WO2021217449A1 - 恶意入侵检测方法、装置、系统、计算设备、介质和程序 - Google Patents

恶意入侵检测方法、装置、系统、计算设备、介质和程序 Download PDF

Info

Publication number
WO2021217449A1
WO2021217449A1 PCT/CN2020/087580 CN2020087580W WO2021217449A1 WO 2021217449 A1 WO2021217449 A1 WO 2021217449A1 CN 2020087580 W CN2020087580 W CN 2020087580W WO 2021217449 A1 WO2021217449 A1 WO 2021217449A1
Authority
WO
WIPO (PCT)
Prior art keywords
target device
folder
visitor
honey
malicious
Prior art date
Application number
PCT/CN2020/087580
Other languages
English (en)
French (fr)
Inventor
李锐
Original Assignee
西门子股份公司
西门子（中国）有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 西门子股份公司, 西门子（中国）有限公司 filed Critical 西门子股份公司
Priority to CN202080099370.9A priority Critical patent/CN115398430A/zh
Priority to PCT/CN2020/087580 priority patent/WO2021217449A1/zh
Priority to EP20933436.6A priority patent/EP4123488A4/en
Publication of WO2021217449A1 publication Critical patent/WO2021217449A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action

Definitions

  • the present disclosure generally relates to the technical field of computer network security, and more specifically, to malicious intrusion detection methods, devices, computing devices, media, and computer programs.
  • Network security is becoming more and more important in our daily life.
  • Some network security solutions such as firewalls, anti-virus software, and intrusion detection systems, to prevent host devices from being attacked.
  • these solutions can only detect or prevent a subset of known attacks.
  • Honeypot systems are designed to collect information from attackers by simulating vulnerable systems.
  • the honeypot system provides a compelling system to record and analyze the activities of attackers. This can help us understand the attacker's attack methods and behavior, and even discover unknown weaknesses.
  • honeypot systems that can monitor and analyze attacks. Some of them use real computers and systems to build honeypots; some use software to simulate real systems. Generally, honeypots built with real systems have high interactivity and high cost, while pure software honeypots have low interactivity and low cost. The main goals of most of these honeypot systems are hacker attacks and information collection, and they cannot help us in the daily use systems, such as the existing honeypot systems Capture-HPC, HoneyMonkey, SpyProxy, PhoneyC, etc.
  • Patent Document 1 and Patent Document 2 listed below are all honeypot systems that use a predefined mixture of physical honeypots and virtual honeypots. However, it only focuses on how to distribute business, and such a honeypot system is not used for daily work systems.
  • Antivirus software can be included in the daily use system. Antivirus software can protect the system from virus threats to some extent, but malicious users will still enter the system without being notified.
  • Patent Document 1 CN 200610169676.9, “Multi-level Honeynet Data Transmission Method and System”;
  • Patent Document 2 CN 200910136094.4, "A method of simulating loopholes and overloading honeypots".
  • the present disclosure proposes a method of making minimal changes to the target device, and detecting malicious intrusion behaviors by setting a honey folder in the target device.
  • the malicious intrusion detection method according to the present disclosure is a low-cost method, which can be deployed on a device with limited resources and does not occupy excessive CPU and memory resources of the device.
  • the malicious intrusion detection method and device of the present disclosure when the owner of the target device leaves the device without locking the device, it is possible to detect whether someone is trying to maliciously invade the target device, and unknown malicious attacks can be detected.
  • a malicious intrusion detection method which includes: setting at least one honey folder in a target device, the secret folder is attractive to an attacker, and the secret folder does not include useful information for the user.
  • the file monitor whether there are visitors to visit the honey folder; and according to whether there are visitors to visit the honey folder, determine whether the target device is maliciously invaded.
  • determining whether the target device has been maliciously invaded includes: in the case of detecting that a visitor accesses the honey folder, making the target device enter a session mode, and requesting all The visitor answers at least one decision question; and according to the visitor's answer, it is determined whether the target device is maliciously invaded by the visitor.
  • question interaction in conversation mode the false alarm rate of intrusion detection can be reduced.
  • determining whether the visitor is a malicious intrusion according to the visitor's answer includes: using a decision tree method to determine whether the target device is maliciously invaded by the visitor. Invasion. Using the decision tree method, query strategies can be set systematically and purposefully to further reduce the false alarm rate of intrusion detection.
  • the decision problem is set to imitate the problem encountered by the user in the actual operating system, and can distinguish between malicious users and normal users. This can effectively prevent the attacker from discovering that the secret folder is not a folder used by the user, but is used to detect attacks.
  • a malicious intrusion detection device including: a honey folder setting unit configured to set at least one honey folder in a target device, the secret folder being attractive to an attacker, and The secret folder does not include files useful to the user; the monitoring unit is configured to monitor whether a visitor accesses the honey folder; and the judging unit is configured to monitor whether a visitor accesses the honey folder To determine whether the target device is maliciously invaded.
  • the judging unit is further configured to: in a case where it is detected that a visitor is accessing the honey folder, make the target device enter the session mode, and request the access Answering at least one decision question; and determining whether the target device is maliciously invaded by the visitor according to the answer of the visitor.
  • the judgment unit is further configured to use a decision tree method to determine whether the target device is maliciously invaded by the visitor.
  • the decision problem is set to imitate the problem encountered by the user in the actual operating system, and can distinguish between malicious users and normal users.
  • a malicious intrusion detection system including at least one target device and a monitoring device, wherein the malicious intrusion detection device according to the above is installed on the target device; The at least one target device is monitored, and when the malicious intrusion detection apparatus determines that the target device is maliciously invaded, the monitoring device sends an alarm to the target device.
  • the monitoring device further includes a database in which decision-making problems are stored, and the decision-making problems are set to imitate the problems encountered by the user in the actual operating system, and can distinguish Malicious users and normal users.
  • a computing device including: at least one processor; and a memory coupled with the at least one processor, the memory is used to store instructions, when the instructions are When the processor executes, the processor is caused to execute the method as described above.
  • a non-transitory machine-readable storage medium that stores executable instructions that, when executed, cause the machine to execute the method as described above.
  • a computer program including computer-executable instructions that, when executed, cause at least one processor to perform the method as described above.
  • a computer program product that is tangibly stored on a computer-readable medium and includes computer-executable instructions that, when executed, cause at least A processor executes the method described above.
  • the malicious intrusion detection method according to the present disclosure is a low-cost method, which can be deployed on a device with limited resources and does not occupy excessive CPU and memory resources of the device. According to the malicious intrusion detection method and device of the present disclosure, when the owner of the target device leaves the device without locking the device, it is possible to detect whether someone is trying to maliciously invade the target device, and unknown malicious attacks can be detected.
  • the method according to the present disclosure can be used to protect devices that are used daily and bring minimal risks to the target device.
  • the target device can be a personal computer or any network communication device.
  • the method according to the present disclosure is particularly suitable for scenarios where you want to protect data, but do not want to install too much software in the system to increase the load of system resources.
  • Fig. 1 is a flowchart showing an exemplary process of a malicious behavior detection method according to an embodiment of the present invention
  • FIG. 2 is a flowchart showing an exemplary process of step S106 in FIG. 1;
  • FIG. 3 is a flowchart showing an exemplary process of using a decision tree method to determine whether a target device is maliciously invaded according to another embodiment of the present invention
  • FIG. 4 is a block diagram showing an exemplary configuration of a malicious intrusion detection device according to another embodiment of the present disclosure
  • Fig. 5 shows a schematic block diagram of a malicious intrusion detection system according to an embodiment of the present disclosure.
  • Fig. 6 shows a block diagram of a computing device implementing a malicious intrusion detection method according to an embodiment of the present disclosure.
  • 602 Processor 604: Memory
  • the term “including” and its variations mean open terms, meaning “including but not limited to”.
  • the term “based on” means “based at least in part on.”
  • the terms “one embodiment” and “an embodiment” mean “at least one embodiment.”
  • the term “another embodiment” means “at least one other embodiment.”
  • the terms “first”, “second”, etc. may refer to different or the same objects. Other definitions can be included below, whether explicit or implicit. Unless clearly indicated in the context, the definition of a term is consistent throughout the specification.
  • the present disclosure proposes a method of making minimal changes to the target device, and detects malicious intrusion behavior by setting a honey folder in the target device.
  • Fig. 1 shows a flowchart of an exemplary process of a malicious behavior detection method 100 according to an embodiment of the present invention.
  • step S102 is first performed to set at least one honey folder in the target device.
  • the honey folder is a file that is attractive to attackers.
  • the secret folder can contain attractive resources, and the user will not access the secret folder during normal use.
  • the honey folder does not include data used by the user or resources useful to the user such as project files. Therefore, visitors who enter this folder may be malicious.
  • the honey folder there are files that look like source code, password files, private pictures, private keys, database files, etc., which are attractive to attackers, but are not actually used by users. They are called “secret files”. document”.
  • the target device may be any network communication product or component that may be maliciously attacked, such as a personal computer or a server.
  • step S104 it is monitored whether any visitor accesses the honey folder.
  • the specific monitoring method used is not limited, and those skilled in the art can use common methods in the prior art to monitor whether a visitor accesses the honey folder.
  • the monitoring program only monitors the honey folder, which, compared to general monitoring program solutions, such as anti-virus software, consumes very few resources on the target device.
  • step S106 it is determined whether the target device is maliciously invaded according to whether a visitor has accessed the honey folder.
  • the honey folder is a folder of a non-existent user or a folder of a non-existent project. Normal users will not enter this folder. Therefore, in an example, if a visitor accesses the honey folder, It can be determined that the target device has received a malicious intrusion.
  • Fig. 2 shows a flowchart of an exemplary process of step S106 in Fig. 1.
  • sub-step S1062 when it is detected that a visitor accesses the honey folder, the target device is entered into a conversation mode, and the visitor is required to answer at least one decision question.
  • the monitoring program will make the target device enter a special interactive mode.
  • a special interactive mode For example, in the Linux system, there are some special shell command lines that require the visitor to answer some decision-making questions; if it is a Windows system, a dialog box can pop up to ask the visitor a question.
  • the decision-making problem adopted is similar to placing the visitor at a crossroads, where malicious users and normal users will choose different paths.
  • the answers to these decision-making questions are usually "yes” or "no”.
  • sub-step S1064 it is determined whether the target device is maliciously invaded by the visitor according to the answer of the visitor.
  • a decision tree method as shown in FIG. 3 can be used to determine whether the target device is maliciously invaded by the visitor.
  • step S301 it is detected that a visitor accesses the honey folder.
  • step S302 the target device enters the conversation mode, and the visitor is required to answer the decision question.
  • a malicious value indicating the degree of maliciousness of the visitor can be set.
  • step S303 is performed to increase the malicious value
  • step S304 is performed to decrease the malicious value.
  • step S305 is performed to determine whether the malicious value is greater than the predetermined threshold.
  • step S306 is executed to send an alarm to the target device to determine that the visitor is a malicious intrusion
  • step S308 is executed to end the judgment.
  • step S307 it is determined whether the malicious value is less than 0. If the malicious value is not less than 0, return to step S302 and ask the visitor to answer the next decision question. If the malicious value is less than 0 or When the visitor exits the folder, it is determined that the visitor is not a malicious intrusion, and step S308 is executed to end the judgment.
  • FIG. 3 illustrates an exemplary process of determining whether the target device is maliciously invaded in the method according to the present disclosure. Those skilled in the art can understand that the method of determining whether the target device is maliciously invaded is not limited to this specific process.
  • FIG. 4 is a block diagram showing an exemplary configuration of a malicious intrusion detection apparatus 400 according to another embodiment of the present disclosure.
  • the malicious intrusion detection device 400 includes a honey folder setting unit 402, a monitoring unit 404, and a judgment unit 406.
  • the honey folder setting unit 402 is configured to set at least one honey folder in the target device, the secret folder is attractive to an attacker, and the secret folder does not include files useful to the user.
  • the monitoring unit 404 is configured to monitor whether a visitor accesses the honey folder.
  • the determining unit 406 is configured to determine whether the target device is maliciously invaded according to whether a visitor has accessed the honey folder.
  • the judgment unit 406 is further configured to: in the case of detecting that a visitor accesses the honey folder, make the target device enter the conversation mode, and require the visitor to answer at least one decision-making question; The answer of the visitor is used to determine whether the target device is maliciously invaded by the visitor.
  • the judgment unit 406 is further configured to use a decision tree method to determine whether the target device is maliciously invaded by the visitor.
  • the decision problem is set to imitate the problem encountered by the user in the actual operating system, and can distinguish between malicious users and normal users.
  • each part of the malicious intrusion detection device 400 shown in FIG. 4 may be the same or similar to the relevant parts of the embodiment of the malicious intrusion detection method 100 of the present disclosure described with reference to FIGS. 1-3, for example. Describe in detail.
  • the malicious intrusion detection device is installed on the target device to monitor whether the target device is maliciously invaded, or one monitoring device can be set to monitor multiple target devices in a unified manner.
  • one monitoring device can be set to monitor multiple target devices in a unified manner.
  • FIG. 5 shows a schematic block diagram of a malicious intrusion detection system 500 according to an embodiment of the present disclosure.
  • the malicious intrusion detection system 500 shown in FIG. 5 includes at least one target device 502 and a monitoring device 504.
  • the malicious intrusion detection device 400 as described above is installed on the target device 502.
  • the monitoring device 504 monitors the at least one target device 502, and when the malicious intrusion detection apparatus 400 determines that the target device 502 is maliciously invaded, the monitoring device 504 sends an alarm to the target device 502.
  • the monitoring device 504 includes a database 5042 in which decision-making problems are stored, and the decision-making problems are set to imitate problems encountered by users in an actual operating system, and can distinguish malicious users from normal users.
  • Fig. 5 shows a system block diagram of a unified target device monitored by a monitoring device.
  • the monitoring device includes a database in which the same or different decision questions set for different target devices can be stored. Although only one target device is shown in FIG. 5, those skilled in the art can understand that the number of target devices is not limited to one, but may be any number.
  • the above-mentioned malicious intrusion detection device can be implemented by hardware, or by software or a combination of hardware and software.
  • FIG. 6 shows a block diagram of a computing device 600 of a malicious intrusion detection method according to an embodiment of the present disclosure.
  • the computing device 600 may include at least one processor 602, and the processor 602 executes at least one computer-readable instruction stored or encoded in a computer-readable storage medium (ie, the memory 604) (ie, the foregoing is in the form of software). Implemented elements).
  • computer-executable instructions are stored in the memory 604, which, when executed, cause at least one processor 602 to complete the malicious intrusion detection method described above with reference to FIGS. 1-3.
  • a non-transitory machine-readable medium may have machine-executable instructions (that is, the above-mentioned elements implemented in the form of software), which when executed by a machine, cause the machine to execute the various embodiments of the present disclosure in conjunction with FIGS. 1-3.
  • machine-executable instructions that is, the above-mentioned elements implemented in the form of software
  • a computer program including computer-executable instructions, which when executed, cause at least one processor to execute each of the above described in conjunction with FIGS. 1-3 in the various embodiments of the present disclosure.
  • a computer program product including computer-executable instructions, which when executed, cause at least one processor to execute the above described in conjunction with FIGS. 1-3 in the various embodiments of the present disclosure.
  • the malicious intrusion detection method according to the present disclosure is a low-cost method, which can be deployed on a device with limited resources and does not occupy excessive CPU and memory resources of the device. According to the malicious intrusion detection method and device of the present disclosure, when the owner of the target device leaves the device without locking the device, it is possible to detect whether someone is trying to maliciously invade the target device, and unknown malicious attacks can be detected.
  • the method according to the present disclosure can be used to protect devices that are used daily and bring minimal risks to the target device.
  • the target device can be a personal computer or any network communication device.
  • the method according to the present disclosure is particularly suitable for scenarios where you want to protect data, but do not want to install too much software in the system to increase the load of system resources.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开涉及恶意入侵检测方法、装置、系统、计算设备、介质和程序。恶意入侵检测方法，包括：在目标设备中设置至少一个蜜文件夹，所述蜜文件夹对攻击者有吸引力，且所述蜜文件夹中不包括对用户有用的文件；监控是否有访问者访问所述蜜文件夹；以及根据是否有访问者访问所述蜜文件夹，确定所述目标设备是否受到恶意入侵。

Description

恶意入侵检测方法、装置、系统、计算设备、介质和程序 技术领域
本公开通常涉及计算机网络安全技术领域，更具体地，涉及恶意入侵检测方法、装置、计算设备、介质和计算机程序。
背景技术
网络安全在我们的日常生活中变得越来越重要。目前有一些网络安全解决方案，例如防火墙、防病毒软件和入侵检测系统等，来防止主机设备被攻击。然而，这些解决方案只能够检测或阻止一部分已知的攻击。
蜜罐系统被设计为通过模拟易受攻击的系统来从攻击者收集信息。蜜罐系统提供一种引人注意的系统，来记录和分析攻击者的活动。这可以帮助我们理解攻击者的攻击方法和行为，甚至可以发现未知的弱点。
目前存在一些蜜罐系统，可以监视和分析攻击。其中一些使用真实的计算机和系统来构建蜜罐；还有一些使用软件来模拟真实系统。通常，用真实系统构建的蜜罐具有高交互性和高成本，而纯软件蜜罐具有低交互性，成本也低。这些蜜罐系统中大部分的主要目标在于黑客攻击和收集信息，而无法在日常使用的系统中帮助我们，例如现有的蜜罐系统Capture-HPC、HoneyMonkey、SpyProxy、PhoneyC等。
现有的一些专利申请，如下面列出的专利文献1和专利文献2，都是采用预定义的物理蜜罐和虚拟蜜罐混合的蜜罐系统。然而，其只关注于如何分配业务，而这样的蜜罐系统并不是用于日常的工作系统。
在日常使用的系统中可以包括各种防病毒软件。防病毒软件可以在某种程度上保护系统免受病毒的威胁，但是恶意用户仍然会在没有被通知的情况下进入系统。
参考文献：
专利文献1：CN 200610169676.9，“多层次蜜网数据传输方法及系统”；
专利文献2：CN 200910136094.4，“一种漏洞拟真超载蜜罐方法”。
发明内容
在下文中给出关于本发明的简要概述，以便提供关于本发明的某些方面的基本理解。应当理解，这个概述并不是关于本发明的穷举性概述。它并不是意图确定本发明的关键或重要部分，也不是意图限定本发明的范围。其目的仅仅是以简化的形式给出某些概念，以此作为稍后论述的更详细描述的前序。
鉴于上述，本公开提出了一种对目标设备进行最小的改变的方法，通过在目标设备中设置蜜文件夹来检测恶意入侵行为。根据本公开的恶意入侵检测方法是一种低成本的方法，其可以部署在只有有限资源的设备上，不会占用设备过多的CPU和内存资源。根据本公开的恶意入侵检测方法和装置，可以在目标设备的主人在没有锁定设备的情况下离开设备时，检测是否有人试图恶意入侵目标设备，并且可以检测出未知的恶意攻击。
根据本公开的一个方面提供了恶意入侵检测方法，包括：在目标设备中设置至少一个蜜文件夹，所述密文件夹对攻击者有吸引力，且所述密文件夹中不包括对用户有用的文件；监控是否有访问者访问所述蜜文件夹；以及根据是否有访问者访问所述蜜文件夹，确定所述目标设备是否受到恶意入侵。
可选地，在上述方面的一个示例中，确定所述目标设备是否受到恶意入侵包括：在检测到有访问者访问所述蜜文件夹的情况下，使所述目标设备进入会话模式，要求所述访问者回答至少一个决策问题；以及根据所述访问者的回答来确定所述目标设备是否被所述访问者恶意入侵。通过会话模式下的问题交互，可以降低入侵检测的误报率。
可选地，在上述方面的一个示例中，所根据所述访问者的回答来确定所述访问者是否是恶意入侵包括：利用决策树的方法来确定所述目标设备是否被所述访问者恶意入侵。采用决策树的方式，可系统地、有目的地设置询问策略，进一步降低入侵检测的误报率。
可选地，在上述方面的一个示例中，所述决策问题被设置为模仿用户在实际操作系统中遇到的问题，并且能够区分恶意用户和正常用户。这样 可以有效避免攻击者发现该密文件夹并非是用户使用的文件夹，而用于检测攻击。
根据本公开的另一方面，提供了恶意入侵检测装置，包括：蜜文件夹设置单元，被配置为在目标设备中设置至少一个蜜文件夹，所述密文件夹对攻击者有吸引力，且所述密文件夹中不包括对用户有用的文件；监控单元，被配置为监控是否有访问者访问所述蜜文件夹；以及判断单元，被配置为根据是否有访问者访问所述蜜文件夹，确定所述目标设备是否受到恶意入侵。
可选地，在上述方面的一个示例中，所述判断单元进一步被配置为：在检测到有访问者访问所述蜜文件夹的情况下，使所述目标设备进入会话模式，要求所述访问者回答至少一个决策问题；以及根据所述访问者的回答来确定所述目标设备是否被所述访问者恶意入侵。
可选地，在上述方面的一个示例中，所述判断单元进一步被配置为：利用决策树的方法来确定所述目标设备是否被所述访问者恶意入侵。
可选地，在上述方面的一个示例中，所述决策问题被设置为模仿用户在实际操作系统中遇到的问题，并且能够区分恶意用户和正常用户。
根据本公开的另一方面，提供了恶意入侵检测系统，包括，至少一个目标设备和监控设备，其中，所述目标设备上安装有根据以上所述的恶意入侵检测装置；所述监控设备对所述至少一个目标设备进行监控，在所述恶意入侵检测装置确定所述目标设备受到恶意入侵的情况下，所述监控设备向所述目标设备发出告警。
可选地，在上述方面的一个示例中，所述监控设备还包括数据库，所述数据库中存储决策问题，所述决策问题被设置为模仿用户在实际操作系统中遇到的问题，并且能够区分恶意用户和正常用户。
根据本公开的另一方面，提供了计算设备，包括：至少一个处理器；以及与所述至少一个处理器耦合的一个存储器，所述存储器用于存储指令，当所述指令被所述至少一个处理器执行时，使得所述处理器执行如上所述的方法。
根据本公开的另一方面，提供了一种非暂时性机器可读存储介质，其存储有可执行指令，所述指令当被执行时使得所述机器执行如上所述的方 法。
根据本公开的另一方面，提供了一种计算机程序，包括计算机可执行指令，所述计算机可执行指令在被执行时使至少一个处理器执行如上所述的方法。
根据本公开的另一方面，提供了一种计算机程序产品，所述计算机程序产品被有形地存储在计算机可读介质上并且包括计算机可执行指令，所述计算机可执行指令在被执行时使至少一个处理器执行如上所述的方法。
根据本公开的恶意入侵检测方法是一种低成本的方法，其可以部署在只有有限资源的设备上，不会占用设备过多的CPU和内存资源。根据本公开的恶意入侵检测方法和装置，可以在目标设备的主人在没有锁定设备的情况下离开设备时，检测是否有人试图恶意入侵目标设备，并且可以检测出未知的恶意攻击。
根据本公开的方法可以用于保护日常使用的设备，给目标设备带来最小的风险，目标设备可以是个人计算机或者任何网络通信设备。根据本公开的方法，尤其适合想要保护数据，但是又不想在系统中安装太大的软件而增加系统资源的负荷的场景。
附图说明
参照下面结合附图对本发明实施例的说明，会更加容易地理解本发明的以上和其它目的、特点和优点。附图中的部件只是为了示出本发明的原理。在附图中，相同的或类似的技术特征或部件将采用相同或类似的附图标记来表示。
图1是示出了根据本发明的一个实施例的恶意行为检测方法的示例性过程的流程图；
图2是示出了图1中的步骤S106的一种示例性过程的流程图；
图3是示出了根据本发明的另一个实施例的采用决策树方法来确定目标设备是否受到恶意入侵的示例性过程的流程图；
图4是示出了根据本公开的另一个实施例的恶意入侵检测装置的示例性配置的框图；
图5示出了根据本公开一个实施例的恶意入侵检测系统的示意性框图； 以及
图6示出了根据本公开的实施例的实现恶意入侵检测方法的计算设备的方框图。
附图标记
100：恶意行为检测方法  S102、S104、S106、S1062、S1064、
                       S301、S302、S303、S304、S305、
                       S306、S307、S308：步骤
300：决策树方法        400：恶意入侵检测装置
402：蜜文件夹设置单元  404：监控单元
406：判断单元          500：恶意入侵检测系统
502：目标设备          504：监控设备
5042：数据库           600：阅读设备
602：处理器            604：存储器
具体实施方式
现在将参考示例实施方式讨论本文描述的主题。应该理解，讨论这些实施方式只是为了使得本领域技术人员能够更好地理解从而实现本文描述的主题，并非是对权利要求书中所阐述的保护范围、适用性或者示例的限制。可以在不脱离本公开内容的保护范围的情况下，对所讨论的元素的功能和排列进行改变。各个示例可以根据需要，省略、替代或者添加各种过程或组件。例如，所描述的方法可以按照与所描述的顺序不同的顺序来执行，以及各个步骤可以被添加、省略或者组合。另外，相对一些示例所描述的特征在其它例子中也可以进行组合。
如本文中使用的，术语“包括”及其变型表示开放的术语，含义是“包括但不限于”。术语“基于”表示“至少部分地基于”。术语“一个实施例”和“一实施例”表示“至少一个实施例”。术语“另一个实施例”表示“至少一个其他实施例”。术语“第一”、“第二”等可以指代不同的或相同的对象。下面可以包括其他的定义，无论是明确的还是隐含的。除非上下文中明确地指明，否则一个术语的定义在整个说明书中是一致的。
在本公开中，提出了一种利用蜜文件夹来进行恶意入侵检测的方法，以用于在我们日常使用的系统中识别恶意入侵行为。
传统的信息泄露检测系统或入侵检测系统需要软件对受保护的目标设备上的资源持续进行监测，这样会占用大量的资源，甚至无法提供正常的服务。在有些情况下，CPU和内存等资源是至关重要的，系统无法接受CPU或内存的大量占用，甚至无法正常使用。
本公开提出了一种对目标设备进行最小的改变的方法，通过在目标设备中设置蜜文件夹来检测恶意入侵行为。
下面将结合附图来描述根据本公开的实施例的恶意入侵检测方法和装置。
图1示出了根据本发明的一个实施例的恶意行为检测方法100的示例性过程的流程图。
在图1中，首先执行步骤S102，在目标设备中设置至少一个蜜文件夹。
蜜文件夹是一种对于攻击者有吸引力的文件，密文件夹中可包含有吸引力的资源，用户在正常使用时不会访问该密文件夹。在本公开中，蜜文件夹中不包括用户使用的数据也不包括项目文件等对用户有用的资源。因此，进入这个文件夹的访问者就有可能是恶意的。在蜜文件夹下，存储有看起来像是源代码、密码文件、私人图片、私钥、数据库文件等对攻击者有吸引力，但实际上不为用户所使用的文件，称之为“密文件”。
所述目标设备可以是个人电脑、服务器等任何有可能受到恶意攻击的网络通信产品或部件。
在步骤S104中，监控是否有访问者访问所述蜜文件夹。
在本公开中，对于具体采用的监控方法不做限定，本领域技术人员可以采用现有技术中的常用方法来监控是否有访问者对蜜文件夹进行访问。
例如，可以在受保护的目标设备上运行一个监控程序来监控是否有访问者访问蜜文件夹。该监控程序只监控蜜文件夹，这相比于一般的监控程序解决方案，比如防病毒软件，只耗费目标设备很少的资源。
在步骤S106中，根据是否有访问者访问所述蜜文件夹，确定所述目标设备是否受到恶意入侵。
如上所述，蜜文件夹是不存在的用户的文件夹或者不存在的项目的文 件夹，正常用户不会进入这个文件夹，因此，在一个示例中，如果有访问者访问这个蜜文件夹，就可以确定目标设备收到恶意入侵。
图2示出了图1中的步骤S106的一种示例性过程的流程图。
如图2所示，在子步骤S1062中，在检测到有访问者访问所述蜜文件夹的情况下，使所述目标设备进入会话模式，要求访问者回答至少一个决策问题。
如果有人或者有程序访问文件夹，则监控程序将使得目标设备进入特殊的交互模式。例如，在Linux系统中，出现一些特殊的shell命令行，要求访问者回答一些决策问题；如果是Windows系统，则可以弹出一个会话框，向访问者提问。
所采用的决策问题类似于使得访问者处于十字路口，恶意用户和正常用户会选择不同的路。优选地，这些决策问题的答案通常是“是”或者“否”。将决策问题设置为模仿用户在真实操作系统中的访问文件夹时可能遇到的问题，并且能够区分出恶意用户和正常用户。例如：
·该文件夹属于其他用户，你是否想要控制？
·你是否要重置密码？
·你是否要删除访问记录？
·是否显示隐藏的文件？
·请输入密码(如果没有密码，则任何输入都可以)
·…
在子步骤S1064中，根据所述访问者的回答来确定所述目标设备是否被所述访问者恶意入侵。
在一个示例中，可以采用如图3所示的决策树的方法来判断所述目标设备是否被所述访问者恶意入侵。
下面参照图3来说明在检测到有访问者访问蜜文件夹时，确定目标设备是否受到恶意入侵的一个示例性过程。
首先，在步骤S301中，检测到有访问者访问蜜文件夹，在步骤S302中，使目标设备进入会话模式，要求访问者回答决策问题，在这里可以设置一个表示访问者的恶意程度的恶意值，并将其初始化为0。根据访问者对于每一个决策问题的回答来改变恶意值，如果答案为是Y，则执行步骤S303 的操作，增加恶意值，如果答案为否N，则执行步骤S304的操作，减小恶意值。在执行S303的增加恶意值的步骤之后，执行步骤S305，判断恶意值是否大于预定阈值，如果恶意值不大于预定阈值N，则回到步骤S302，要求访问者回答下一个决策问题，如果恶意值大于预定阈值Y，则执行步骤S306，向目标设备发送告警，确定访问者是恶意入侵，然后执行到步骤S308，结束判断。在执行S304的减小恶意值的步骤之后，在步骤S307判断恶意值是否小于0，如果恶意值不小于0，则回到步骤S302，要求访问者回答下一个决策问题，如果恶意值小于0或者访问者退出文件夹，则确定访问者不是恶意入侵，执行到步骤S308，结束判断。
以上参照图3举例说明了在根据本公开的方法中，确定目标设备是否受到恶意入侵的一个示例性过程，本领域技术人员可以理解，确定目标设备是否受到恶意入侵的方法不限于该具体过程。
图4是示出了根据本公开的另一个实施例的恶意入侵检测装置400的示例性配置的框图。
如图4所示，恶意入侵检测装置400包括蜜文件夹设置单元402、监控单元404和判断单元406。
其中，蜜文件夹设置单元402被配置为在目标设备中设置至少一个蜜文件夹，所述密文件夹对攻击者有吸引力，且所述密文件夹中不包括对用户有用的文件。
监控单元404被配置为监控是否有访问者访问所述蜜文件夹。
判断单元406被配置为根据是否有访问者访问所述蜜文件夹，确定所述目标设备是否受到恶意入侵。
其中，所述判断单元406进一步被配置为：在检测到有访问者访问所述蜜文件夹的情况下，使所述目标设备进入会话模式，要求所述访问者回答至少一个决策问题；根据所述访问者的回答来确定所述目标设备是否被所述访问者恶意入侵。
其中，所述判断单元406进一步被配置为：利用决策树的方法来确定所述目标设备是否被所述访问者恶意入侵。
其中，所述决策问题被设置为模仿用户在实际操作系统中遇到的问题， 并且能够区分恶意用户和正常用户。
图4所示的恶意入侵检测装置400的各个部分的操作和功能的细节例如可以与参照结合图1-3描述的本公开的恶意入侵检测方法100的实施例的相关部分相同或类似，这里不再详细描述。
还需要说明的是，图4所示的恶意入侵检测装置400及其组成单元的结构仅仅是示例性的，本领域技术人员可以根据需要对图4所示的结构框图进行修改。
在以上说明的本公开的方案中，通过在目标设备上设置恶意入侵检测装置来监控目标设备是否受到恶意入侵，也可以设置一个监控设备来对多个目标设备进行统一监控，下面将参照图5具体说明。
图5示出了根据本公开一个实施例的恶意入侵检测系统500的示意性框图。
图5所示的恶意入侵检测系统500，包括，至少一个目标设备502和监控设备504。
其中，目标设备502上安装有如以上所述的恶意入侵检测装置400。
监控设备504对所述至少一个目标设备502进行监控，在所述恶意入侵检测装置400确定所述目标设备502受到恶意入侵的情况下，所述监控设备504向目标设备502发出告警。
其中，所述监控设备504包括数据库5042，所述数据库5042中存储决策问题，所述决策问题被设置为模仿用户在实际操作系统中遇到的问题，并且能够区分恶意用户和正常用户。
图5中示出了由一个监控设备统一目标设备进行监控的系统框图，监控设备中包括一个数据库，其中可以存储针对不同目标设备设置的相同的或者不同的决策问题。虽然图5中只示出了一个目标设备，本领域技术人员可以理解，目标设备的数量不限于一个，而可以是任意多个。
如上参照图1到图5，对根据本公开的实施例的恶意入侵检测方法、装置和系统的实施例进行了描述。以上所述的恶意入侵检测装置可以采用硬件实现，也可以采用软件或者硬件和软件的组合来实现。
图6示出了根据本公开的实施例的恶意入侵检测方法的计算设备600的方框图。根据一个实施例，计算设备600可以包括至少一个处理器602， 处理器602执行在计算机可读存储介质(即，存储器604)中存储或编码的至少一个计算机可读指令(即，上述以软件形式实现的元素)。
在一个实施例中，在存储器604中存储计算机可执行指令，其当执行时使得至少一个处理器602完成以上参照图1-3所描述的恶意入侵检测方法。
应该理解，在存储器604中存储的计算机可执行指令当执行时使得至少一个处理器602进行本公开的各个实施例中以上结合图1-5描述的各种操作和功能。
根据一个实施例，提供了一种非暂时性机器可读介质。该非暂时性机器可读介质可以具有机器可执行指令(即，上述以软件形式实现的元素)，该指令当被机器执行时，使得机器执行本公开的各个实施例中以上结合图1-3描述的各种操作和功能。
根据一个实施例，提供了一种计算机程序，包括计算机可执行指令，所述计算机可执行指令在被执行时使至少一个处理器执行本公开的各个实施例中以上结合图1-3描述的各种操作和功能。
根据一个实施例，提供了一种计算机程序产品，包括计算机可执行指令，所述计算机可执行指令在被执行时使至少一个处理器执行本公开的各个实施例中以上结合图1-3描述的各种操作和功能。
根据本公开的恶意入侵检测方法是一种低成本的方法，其可以部署在只有有限资源的设备上，不会占用设备过多的CPU和内存资源。根据本公开的恶意入侵检测方法和装置，可以在目标设备的主人在没有锁定设备的情况下离开设备时，检测是否有人试图恶意入侵目标设备，并且可以检测出未知的恶意攻击。
根据本公开的方法可以用于保护日常使用的设备，给目标设备带来最小的风险，目标设备可以是个人计算机或者任何网络通信设备。根据本公开的方法，尤其适合想要保护数据，但是又不想在系统中安装太大的软件而增加系统资源的负荷的场景。
上面结合附图阐述的具体实施方式描述了示例性实施例，但并不表示可以实现的或者落入权利要求书的保护范围的所有实施例。在整个本说明书中使用的术语“示例性”意味着“用作示例、实例或例示”，并不意味着比其它实施例“优选”或“具有优势”。出于提供对所描述技术的理解的目 的，具体实施方式包括具体细节。然而，可以在没有这些具体细节的情况下实施这些技术。在一些实例中，为了避免对所描述的实施例的概念造成难以理解，公知的结构和装置以框图形式示出。
本公开内容的上述描述被提供来使得本领域任何普通技术人员能够实现或者使用本公开内容。对于本领域普通技术人员来说，对本公开内容进行的各种修改是显而易见的，并且，也可以在不脱离本公开内容的保护范围的情况下，将本文所定义的一般性原理应用于其它变型。因此，本公开内容并不限于本文所描述的示例和设计，而是与符合本文公开的原理和新颖性特征的最广范围相一致。

Claims (14)

  1. 恶意入侵检测方法，包括：
    在目标设备中设置至少一个蜜文件夹，所述密文件夹对攻击者有吸引力，且所述密文件夹中不包括对用户有用的文件；
    监控是否有访问者访问所述蜜文件夹；以及
    根据是否有访问者访问所述蜜文件夹，确定所述目标设备是否受到恶意入侵。
  2. 如权利要求1所述的方法，其中，确定所述目标设备是否受到恶意入侵包括：
    在检测到有访问者访问所述蜜文件夹的情况下，使所述目标设备进入会话模式，要求所述访问者回答至少一个决策问题；以及
    根据所述访问者的回答来确定所述目标设备是否被所述访问者恶意入侵。
  3. 如权利要求2所述的方法，其中，根据所述访问者的回答来确定所述目标设备是否被所述访问者恶意入侵包括：利用决策树的方法来确定所述目标设备是否被所述访问者恶意入侵。
  4. 如权利要求1-3中任意一项所述的方法，其中，所述决策问题被设置为模仿用户在实际操作系统中遇到的问题，并且能够区分恶意用户和正常用户。
  5. 恶意入侵检测装置(400)，包括：
    蜜文件夹设置单元(402)，被配置为在目标设备中设置至少一个蜜文件夹，所述密文件夹对攻击者有吸引力，且所述密文件夹中不包括对用户有用的文件；
    监控单元(404)，被配置为监控是否有访问者访问所述蜜文件夹；以及
    判断单元(406)，被配置为根据是否有访问者访问所述蜜文件夹，确定所述目标设备是否受到恶意入侵。
  6. 如权利要求5所述的装置(400)，其中，所述判断单元(406)进一步被配置为：
    在检测到有访问者访问所述蜜文件夹的情况下，使所述目标设备进入会话模式，要求所述访问者回答至少一个决策问题；以及
    根据所述访问者的回答来确定所述目标设备是否被所述访问者恶意入侵。
  7. 如权利要求6所述的装置(400)，其中，所述判断单元(406)进一步被配置为：利用决策树的方法来确定所述目标设备是否被所述访问者恶意入侵。
  8. 如权利要求5-7中任意一项所述的装置(400)，其中，所述决策问题被设置为模仿用户在实际操作系统中遇到的问题，并且能够区分恶意用户和正常用户。
  9. 恶意入侵检测系统(500)，包括，至少一个目标设备(502)和监控设备(504)，
    其中，所述目标设备上安装有根据权利要求5-8中任意一项所述的恶意入侵检测装置(400)；
    所述监控设备(504)对所述至少一个目标设备(502)进行监控，在所述恶意入侵检测装置(400)确定所述目标设备(502)受到恶意入侵的情况下，所述监控设备(504)向所述目标设备(502)发出告警。
  10. 根据权利要求9所述的系统(500)，其中，所述监控设备(504)还包括数据库(5042)，所述数据库(5042)存储决策问题，所述决策问题被设置为模仿用户在实际操作系统中遇到的问题，并且能够区分恶意用户和正常用户。
  11. 计算设备(600)，包括：
    至少一个处理器(602)；以及
    与所述至少一个处理器(602)耦合的一个存储器(604)，所述存储器用于存储指令，当所述指令被所述至少一个处理器(602)执行时，使得所述处理器(602)执行如权利要求1-4中任意一项所述的方法。
  12. 一种非暂时性机器可读存储介质，其存储有可执行指令，所述指令当被执行时使得所述机器执行如权利要求1-4中任意一项所述的方法。
  13. 一种计算机程序，包括计算机可执行指令，所述计算机可执行指令在被执行时使至少一个处理器执行根据权利要求1-4中任意一项所述的方法。
  14. 一种计算机程序产品，所述计算机程序产品被有形地存储在计算机可读介质上并且包括计算机可执行指令，所述计算机可执行指令在被执行时使至少一个处理器执行根据权利要求1-4中任意一项所述的方法。
PCT/CN2020/087580 2020-04-28 2020-04-28 恶意入侵检测方法、装置、系统、计算设备、介质和程序 WO2021217449A1 (zh)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CN202080099370.9A CN115398430A (zh) 2020-04-28 2020-04-28 恶意入侵检测方法、装置、系统、计算设备、介质和程序
PCT/CN2020/087580 WO2021217449A1 (zh) 2020-04-28 2020-04-28 恶意入侵检测方法、装置、系统、计算设备、介质和程序
EP20933436.6A EP4123488A4 (en) 2020-04-28 2020-04-28 METHOD, APPARATUS AND SYSTEM FOR MALICIOUS INTRUSION DETECTION, COMPUTER DEVICE, MEDIUM AND PROGRAM

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/087580 WO2021217449A1 (zh) 2020-04-28 2020-04-28 恶意入侵检测方法、装置、系统、计算设备、介质和程序

Publications (1)

Publication Number Publication Date
WO2021217449A1 true WO2021217449A1 (zh) 2021-11-04

Family

ID=78331687

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/087580 WO2021217449A1 (zh) 2020-04-28 2020-04-28 恶意入侵检测方法、装置、系统、计算设备、介质和程序

Country Status (3)

Country Link
EP (1) EP4123488A4 (zh)
CN (1) CN115398430A (zh)
WO (1) WO2021217449A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114553529A (zh) * 2022-02-22 2022-05-27 深信服科技股份有限公司 一种数据处理方法、装置、网络设备及存储介质
CN116094847A (zh) * 2023-04-11 2023-05-09 中国工商银行股份有限公司 蜜罐识别方法、装置、计算机设备和存储介质

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101075985A (zh) * 2007-02-08 2007-11-21 腾讯科技（深圳）有限公司 即时通信系统、服务器及安全登录即时通信系统的方法
CN108090362A (zh) * 2017-02-08 2018-05-29 哈尔滨安天科技股份有限公司 一种atm程序更新的安全防护方法及系统
US10277629B1 (en) * 2016-12-20 2019-04-30 Symantec Corporation Systems and methods for creating a deception computing system
CN110944014A (zh) * 2019-12-18 2020-03-31 北京天融信网络安全技术有限公司 终端数据安全主动防御方法及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8667581B2 (en) * 2006-06-08 2014-03-04 Microsoft Corporation Resource indicator trap doors for detecting and stopping malware propagation
US8739281B2 (en) * 2011-12-06 2014-05-27 At&T Intellectual Property I, L.P. Multilayered deception for intrusion detection and prevention
US10270807B2 (en) * 2015-07-21 2019-04-23 Cymmetria, Inc. Decoy and deceptive data object technology

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101075985A (zh) * 2007-02-08 2007-11-21 腾讯科技（深圳）有限公司 即时通信系统、服务器及安全登录即时通信系统的方法
US10277629B1 (en) * 2016-12-20 2019-04-30 Symantec Corporation Systems and methods for creating a deception computing system
CN108090362A (zh) * 2017-02-08 2018-05-29 哈尔滨安天科技股份有限公司 一种atm程序更新的安全防护方法及系统
CN110944014A (zh) * 2019-12-18 2020-03-31 北京天融信网络安全技术有限公司 终端数据安全主动防御方法及装置

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4123488A4

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114553529A (zh) * 2022-02-22 2022-05-27 深信服科技股份有限公司 一种数据处理方法、装置、网络设备及存储介质
CN116094847A (zh) * 2023-04-11 2023-05-09 中国工商银行股份有限公司 蜜罐识别方法、装置、计算机设备和存储介质

Also Published As

Publication number Publication date
EP4123488A1 (en) 2023-01-25
CN115398430A (zh) 2022-11-25
EP4123488A4 (en) 2023-12-13

Similar Documents

Publication Publication Date Title
Ullah et al. Data exfiltration: A review of external attack vectors and countermeasures
US10574684B2 (en) Locally detecting phishing weakness
US9348984B2 (en) Method and system for protecting confidential information
CN109495443B (zh) 一种基于主机蜜罐对抗勒索软件攻击的方法和系统
US9055093B2 (en) Method, system and computer program product for detecting at least one of security threats and undesirable computer files
US7549166B2 (en) Defense mechanism for server farm
US11206281B2 (en) Validating the use of user credentials in a penetration testing campaign
Duncan et al. An overview of insider attacks in cloud computing
US20130227691A1 (en) Detecting Malicious Network Content
US7581004B2 (en) System and method for alerting on open file-share sessions on a user's electronic device
RU2634173C1 (ru) Система и способ обнаружения приложения удалённого администрирования
Xu et al. Detecting infection onset with behavior-based policies
Phyo et al. A detection-oriented classification of insider it misuse
Zhang et al. User intention-based traffic dependence analysis for anomaly detection
US11005878B1 (en) Cooperation between reconnaissance agents in penetration testing campaigns
Al-Sharif et al. White-hat hacking framework for promoting security awareness
WO2021217449A1 (zh) 恶意入侵检测方法、装置、系统、计算设备、介质和程序
WO2022088633A1 (zh) 横向渗透防护方法、装置、设备及存储介质
BalaGanesh et al. Smart devices threats, vulnerabilities and malware detection approaches: a survey
WO2023151238A1 (zh) 一种勒索病毒检测方法及相关系统
KR20100067383A (ko) 서버 보안 시스템 및 서버 보안 방법
Möller et al. Introduction to Cybersecurity
CN112118204A (zh) 一种Windows文件系统非法访问的感知方法及系统
Fan et al. Privacy Petri net and privacy leak software
Yang et al. Computer network attack and defense technology

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20933436

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2020933436

Country of ref document: EP

Effective date: 20221020

NENP Non-entry into the national phase

Ref country code: DE