CN114499928B - Remote registry monitoring method and device - Google Patents

Abstract

The embodiment of the present invention provides a remote registry monitoring method and device. The monitoring method is applied to a device in an intranet, and includes: in response to the remote registry service process of the operating system calling a remote registry operation function, performing a remote registry operation, and obtaining data of the remote registry operation; based on the obtained data of the remote registry operation, obtaining the address of the target device in the intranet that initiated the remote registry operation; and performing a security identification of the remote registry operation based on the obtained address of the target device in the intranet and the data of the remote registry operation. The embodiment of the present invention can solve the problem of lack of effective and accurate identification of the behavior of the intranet remote registry operation in monitoring network attacks, and improve the device's ability to detect security threats.

Description

Remote registry monitoring method and device

Technical Field

The present invention relates to the technical field of network security, and in particular to a remote registry monitoring method and device.

Background technique

In the complete attack chain of network penetration, the intranet remote lateral penetration stage is that the attacker uses a compromised device as a springboard to try to attack other devices in the same network, obtain more valuable credentials and higher-level permissions, thereby expanding the attack surface and controlling the entire intranet.

The registry plays an important role in the Windows system. It stores various parameters and directly controls the startup of the Windows operating system, the loading of hardware drivers, and the operation of some Windows applications. The Remote Registry service is a function provided by the Windows system for remotely modifying and viewing the registry information of local devices. Remote attacks through the remote registry are a common attack method for attackers to penetrate the intranet horizontally. It is a capability that exploits the operating system's own mechanism.

The existing registry monitoring method can only identify registry operations initiated locally. There is a lack of effective and accurate identification protection mechanism for attackers who use compromised devices in the intranet as a springboard to initiate remote registry operations on other devices in the intranet, which makes the devices on the defender in a state of monitoring failure. Existing network attack detection methods cannot effectively and accurately cover such attack methods.

Summary of the invention

In view of the problems in the prior art, an embodiment of the present invention provides a remote registry monitoring method and device.

Specifically, the embodiment of the present invention provides the following technical solutions:

In a first aspect, an embodiment of the present invention provides a remote registry monitoring method, which is applied to a device in an intranet, including:

In response to the remote registry service process of the operating system calling the remote registry operation function, performing the remote registry operation and obtaining the data of the remote registry operation;

Based on the acquired data of the remote registry operation, acquiring an address of a target device in the intranet that initiates the remote registry operation;

The remote registry operation is security authenticated according to the acquired address of the target device in the intranet and the data of the remote registry operation.

Further, the monitoring method is executed by setting a HOOK function in the remote registry operation function of the device in the intranet;

The HOOK function is set in the remote registry operation function, including:

Find the remote registry service process of the operating system, and install a monitoring module in the remote registry service process;

The HOOK function is set in the remote registry operation function of the remote registry service process through the monitoring module.

Further, setting the HOOK function in the remote registry operation function of the remote registry service process includes:

Determining a remote registry core function file called by the remote registry service process;

Determining the remote registry interface in the remote registry core function file based on an identifier of the remote registry interface;

The HOOK function is set in the remote registry operation function of the determined remote registry interface.

Furthermore, the remote registry service process performs the remote registry operation, and the remote registry operation function called includes at least one of a registry key modification function, a registry key deletion function, a registry key query function, and a registry data restoration function.

Further, the determining of the remote registry core function file called by the remote registry service process includes:

Determine the memory address of the regsvc.dll file called by the remote registry service process;

The identifier based on the remote registry interface, determining the remote registry interface in the remote registry core function file, comprises:

Based on the identifier of the IRemoteRegistry interface, determining the address of the IRemoteRegistry interface in the regsvc.dll file;

The step of setting the HOOK function in the remote registry operation function of the determined remote registry interface comprises:

Based on the memory address of the IRemoteRegistry interface, the HOOK function is set in the BaseRegSetValue function, BaseRegDeleteKe function, BaseRegDeleteValue function, BaseRegQueryValue function and BaseRegRestoreKey function of the IRemoteRegistry interface.

Further, obtaining the data of the remote registry operation includes:

Calling an application program interface function to obtain the return data of the remote registry operation;

The step of acquiring the address of the target device in the intranet that initiates the remote registry operation based on the acquired data of the remote registry operation includes:

The address of the target device in the intranet that initiates the remote registry operation is obtained from the returned data of the remote registry operation.

Furthermore, after performing security authentication on the remote registry operation according to the acquired address of the target device in the intranet and the data of the remote registry operation, the method further includes:

Determining whether the security identification result indicates that the remote registry operation is an attack behavior;

If the security identification result is that the remote registry operation is an attack behavior, the remote registry operation is protected and intercepted;

If the security identification result is that the remote registry operation is a non-attack behavior, the remote registry operation function is returned to continue execution.

In a second aspect, an embodiment of the present invention further provides a remote registry monitoring device, which is applied to a device in an intranet, including:

A data acquisition module, used for performing remote registry operation in response to the remote registry service process of the operating system calling the remote registry operation function, and acquiring the data of the remote registry operation;

An address acquisition module, configured to acquire an address of a target device in the intranet that initiates the remote registry operation based on the acquired data of the remote registry operation;

The information sending module is used to perform security authentication on the remote registry operation according to the acquired address of the target device in the intranet and the data of the remote registry operation.

In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the remote registry monitoring method described in the first aspect are implemented.

In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the remote registry monitoring method described in the first aspect.

In a fifth aspect, an embodiment of the present invention further provides a computer program product having executable instructions stored thereon, which, when executed by a processor, enables the processor to implement the steps of the remote registry monitoring method as described in the first aspect.

The remote registry monitoring method and device provided by the embodiment of the present invention can obtain the data of the remote registry operation and monitor the remote registry operation by calling the remote registry operation function in the remote registry service process of the operating system when performing the remote registry operation. The behavior of the remote registry operation from the intranet can be accurately identified, and the address of the intranet device that initiates the remote registry operation can be obtained. The behavior of the remote registry operation can be further security identified based on the obtained data and address. In the event of a remote lateral penetration attack on the intranet, the attacker's information can be obtained in real time, and the attacker's address can be obtained to further track and trace the source, thereby effectively improving the security defense capability of the device, solving the problem of lack of effective and accurate identification of the behavior of the intranet remote registry operation in monitoring network attacks, and improving the device's detection capability of security threats.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

FIG1 is a schematic diagram of a flow chart of a remote registry monitoring method provided by the present invention;

2 is a schematic diagram of a flow chart of setting a HOOK function in a remote registry operation function provided by the present invention;

3 is a schematic diagram of a flow chart of setting a HOOK function through a monitoring module provided by the present invention;

4 is a schematic diagram of a flow chart of another monitoring module setting a HOOK function provided by the present invention;

5 is a schematic diagram of a flow chart of obtaining data of a remote registry operation provided by the present invention;

6 is a flow chart of an application scenario of the remote registry monitoring method provided by the present invention;

7 is a schematic diagram of the composition structure of the remote registry monitoring device provided by the present invention;

FIG8 is a schematic diagram of the physical structure of the electronic device provided by the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

The remote registry monitoring method of the present invention is described below in conjunction with FIG. 1 to FIG. 6 .

Please refer to FIG. 1 , which is a flow chart of a remote registry monitoring method provided by the present invention. The remote registry monitoring method shown in FIG. 1 is applied to a device in an intranet. As shown in FIG. 1 , the remote registry monitoring method at least includes:

101. In response to the remote registry service process of the operating system calling a remote registry operation function, a remote registry operation is performed to obtain remote registry operation data.

In the embodiment of the present invention, the intranet may be an enterprise LAN, a campus LAN, a shopping mall LAN, etc. The embodiment of the present invention does not limit the application scenario of the intranet, and the intranet may include a wired network and/or a wireless network. The devices in the intranet may be personal computers, servers, workstations, etc., and the embodiment of the present invention does not limit the types of devices in the intranet. The operating system for managing computer hardware and software resources running in the devices in the intranet is a Windows system, such as Windows 10. The embodiment of the present invention does not limit the version of the Windows system running in the devices in the intranet. The remote registry service can be executed by a remote registry service process that is started when the operating system is started and runs in the background. The remote registry operation function is a function for performing remote registry operations. The remote registry service process can remotely operate the registry through the remote registry operation function, such as remotely querying key values, remotely modifying key values, and remotely restoring data through a remote procedure call (RPC). The embodiment of the present invention does not limit the type of the remote registry operation function.

In an embodiment of the present invention, when the remote registry service process of the operating system calls a remote registry operation function to perform a remote registry operation, the data of the remote registry operation performed by the remote registry operation function, i.e., the remote registry operation data, can be captured. The behavioral characteristics of the remote registry operation can be reflected through the acquired remote registry operation data. For example, the acquired remote registry operation data can include the return data of the remote registry operation. The embodiment of the present invention does not limit the type of the captured remote registry operation data.

102. Based on the acquired data of the remote registry operation, acquire the address of the target device in the intranet that initiates the remote registry operation.

In an embodiment of the present invention, after obtaining the data of the remote registry operation, the address of the target device in the intranet that initiated the remote registry operation can be obtained based on the obtained data of the remote registry operation. Optionally, the method for obtaining the address of the target device in the intranet that initiated the remote registry operation can be determined based on the type of the remote registry operation data obtained, so as to obtain the address of the target device in the intranet that initiated the remote registry operation based on the obtained data of the remote registry operation, which is not limited in the embodiment of the present invention. For example, the obtained data of the remote registry operation includes the return data of the remote registry operation, and the IP address of the target device in the intranet that initiated the remote registry operation can be directly obtained from the return data of the remote registry operation.

103 , performing security authentication on the remote registry operation according to the acquired address of the target device in the intranet and the data of the remote registry operation.

In an embodiment of the present invention, after obtaining the data of the remote registry operation and the address of the target device in the intranet, the remote registry operation can be security-identified based on the obtained data of the remote registry operation and the address of the target device in the intranet. Optionally, it can also be determined whether to perform protection interception on the remote registry operation based on the security identification result. For example, it can be determined whether the security identification result shows that the remote registry operation is an attack behavior. If the security identification result shows that the remote registry operation is an attack behavior, the remote registry operation can be protected and intercepted to prevent the attacker from further expanding the attack surface and improve the security protection capability of the device. If the security identification result shows that the remote registry operation is a non-attack behavior, the remote registry operation function can be returned to continue execution. For example, the obtained data of the remote registry operation and the address of the target device in the intranet can be sent to the threat behavior identification engine for security identification, and the security identification result fed back by the threat behavior identification engine can be received. The threat behavior identification engine is a cloud-based behavior identification system. It can detect whether the operation behavior is an attack behavior by forming a set of rules for matching behavior data based on the accumulated experience of security operation experts.

The remote registry monitoring method provided by the embodiment of the present invention obtains the data of the remote registry operation and monitors the remote registry operation by calling the remote registry operation function in the remote registry service process of the operating system when performing the remote registry operation. The behavior of the remote registry operation from the intranet can be accurately identified, and the address of the intranet device that initiates the remote registry operation can be obtained. The behavior of the remote registry operation can be further security identified based on the obtained data and address. In the event of a remote lateral penetration attack on the intranet, the attacker's information can be obtained in real time, and the attacker's address can be obtained to further track and trace the source, thereby effectively improving the security defense capability of the device, solving the problem of lack of effective and accurate identification of the behavior of the intranet remote registry operation in monitoring network attacks, and improving the device's detection capability of security threats.

The Hook function is also called a hook function, which is used to capture the function call first when the system calls a function, obtain the control of the function, and perform additional processing on the function. The HOOK function can be pre-set in the remote registry operation function, and the remote registry operation can be monitored through the HOOK function. Please refer to Figure 2, which is a flow chart of setting the HOOK function in the remote registry operation function provided by the present invention. As shown in Figure 2, setting the HOOK function in the remote registry operation function at least includes:

201, find the remote registry service process of the operating system, and install the monitoring module in the remote registry service process.

In the embodiment of the present invention, the remote registry service process of the operating system can be found by calling an application programming interface (API) function provided by the operating system to obtain a process identifier (PID) of the remote registry service process. For example, the application programming interface function is QueryServiceStatusEx. Then, according to the obtained process identifier of the remote registry service process, a monitoring module can be injected into the remote registry service process. The method of injecting the monitoring module into the remote registry service process can adopt an existing process injection method, which is not limited in the embodiment of the present invention.

202, setting a HOOK function in a remote registry operation function of a remote registry service process through a monitoring module.

In an embodiment of the present invention, after installing a monitoring module in a remote registry service process of an operating system, the monitoring module can determine a remote registry operation function according to the remote registry service process, and set a HOOK function in the remote registry operation function. The embodiment of the present invention does not limit the method by which the monitoring module determines the remote registry operation function according to the remote registry service process. For example, the remote registry core function file called by the remote registry service process can be determined according to the remote registry service process, and the remote registry operation function can be determined in the remote registry core function file. The embodiment of the present invention does not limit the method by which the monitoring module sets the HOOK function in the remote registry operation function. For example, the HOOK function can be set in the remote registry operation function by modifying the code of the remote registry operation function.

Please refer to FIG. 3 , which is a flow chart of setting a HOOK function through a monitoring module provided by the present invention. As shown in FIG. 3 , the monitoring module setting a HOOK function at least includes:

301, determine the remote registry core function file called by the remote registry service process.

In an embodiment of the present invention, the monitoring module can obtain the file called by the remote registry service process according to the remote registry service process, and determine the remote registry core function file according to the file called by the remote registry service process. The remote registry core function file is a file used to provide the remote registry function. For example, the remote registry core function file can be a dynamic link file (Dynamic Link Library, referred to as DLL). Among them, the method for obtaining the file called by the remote registry service process can be implemented by the method of the prior art, and the embodiment of the present invention does not limit this. After obtaining the file called by the remote registry service process, the address of the remote registry core function file called by the remote registry service process in the memory can be determined according to the name of the remote registry core function file.

302. Determine the remote registry interface in the remote registry core function file based on the identifier of the remote registry interface.

In an embodiment of the present invention, after determining the remote registry core function file called by the remote registry service process, the monitoring module can search the remote registry core function file according to the unique identifier (Globally Unique Identifier, GUID) in the data structure of the remote registry interface, and locate the corresponding remote registry interface in the remote registry core function file. Among them, the method of searching and locating the remote registry interface in the remote registry core function file according to the GUID can be implemented by the method of the prior art, and the embodiment of the present invention does not limit this. By searching in the remote registry core function file according to the GUID, the address of the corresponding remote registry interface in the memory can be located in the remote registry core function file.

303, setting a HOOK function in the remote registry operation function of the determined remote registry interface.

In an embodiment of the present invention, after determining the remote registry interface in the remote registry core function file, the monitoring module can set the HOOK function in the remote registry operation function of the remote registry interface according to the determined remote registry interface. Among them, the HOOK function can be set in the remote registry operation function of the remote registry interface according to the address of the determined remote registry interface in the memory. For example, the code of the remote registry operation function can be modified in the memory according to the address of the remote registry interface in the memory, and the HOOK function can be set in the remote registry operation function, so that when the remote registry operation function is called, it can enter the HOOK function, and after the HOOK function is executed, it can return to the remote registry operation function to continue execution.

In some optional examples, the remote registry service process performs remote registry operations, and the remote registry operation functions called may include at least one of modifying registry key value functions, deleting registry key functions, deleting registry key value functions, querying registry key value functions, and restoring registry data functions. For example, the monitoring module sets HOOK functions in the modify registry key value function, delete registry key value function, delete registry key value function, query registry key value function and restore registry data function of the remote registry interface; when the remote registry service process of the operating system calls the modify registry key value function to modify the remote registry key value, the HOOK function set in the modify registry key value function will obtain the data of remote modification of the registry key value in response to the call of the modify registry key value function by the remote registry service process; when the remote registry service process of the operating system calls the query registry key value function and the delete registry key value function to query the remote registry key value and remotely delete the queried registry key value, the HOOK function set in the call query registry key value function will obtain the data of remote query registry key value in response to the call of the query registry key value function by the remote registry service process, and the HOOK function set in the delete registry key value function will obtain the data of remote deletion of the registry key value in response to the call of the delete registry key value function by the remote registry service process.

Please refer to FIG. 4 , which is a flow chart of another monitoring module setting HOOK function provided by the present invention. As shown in FIG. 4 , the monitoring module setting HOOK function at least includes:

401, determine the memory address of the regsvc.dll file called by the remote registry service process.

402. Based on the identifier of the IRemoteRegistry interface, determine the address of the IRemoteRegistry interface in the regsvc.dll file.

403, based on the memory address of the IRemoteRegistry interface, set the HOOK function in the BaseRegSetValue function, BaseRegDeleteKe function, BaseRegDeleteValue function, BaseRegQueryValue function and BaseRegRestoreKey function of the IRemoteRegistry interface.

In an embodiment of the present invention, the monitoring module first determines the memory address of the remote registry core function file regsvc.dll called by the Windows system remote registry service process, and then searches in the memory address of regsvc.dll according to the GUID in the data structure of the remote registry interface IRemoteRegistry, and locates the memory address of the IRemoteRegistry interface in the memory address of regsvc.dll, and then sets the HOOK function by modifying the code of the function in the registry key value modification function BaseRegSetValue, the registry key deletion function BaseRegDeleteKe, the registry key value deletion function BaseRegDeleteValue, the registry key value query function BaseRegQueryValue and the registry data restoration function BaseRegRestoreKey of the IRemoteRegistry interface.

Please refer to FIG. 5 , which is a schematic diagram of a flow chart of obtaining data of a remote registry operation provided by the present invention. As shown in FIG. 5 , obtaining data of a remote registry operation at least includes:

501, call the application program interface function to obtain the return data of the remote registry operation.

In an embodiment of the present invention, the HOOK function can obtain the return data of the remote registry operation by calling the application interface function RpcServerInqCallAttributes. The return data of the remote registry operation records information such as the remote registry operation name, remote registry operation execution data, and the IP address of the device that initiated the remote registry operation.

502. Obtain the address of the target device in the intranet that initiates the remote registry operation from the returned data of the remote registry operation.

In an embodiment of the present invention, after obtaining the return data of the remote registry operation, the HOOK function can directly obtain the IP address of the target device in the intranet that initiated the remote registry operation from the return data of the remote registry operation. For example, if the remote registry operation is the remote registry operation name: delete registry key value, and the remote registry operation execution data: KeyPath: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, KeyValueName: AntiVirus, IP: 192.168.44.138, the IP address of the target device in the intranet that initiated the remote deletion of the registry key can be directly obtained as 192.168.44.138.

Please refer to FIG. 6, which is a flow chart of an application scenario of the remote registry monitoring method provided by the present invention. As shown in FIG. 6, in an embodiment of the present invention, firstly, the remote registry (RemoteRegistry) service process of the operating system is searched, and a monitoring module is installed in the remote registry service process; then, the GetModuleHandle function is called by the monitoring module to obtain the memory address of the regsvc.dll file of the remote registry service process, and the memory address of the IRemoteRegistry interface is searched and located in the regsvc.dll file according to the GUID of the IRemoteRegistry interface, and the HOOK function is set in the RPC remote registry operation function of the IRemoteRegistry interface; the RPC service function of the IRemoteRegistry interface includes BaseRegSetVa lue (modify registry key value) function, BaseRegDeleteKey (delete registry key) function, BaseRegDeleteValue (delete registry key value) function, BaseRegQueryValue (query registry key value) function, BaseRegRestoreKey (restore registry data) function; then monitor the remote registry operation through the HOOK function. When the remote registry service process calls the remote registry operation function to perform remote registry operation, the HOOK function can obtain the data of the remote registry operation, and obtain the IP address of the device in the intranet that initiated the remote registry operation from the data of the remote registry operation; finally, send the obtained remote registry operation data and IP address to the threat behavior recognition engine for security identification, and intercept the remote registry operation behavior according to the final identification result.

The remote registry monitoring device provided by the present invention is described below. The remote registry monitoring device described below and the remote registry monitoring method described above can be referred to each other.

Please refer to FIG. 7, which is a schematic diagram of the composition structure of the remote registry monitoring device provided by the present invention. The remote registry monitoring device shown in FIG. 7 is applied to a device in an intranet. As shown in FIG. 7, the remote registry monitoring device at least includes:

The data acquisition module 710 is used to perform remote registry operations and acquire remote registry operation data in response to the remote registry service process of the operating system calling the remote registry operation function.

The address acquisition module 720 is used to acquire the address of the target device in the intranet that initiates the remote registry operation based on the acquired data of the remote registry operation.

The information sending module 730 is used to perform security authentication on the remote registry operation according to the acquired address of the target device in the intranet and the data of the remote registry operation.

Optionally, the remote registry monitoring device is set in a HOOK function set in a remote registry operation function of a device in the intranet, and the remote registry monitoring device further includes:

The monitoring installation module is used to find the remote registry service process of the operating system and install the monitoring module in the remote registry service process.

The HOOK function setting module is used to set the HOOK function in the remote registry operation function of the remote registry service process through the monitoring module.

Optionally, the HOOK function setting module includes:

The core file determination unit is used to determine the remote registry core function file called by the remote registry service process.

The service interface determining unit is used to determine the remote registry interface in the remote registry core function file based on the identifier of the remote registry interface.

The HOOK function setting unit is used to set the HOOK function in the remote registry operation function of the determined remote registry interface.

Optionally, the remote registry service process performs remote registry operations, and the remote registry operation function called includes at least one of a registry key modification function, a registry key deletion function, a registry key value deletion function, a registry key value query function, and a registry data restoration function.

Optionally, the core file determination unit is used to determine the memory address of the regsvc.dll file called by the remote registry service process.

The service interface determination unit is used to determine the address of the IRemoteRegistry interface in the regsvc.dll file based on the identifier of the IRemoteRegistry interface.

The HOOK function setting unit is used to set the HOOK function in the BaseRegSetValue function, BaseRegDeleteKe function, BaseRegDeleteValue function, BaseRegQueryValue function and BaseRegRestoreKey function of the IRemoteRegistry interface based on the memory address of the IRemoteRegistry interface.

Optionally, the data acquisition module 710 is used to call an application program interface function to acquire return data of a remote registry operation.

The address acquisition module 720 is used to acquire the address of the target device in the intranet that initiates the remote registry operation from the returned data of the acquired remote registry operation.

Optionally, the remote registry monitoring device further includes:

The result judgment module is used to judge whether the security identification result shows that the remote registry operation is an attack behavior.

The protection interception module is used to perform protection interception on the remote registry operation according to the judgment result of the result judgment module, if the security identification result is that the remote registry operation is an attack behavior.

The end return module is used to return to the remote registry operation function to continue execution according to the judgment result of the result judgment module. If the security identification result is that the remote registry operation is not an attack behavior, the remote registry operation function is returned to continue execution.

FIG8 illustrates a schematic diagram of the physical structure of an electronic device. As shown in FIG8 , the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the following method: in response to the remote registry service process of the operating system calling the remote registry operation function, perform a remote registry operation, and obtain the data of the remote registry operation; based on the obtained data of the remote registry operation, obtain the address of the target device in the intranet that initiates the remote registry operation; and perform security authentication on the remote registry operation according to the obtained address of the target device in the intranet and the data of the remote registry operation.

In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

On the other hand, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the methods provided in the above embodiments, for example including: in response to the remote registry service process of the operating system calling a remote registry operation function, performing a remote registry operation, and obtaining data of the remote registry operation; based on the obtained data of the remote registry operation, obtaining the address of the target device in the intranet that initiated the remote registry operation; and performing a security authentication on the remote registry operation based on the obtained address of the target device in the intranet and the data of the remote registry operation.

The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM/RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (8)

1. A remote registry monitoring method, characterized in that it is applied to a device in an intranet, comprising: In response to the remote registry service process of the operating system calling the remote registry operation function, performing the remote registry operation and obtaining the data of the remote registry operation; Based on the acquired data of the remote registry operation, acquiring an address of a target device in the intranet that initiates the remote registry operation; Performing security authentication on the remote registry operation according to the acquired address of the target device in the intranet and the data of the remote registry operation; The monitoring method is executed by setting a HOOK function in the remote registry operation function of the device in the intranet; The HOOK function is set in the remote registry operation function, including: Find the remote registry service process of the operating system, and install a monitoring module in the remote registry service process; Setting the HOOK function in the remote registry operation function of the remote registry service process through the monitoring module; Setting the HOOK function in the remote registry operation function of the remote registry service process includes: Determining a remote registry core function file called by the remote registry service process; Determining the remote registry interface in the remote registry core function file based on an identifier of the remote registry interface; The HOOK function is set in the remote registry operation function of the determined remote registry interface. 2. The remote registry monitoring method according to claim 1 is characterized in that the remote registry service process performs the remote registry operation, and the remote registry operation function called includes at least one of a registry key value modification function, a registry key deletion function, a registry key value deletion function, a registry key value query function and a registry data restoration function. 3. The remote registry monitoring method according to claim 2, wherein determining the remote registry core function file called by the remote registry service process comprises: Determine the memory address of the regsvc.dll file called by the remote registry service process; The identifier based on the remote registry interface, determining the remote registry interface in the remote registry core function file, comprises: Based on the identifier of the IRemoteRegistry interface, determining the address of the IRemoteRegistry interface in the regsvc.dll file; The step of setting the HOOK function in the remote registry operation function of the determined remote registry interface comprises: Based on the memory address of the IRemoteRegistry interface, the HOOK function is set in the BaseRegSetValue function, BaseRegDeleteKe function, BaseRegDeleteValue function, BaseRegQueryValue function and BaseRegRestoreKey function of the IRemoteRegistry interface. 4. The remote registry monitoring method according to any one of claims 1 to 3, characterized in that obtaining the data of the remote registry operation comprises: Calling an application program interface function to obtain the return data of the remote registry operation; The step of acquiring the address of the target device in the intranet that initiates the remote registry operation based on the acquired data of the remote registry operation includes: The address of the target device in the intranet that initiates the remote registry operation is obtained from the returned data of the remote registry operation. 5. The remote registry monitoring method according to claim 4, characterized in that after performing security authentication on the remote registry operation based on the acquired address of the target device in the intranet and the data of the remote registry operation, it further comprises: Determining whether the security identification result indicates that the remote registry operation is an attack behavior; If the security identification result is that the remote registry operation is an attack behavior, the remote registry operation is protected and intercepted; If the security identification result is that the remote registry operation is a non-attack behavior, the remote registry operation function is returned to continue execution. 6. A remote registry monitoring device, characterized in that it is applied to a device in an intranet, comprising: A data acquisition module, used for performing remote registry operation in response to the remote registry service process of the operating system calling the remote registry operation function, and acquiring the data of the remote registry operation; An address acquisition module, configured to acquire an address of a target device in the intranet that initiates the remote registry operation based on the acquired data of the remote registry operation; An information sending module, used for performing security authentication on the remote registry operation according to the acquired address of the target device in the intranet and the data of the remote registry operation; The monitoring device is executed by setting a HOOK function in the remote registry operation function of the device in the intranet; The device also includes: A monitoring installation module is used to find the remote registry service process of the operating system and install the monitoring module in the remote registry service process; A HOOK function setting module is used to set a HOOK function in a remote registry operation function of a remote registry service process through a monitoring module; The HOOK function setting module includes: A core file determination unit, used for determining a remote registry core function file called by a remote registry service process; A service interface determination unit, configured to determine a remote registry interface in a remote registry core function file based on an identifier of the remote registry interface; The HOOK function setting unit is used to set the HOOK function in the remote registry operation function of the determined remote registry interface. 7. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the remote registry monitoring method according to any one of claims 1 to 5 are implemented. 8. A non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of the remote registry monitoring method according to any one of claims 1 to 5 are implemented.