CN112395602B - Processing method, device and system for static security feature database - Google Patents

Abstract

The application discloses a processing method, a device and a system of a static security feature database, relates to the technical field of network security, and can meet the requirement of matching static instruction sequence features and automatically generate the static security feature database. The method comprises the following steps: firstly, reading files collected in advance in a library making directory, wherein the library making directory comprises files of target official operating systems of different versions running in a memory under a clean environment; then, performing static disassembling analysis on the read file to obtain an API calling sequence corresponding to the monitoring point; and finally, creating a static security feature database according to the API calling sequence. The method and the device are suitable for processing the static security feature database.

Description

Method, device and system for processing static security feature database

technical field

The present application relates to the technical field of network security, and in particular, to a method, device and system for processing a static security feature database.

Background technique

With the development of Internet informatization, there are more and more cyber hacker attacks, and hacker attack methods are constantly evolving. Hackers can use vulnerabilities to make software processes realize some attack events. Therefore, in order to better restrict the execution of legitimate events of software processes, the way of defining permission sets can be used to limit the events that software processes can execute.

At present, the corresponding instruction execution sequence during program execution can be matched with the preset normal behavior instruction execution sequence in the static security feature database, so as to timely discover whether there is a vulnerability attack event. However, these normal behavior instruction execution sequences are usually manually tested and added one by one, which not only affects the creation efficiency of the security feature database, but also makes it difficult to obtain a more comprehensive static security feature database due to the limitations of manual labor, which will affect the subsequent The accuracy of behavioral anomaly detection.

SUMMARY OF THE INVENTION

In view of this, the present application provides a method, device and system for processing a static security feature database, the main purpose of which is to solve the problem that the current prior art will affect the creation efficiency of the security feature database, and a more comprehensive static security feature database cannot be obtained, In turn, it will affect the technical problem of the accuracy of subsequent behavior anomaly detection.

According to one aspect of the present application, a method for processing a static security feature database is provided, which can be applied to the server side, and the method includes:

Read the pre-collected files in the library directory, wherein the library directory contains files of different versions of the target official operating system running in memory in a clean environment;

Perform static disassembly analysis on the read file to obtain an application programming interface (Application Programming Interface, API) calling sequence corresponding to the monitoring point;

According to the sequence of API calls, a static security feature database is created.

Optionally, static disassembly analysis is performed on the read file to obtain the API call sequence corresponding to the monitoring point, specifically including:

Perform static disassembly analysis on the read file, and obtain the key API matching in the preset key API list as the monitoring point;

The key API is backtracked to a preset level, and the API call sequence corresponding to the key API is obtained.

Optionally, after creating and obtaining the static security feature database, the method further includes:

Obtain the target API call sequence of the behavior to be detected;

Matching the target API call sequence with the API call sequence in the static security feature database;

If there is no matching API calling sequence in the static security feature database, it is determined that the behavior to be detected is a suspected abnormal behavior, and a corresponding alarm is triggered.

Optionally, the library directory further includes an update file that runs in the memory in a clean environment after the target official operating system is patched.

Optionally, the library directory also includes new files generated in the memory when different genuine software runs separately in the target official operating system in a clean environment.

Optionally, the library directory also includes files of different versions of other official operating systems running in memory in a clean environment.

Optionally, the library directory further includes update files that run in memory in a clean environment after the other official operating systems are patched.

Optionally, the library directory also includes new files generated in the memory when different genuine software runs separately in the other official operating systems in a clean environment.

According to another aspect of the present application, another method for processing a static security feature database is provided, which can be applied to the client side, and the method includes:

Obtain the files of the installed target official operating system running in memory in a clean environment;

Upload the file to the library directory, which contains files of different versions of the target official operating system running in the memory in a clean environment, so as to obtain through static disassembly analysis according to the files in the library directory The API call sequence corresponding to the monitoring point is created to create a static security feature database.

Optionally, the obtaining the files running in the memory of the installed target official operating system in a clean environment specifically includes:

After installing the target official operating system, install the driver and enable each service item of the target official operating system and set up self-start, so as to obtain each process module file when the target official operating system runs in a clean environment;

The respective corresponding file hash values and file name directories of the process module files are stored in the file list;

A module loading callback is set, and the dynamic module files within the preset running time are loaded and merged into the file list according to the corresponding file hash value and file name directory.

Optionally, the uploading of the file to the library-making directory specifically includes:

According to the file hash value and the file name directory in the file list, the corresponding file is stored in the library directory.

Optionally, according to the file hash value and file name directory in the file list, save the corresponding file in the library directory, specifically including:

Obtain the corresponding file according to the file hash value and the file name directory in the file list;

According to the version number of the operating system, the editing number of the operating system, and the number of digits of the current system corresponding to the target official operating system, the obtained file is stored in a corresponding folder in the library directory.

Optionally, if the file size is greater than a preset threshold, uploading the file to the library directory specifically includes:

The file is uploaded to the library directory through the file transfer protocol FTP or the secure file transfer protocol SFTP.

According to another aspect of the present application, a processing device for a static security feature database is provided, which can be applied to a server side, and the device includes:

The reading module is used to read the pre-collected files in the library directory, wherein the library directory contains files of different versions of the target official operating system running in the memory in a clean environment;

The analysis module is used to perform static disassembly analysis on the read file, and obtain the API call sequence corresponding to the monitoring point;

A creation module is used to create a static security feature database according to the API calling sequence.

Optionally, the analysis module is specifically configured to perform static disassembly analysis on the read file, and obtain a key API that matches a preset key API list as the monitoring point;

The key API is backtracked to a preset level, and the API call sequence corresponding to the key API is obtained.

Optionally, the device further includes:

an acquisition module, configured to acquire the target API calling sequence of the behavior to be detected after the static security feature database is created and obtained;

a matching module for matching the target API call sequence with the API call sequence in the static security feature database;

A determining module, configured to determine that the to-be-detected behavior is a suspected abnormal behavior if there is no matching API calling sequence in the static security feature database, and trigger a corresponding alarm.

Optionally, the library directory further includes an update file that runs in the memory in a clean environment after the target official operating system is patched.

Optionally, the library directory also includes new files generated in the memory when different genuine software runs separately in the target official operating system in a clean environment.

Optionally, the library directory also includes files of different versions of other official operating systems running in memory in a clean environment.

Optionally, the library directory further includes update files that run in memory in a clean environment after the other official operating systems are patched.

Optionally, the library directory also includes new files generated in the memory when different genuine software runs separately in the other official operating systems in a clean environment.

According to another aspect of the present application, a processing device for a static security feature database is provided, which can be applied to a client side, and the device includes:

The acquisition module is used to acquire the files running in the memory of the installed target official operating system in a clean environment;

The sending module is used for uploading the file to the library directory, and the library directory contains files of different versions of the target official operating system running in the memory in a clean environment, so that according to the files in the library directory The application program interface API call sequence corresponding to the monitoring point obtained by static disassembly analysis is used to create a static security feature database.

Optionally, the obtaining module is specifically configured to install a driver, enable each service item of the target official operating system and set self-start after installing the target official operating system, so as to obtain the clean state of the target official operating system. Each process module file when running in the environment;

The respective corresponding file hash values and file name directories of the process module files are stored in the file list;

A module loading callback is set, and the dynamic module files within the preset running time are loaded and merged into the file list according to the corresponding file hash value and file name directory.

Optionally, the sending module is specifically configured to save the corresponding file in the library directory according to the file hash value and the file name directory in the file list.

Optionally, the sending module is further configured to obtain the corresponding file according to the file hash value and the file name directory in the file list;

According to the version number of the operating system, the editing number of the operating system, and the number of digits of the current system corresponding to the target official operating system, the obtained file is stored in a corresponding folder in the library directory.

Optionally, the sending module is further configured to upload the file to the library directory through a file transfer protocol FTP or a secure file transfer protocol SFTP if the file size is greater than a preset threshold.

According to yet another aspect of the present application, a storage medium is provided on which a computer program is stored, and when the program is executed by a processor, the above-mentioned processing method applicable to the static security feature database on the server side is implemented.

According to yet another aspect of the present application, a server is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executed on the processor, the processor implementing the above-mentioned applicable to the program when the processor executes the program. The processing method of the static security feature database on the server side.

According to a further aspect of the present application, a storage medium is provided on which a computer program is stored, and when the program is executed by a processor, the above-mentioned processing method applicable to a client-side static security feature database is implemented.

According to yet another aspect of the present application, a client device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, the processor implementing the above-mentioned program when executing the program. The processing method applied to the static security feature database on the client side.

According to another aspect of the present application, a processing system for a static security feature database is provided, including: the above-mentioned client device and the above-mentioned server.

By means of the above technical solutions, a method, device and system for processing a static security feature database provided by the present application, the present application can collect in advance the files of different versions of the target official operating system running in the memory in a clean environment, and then pass these files. The file is statically disassembled and analyzed to obtain the API call sequence corresponding to the monitoring point, and then a static security feature database is automatically created according to these API call sequences obtained by the analysis. Compared with the current existing methods, the static security feature database can be created automatically, thus improving the efficiency of creating the security feature database; and based on the files running in the memory of different versions of the official operating system in a clean environment, analyze and generate normal behavior. The instruction execution sequence can obtain a more comprehensive static security feature database, so that the accuracy of subsequent behavior anomaly detection can be improved by using the static security feature database.

The above description is only an overview of the technical solution of the present application. In order to be able to understand the technical means of the present application more clearly, it can be implemented according to the content of the description, and in order to make the above-mentioned and other purposes, features and advantages of the present application more obvious and easy to understand , and the specific embodiments of the present application are listed below.

Description of drawings

The drawings described herein are used to provide further understanding of the present application and constitute a part of the present application. The schematic embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation of the present application. In the attached image:

1 shows a schematic flowchart of a method for processing a static security feature database provided by an embodiment of the present application;

FIG. 2 shows a schematic flowchart of making a basic rule base provided by an embodiment of the present application;

FIG. 3 shows a schematic flowchart of making and updating a rule base provided by an embodiment of the present application;

4 shows a schematic flowchart of another method for processing a static security feature database provided by an embodiment of the present application;

FIG. 5 shows a schematic diagram of the architecture of a distributed file analysis system provided by an embodiment of the present application;

6 shows a schematic flowchart of another method for processing a static security feature database provided by an embodiment of the present application;

FIG. 7 shows a schematic structural diagram of a processing apparatus for a static security feature database provided by an embodiment of the present application;

FIG. 8 shows a schematic structural diagram of another apparatus for processing a static security feature database provided by an embodiment of the present application;

FIG. 9 shows a schematic structural diagram of a system for processing a static security feature database provided by an embodiment of the present application.

Detailed ways

Hereinafter, the present application will be described in detail with reference to the accompanying drawings and in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features of the embodiments may be combined with each other in the case of no conflict.

Aiming at the technical problem in the prior art that the creation efficiency of the security feature database is low and the accuracy of subsequent behavior abnormality detection is affected, the present embodiment provides a processing method for a static security feature database, as shown in FIG. 1 , which can Applied to the server side or other terminal side, the method includes:

101. Read the pre-collected files in the library directory.

Among them, the library directory contains files of different versions of the target official operating system running in memory in a clean environment. These files can be collected and uploaded on the client side in advance, that is, install different versions of the target official operating system on the client side and run them, obtain the files running in the memory in a clean environment, and upload them to the library directory on the server side.

It should be noted that you can also install different versions of the target official operating system through the local terminal associated with the server, and then collect these files into the specified library directory. Specific settings can be pre-selected according to actual needs.

102. Perform static disassembly analysis on the file read from the library directory, and obtain an API calling sequence corresponding to the monitoring point.

The monitoring point may be a key API, such as the main API called by the behavior event implementation.

In this embodiment, the library making script engine can be edited in advance, and then the library making script engine is used to perform static disassembly analysis on the collected files. For example, the library scripting engine can be fully implemented in python language, and can be divided into two parts, one is file processing and function task scheduling, and the other is to support the interactive disassembler (Interactive Disassembler, IDA) and other disassembly tools to call plug-in scripts, Extract the required information from disassembly tools such as IDA to make rules. Specifically, it can automatically process all collected files, call IDA to load files and IDA scripts, realize static disassembly analysis of PE files, and output all monitoring point rules, that is, the API call sequence corresponding to the monitoring point.

103. Create a static security feature database according to the API calling sequence obtained by the static disassembly analysis.

In the static security feature database, for different versions of the target official operating system, the behavior events executed by the system process have their own corresponding normal API call sequences, so that when the behavior events of a certain version of the system process are subsequently verified, these normal APIs can be passed through. The calling sequence verifies whether the system process has abnormal behavior.

The method of this embodiment can collect files of different versions of the target official operating system running in the memory in a clean environment in advance, and then perform static disassembly analysis on these files to obtain the API call sequence corresponding to the monitoring point, and then according to the analysis of these obtained The sequence of API calls automatically creates a database of static security features. Compared with the current existing methods, the static security feature database can be created automatically, thus improving the efficiency of creating the security feature database; and based on the files running in the memory of different versions of the official operating system in a clean environment, analyze and generate normal behavior. The instruction execution sequence can obtain a more comprehensive static security feature database, so that the accuracy of subsequent behavior anomaly detection can be improved by using the static security feature database.

Further, as a refinement and extension of the specific implementation of the above embodiment, in order to accurately obtain the API calling sequence corresponding to the monitoring point. As an optional method, step 102 may specifically include: performing static disassembly analysis on the read files, and obtaining key APIs matching the preset key API list as monitoring points; then backtracking these key APIs respectively Preset levels to obtain API call sequences corresponding to key APIs.

Among them, the preset key API list can store information of each key API, this optional method can use the preset key API list to find monitoring points, and the preset key API list can be preset according to actual business needs. The preset level can also be preset according to actual needs. If the preset level is level 3, it is necessary to trace back to the target API that calls the key API, and the API that calls the target API.

After the static security feature database is created and obtained, in order to implement subsequent behavior anomaly detection, optionally, the method of this embodiment may further include: first acquiring the target API call sequence of the behavior to be detected; then comparing the target API call sequence with the static security feature database If there is no matching API call sequence in the static security feature database, it is determined that the behavior to be detected is a suspected abnormal behavior, and a corresponding alarm is triggered. The methods of the alarm may include text, pictures, audio, video, lighting, vibration, and the like.

When there is no matching API call sequence in the static security feature database, it can be reported for further analysis and investigation. If it is determined that the target API call sequence is normal, it can be updated to the static security feature database.

In this embodiment, in addition to the files running in the memory of the target official operating system of different versions in the clean environment, in the library directory, in order to obtain a more comprehensive static security feature database, the following more optional methods are provided:

As an option, the repository directory can also contain update files for these versions of the target official operating system to run in memory in a clean environment after patches are installed. For example, as shown in Figure 2, first install the target operating system (Operating System, OS), and differentiate between versions; then run the collection tool to trigger behaviors to collect files running in memory in a clean environment, and upload the files to the library directory ; Finally, run the library-making script engine to perform static disassembly analysis on the files in the library-making directory to make a rule base, and then obtain a basic rule base.

Then install the updated patch on the target operating system, run the collection tool to trigger the behavior to collect the update files running in the memory in a clean environment; then upload the update files to the library directory in the same way, run the library script engine to make the rule base, and then get Update the rule base, as shown in Figure 3.

As another optional method, the library directory can also contain different genuine software (such as browsers, office software, PDF readers, etc.) when running separately in the target official operating system in a clean environment, the memory New file generated. Follow-up static disassembly analysis is carried out on these new files, and the normal API call sequence when the genuine software runs in the target official operating system is produced, and the static security feature database obtained at the end can realize abnormal detection of software behavior and enrich the security verification. Various application scenarios.

For example, the clean system installed by the official website system ISO only installs the software installation package downloaded by the official software; then use the latest version of the file collection tool provided by the rule maintainer to collect the information about the files in the memory when the software runs in the official operating system in a clean environment. New file generated.

As yet another option, the library directory can also contain files of different versions of other official operating systems running in memory in a clean environment. Afterwards, static disassembly analysis is performed on these files, and a static security feature database that can verify more abnormal operating system behaviors is obtained.

Further, based on the above content, as another optional method, the library directory may also include update files that run in the memory in a clean environment after installing patches for other official operating systems. It is equivalent to finally obtaining not only the basic rule bases of different versions of other official operating systems, but also the updated rule bases of these versions of other official operating systems, so as to meet more system behavior anomaly detection needs.

Further, the library directory may also contain new files generated in the memory when different genuine software runs separately in other official operating systems in a clean environment. The static security feature database finally obtained in this way can detect whether software behaviors under other operating systems are abnormal, thereby satisfying more software behavior detection requirements.

The content of the above embodiment is the processing process of the static security feature database described on the client side. Further, in order to fully describe the implementation of this embodiment, this embodiment also provides another processing method for the static security feature database, which can be used. Applied to the client side, as shown in Figure 4, the method includes:

201. Obtain the files running in the memory of the installed target official operating system in a clean environment.

Specifically, the file collection tool can be used to run on the target operating system and collect the module files running in the memory for a period of time.

202. Upload the obtained file to the production library directory.

Among them, the library-making directory can contain files of different versions of the target official operating system running in the memory in a clean environment, and further, in order to facilitate the API calls corresponding to the monitoring points obtained through static disassembly analysis of the files in the library-making directory sequence to create a static security feature database.

For example, in order to improve the creation efficiency of the static security feature database, multiple terminals may be used to collect files in the process described in this solution. Then upload it to the library directory of the distributed static file analysis system. As shown in Figure 5, the distributed static file analysis system can output the basic library and incremental library of static rules. The client submits the file tasks to be analyzed according to the requirements of a certain file directory format, and the task scheduler performs scheduling to decide which one The terminal service performs analysis, and after the analysis is completed, the basic library or incremental library is output, and the analysis service provides a rule acquisition interface and a task query interface. Among them, the analysis service can be the micro HTTP Server, which can be injected into the task scheduling module. The initial version may not have the task scheduling service. After receiving the analysis request, the micro HTTP Server saves the uploaded file and calls disassembly tools such as IDA to analyze the script engine. Complete the analysis of static files and output rule files. The following is an example of interface design:

1) POST/make_rules submit task directory analysis to generate basic library or incremental library;

2) POST/rules to obtain the basic library or incremental library of an OS;

3) POST/zipfile uploads the basic library or incremental library file to be analyzed and analyzes it, which is suitable for file transfer when the total size of the library file is less than 300MB.

Through the above processing method applicable to the static security feature database on the client side, compared with the current existing method, the static security feature database can be created automatically, thus improving the creation efficiency of the security feature database; By analyzing the files running in the memory of the operating system in a clean environment, the command execution sequences that generate normal behaviors can be analyzed, and a more comprehensive static security feature database can be obtained, so that the accuracy of subsequent behavior anomaly detection can be improved by using the static security feature database.

Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully describe the specific implementation process of this embodiment, another method for processing a static security feature database applicable to the client side is provided, as shown in FIG. 6 . As shown, the method includes:

301. After installing the target official operating system, install the driver, enable each service item of the target official operating system, and set auto-start, so as to obtain each process module file when the target official operating system runs in a clean environment.

302. Save the respective file hash values and file name directories of the process module files in the file list.

303. Set a module loading callback, and load and merge the dynamic module files within the preset running duration into the file list according to the corresponding file hash value and file name directory.

304. Save the corresponding file in the library directory according to the file hash value and the file name directory in the file list.

Through the above method, the collected files are more comprehensive and accurate, and more instruction execution sequences with normal system behavior can be obtained.

For example, use the file collection tool to run the installation function driver and open all service items and set auto-start, the driver layer enumerates all process modules, saves a file list, and sets the module loading callback, captures the dynamic module loading over a period of time and merges it into File list, calculate the file hash of the file list, when the click is completed, the file list will be saved to the specified directory according to the "file name directory\hash" method, and if the file hash in the target directory already exists, it will be overwritten. Subsequently, it is convenient to create a static security feature database according to the API calling sequence corresponding to the monitoring point obtained by static disassembly analysis of the files in the library directory.

In order to facilitate the management of the library catalogue and make the subsequent creation of the static security feature database more normative, as an optional method, step 304 may specifically include: according to the file hash value and the file name catalogue in the file list, obtain the corresponding file; and then save the obtained file in the corresponding folder in the library directory according to the operating system version number, operating system edit number, and current system digits corresponding to the target official operating system.

For example, after the collection tool runs done, a folder of "OS version number + OS compilation number + current system digits" will be created in the same directory. In addition, you can also click here to collect running files of software such as browsers and Office/PDF. output standard.

If the size of the file to be uploaded to the library directory is larger than the preset threshold, in order to improve the file transfer speed, as an optional method, the File Transfer Protocol (FTP) or Secure File Transfer Protocol (Secure File Transfer) can be used as an optional method. Protocol, SFTP), upload the file to the library directory. For example, for incremental packages or basic package files larger than a certain size, use ftp/sftp to upload the files to the specified directory, and submit the task directory directly to complete the analysis.

By applying the above solution, a solution for automatic library preparation of static instruction sequence features is provided correspondingly. By standardizing the system installation version, installation environment, and file collection method, static analysis is used to obtain the complete program instruction execution sequence, and the static instruction sequence feature library is created according to the specified rules, which is automatically produced and verified. It can meet the needs of static instruction sequence feature matching, and automatically generate basic library or incremental library. The subsequently created database can be applied to all scenarios based on instruction execution sequence feature matching.

Further, as a specific implementation of the method shown in FIG. 1 , an embodiment of the present application provides a processing device that can be applied to a static security feature database on the server side. As shown in FIG. 7 , the device includes: a reading module 41 , an analysis module 42 , and a creation module 43 .

The reading module 41 can be used to read the pre-collected files in the library-making directory, wherein the library-making directory contains files of different versions of the target official operating system running in the memory in a clean environment;

The analysis module 42 can be used to perform static disassembly analysis on the read file, and obtain the application program interface API calling sequence corresponding to the monitoring point;

The creating module 43 can be configured to create a static security feature database according to the API calling sequence.

In a specific application scenario, the analysis module 42 can be specifically configured to perform static disassembly analysis on the read file, and obtain the key API matching the preset key API list as the monitoring point; The key API is traced back to the preset level, and the API call sequence corresponding to the key API is obtained.

In a specific application scenario, the device may further include: an acquisition module 44, a matching module 45, and a determination module 46;

The acquiring module 44 can be used to acquire the target API calling sequence of the behavior to be detected after the static security feature database is created and obtained;

A matching module 45, configured to match the target API call sequence with the API call sequence in the static security feature database;

The determining module 46 may be configured to determine that the to-be-detected behavior is a suspected abnormal behavior if there is no matching API calling sequence in the static security feature database, and trigger a corresponding alarm.

In a specific application scenario, optionally, the library directory may further include an update file that runs in the memory in a clean environment after the target official operating system is patched.

In a specific application scenario, optionally, the library directory further includes new files generated in the memory when different genuine software runs separately in the target official operating system in a clean environment.

In a specific application scenario, optionally, the library directory also includes files of different versions of other official operating systems running in memory in a clean environment.

In a specific application scenario, optionally, the library directory further includes update files that run in the memory in a clean environment after the other official operating systems are patched.

In a specific application scenario, the library directory also includes new files generated in the memory when different genuine software runs separately in the other official operating systems in a clean environment.

It should be noted that, for other corresponding descriptions of the functional units involved in the apparatus for processing a static security feature database on the server side provided by this embodiment, reference may be made to the corresponding descriptions in FIG. 1 , which will not be repeated here. .

Further, as a specific implementation of the methods shown in FIG. 4 and FIG. 6 , an embodiment of the present application provides a processing device for a static security feature database on the client side. As shown in FIG. 8 , the device includes: acquiring Module 51 , sending module 52 .

Obtaining module 51, which can be used to obtain files running in the memory of the installed target official operating system in a clean environment;

The sending module 52 can be used to upload the file to the library directory, where the library directory contains files of different versions of the target official operating system running in the memory in a clean environment, so that according to the files in the library directory The static security feature database is created through the application program interface API calling sequence corresponding to the monitoring point obtained by static disassembly analysis.

In a specific application scenario, the obtaining module 51 can be specifically configured to install drivers, enable various service items of the target official operating system and set auto-start after installing the target official operating system, so as to obtain the target official operating system. Each process module file when the operating system runs in a clean environment; save the corresponding file hash value and file name directory of the process module file in the file list; set the module loading callback, and set the dynamic value within the preset running time. The module files are loaded and merged into the file list according to the corresponding file hash value and file name directory.

In a specific application scenario, the sending module 52 may be specifically configured to save the corresponding file in the library directory according to the file hash value and the file name directory in the file list.

In a specific application scenario, the sending module 52 may be further configured to obtain the corresponding file according to the file hash value and the file name directory in the file list; according to the operating system version corresponding to the target official operating system number, operating system edit number, and current system digits, and save the obtained file in the corresponding folder in the library directory.

In a specific application scenario, the sending module 52 may be further configured to upload the file to the library directory through FTP or SFTP if the file size is greater than a preset threshold.

It should be noted that, for other corresponding descriptions of the functional units involved in a processing device for a static security feature database on the client side provided by this embodiment, reference may be made to the corresponding descriptions in FIG. 4 and FIG. 6 , here No longer.

Based on the above method shown in FIG. 1 , correspondingly, an embodiment of the present application further provides a storage medium on which a computer program is stored, and when the program is executed by a processor, the above applicable service shown in FIG. 1 is implemented. The processing method of the static security feature database on the terminal side. Based on the above methods shown in FIG. 4 and FIG. 6 , the embodiment of the present application further provides another storage medium on which a computer program is stored, and when the program is executed by a processor, the above-mentioned methods shown in FIG. 4 and FIG. 6 are realized. A processing method applicable to the static security feature database on the client side.

Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, and the software product can be stored in a non-volatile storage medium (which may be CD-ROM, U disk, mobile hard disk, etc.), including several The instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute the methods of various implementation scenarios of the present application.

Based on the above method shown in FIG. 1 and the virtual device embodiment shown in FIG. 7 , in order to achieve the above purpose, an embodiment of the present application further provides a server, which may specifically be a computer, server equipment, or other network equipment, etc. . The device includes a storage medium and a processor; the storage medium is used to store a computer program; and the processor is used to execute the computer program to implement the above-mentioned processing method of the static security feature database on the server side as shown in FIG. 1 .

Based on the methods shown in FIG. 4 and FIG. 6 and the virtual device embodiment shown in FIG. 8 , in order to achieve the above purpose, an embodiment of the present application further provides a client device, which may specifically be a personal computer, a notebook computer , tablet computer, smart phone, or other network equipment, etc., the client device includes a storage medium and a processor; a storage medium for storing a computer program; a processor for executing the computer program to achieve the above-mentioned Figures 4 and 6 The shown processing method can be applied to the static security feature database on the client side.

Optionally, both of the above two physical devices may further include a user interface, a network interface, a camera, a radio frequency (Radio Frequency, RF) circuit, a sensor, an audio circuit, a WI-FI module, and the like. The user interface may include a display screen (Display), an input unit such as a keyboard (Keyboard), etc., and the optional user interface may also include a USB interface, a card reader interface, and the like. Optional network interfaces may include standard wired interfaces, wireless interfaces (such as WI-FI interfaces), and the like.

Those skilled in the art can understand that the physical device structure of a client device and a server provided in this embodiment does not constitute a limitation on the two physical devices, and may include more or less components, or combine some components , or a different component arrangement.

The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the above two physical devices, and supports the operation of information processing programs and other software and/or programs. The network communication module is used to realize the communication between various components in the storage medium, as well as the communication with other hardware and software in the information processing entity device.

Based on the above content, further, an embodiment of the present application further provides a processing system for a static security feature database. As shown in FIG. 9 , the system includes: a server 61 and a client device 62;

The server 61 may be used to execute the method shown in FIG. 1 , and the client device 62 may be used to execute the method shown in FIG. 4 and FIG. 6 .

The client device 62 can be used to obtain the files running in the memory of the installed target official operating system in a clean environment; and then upload the files to the library directory of the server 61 .

The server 61 can be used to first read the files collected in advance in the library directory, wherein the library directory contains files of different versions of the target official operating system running in the memory in a clean environment; Perform static disassembly analysis on the description file to obtain the API call sequence corresponding to the monitoring point; finally, create a static security feature database according to the API call sequence.

From the description of the above embodiments, those skilled in the art can clearly understand that the present application can be implemented by means of software plus a necessary general hardware platform, and can also be implemented by hardware. By applying the technical solution of the present application, a solution for automatic library preparation of static instruction sequence features is provided correspondingly. By standardizing the system installation version, installation environment, and file collection method, static analysis is used to obtain the complete program instruction execution sequence, and a static instruction sequence feature library is created according to the specified rules, which is automatically produced and verified. It can meet the needs of static instruction sequence feature matching, and automatically generate basic library or incremental library. The subsequently created database can be applied to all scenarios based on instruction execution sequence feature matching.

Those skilled in the art can understand that the accompanying drawing is only a schematic diagram of a preferred implementation scenario, and the modules or processes in the accompanying drawing are not necessarily necessary to implement the present application. Those skilled in the art can understand that the modules in the device in the implementation scenario may be distributed in the device in the implementation scenario according to the description of the implementation scenario, or may be located in one or more devices different from the implementation scenario with corresponding changes. The modules of the above implementation scenarios may be combined into one module, or may be further split into multiple sub-modules.

The above serial numbers in the present application are only for description, and do not represent the pros and cons of the implementation scenarios. The above disclosures are only a few specific implementation scenarios of the present application, however, the present application is not limited thereto, and any changes that can be conceived by those skilled in the art should fall within the protection scope of the present application.

Claims (29)

1. A method for processing a static security feature database, comprising:

reading files collected in advance in a library making directory, wherein the library making directory comprises files of target official operating systems of different versions running in a memory under a clean environment, and the files are obtained by installing the target official operating systems of different versions in a terminal to run; performing static disassembling analysis on the read file to obtain an application program interface API calling sequence corresponding to the monitoring point;

creating a static security feature database according to the API calling sequence;

the method includes that a terminal acquires a file of an installed target official operating system running in an internal memory in a clean environment, and specifically includes the following steps:

after the target official operating system is installed, the terminal installs a driver and starts each service item of the target official operating system and sets self-starting so as to obtain each process module file when the target official operating system runs in a clean environment;

the terminal stores the file hash value and the file name directory corresponding to the process module file in a file list;

and the terminal setting module loads and recalls, and loads and merges the dynamic module files in the preset running time into the file list according to the corresponding file hash value and the file name directory.

2. The method according to claim 1, wherein performing static disassembling analysis on the read file to obtain an API call sequence corresponding to the monitoring point specifically comprises:

performing static disassembling analysis on the read file, and acquiring a key API matched with a preset key API list as the monitoring point;

and backtracking the key API to a preset level, and acquiring an API calling sequence corresponding to the key API.

3. The method of claim 1, wherein after creating the static security feature database, the method further comprises:

acquiring a target API call sequence of a behavior to be detected;

matching the target API call sequence with an API call sequence in the static security feature database;

and if the static security feature database does not have a matched API calling sequence, determining that the behavior to be detected is a suspected abnormal behavior, and triggering to perform corresponding alarm.

4. The method of claim 1, wherein the library directory further comprises an update file that runs in a memory in a clean environment after the target official operating system installs a patch.

5. The method of claim 1, wherein the library catalogs further comprise new files generated in memory when different legal versions of software are run separately in the target official os in a clean environment.

6. The method of claim 1, wherein the library directory further comprises files of different versions of other official operating systems running in the memory in a clean environment.

7. The method of claim 6, wherein the library catalogs further comprise updated files that are run in memory in a clean environment after the other official operating systems have installed the patches.

8. The method of claim 6, wherein the library catalogs further comprise new files generated in the memory when different legal versions of software are respectively and independently run in the other official operating systems in the clean environment.

9. A method for processing a static security feature database, comprising:

acquiring a file of the installed target official operating system running in a memory under a clean environment;

uploading the file to a library making directory, wherein the library making directory comprises files of target official operation systems of different versions running in an internal memory under a clean environment, so that a static security feature database is created according to an Application Program Interface (API) calling sequence corresponding to the monitoring point, which is obtained by static disassembling analysis of the files in the library making directory;

the acquiring of the file of the installed target official operating system running in the memory in the clean environment specifically includes:

after the target official operating system is installed, installing a driver, starting each service item of the target official operating system and setting self-starting so as to obtain each process module file when the target official operating system runs in a clean environment;

storing the file hash value and the file name directory corresponding to the process module file in a file list;

and setting module loading callback, and loading and merging the dynamic module files in the preset running time into the file list according to the corresponding file hash value and the file name directory.

10. The method according to claim 9, wherein uploading the file into a library directory specifically comprises:

and storing the corresponding file in the library making directory according to the file hash value and the file name directory in the file list.

11. The method according to claim 10, wherein storing the corresponding file in the library-making directory according to the file hash value and the file name directory in the file list specifically comprises:

acquiring a corresponding file according to the file hash value and the file name directory in the file list;

and storing the acquired file in a corresponding folder in the library making directory according to the operating system version number, the operating system edition number and the current system digit corresponding to the target official operating system.

12. The method according to claim 9, wherein if the file size is larger than a preset threshold, the uploading the file to a library manufacturing directory specifically comprises:

and uploading the file to a library directory through a File Transfer Protocol (FTP) or a Secure File Transfer Protocol (SFTP).

13. A processing apparatus for a static security feature database, comprising:

the reading module is used for reading files collected in advance in a library making directory, wherein the library making directory comprises files of target official operating systems of different versions running in a memory under a clean environment, and the files are obtained by installing the target official operating systems of different versions in a terminal to run;

the analysis module is used for performing static disassembling analysis on the read file to obtain an application program interface API calling sequence corresponding to the monitoring point;

the creating module is used for creating a static security feature database according to the API calling sequence;

after the target official operating system is installed, the terminal installs, drives and starts each service item of the target official operating system and sets self-starting so as to obtain each process module file when the target official operating system runs in a clean environment;

the terminal stores the file hash value and the file name directory corresponding to the process module file in a file list;

and the terminal setting module loads and recalls, and loads and merges the dynamic module files in the preset running time into the file list according to the corresponding file hash value and the file name directory.

14. The apparatus of claim 13,

the analysis module is specifically configured to perform static disassembling analysis on the read file, and acquire a key API matched with a preset key API list as the monitoring point;

and backtracking the key API to a preset level, and acquiring an API calling sequence corresponding to the key API.

15. The apparatus of claim 13, further comprising:

the acquisition module is used for acquiring a target API call sequence of the behavior to be detected after the static security feature database is established;

the matching module is used for matching the target API calling sequence with the API calling sequence in the static security feature database;

and the determining module is used for determining that the behavior to be detected is suspected abnormal behavior and triggering to perform corresponding alarm if the matched API calling sequence does not exist in the static security feature database.

16. The apparatus of claim 13, wherein the library directory further comprises an update file that runs in a memory in a clean environment after the target official operating system installs the patch.

17. The apparatus of claim 13, wherein the library catalogs further comprise new files generated in memory when different legal versions of software are run separately in the target official os in a clean environment.

18. The apparatus of claim 13, wherein the library directory further comprises files of different versions of other official operating systems running in the clean environment memory.

19. The apparatus of claim 18, wherein the library catalogs further comprise updated files that are run in memory in a clean environment after the other official operating systems have installed the patches.

20. The apparatus of claim 18, wherein the library catalogs further comprise new files generated in the memory when different legal versions of software are run separately in the other official operating systems in a clean environment.

21. A processing apparatus for a static security feature database, comprising:

the acquisition module is used for acquiring files of the installed target official operating system running in the memory under the clean environment;

the sending module is used for uploading the file to a library making directory, wherein the library making directory comprises files of target official operation systems of different versions running in a memory under a clean environment, so that a static safety characteristic database is created according to an Application Program Interface (API) calling sequence corresponding to the monitoring point, which is obtained by static disassembling analysis of the files in the library making directory;

the acquiring module is specifically configured to, after the target official operating system is installed, install a driver and start each service item of the target official operating system and set a self-start, so as to acquire each process module file of the target official operating system when the target official operating system runs in a clean environment;

storing the file hash value and the file name directory corresponding to the process module file in a file list;

and setting module loading callback, and loading and merging the dynamic module files in the preset running time into the file list according to the corresponding file hash value and the file name directory.

22. The apparatus of claim 21,

the sending module is specifically configured to store the corresponding file in the library manufacturing directory according to the file hash value and the file name directory in the file list.

23. The apparatus of claim 22,

the sending module is specifically further configured to obtain a corresponding file according to the file hash value and the file name directory in the file list;

and storing the acquired files in corresponding folders in the library making directory according to the operating system version number, the operating system editing number and the current system digit corresponding to the target official operating system.

24. The apparatus of claim 21,

the sending module is specifically configured to upload the file to a library directory through a File Transfer Protocol (FTP) or a Secure File Transfer Protocol (SFTP) if the size of the file is greater than a preset threshold.

25. A storage medium on which a computer program is stored, which program, when being executed by a processor, carries out the method of processing a static security feature database according to any one of claims 1 to 8.

26. A server comprising a storage medium, a processor and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the processing method of the static security feature database according to any one of claims 1 to 8 when executing the program.

27. A storage medium on which a computer program is stored, which program, when being executed by a processor, carries out the method of processing a static security feature database according to any one of claims 9 to 12.

28. A client device comprising a storage medium, a processor and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the processing method of the static security feature database according to any one of claims 9 to 12 when executing the program.

29. A system for processing a static security feature database, comprising: a server as claimed in claim 26 and a client device as claimed in claim 28.

Images