dynamic analysis result to the terminal defense unit.
  • the abnormal traffic analysis unit of the present invention is disposed at the server, and includes at least: a third interaction module, and a third processing module; wherein
  • the third processing module is configured to optimize its own policy configuration according to the received malicious network information
  • the third interaction module is configured to send a notification message to the terminal defense unit after detecting abnormal traffic from the terminal.
  • server where the dynamic analysis unit is located and the server where the abnormal traffic analysis unit is located may be the same server or different servers.
  • FIG. 2 is a flowchart of an APT detection method according to the present invention, as shown in FIG. 2, including:
  • Step 200 The APT detecting device dynamically analyzes the suspicious file samples to obtain malicious network information.
  • the malicious network information in this step is obtained from the dynamic analysis result obtained after the dynamic analysis.
  • Step 201 The APT detecting device optimizes a policy configuration for abnormal traffic analysis according to the analyzed malicious network information.
  • the step specifically includes: adding information such as a domain name, and/or an IP address, and/or a port number, and/or malicious process information of the malicious website in the malicious network information to the blacklist.
  • the method of the invention further comprises:
  • Step 203 The APT detecting device detects abnormal traffic from the terminal, and processes related malicious network behavior according to the malicious network information.
  • the malicious network behavior is processed according to the malicious network information, including but not limited to: stopping the malicious process and deleting the malicious software on the terminal.
  • the method of the invention further comprises:
  • the APT detection device detects malicious network behaviors reported by other systems in the network, such as a mail server (such as reporting malware, etc.), and dynamically analyzes the reported malicious network behavior to obtain malicious network information.
  • a mail server such as reporting malware, etc.
  • the malicious network information includes, but is not limited to, a domain name of a malicious website, and/or an IP address, and/or a port number, and/or malicious process information, and the like.
  • the file dynamic behavior analysis function, the abnormal traffic analysis function and the terminal defense function are integrated into one, and the three are effectively coordinated.
  • the source effectively blocks malicious network behavior, improves detection accuracy and protection, and improves the accuracy and effectiveness of APT detection.
  • the method of the present invention further includes:
  • the APT detection device performs static defense functions such as process monitoring and file scanning and killing.
  • the method of the present invention further includes:
  • the APT detection device performs traffic monitoring and traffic analysis, filters out abnormal traffic and performs traffic blocking according to the policy.
  • the method of the present invention further includes:
  • the APT detection device dynamically analyzes the received file and obtains the analysis result.
  • the present invention also provides a computer readable storage medium storing computer executable instructions for performing the APT detection method of any of the present invention.
  • FIG. 3 is a schematic flowchart of a first embodiment of an APT detection method according to the present invention.
  • the scenario of the first embodiment is: after the terminal opens a malicious sample with network behavior, the linkage of the APT detection system of the present invention is used to implement the malicious sample. Detection, removal and improvement of the accuracy of abnormal flow analysis.
  • the dynamic analysis unit dynamically analyzes the sample and notifies the terminal defense unit of the analysis result. After receiving the analysis result, the terminal defense unit processes the malicious sample according to the policy, and reports the malicious network information to the abnormality.
  • the traffic analysis unit, the abnormal traffic analysis unit optimizes the policy configuration accordingly to improve the analysis accuracy.
  • the specific implementation includes:
  • Step 300 After detecting that the local file is opened or running, the terminal defense unit uploads the opened or running file to the dynamic analysis function unit for analysis.
  • the file uploading manner may be automatically uploaded by the terminal defense unit according to the configuration; or the terminal defense unit may prompt the user to perform manual uploading.
  • Step 301 After receiving the sample file, the dynamic analysis unit saves the sample file locally and performs dynamic analysis.
  • the analysis method generally adopts a sandbox detection manner, runs the received sample file in the virtual machine to obtain the running result, and filters the malicious network behavior from the running result according to a preset rule, and the related malicious Network information such as the malicious website domain name, IP address, port number, etc. are recorded.
  • Step 302 The dynamic analysis unit returns a sample dynamic analysis result to the terminal defense unit.
  • the dynamic analysis result can carry: whether the sample is a malicious sample, file characteristics (such as file name, size, MD5 value, etc.), the domain name of the visited malicious website, the IP address, the port number, and the like.
  • file characteristics such as file name, size, MD5 value, etc.
  • the domain name of the visited malicious website the IP address, the port number, and the like.
  • the method for the dynamic analysis unit to search for the terminal can be implemented by using a unified management center.
  • the terminal user sends a message to the management center to inform the IP address and port number of the user, and the management center saves the information, so that the subsequent dynamic analysis unit Or the abnormal traffic analysis unit can obtain the IP address and port number of the target terminal by querying the management center, thereby implementing message interaction with the terminal.
  • Step 303 After receiving the dynamic analysis result returned by the dynamic analysis unit, the terminal defense unit extracts and saves related information such as file features and malicious websites from the dynamic analysis result; the terminal defense unit processes the malicious sample and related processes according to the local configuration policy. For example, you can terminate malicious processes and delete related malicious files according to policies.
  • Step 304 The terminal defense unit reports the malicious network information, such as the domain name, the IP address, and the port number of the malicious website, to the abnormal traffic analysis unit.
  • Step 305 After receiving the malicious network information reported by the terminal defense function unit, the abnormal traffic analysis unit uses the malicious network information for policy optimization, for example, adding the domain name, IP address, and port number of the malicious website to the blacklist. The subsequent traffic from or sent to this website can be directly judged as malicious traffic by the abnormal traffic analysis unit, thereby achieving the purpose of optimizing traffic analysis accuracy.
  • FIG. 4 is a schematic flowchart of a second embodiment of an APT detection method according to the present invention.
  • the second embodiment is the same as the scenario shown in FIG. 2, except that in the second embodiment, malicious network information is directly used by the dynamic analysis unit. Send to the abnormal traffic analysis unit.
  • the specific implementation include:
  • Steps 400 to 403 The specific implementation is completely consistent with steps 300 to 303, and details are not described herein again.
  • Step 404 After detecting that the sample file has a malicious network behavior, the dynamic analysis unit reports the malicious network information to the abnormal traffic analysis unit, where the malicious network information includes but is not limited to: a domain name, an IP address, a port number, and the like of the malicious website.
  • the method for the dynamic analysis unit to find the abnormal traffic analysis unit can be implemented by a unified management center.
  • the management center stores configuration information of all dynamic analysis units and abnormal traffic analysis.
  • the dynamic analysis unit or the abnormal traffic analysis unit can obtain the IP address and port number of the other party by querying the management center, thereby implementing message interaction between the two.
  • Step 405 After receiving the reported malicious network information of the dynamic analysis unit, the abnormal traffic analysis unit uses the malicious network information for policy optimization, for example, adding the domain name, IP address, port number, etc. of the malicious website to the blacklist. The subsequent traffic from or sent to this website can be directly judged as malicious traffic by the abnormal traffic analysis unit, thereby achieving the purpose of optimizing traffic analysis accuracy.
  • FIG. 5 is a schematic flowchart of a third embodiment of the APT detection method according to the present invention.
  • the scenario of the third embodiment is: a processing flow after the dynamic analysis unit detects malware reported by other systems in the network, such as a mail system.
  • the dynamic analysis unit dynamically analyzes the sample uploaded by the mail system, and returns the analysis result to the mail system, and notifies the terminal defense unit of the related user to the malicious file feature, and reports the malicious network information to the abnormality.
  • the traffic analysis unit, the abnormal traffic analysis unit optimizes the policy configuration accordingly to improve the analysis accuracy.
  • the specific implementation includes:
  • Step 500 The mail system uploads the sample to the dynamic analysis function unit.
  • the mail system is deployed in a mail server of the same intranet as the APT detecting device.
  • the manner in which the mail system uploads the sample to the dynamic analysis unit may include: after receiving the mail, the mail system extracts the attached attachment from the mail for the mail carrying the attachment. It is sent out and sent to the dynamic analysis unit for analysis.
  • the message also carries the email address of the mail recipient or the identity information of the recipient.
  • Step 501 After receiving the sample, the dynamic analysis unit saves the sample and the recipient information locally, and performs dynamic analysis.
  • the dynamic analysis method generally adopts the sandbox detection method, runs the received samples in the virtual machine to obtain the running result, and filters the malicious network behavior from the running result according to a preset rule, and the related malicious Network information such as the malicious website domain name, IP address, port number, etc. are recorded.
  • Step 502 The dynamic analysis unit returns a sample dynamic analysis result to the terminal defense unit.
  • the dynamic analysis result may carry information such as whether the sample is a malicious sample, a file feature (such as a file name, a size, an MD5 value, etc.).
  • a file feature such as a file name, a size, an MD5 value, etc.
  • Step 503 The dynamic analysis unit searches for the IP address and port number of the current terminal defense unit of the recipient to which the sample belongs, and sends a message to the terminal defense unit, where the message carries malicious file information, such as file characteristics (such as a file). Name, size, MD5 value, etc.), the domain name, IP address, port number, etc. of the malicious website visited.
  • malicious file information such as file characteristics (such as a file). Name, size, MD5 value, etc.), the domain name, IP address, port number, etc. of the malicious website visited.
  • the manner in which the dynamic analysis unit searches for the current terminal defense unit of the recipient to which the sample belongs may be implemented by using a unified management center.
  • the management center In addition to the configuration information of all dynamic analysis units and abnormal traffic analysis, the management center also stores the network address of the user's terminal defense unit.
  • the user's terminal defense unit reports its own network address to the management center.
  • the defense unit reports to the management center by the terminal defense unit.
  • the report message carries the user identifier.
  • the management center saves the user identifier and the network information of the terminal defense unit.
  • the management center can also save the email address of the user.
  • the dynamic analysis unit sends a query message to the management center, and the query message carries the user email address or user identifier obtained from the mail system. In this way, the management center can query the network address of the current terminal defense unit of the user according to the user identifier or the user email address, and return it to the dynamic analysis unit.
  • the mail system in step 500 can also be obtained by querying the management center. Go to the dynamic analysis unit address and report the sample to it.
  • Step 504 After detecting the malicious network behavior of the sample, the dynamic analysis function unit reports the malicious network information to the abnormal traffic analysis unit, where the malicious network information includes but is not limited to: a domain name, an IP address, a port number, and the like of the malicious website.
  • Step 505 After receiving the reported malicious network information of the dynamic analysis unit, the abnormal traffic analysis unit uses the malicious network information for policy optimization, for example, adding the domain name, IP address, port number, etc. of the malicious website to the blacklist. The subsequent traffic from or sent to this website can be directly judged as malicious traffic by the abnormal traffic analysis unit, thereby achieving the purpose of optimizing traffic analysis accuracy.
  • FIG. 6 is a schematic flowchart of a fourth embodiment of the APT detection method according to the present invention.
  • the scenario of the fourth embodiment is: after detecting the abnormal traffic, the abnormal traffic analysis unit notifies the relevant terminal defense unit to process the malware.
  • the specific implementation includes:
  • Step 600 The malware running on the terminal connects to the external network to send or receive a message to the malicious website.
  • Step 601 The abnormal traffic analysis unit captures the traffic sent or received on the terminal and performs abnormal traffic analysis; after detecting the abnormal traffic, the traffic is blocked according to the policy.
  • the abnormal traffic analysis unit can obtain network information of malicious traffic, such as the domain name, IP address, and port number of the malicious website.
  • Step 602 The abnormal traffic analysis unit sends a message to the terminal defense unit to notify the terminal to clear the malware.
  • the message sent in this step carries malicious network information, wherein the malicious network information includes but is not limited to: malicious process information, a malicious website domain name, an IP address, a port number, and the like.
  • Step 603 to step 604 After receiving the notification, the terminal defense unit processes the related malicious sample and related malware according to the policy configuration, for example, the related malicious process may be terminated, the related malicious sample may be deleted, or an alarm may be popped to the user, and then the terminal The defense unit returns a confirmation message to the abnormal traffic analysis unit.
  • the terminal defense unit processes the related malicious sample and related malware according to the policy configuration, for example, the related malicious process may be terminated, the related malicious sample may be deleted, or an alarm may be popped to the user, and then the terminal The defense unit returns a confirmation message to the abnormal traffic analysis unit.
  • the terminal defense unit is notified of the manner of removing the malware, so that the system terminates the operation of the malicious process from the source and clears the malware.
  • FIG. 7 is a schematic flowchart of a fifth embodiment of an APT detection method according to the present invention.
  • the scenario of the fifth embodiment is the same as the scenario of the first embodiment, except that in the fifth embodiment, message interaction between units is performed. Forward through a unified management center.
  • the specific implementation includes:
  • Steps 700 to 701 After detecting that the local file is opened or running, the terminal defense unit uploads the file to the management center, and the management center saves the identifier (ID) or network address of the terminal defense unit, and selects a dynamic analysis unit by using the policy. The file that is opened or running is forwarded to the dynamic analysis unit for analysis.
  • ID identifier
  • the management center saves the identifier (ID) or network address of the terminal defense unit, and selects a dynamic analysis unit by using the policy.
  • the file that is opened or running is forwarded to the dynamic analysis unit for analysis.
  • Step 702 After receiving the sample file, the dynamic analysis unit saves the sample file locally and performs dynamic analysis.
  • the analysis method generally adopts a sandbox detection manner, runs the received sample file in the virtual machine to obtain the running result, and filters the malicious network behavior from the running result according to a preset rule, and the related malicious Network information such as the malicious website domain name, IP address, port number, etc. are recorded.
  • Step 703 to step 704 The dynamic analysis unit returns the sample dynamic analysis result to the management center, and the management center obtains the network address of the terminal defense unit by querying the previously saved information, and sends the dynamic analysis result to the terminal defense function unit.
  • the dynamic analysis result can carry: whether the sample is a malicious sample, file characteristics (such as file name, size, MD5 value, etc.), the domain name of the visited malicious website, the IP address, the port number, and the like.
  • file characteristics such as file name, size, MD5 value, etc.
  • the management center saves the malicious network information of the sample file.
  • Step 705 After receiving the dynamic analysis result returned by the dynamic analysis unit, the terminal defense unit receives the dynamic analysis result. Extracting the file characteristics, malicious websites and other related information from the dynamic analysis results and saving them; the terminal defense unit processes the malicious samples and related processes according to the local configuration policy, for example, the malicious process can be terminated according to the policy and related malicious files are deleted.
  • Step 706 The management center reports the malicious network information, such as the domain name, the IP address, and the port number of the malicious website, to the abnormal traffic analysis unit.
  • malicious network information such as the domain name, the IP address, and the port number of the malicious website
  • Step 707 After receiving the malicious network information reported by the terminal defense function unit, the abnormal traffic analysis unit uses the malicious network information for policy optimization, for example, adding the domain name, IP address, and port number of the malicious website to the blacklist. The subsequent traffic from or sent to this website can be directly judged as malicious traffic by the abnormal traffic analysis unit, thereby achieving the purpose of optimizing traffic analysis accuracy.
  • the file dynamic behavior analysis function, the abnormal traffic analysis function and the terminal defense function are integrated into one, and the three are effectively coordinated, the dynamic analysis function and/or the terminal.
  • the defense function reports the malicious network information to the abnormal traffic analysis function, so that the abnormal traffic analysis function can quickly improve the accuracy of the traffic analysis.
  • the abnormal traffic analysis function and/or the dynamic analysis function notify the terminal defense function to stop the malicious process and delete the malicious behavior.
  • the malware on the terminal makes the system block the operation of the malware from the source, improves the detection accuracy and protection ability, and improves the accuracy and effectiveness of the APT detection.
  • Embodiments of the present invention also provide a storage medium including a stored program, wherein the program described above executes the method of any of the above.
  • the foregoing storage medium may include, but is not limited to, a USB flash drive, a Read-Only Memory (ROM), and a Random Access Memory (RAM).
  • ROM Read-Only Memory
  • RAM Random Access Memory
  • Embodiments of the present invention also provide a processor for running a program, wherein the program is executed to perform the steps of any of the above methods.
  • an APT detection method, system, and apparatus provided by the embodiments of the present invention have the following beneficial effects: the file dynamic behavior analysis function, the abnormal traffic analysis function, and the terminal defense function are integrated as a whole, and the three are effectively coordinated.
  • the malicious network behavior is effectively prevented from the source, and the detection accuracy and protection ability are improved, thereby improving the accuracy and effectiveness of the APT detection.

Abstract

本发明实施例公开了一种APT检测方法、系统及装置，包括APT检测装置对可疑的文件样本进行动态分析，得到恶意网络信息；根据分析得到的恶意网络信息优化用于异常流量分析的策略配置。通过本发明实施例提供的技术方案，使得异常流量分析功能快速提升了流量分析的精度，有助于提高APT检测的准确性和有效性。进一步地，APT检测装置检测到来自终端的异常流量，按照恶意网络信息对相关的恶意网络行为进行处理，以中止恶意进程并删除终端上的恶意软件，使得系统从源头阻断了恶意软件的运行，提高了检测精确度和防护能力，从而提高了APT检测的准确性和有效性。

Description

一种APT检测方法、系统及装置 技术领域
本发明涉及安全监测技术，尤指一种APT检测方法、系统及装置。
背景技术
高级持续性威胁(APT，Advanced Persistent Threat)是一种高级且持续的攻击。相较于一般零星的黑客攻击事件，APT攻击具有计划性、较强的针对性，并可长期潜伏。美国国家标准和技术研究院对APT给出了详细定义：“精通复杂技术的攻击者利用多种攻击向量(如：网络，物理和欺诈等)、借助丰富资源创建机会实现自己的目的”。这些目的通常包括对目标企业的信息技术架构进行篡改，从而盗取数据(如将数据从内网输送到外网)，执行或阻止一项任务、程序；又或者是潜入对方架构中伺机进行偷取数据等。
APT的特点表现在A与P上，A代表高级(Advanced)，主要表现在攻击水平高超，即攻击行为特征难以提取、单点隐蔽性强、攻击渠道多样化、攻击空间不确定。P代表持续性(Persistent)，主要表现在攻击过程持续时间长、攻击成功后隐藏时间长。
传统的安全检测技术主要包括：基于签名的检测技术，如网络入侵检测、恶意代码检测等，主要针对已知且长期大量传播的攻击比较有效；主动行为防御检测技术，如杀毒厂商的桌面防御系统、杀毒软件等，能实时监控进程的行为，但会影响用户使用，并存在大量的误报。传统的检测手段主要针对已知的威胁，对于未知的漏洞、木马程序、攻击手法等，无法进行检测。显然，传统的检测手段在应对APT攻击检测时更是显得力不从心。
目前，APT检测技术归纳起来主要包括：动态分析检测、异常流量检测、终端防御检测。其中，
动态分析检测的典型代表有沙箱检测技术，主要是通过在虚拟环境上执行检测，基于运行结果来判定是否为恶意攻击。但是，动态分析检测只能检测恶意软件并提出预警，并不能从源头阻断恶意软件的运行。在执行了动态分析检测之后，由于缺乏和终端设备之间的联动，恶意软件可能还是会继续在终端设备上运行。
异常流量检测类似于防火墙技术，主要是通过对通过设备的流量包进行协议解析和内容解析，并与事先设定的规则(如黑白名单)进行比对，从而检测出异常的行为。异常流量检测基于异常流量分析的APT检测系统可以检测联网的恶意软件，但是，由于异常流量检测的精确度很大程度上取决于规则库，而很多首次出现的网络病毒其访问的恶意网站并不在规则库之列，因此，异常流量检测存在精确度欠佳的问题。并且，异常流量检测只能在本设备上阻断恶意流量，由于缺乏和终端设备之间的联动，因此，在恶意流量被阻断之后，终端设备上的恶意软件和恶意进程可能还是在本地继续运行。
传统的终端上的终端防御检测功能只是实现了静态杀毒软件的功能，对于没有列入静态病毒库的病毒无法清除。并且，由于缺乏和其他设备之间的实时联动，无法及时阻断和清除其他设备检测出的本地恶意文件。
综上所述，目前APT防御检测技术，要么对恶意流量的检测精确度欠佳；要么无法从源头阻断恶意进程的运行及清除恶意软件等，从而降低了APT防御技术的准确性和有效性。
发明内容
为了解决上述技术问题，本发明实施例提供一种APT检测方法、系统及装置，能够提高APT检测的准确性和有效性。
为了达到本发明目的，本发明实施例提供了一种高级持续性威胁APT检测系统，包括：异常流量分析单元、终端防御单元、动态分析单元，其中，
终端防御单元，设置为将可疑的文件样本输出给动态分析单元；根据 来自所述异常流量分析单元的通知消息对相关的恶意网络行为进行处理；
动态分析单元，设置为对接收到的文件样本进行动态分析，将分析得到的恶意网络信息输出给异常流量分析单元；
异常流量分析单元，设置为根据接收到的恶意网络信息优化自身的策略配置；检测到来自终端的异常流量后向所述终端防御单元发送通知消息。
可选地，所述动态分析单元还设置为：检测到网络中其它系统上报恶意网络行为，对上报的恶意网络行为进行动态分析，并将动态分析结果输出给所述终端防御单元，将分析得到的恶意网络信息输出给所述异常流量分析单元。
可选地，所述动态分析单元还设置为：将所述动态分析结果输出给终端防御单元；
所述终端防御单元还设置为：根据来自动态分析单元的动态分析结果获取恶意网络信息并输出给异常流量分析单元。
可选地，所述通知消息中携带有恶意网络信息。
可选地，所述恶意网络信息包括：恶意网站的域名、和/或IP地址、和/或端口号、和/或恶意进程信息。
可选地，所述异常流量分析单元、所述终端防御单元、所述动态分析单元之间通过管理中心查询交互对端的地址以发起信息交互；
或者，所述异常流量分析单元、所述终端防御单元、所述动态分析单元之间经由管理中心向对端转发交互的信息。
本发明还提供了一种APT检测装置，设置在终端；包括第一交互模块，第一处理模块；其中，
第一交互模块，设置为将可疑的文件样本输出给动态分析模块；
第一处理模块，设置为根据来自异常流量分析单元的通知消息对相关的恶意网络行为进行处理。
可选地，所述第一处理模块还设置为：根据来自动态分析单元的动态 分析结果获取恶意网络信息并输出给异常流量分析单元。
本发明又提供了一种APT检测装置，设置在服务器；包括第二交互模块，第二处理模块；其中，
第二处理模块，设置为对接收到的文件样本进行动态分析；
第二交互模块，设置为将分析得到的恶意网络信息输出给异常流量分析单元。
可选地，所述第二处理模块还设置为：检测到网络中其它系统上报恶意网络行为，对上报的恶意网络行为进行动态分析；
所述第二交互模块还设置为：将动态分析结果输出给终端防御单元，将分析得到的恶意网络信息输出给异常流量分析单元。
可选地，所述第二交互模块还设置为：将所述动态分析结果输出给终端防御单元。
本发明再提供了一种APT检测装置，设置在服务器；包括第三交互模块，第三处理模块；其中，
第三处理模块，设置为根据接收到的恶意网络信息优化自身的策略配置；
第三交互模块，设置为检测到来自终端的异常流量后向终端防御单元发送通知消息。
本发明还提供了一种高级持续性威胁APT检测方法，包括：
APT检测装置对可疑的文件样本进行动态分析，得到恶意网络信息；
APT检测装置根据分析得到的恶意网络信息优化用于异常流量分析的策略配置。
可选地，还包括：
所述APT检测装置检测到来自终端的异常流量，按照恶意网络信息对相关的恶意网络行为进行处理。
可选地，所述按照恶意网络信息对相关的恶意网络行为进行处理包括：中止恶意进程并删除终端上的恶意软件。
可选地，还包括：
所述APT检测装置检测到网络中其它系统上报恶意网络行为，对上报的恶意网络行为进行动态分析得到所述恶意网络信息。
可选地，所述恶意网络信息包括：恶意网站的域名、和/或IP地址、和/或端口号、和/或恶意进程信息。
与现有技术相比，本申请技术方案包括：APT检测装置对可疑的文件样本进行动态分析，得到恶意网络信息；根据分析得到的恶意网络信息优化设置为异常流量分析的策略配置。通过本发明提供的技术方案，使得异常流量分析功能快速提升了流量分析的精度，有助于提高APT检测的准确性和有效性。
可选地，APT检测装置检测到来自终端的异常流量，按照恶意网络信息对相关的恶意网络行为进行处理，以中止恶意进程并删除终端上的恶意软件，使得系统从源头阻断了恶意软件的运行，提高了检测精确度和防护能力，从而提高了APT检测的准确性和有效性。
根据本发明的又一个实施例，还提供了一种存储介质，所述存储介质包括存储的程序，其中，所述程序运行时执行上述任一项所述的方法。
根据本发明的又一个实施例，还提供了一种处理器，所述处理器用于运行程序，其中，所述程序运行时执行上述任一项所述的方法。
本发明的其它特征和优点将在随后的说明书中阐述，并且，部分地从说明书中变得显而易见，或者通过实施本发明而了解。本发明的目的和其他优点可通过在说明书、权利要求书以及附图中所特别指出的结构来实现和获得。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一 部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1为本发明APT检测装置的组成结构示意图；
图2为本发明APT检测方法的流程图；
图3为本发明APT检测方法的第一实施例的流程示意图；
图4为本发明APT检测方法的第二实施例的流程示意图；
图5为本发明APT检测方法的第三实施例的流程示意图；
图6为本发明APT检测方法的第四实施例的流程示意图；
图7为本发明APT检测方法的第五实施例的流程示意图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚明白，下文中将结合附图对本发明的实施例进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
图1为本发明APT检测系统的组成结构示意图，如图1所示，至少包括异常流量分析单元、终端防御单元、动态分析单元，其中，
终端防御单元，设置为将可疑的文件样本输出给动态分析单元；根据来自所述异常流量分析单元的通知消息对相关的恶意网络行为进行处理；
动态分析单元，设置为对接收到的文件样本进行动态分析，将分析得到的恶意网络信息输出给异常流量分析单元；
异常流量分析单元，设置为根据接收到的恶意网络信息优化自身的策略配置；检测到来自终端的异常流量后向所述终端防御单元发送通知消息。
可选地，
动态分析单元还设置为：检测到网络中其它系统如邮件服务器上报恶意网络行为(如上报恶意软件等)，对上报的恶意网络行为进行动态分析，并将动态分析结果输出给终端防御单元，将分析得到的恶意网络信息输出 给异常流量分析单元。
可选地，
动态分析单元还设置为：将所述动态分析结果输出给终端防御单元；
终端防御单元还设置为：根据来自动态分析单元的动态分析结果获取恶意网络信息并输出给异常流量分析单元。
可选地，通知消息中携带有恶意网络信息。
其中，恶意网络信息包括但不限于：恶意网站的域名、和/或IP地址、和/或端口号、和/或恶意进程信息等。
可选地，异常流量分析单元根据接收到的恶意网络信息优化自身的策略配置具体包括：将恶意网站的域名、和/或IP地址，和/或端口号、和/或恶意进程信息等信息添加到黑名单中。
可选地，终端防御单元对相关的恶意网络行为进行处理包括但不限于：中止恶意进程并删除终端上的恶意软件。
可选地，
异常流量分析单元、终端防御单元、动态分析单元之间可以通过统一的管理中心查询交互对端的地址以发起信息交互，或者，也可以经由管理中心向对端转发交互的信息。
通过本发明提供的APT检测装置，将文件动态行为分析功能、异常流量分析功能和终端防御功能组成一个整体，三者之间进行有效配合，从源头有效地阻止了恶意网络行为，提高了检测精确度和防护能力，从而提高了APT检测的准确性和有效性。
可选地，
终端防御单元还设置为：具备进程监控和文件扫描查杀等静态防御功能。
可选地，基于上述本发明三种APT检测装置，
异常流量分析单元还设置为：进行流量监控和流量分析，从中筛选出 异常流量并根据策略进行流量阻断。
可选地，
动态分析单元还设置为：对接收到的文件进行动态分析并得出分析结果。
本发明终端防御单元设置在终端，至少包括：第一交互模块，第一处理模块；其中，
第一交互模块，设置为将可疑的文件样本输出给动态分析模块；
第一处理模块，设置为根据来自异常流量分析单元的通知消息对相关的恶意网络行为进行处理。
可选地，第一处理模块还设置为：根据来自动态分析单元的动态分析结果获取恶意网络信息并输出给异常流量分析单元。
本发明动态分析单元设置在服务器，至少包括：第二交互模块，第二处理模块；其中，
第二处理模块，设置为对接收到的文件样本进行动态分析；
第二交互模块，设置为将分析得到的恶意网络信息输出给异常流量分析单元。
可选地，第二处理模块还设置为：检测到网络中其它系统上报恶意网络行为，对上报的恶意网络行为进行动态分析；
第二交互模块还设置为：将动态分析结果输出给终端防御单元，将分析得到的恶意网络信息输出给异常流量分析单元。
可选地，第二交互模块还设置为：将所述动态分析结果输出给终端防御单元。
本发明异常流量分析单元设置在服务器，至少包括：第三交互模块，第三处理模块；其中，
第三处理模块，设置为根据接收到的恶意网络信息优化自身的策略配置；
第三交互模块，设置为检测到来自终端的异常流量后向终端防御单元发送通知消息。
需要说明的是，动态分析单元所在服务器与异常流量分析单元所在服务器可以是同一台服务器，也可以是不同的服务器。
图2为本发明APT检测方法的流程图，如图2所示，包括：
步骤200：APT检测装置对可疑的文件样本进行动态分析，得到恶意网络信息。
本步骤中的恶意网络信息是从动态分析后得到的动态分析结果中获取的。
步骤201：APT检测装置根据分析得到的恶意网络信息优化用于异常流量分析的策略配置。
本步骤具体包括：将恶意网络信息中的恶意网站的域名、和/或IP地址，和/或端口号、和/或恶意进程信息等信息添加到黑名单中。
本发明方法还包括：
步骤203：APT检测装置检测到来自终端的异常流量，按照恶意网络信息对相关的恶意网络行为进行处理。
其中，按照恶意网络信息对相关的恶意网络行为进行处理包括但不限于：中止恶意进程并删除终端上的恶意软件。
本发明方法还包括：
APT检测装置检测到网络中其它系统如邮件服务器上报恶意网络行为(如上报恶意软件等)，对上报的恶意网络行为进行动态分析得到恶意网络信息。
可选地，恶意网络信息包括但不限于：恶意网站的域名、和/或IP地址、和/或端口号、和/或恶意进程信息等。
通过本发明提供的APT检测方法，将文件动态行为分析功能、异常流量分析功能和终端防御功能组成一个整体，三者之间进行有效配合，从 源头有效地阻止了恶意网络行为，提高了检测精确度和防护能力，从而提高了APT检测的准确性和有效性。
可选地，本发明方法还包括：
APT检测装置进行进程监控和文件扫描查杀等静态防御功能。
可选地，本发明方法还包括：
APT检测装置进行流量监控和流量分析，从中筛选出异常流量并根据策略进行流量阻断。
可选地，本发明方法还包括：
APT检测装置对接收到的文件进行动态分析并得出分析结果。
本发明还提供了一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行本发明任一项的APT检测方法。
下面结合图1所示的本发明APT检测装置对本发明APT检测方法的具体实现进行详细描述。
图3为本发明APT检测方法的第一实施例的流程示意图，第一实施例的场景为：终端打开一个存在网络行为的恶意样本后，通过本发明APT检测系统的联动来实现对恶意样本的检测、清除和对异常流量分析精度的改进。在第一实施例中，由动态分析单元对样本进行动态分析，并向终端防御单元通知分析结果，终端防御单元收到分析结果后根据策略对恶意样本进行处理，并将恶意网络信息上报给异常流量分析单元，异常流量分析单元据此优化策略配置，以提高分析精度。如图3所示，具体实现包括：
步骤300：终端防御单元在检测到本地文件被打开或者运行之后，将被打开或者运行的文件上传给动态分析功能单元进行分析。
本步骤中，文件上传的方式可以是根据配置由终端防御单元自动上传；也可以是终端防御单元提示用户进行手动上传。
步骤301：动态分析单元收到样本文件后，将样本文件保存在本地，并进行动态分析。
可选地，分析的方法一般可以采用沙箱检测的方式，在虚拟机中运行接收到的样本文件以获取运行结果，并根据预先设定的规则从运行结果中筛选出恶意网络行为，相关恶意网络信息如恶意网站域名、IP地址、端口号等即被记录下来。
步骤302：动态分析单元向终端防御单元返回样本动态分析结果。
在动态分析结果中可以携带：样本是否为恶意样本、文件特征(如文件名称、大小、MD5值等)、访问的恶意网站的域名、IP地址、端口号等恶意网络信息。
可选地，动态分析单元查找终端的方法可以通过统一的管理中心实现，比如：终端用户事先向管理中心发送消息告知自身的IP地址和端口号，管理中心保存这些信息，这样，后续动态分析单元或异常流量分析单元便可以通过向管理中心查询来获取目标终端的IP地址和端口号，从而实现和终端之间的消息交互。
步骤303：终端防御单元收到动态分析单元返回的动态分析结果后，从动态分析结果中提取文件特征、恶意网站等相关信息并保存；终端防御单元根据本地配置策略对恶意样本和相关进程进行处理，比如可根据策略终止恶意进程并删除相关恶意文件等。
步骤304：终端防御单元将恶意网络信息如恶意网站的域名、IP地址、端口号等信息上报给异常流量分析单元。
步骤305：异常流量分析单元接收到终端防御功能单元上报的恶意网络信息后，将恶意网络信息用于策略优化，比如：将恶意网站的域名、IP地址、端口号等添加到黑名单中，这样，后续来自或发送到这个网站的流量都可以直接被异常流量分析单元判断为恶意流量，从而达到优化流量分析精度的目的。
图4为本发明APT检测方法的第二实施例的流程示意图，第二实施例与图2所示的场景相同，不同之处在于：第二实施例中，由动态分析单元直接将恶意网络信息发送给异常流量分析单元。如图3所示，具体实现 包括：
步骤400～步骤403：具体实现与步骤300～步骤303完全一致，这里不再赘述。
步骤404：动态分析单元检测到样本文件存在恶意网络行为后，向异常流量分析单元上报恶意网络信息，恶意网络信息包含但不限于：恶意网站的域名、IP地址、端口号等信息。
本步骤中，动态分析单元查找异常流量分析单元的方法可以通过统一的管理中心实现。管理中心保存有所有动态分析单元和异常流量分析的配置信息，动态分析单元或异常流量分析单元可以通过向管理中心查询来获取对方的IP地址和端口号，从而实现两者之间的消息交互。
步骤405：异常流量分析单元接收到动态分析单元的上报的恶意网络信息后，将恶意网络信息用于策略优化，比如：将恶意网站的域名、IP地址、端口号等添加到黑名单中，这样，后续来自或发送到这个网站的流量都可以直接被异常流量分析单元判断为恶意流量，从而达到优化流量分析精度的目的。
图5为本发明APT检测方法的第三实施例的流程示意图，第三实施例的场景为：动态分析单元检测到网络中其他系统如邮件系统上报的恶意软件后的处理流程。在第三实施例中，动态分析单元对邮件系统上传的样本进行动态分析，并向邮件系统返回分析结果，同时将恶意文件特征通知给相关用户的终端防御单元，并将恶意网络信息上报给异常流量分析单元，异常流量分析单元据此优化策略配置，以提高分析精度。如图5所示，具体实现包括：
步骤500：邮件系统将样本上传给动态分析功能单元。
可选地，邮件系统为和APT检测装置部署在同一内网的邮件服务器中。
本步骤中，邮件系统将样本上传给动态分析单元可以采取的方式包括：邮件系统收到邮件后，对于携带附件的邮件，将携带的附件从邮件中提取 出来并通过消息发送给动态分析单元分析，在该消息中还携带有邮件收件人的邮箱地址或收件人的身份信息等。
步骤501：动态分析单元收到样本后，将样本和收件人信息保存在本地，并进行动态分析。
本步骤中，动态分析的方法一般可以采用沙箱检测的方式，在虚拟机中运行接收到的样本以获取运行结果，并根据预先设定的规则从运行结果中筛选出恶意网络行为，相关恶意网络信息如恶意网站域名、IP地址、端口号等即被记录下来。
步骤502：动态分析单元向终端防御单元返回样本动态分析结果。
可选地，动态分析结果中可以携带样本是否为恶意样本、文件特征(如文件名称、大小、MD5值等)等信息。
步骤503：动态分析单元查找到样本所属收件人当前的终端防御单元的IP地址和端口号，向改终端防御单元发送消息，在该消息中携带有恶意文件信息，比如：文件特征(如文件名称、大小、MD5值等)、访问的恶意网站的域名、IP地址、端口号等。
可选地，动态分析单元查找样本所属收件人当前的终端防御单元的方式可以通过统一的管理中心实现。
管理中心中除了保存有所有动态分析单元、异常流量分析的配置信息之外，还保存有用户的终端防御单元的网络地址，用户的终端防御单元向管理中心上报自身的网络地址可以采用用户登录终端防御单元时由终端防御单元向管理中心上报，上报消息中携带有用户标识，管理中心保存用户标识及其终端防御单元的网络信息；管理中心还可以保存该用户的邮件地址。动态分析单元通过向管理中心发送查询消息，在查询消息中携带有从邮件系统中获取到的用户邮件地址或者用户标识。这样，管理中心便可以根据用户标识或者用户邮件地址查询到该用户当前的终端防御单元的网络地址，并将其返回给动态分析单元。
类似地，步骤500中邮件系统也可以通过向管理中心查询的方式获取 到动态分析单元地址并向其上报样本。
步骤504：动态分析功能单元检测到样本存在恶意网络行为后，向异常流量分析单元上报恶意网络信息，恶意网络信息包含但不限于：恶意网站的域名、IP地址、端口号等信息。
步骤505：异常流量分析单元接收到动态分析单元的上报的恶意网络信息后，将恶意网络信息用于策略优化，比如：将恶意网站的域名、IP地址、端口号等添加到黑名单中，这样，后续来自或发送到这个网站的流量都可以直接被异常流量分析单元判断为恶意流量，从而达到优化流量分析精度的目的。
图6为本发明APT检测方法的第四实施例的流程示意图，第四实施例的场景为：异常流量分析单元检测到异常流量后，通知相关的终端防御单元对恶意软件进行处理。如图6所示，具体实现包括：
步骤600：终端上运行的恶意软件连接到外网，向恶意网站发送或接收消息。
步骤601：异常流量分析单元捕获到终端上发送或接收到的流量并进行异常流量分析；检测到异常流量后，根据策略进行流量阻断。
通过异常流量分析，异常流量分析单元可以获取到恶意流量的网络信息，如恶意网站的域名、IP地址、端口号等。
步骤602：异常流量分析单元向终端防御单元发送消息，以通知终端清除恶意软件。
本步骤发送的消息中携带有恶意网络信息，其中，恶意网络信息包含但不限于：恶意进程信息、恶意网站的域名、IP地址、端口号等。
步骤603～步骤604：终端防御单元收到通知后，根据策略配置对相关恶意样本及相关恶意软件进行处理，比如：可以终止相关恶意进程、删除相关恶意样本或向用户弹出告警等，之后，终端防御单元向异常流量分析单元返回确认消息。
第四实施例通过异常流量分析单元检测到异常流量后通知终端防御单元清除恶意软件的方式，使得系统从源头终止了恶意进程的运行并清除了恶意软件。
图7为本发明APT检测方法的第五实施例的流程示意图，第五实施例的场景与第一实施例的场景相同，不同之处在于：第五实施例中，各单元之间的消息交互通过统一的管理中心进行转发。如图7所示，具体实现包括：
步骤700～步骤701：终端防御单元在检测到本地文件被打开或者运行之后，将文件上传给管理中心，管理中心保存终端防御单元的标识(ID)或网络地址，并通过策略选择一个动态分析单元，将被打开或者运行的文件转发给该动态分析单元进行分析。
本步骤中，管理中心如何根据策略选择一个动态分析单元的具体实现属于本领域技术人员的公知技术，其具体实现并不用于限定本发明的保护范围，这里不再赘述。
步骤702：动态分析单元收到样本文件后，将样本文件保存在本地，并进行动态分析。
可选地，分析的方法一般可以采用沙箱检测的方式，在虚拟机中运行接收到的样本文件以获取运行结果，并根据预先设定的规则从运行结果中筛选出恶意网络行为，相关恶意网络信息如恶意网站域名、IP地址、端口号等即被记录下来。
步骤703～步骤704：动态分析单元向管理中心返回样本动态分析结果，管理中心通过查询之前保存的信息获取终端防御单元网络地址，并将动态分析结果发送给该终端防御功能单元。
在动态分析结果中可以携带：样本是否为恶意样本、文件特征(如文件名称、大小、MD5值等)、访问的恶意网站的域名、IP地址、端口号等恶意网络信息。管理中心保存所述样本文件的恶意网络信息。
步骤705：终端防御单元收到动态分析单元返回的动态分析结果后， 从动态分析结果中提取文件特征、恶意网站等相关信息并保存；终端防御单元根据本地配置策略对恶意样本和相关进程进行处理，比如可根据策略终止恶意进程并删除相关恶意文件等。
步骤706：管理中心将恶意网络信息如恶意网站的域名、IP地址、端口号等信息上报给异常流量分析单元。
步骤707：异常流量分析单元接收到终端防御功能单元上报的恶意网络信息后，将恶意网络信息用于策略优化，比如：将恶意网站的域名、IP地址、端口号等添加到黑名单中，这样，后续来自或发送到这个网站的流量都可以直接被异常流量分析单元判断为恶意流量，从而达到优化流量分析精度的目的。
从上述流程中可以看出，采取本发明提供的技术方案，将文件动态行为分析功能、异常流量分析功能和终端防御功能组成一个整体，三者之间进行有效配合，动态分析功能和/或终端防御功能将恶意网络信息上报给异常流量分析功能，使得异常流量分析功能快速提升了流量分析的精度；异常流量分析功能和/或动态分析功能检测到恶意行为后通知终端防御功能中止恶意进程并删除终端上的恶意软件，使得系统从源头阻断了恶意软件的运行，提高了检测精确度和防护能力，从而提高了APT检测的准确性和有效性。
本发明的实施例还提供了一种存储介质，该存储介质包括存储的程序，其中，上述程序运行时执行上述任一项所述的方法。
可选地，在本实施例中，上述存储介质可以包括但不限于：U盘、只读存储器(Read-Only Memory，简称为ROM)、随机存取存储器(Random Access Memory，简称为RAM)、移动硬盘、磁碟或者光盘等各种可以存储程序代码的介质。
本发明的实施例还提供了一种处理器，该处理器用于运行程序，其中，该程序运行时执行上述任一项方法中的步骤。
以上所述，仅为本发明的较佳实例而已，并非用于限定本发明的保护 范围。凡在本发明的精神和原则之内，所做的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
如上所述，本发明实施例提供的一APT检测方法、系统及装置具有以下有益效果：将文件动态行为分析功能、异常流量分析功能和终端防御功能组成一个整体，三者之间进行有效配合，从源头有效地阻止了恶意网络行为，提高了检测精确度和防护能力，从而提高了APT检测的准确性和有效性。

Claims (18)

  1. 一种高级持续性威胁APT检测系统，包括：异常流量分析单元、终端防御单元、动态分析单元，其中，
    终端防御单元，设置为将可疑的文件样本输出给动态分析单元；根据来自所述异常流量分析单元的通知消息对相关的恶意网络行为进行处理；
    动态分析单元，设置为对接收到的文件样本进行动态分析，将分析得到的恶意网络信息输出给异常流量分析单元；
    异常流量分析单元，设置为根据接收到的恶意网络信息优化自身的策略配置；检测到来自终端的异常流量后向所述终端防御单元发送通知消息。
  2. 根据权利要求1所述的APT检测系统，其中，
    所述动态分析单元还设置为：检测到网络中其它系统上报恶意网络行为，对上报的恶意网络行为进行动态分析，并将动态分析结果输出给所述终端防御单元，将分析得到的恶意网络信息输出给所述异常流量分析单元。
  3. 根据权利要求1所述的APT检测系统，其中，所述动态分析单元还设置为：将所述动态分析结果输出给终端防御单元；
    所述终端防御单元还设置为：根据来自动态分析单元的动态分析结果获取恶意网络信息并输出给异常流量分析单元。
  4. 根据权利要求1～3任一项所述的APT检测系统，其中，所述通知消息中携带有恶意网络信息。
  5. 根据权利要求4所述的APT检测系统，其中，所述恶意网络 信息包括：恶意网站的域名、和/或IP地址、和/或端口号、和/或恶意进程信息。
  6. 根据权利要求1～3任一项所述的APT检测系统，其中，
    所述异常流量分析单元、所述终端防御单元、所述动态分析单元之间通过管理中心查询交互对端的地址以发起信息交互；
    或者，所述异常流量分析单元、所述终端防御单元、所述动态分析单元之间经由管理中心向对端转发交互的信息。
  7. 一种APT检测装置，设置在终端；包括第一交互模块，第一处理模块；其中，
    第一交互模块，设置为将可疑的文件样本输出给动态分析模块；
    第一处理模块，设置为根据来自异常流量分析单元的通知消息对相关的恶意网络行为进行处理。
  8. 根据权利要求7所述的APT检测装置，其中，所述第一处理模块还设置为：根据来自动态分析单元的动态分析结果获取恶意网络信息并输出给异常流量分析单元。
  9. 一种APT检测装置，设置在服务器；包括第二交互模块，第二处理模块；其中，
    第二处理模块，设置为对接收到的文件样本进行动态分析；
    第二交互模块，设置为将分析得到的恶意网络信息输出给异常流量分析单元。
  10. 根据权利要求9所述的APT检测装置，其中，所述第二处理模块还设置为：检测到网络中其它系统上报恶意网络行为，对上报 的恶意网络行为进行动态分析；
    所述第二交互模块还设置为：将动态分析结果输出给终端防御单元，将分析得到的恶意网络信息输出给异常流量分析单元。
  11. 根据权利要求9所述的APT检测装置，其中，所述第二交互模块还设置为：将所述动态分析结果输出给终端防御单元。
  12. 一种APT检测装置，设置在服务器；包括第三交互模块，第三处理模块；其中，
    第三处理模块，设置为根据接收到的恶意网络信息优化自身的策略配置；
    第三交互模块，设置为检测到来自终端的异常流量后向终端防御单元发送通知消息。
  13. 一种高级持续性威胁APT检测方法，包括：
    APT检测装置对可疑的文件样本进行动态分析，得到恶意网络信息；
    APT检测装置根据分析得到的恶意网络信息优化设置为异常流量分析的策略配置。
  14. 根据权利要求13所述的APT检测方法，其中，还包括：
    所述APT检测装置检测到来自终端的异常流量，按照恶意网络信息对相关的恶意网络行为进行处理。
  15. 根据权利要求14所述的APT检测方法，其中，所述按照恶意网络信息对相关的恶意网络行为进行处理包括：中止恶意进程并删除终端上的恶意软件。
  16. 根据权利要求13所述的APT检测方法，其中，还包括：
    所述APT检测装置检测到网络中其它系统上报恶意网络行为，对上报的恶意网络行为进行动态分析得到所述恶意网络信息。
  17. 根据权利要求13～16任一项所述的APT检测方法，其中，所述恶意网络信息包括：恶意网站的域名、和/或IP地址、和/或端口号、和/或恶意进程信息。
  18. 一种存储介质，所述存储介质包括存储的程序，其中，所述程序运行时执行权利要求13至17中任一项所述的方法。
PCT/CN2017/107406 2016-12-01 2017-10-24 一种apt检测方法、系统及装置 WO2018099206A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611091570.1 2016-12-01
CN201611091570.1A CN108134761B (zh) 2016-12-01 2016-12-01 一种apt检测系统及装置

Publications (1)

Publication Number Publication Date
WO2018099206A1 true WO2018099206A1 (zh) 2018-06-07

Family

ID=62241365

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/107406 WO2018099206A1 (zh) 2016-12-01 2017-10-24 一种apt检测方法、系统及装置

Country Status (2)

Country Link
CN (1) CN108134761B (zh)
WO (1) WO2018099206A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110958129A (zh) * 2018-09-26 2020-04-03 北京国双科技有限公司 流量分析的方法、系统和装置
CN111277585A (zh) * 2020-01-16 2020-06-12 深信服科技股份有限公司 威胁处理方法、装置、设备和可读存储介质
WO2020190394A1 (en) * 2019-03-21 2020-09-24 Microsoft Technology Licensing, Llc Cloud view detection of virtual machine brute force attacks
CN113079151A (zh) * 2021-03-26 2021-07-06 深信服科技股份有限公司 一种异常处理方法、装置、电子设备及可读存储介质
CN113364799A (zh) * 2021-06-22 2021-09-07 北京安天网络安全技术有限公司 一种网络威胁行为的处理方法和系统

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109726043A (zh) * 2018-09-07 2019-05-07 网联清算有限公司 应用服务控制方法及装置
CN109409089B (zh) * 2018-09-28 2021-11-23 西安电子科技大学 一种基于虚拟机自省的Windows加密型勒索软件检测方法
CN114301689B (zh) * 2021-12-29 2024-02-23 北京安天网络安全技术有限公司 校园网络安全防护方法、装置、计算设备及存储介质
CN115051833B (zh) * 2022-05-12 2023-12-15 中国电子科技集团公司电子科学研究院 一种基于终端进程的互通网络异常检测方法
CN115242436B (zh) * 2022-06-14 2023-12-01 徐州恒佳电子科技有限公司 一种基于命令行特征的恶意流量检测方法及系统

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104283889A (zh) * 2014-10-20 2015-01-14 国网重庆市电力公司电力科学研究院 基于网络架构的电力系统内部apt攻击检测及预警系统
CN106034056A (zh) * 2015-03-18 2016-10-19 北京启明星辰信息安全技术有限公司 一种业务安全分析的方法和系统

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102457495A (zh) * 2010-10-21 2012-05-16 中华电信股份有限公司 网络病毒防护方法及系统
US9954871B2 (en) * 2015-05-06 2018-04-24 Hand Held Products, Inc. Method and system to protect software-based network-connected devices from advanced persistent threat
CN105376245B (zh) * 2015-11-27 2018-10-30 杭州安恒信息技术有限公司 一种基于规则的apt攻击行为的检测方法

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104283889A (zh) * 2014-10-20 2015-01-14 国网重庆市电力公司电力科学研究院 基于网络架构的电力系统内部apt攻击检测及预警系统
CN106034056A (zh) * 2015-03-18 2016-10-19 北京启明星辰信息安全技术有限公司 一种业务安全分析的方法和系统

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110958129A (zh) * 2018-09-26 2020-04-03 北京国双科技有限公司 流量分析的方法、系统和装置
WO2020190394A1 (en) * 2019-03-21 2020-09-24 Microsoft Technology Licensing, Llc Cloud view detection of virtual machine brute force attacks
US11159542B2 (en) 2019-03-21 2021-10-26 Microsoft Technology Licensing, Llc Cloud view detection of virtual machine brute force attacks
CN111277585A (zh) * 2020-01-16 2020-06-12 深信服科技股份有限公司 威胁处理方法、装置、设备和可读存储介质
CN113079151A (zh) * 2021-03-26 2021-07-06 深信服科技股份有限公司 一种异常处理方法、装置、电子设备及可读存储介质
CN113079151B (zh) * 2021-03-26 2023-05-16 深信服科技股份有限公司 一种异常处理方法、装置、电子设备及可读存储介质
CN113364799A (zh) * 2021-06-22 2021-09-07 北京安天网络安全技术有限公司 一种网络威胁行为的处理方法和系统
CN113364799B (zh) * 2021-06-22 2022-10-28 北京安天网络安全技术有限公司 一种网络威胁行为的处理方法和系统

Also Published As

Publication number Publication date
CN108134761A (zh) 2018-06-08
CN108134761B (zh) 2021-05-04

Similar Documents

Publication Publication Date Title
WO2018099206A1 (zh) 一种apt检测方法、系统及装置
US11936666B1 (en) Risk analyzer for ascertaining a risk of harm to a network and generating alerts regarding the ascertained risk
JP6894003B2 (ja) Ａｐｔ攻撃に対する防御
US9762543B2 (en) Using DNS communications to filter domain names
US11562068B2 (en) Performing threat detection by synergistically combining results of static file analysis and behavior analysis
US10084816B2 (en) Protocol based detection of suspicious network traffic
US9288220B2 (en) Methods and systems for malware detection
US10726125B2 (en) Malware detection using clustering with malware source information
US9602525B2 (en) Classification of malware generated domain names
CN107888607A (zh) 一种网络威胁检测方法、装置及网络管理设备
US20180063146A1 (en) Black list generating device, black list generating system, method of generating black list, and program of generating black list
Zimba Malware-free intrusion: a novel approach to ransomware infection vectors
CN105592017B (zh) 跨站脚本攻击的防御方法及系统
Kaur et al. Automatic attack signature generation systems: A review
TWI407328B (zh) 網路病毒防護方法及系統
US11909761B2 (en) Mitigating malware impact by utilizing sandbox insights
US11924235B2 (en) Leveraging user-behavior analytics for improved security event classification
WO2015167523A1 (en) Packet logging
US11636208B2 (en) Generating models for performing inline malware detection
US10142360B2 (en) System and method for iteratively updating network attack mitigation countermeasures
Zhao et al. Network security model based on active defense and passive defense hybrid strategy
Sharma et al. Intrusion detection system using shadow honeypot
US20230082289A1 (en) Automated fuzzy hash based signature collecting system for malware detection
Cusack et al. Listening to botnet communication channels to protect information systems
O'Brien Assessing the importance of modern security tools and frameworks to help detect and defend against Cozy bear

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17875847

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17875847

Country of ref document: EP

Kind code of ref document: A1