WO2021046811A1 - Attack behavior determination method and apparatus, and computer storage medium - Google Patents

Abstract

Disclosed in the present invention are an attack behavior determination method and apparatus, a computer storage medium, and a computing device. The attack behavior determination method comprises: monitoring an actual execution condition of a specified operation, and obtaining an actual instruction execution logic sequence of the specified operation; comparing the actual instruction execution logic sequence of the specified operation with a preset instruction execution logic sequence of the specified operation; and if the actual instruction execution logic sequence of the specified operation is inconsistent with the preset instruction execution logic sequence of the specified operation, determining that an attack behavior is happening. Embodiments of the present invention depart from the hierarchy of "code characteristics and behavior" and are innovatively based on the hierarchy of the instruction execution logical sequence; the preset instruction execution logic sequence of the specified operation is compared with the actual instruction execution logic sequence; if the preset instruction execution logic sequence is inconsistent with the actual instruction execution logic sequence, it is determined that the attack behavior is happening, so that different types of attack behaviors can be effectively found.

Description

Method, device and computer storage medium for judging attack behavior Technical field

The present invention relates to the field of information network security, in particular to a method, a device, a computer storage medium and a computing device for determining an attack behavior.

Background technique

APT (Advanced Persistent Threat, Advanced Persistent Threat) is a cyber attack and intrusion launched by hackers for the purpose of stealing core information against customers. It is a long-planned "malicious business espionage threat." This kind of behavior is often after long-term management and planning, and has a high degree of concealment. The attack method of APT is to conceal oneself and steal data from a specific target in a long-term, planned and organized manner. This act of stealing information and collecting information in the digital space is a kind of "cyber espionage" behavior.

The biggest difference between APT attacks and ordinary network attacks is the purpose and long-term sustainability. Ordinary attacks usually do not have a clear target. As long as there are vulnerabilities and within the scope of the attack, the system will be attacked indiscriminately, and the follow-up work will be carried out immediately when the attack is successful, or damage, or steal, or control . An APT attack usually has a clear target in advance, and the system that is not the target will not be attacked even if there are loopholes. And has a clear purpose of attack, mainly based on stealing. After the attack is successful, it does not work immediately, but hides it. When certain conditions are met, or the target object appears, it will quickly attack to complete the intended purpose.

Technically, APT attacks usually use exclusive private vulnerabilities and write exclusive private attack codes. The vulnerabilities and codes will not spread on a large scale. Basically, it is difficult for security companies to obtain samples, and it is also difficult to pass "features". "Matching" means to discover APT attacks. In addition, APT attacks are usually in a hidden state, and there will not be too many additional behaviors before obtaining instructions to initiate a formal attack or before the attack target appears. It is also difficult for security software to detect APT attacks through "behavior identification". Finally, APT attacks are usually initiated by countries or organizations. They have abundant available resources and can implement various effective protections. They can hide themselves in normal software and hardware codes and wait for opportunities to act silently.

The Stuxnet virus, which was once a sensation, fully demonstrated the concealment, harm, and difficulty of APT attacks.

The target of the Stuxnet virus attack is clear: a nuclear plant in a certain country.

The resources invested are huge: 4 0Day vulnerabilities in operating systems and 2 0Day vulnerabilities in industrial control systems create a complete combined attack chain.

The attack cycle is very long: first infect the system maintenance contractor of the nuclear plant, and wait latently, until the infected device enters the isolation network of its real target "nuclear plant", and then spreads horizontally, infects the industrial control system, and destroys Nuclear industry facilities lasted one year before and after.

Use trusted programs to cover up: The core drivers of the attack components have legal digital signatures.

The current security technology, the detection of malicious attacks, still stays at the judgment level of "code malicious feature comparison detection" and "sensitive and dangerous behavior trigger detection", and the system itself and the program with legal digital signature of a formal company usually will Give the default trust without checking.

Therefore, for APT attacks that have no known characteristics, no behaviors, and even trusted programs as a cover, the current security technology has no substantial discovery and protection effects, and it is urgent to solve this technical problem.

Summary of the invention

In view of the above-mentioned problems, the present invention is proposed to provide a method, device, computer storage medium and computing device for determining attack behaviors that overcome the above-mentioned problems or at least partially solve the above-mentioned problems, which can effectively discover various attack behaviors.

According to an aspect of the embodiments of the present invention, there is provided a method for judging attack behavior, including:

Monitor the actual execution of the specified operation, and obtain the actual instruction execution logic sequence of the specified operation;

Comparing the actual instruction execution logic sequence of the specified operation with the preset instruction execution logic sequence of the specified operation;

If the actual instruction execution logic sequence of the specified operation is inconsistent with the preset instruction execution logic sequence of the specified operation, it is determined that an attack is occurring.

Optionally, the designated operation includes an operation on a key file or a key location.

Optionally, monitoring the actual execution of the specified operation and obtaining the actual instruction execution logic sequence of the specified operation includes:

Monitor the actual process of code execution by the central processing unit, record and save relevant information about the branch instructions actually executed by the central processing unit;

Extract the actual instruction execution logic sequence of the specified operation from the stored related information of the branch instruction.

Optionally, monitoring the actual execution of the specified operation and obtaining the actual instruction execution logic sequence of the specified operation includes:

Apply to the platform or operating system for the ability to monitor the actual process of the CPU executing code, record and save the relevant information about the branch instructions actually executed by the CPU;

Based on the capability of the application, extract the actual instruction execution logic sequence of the specified operation from the related information of the branch instruction.

Optionally, monitoring the actual execution of the specified operation and obtaining the actual instruction execution logic sequence of the specified operation includes:

Set up hooks that monitor the actual execution of the specified operation;

By using the set hook, the specified operation is captured during the actual execution of the specified operation, and the actual instruction execution logic sequence of the specified operation is obtained.

Optionally, the preset instruction execution logic sequence of the specified operation is collected in the following manner:

In a trusted environment, the preset instructions of the specified operation are collected to execute the logic sequence.

Optionally, the preset instruction execution logic sequence of the specified operation is collected in the following manner:

In a single computer, collecting multiple instruction execution logic sequences involved in the actual execution of the specified operation; determining a preset instruction execution logic sequence of the specified operation based on the multiple instruction execution logic sequences;

and / or

In multiple computers, collect one or more instruction execution logic sequences involved in the actual execution process of the specified operation of each computer; based on the one or more instruction execution logic sequences corresponding to each computer, determine The preset instructions of the specified operation execute a logic sequence.

According to another aspect of the embodiments of the present invention, there is provided an apparatus for judging attack behavior, including:

The monitoring module is adapted to monitor the actual execution of the specified operation, and obtain the actual instruction execution logic sequence of the specified operation;

The comparison module is adapted to compare the actual instruction execution logic sequence of the specified operation with the preset instruction execution logic sequence of the specified operation;

The determination module is adapted to determine that an attack is occurring if the actual instruction execution logic sequence of the designated operation is inconsistent with the preset instruction execution logic sequence of the designated operation.

Optionally, the designated operation includes an operation on a key file or a key location.

Optionally, the monitoring module is further adapted to: monitor the actual flow of the code executed by the central processing unit, record and save relevant information about the branch instructions actually executed by the central processing unit; In the information, the actual instruction execution logic sequence of the specified operation is extracted.

Optionally, the monitoring module is further adapted to: apply to the platform or the operating system to monitor the actual flow of the code executed by the central processing unit, record and save the relevant information of the branch instructions actually executed by the central processing unit; The applied capability extracts the actual instruction execution logic sequence of the specified operation from the relevant information of the branch instruction.

Optionally, the monitoring module is further adapted to: set a hook for monitoring the actual execution of the specified operation; use the set hook to capture the specified operation during the actual execution of the specified operation, Obtain the actual instruction execution logic sequence of the specified operation.

Optionally, the device further includes:

The first collection module is adapted to collect the preset instruction execution logic sequence of the specified operation in a trusted environment.

Optionally, the device further includes:

The second collection module is adapted to collect multiple instruction execution logic sequences involved in the actual execution process of the specified operation in a single computer; based on the multiple instruction execution logic sequences, determine the preset value of the specified operation Instruction execution logic sequence;

and / or

In multiple computers, collect one or more instruction execution logic sequences involved in the actual execution process of the specified operation of each computer; based on the one or more instruction execution logic sequences corresponding to each computer, determine The preset instructions of the specified operation execute a logic sequence.

According to another aspect of the embodiments of the present invention, a computer storage medium is also provided, the computer storage medium stores computer program code, and when the computer program code runs on a computing device, it causes the computing device to execute the foregoing The method of judging aggressive behavior.

According to another aspect of the embodiments of the present invention, there is also provided a computing device, including: a processor; a memory storing computer program code; when the computer program code is executed by the processor, the computing device Perform the above-mentioned aggressive behavior determination method.

With the above technical solutions, the embodiment of the present invention breaks away from the level of "code features and behaviors", innovatively based on the level of the instruction execution logic sequence, and combines the preset instruction execution logic sequence of the specified operation with the actual instruction execution logic sequence. In comparison, when the comparison is inconsistent, it is determined that the attack is occurring, and various attack behaviors can be found effectively.

Further, the embodiment of the present invention can monitor the actual execution status of the designated operation of the key file or the key position in a targeted manner, and obtain the actual instruction execution logic sequence for the designated operation of the key file or the key position. The actual instruction execution logic sequence of the designated operation of the file or key position is compared with the preset instruction execution logic sequence. When the comparison is inconsistent, it is determined that the attack is occurring, which can improve the efficiency of attack determination and discover the attack in time. , In order to take corresponding protective measures.

The above description is only an overview of the technical solution of the present invention. In order to understand the technical means of the present invention more clearly, it can be implemented in accordance with the content of the specification, and in order to make the above and other objectives, features and advantages of the present invention more obvious and understandable. In the following, specific embodiments of the present invention will be cited.

Based on the following detailed description of specific embodiments of the present invention in conjunction with the accompanying drawings, those skilled in the art will better understand the above and other objectives, advantages and features of the present invention.

Description of the drawings

The drawings described here are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and the description thereof are used to explain the present invention, and do not constitute an improper limitation of the present invention. In the attached picture:

Figure 1 shows the execution logic diagram of a complete program;

Figure 2 shows a flow chart of a method for judging an attack according to an embodiment of the present invention;

Fig. 3 shows a flowchart of a method for judging an attack according to another embodiment of the present invention;

Figure 4 shows a flow chart of instruction execution according to another embodiment of the present invention;

FIG. 5 shows a structural diagram of a device for determining an attack behavior according to an embodiment of the present invention; and

Fig. 6 shows a structural diagram of a device for judging an attacking behavior according to another embodiment of the present invention.

detailed description

Hereinafter, exemplary embodiments of the present invention will be described in more detail with reference to the accompanying drawings. Although the drawings show exemplary embodiments of the present invention, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present invention and to fully convey the scope of the present invention to those skilled in the art.

As introduced above, for some attacks, such as APT attacks, it is difficult to find using current feature matching or behavior discrimination technical means. In order to effectively discover this type of attack, the inventor made a creative idea, which will be introduced in detail below.

First of all, all behaviors in the computer are implemented by code. The code is composed of a set of predefined instructions.

Examples are as follows:

FF 15 8C 0E 87 6B call ds: _imp_CreateFilew@28

8B F0 mov esi, eax

83 FE FF cmp esi, 0FFFFFFFFh

75 33 jnz short loc_6B818B38

FF 15 C4 0D 87 6B call ds: _imp_GetLastError@0

83 F8 02 cmp eax, 2

75 23 jnz short loc_6B818B33

The above piece of assembly code implements the following functional logic:

1. Call the system API (Application Programming Interface) CreateFile to create a file;

2. Judge whether the file is created successfully;

3. If successful, jump to loc_6B818B38 to perform the following actions;

4. If unsuccessful, call GetLastError to get the error code;

5. If the error code is not equal to 2, jump to loc_6B818B33 for execution.

It uses the following commands:

call: call; mov: move; cmp: compare; jnz: logical jump according to the comparison result.

The inventor found that once the code is compiled, it is fixed, and the execution logic of the instruction is also fixed.

For example: as long as the file is created successfully, it will "jump to loc_6B818B38 to execute"; if the creation is unsuccessful, it will "call GetLastError"; if the error code is not equal to 2, it will "jump to loc_6B818B33 for execution" ".

This code is fixed from beginning to end and is the execution logic. There will be no change. Unless this code is changed, the logic will not change.

Figure 1 is a diagram of the execution logic of a complete program. It can be seen from Figure 1 that the execution logic of the entire program is composed of countless "conditional judgments" and "branch". Different branches are executed according to different conditions. Form an execution link.

As a result, the inventor came to the conclusion that for the same program or the same piece of code, when all conditions are consistent, an exactly the same execution chain will be obtained, that is, a set of exactly the same instruction execution logic sequence.

As far as the code shown in the above example is concerned, as long as the condition of "file creation is successful" remains unchanged, the instruction execution logic sequence is fixed, and instructions that are not related to logic are ignored here, and only the jump class that will change the execution route is left. Instruction, you will get the following instruction execution logic sequence:

1. call CreateFile

2. jnz loc_6B818B38

Additional instructions:

The call GetLastError and jnz loc_6B818B33 will not be executed, nor will they enter the instruction execution sequence.

Based on the above-mentioned concept, the inventor proposes a solution based on instruction execution logic sequence to discover attack behaviors. Fig. 2 shows a flowchart of a method for judging an attack according to an embodiment of the present invention. As shown in Figure 2, the method may include the following steps S201 to S203:

Step S201, monitor the actual execution of the specified operation, and obtain the actual instruction execution logic sequence of the specified operation;

Step S202, comparing the actual instruction execution logic sequence of the specified operation with the preset instruction execution logic sequence of the specified operation;

In step S203, if the actual instruction execution logic sequence of the specified operation is inconsistent with the preset instruction execution logic sequence of the specified operation, it is determined that an attack is occurring.

The embodiment of the present invention is innovatively based on the level of the instruction execution logic sequence, and compares the preset instruction execution logic sequence of the specified operation with the actual instruction execution logic sequence. When the comparison is inconsistent, it is determined that the attack is occurring. Effectively discover all kinds of attacks.

In an alternative embodiment of the present invention, the above-mentioned designated operation may be various sensitive operations on key files or key locations. The key file here may be a file that is more important to enterprises or individual users, or a file that is more important to the system, etc., which is not limited in the embodiment of the present invention. The key location here may be a system directory, a key disk area, etc., which is not limited in the embodiment of the present invention. Attackers attack these key files or key locations to achieve the purpose of stealing data and obtaining permissions.

The embodiment of the present invention can monitor the actual execution situation of the designated operation of the key file or key position in a targeted manner, obtain the actual instruction execution logic sequence for the key file or the designated operation of the key position, and then target the key file or key position. The actual instruction execution logic sequence of the designated operation of the location is compared with the preset instruction execution logic sequence. When the comparison is inconsistent, it is determined that the attack is occurring, which can improve the efficiency of attack determination, and discover the attack in time, so as to take Corresponding protection means.

In the above step S201, the actual execution of the specified operation is monitored, and the actual instruction execution logic sequence of the specified operation is obtained. The embodiment of the present invention provides optional solutions such as using existing monitoring capabilities or setting monitoring, which will be described in detail below. Introduction.

In scheme one, the actual flow of the code execution by the central processing unit can be monitored, and the relevant information of the branch instructions actually executed by the central processing unit can be recorded and saved; then the information of the specified operation can be extracted from the relevant information of the saved branch instructions. The actual instruction executes the logical sequence.

In the second plan, you can apply to the platform or operating system to monitor the actual process of the CPU execution code, record and save the relevant information of the branch instructions actually executed by the CPU; branch from the application based on the ability of the application The actual instruction execution logic sequence of the specified operation is extracted from the related information of the instruction.

In this solution, how to realize the ability to monitor instruction execution can be implemented in different ways according to different platforms, such as the BTM (Branch Trace Message) mechanism introduced by the Pentium processor, and the LBR (Branch Trace Message) mechanism introduced by the P6 processor. The Last Branch Recording (Last Branch Recording) mechanism, etc., can all realize the corresponding capabilities.

In addition, chip manufacturers, hardware manufacturers, or operating system manufacturers can also integrate instruction execution sequence monitoring into the system. Embodiments of the present invention can apply for corresponding capabilities. Based on the applied capabilities, obtain relevant information about branch instructions, and then obtain information from branch instructions. The actual instruction execution logic sequence of the specified operation is extracted from the relevant information.

In scheme three, you can set a hook to monitor the actual execution of the specified operation; then use the set hook to capture the specified operation during the actual execution of the specified operation, and obtain the actual instruction execution logic sequence of the specified operation.

The preset instruction execution logic sequence of the specified operation mentioned in step S202 above is the instruction execution logic sequence of the specified operation in the normal operation scenario, which can be specifically collected in the following manner.

The first way is to collect preset instructions for specified operations to execute logic sequences in a trusted environment. The trusted environment here may be a factory system environment or a legally digitally signed system environment of a regular company, etc. The embodiment of the present invention may select a trusted environment according to actual needs, and there is no limitation on this.

Manner 2: In a single computer, collect multiple instruction execution logic sequences involved in the actual execution of the specified operation; based on the multiple instruction execution logic sequences, determine the preset instruction execution logic sequence of the specified operation.

For example, if the collected 20 instruction execution logic sequences involved in the actual execution process of the specified operation are all sequence P, then the sequence P can be determined as the preset instruction execution logic sequence of the specified operation. It should be noted that the examples here are only illustrative and do not limit the present invention.

Mode three, among multiple computers, collect one or more instruction execution logic sequences involved in the actual execution of the specified operation of each computer; execute logic sequences based on one or more instructions corresponding to each computer to determine the specified operation The preset instructions execute the logic sequence.

For example, in 30 computers, the instruction execution logic sequences generated during the actual execution of the specified operation are all sequence P, then the sequence P can be determined as the preset instruction execution logic sequence of the specified operation. It should be noted that the examples here are only illustrative and do not limit the present invention.

The above methods 2 and 3 are based on the principle of "for the same program or the same piece of code, under the premise that all conditions are consistent, you will get exactly the same execution chain". Under normal operation scenarios, no matter what The same instruction sequence with the same condition is collected multiple times in a single computer, or the same instruction sequence with the same condition is distributed in multiple computers. The collected instruction sequence should be the same. If there is a difference, it may only be Anomalies exist, such as: HOOK points with APT attack codes, etc.

The foregoing describes the multiple implementation manners of each link in the embodiment shown in FIG. 2, and the method for determining the attack behavior provided by the embodiment of the present invention will be further described through specific embodiments below.

In a specific embodiment, if the purpose of the APT attacker is to steal all the file data with the word "secret", then when designing the working logic, it is nothing more than reading and judging the file after the file is created successfully. Whether the title has the words "confidential", if so, then pass it back, if not, ignore it.

No matter how it designs the operation logic, the instruction execution logic sequence of the file operation will change accordingly, because it will add the logic of "judgment" and "return" in the logic chain, and these two logics are not in normal circumstances. of.

First of all, the existence of APT attack code, and the existence of no APT attack code, its instruction execution logic must be different.

Secondly, when operating a "secret" file, and operating a "non-secret" file, the instruction execution logic is still different.

Therefore, as shown in FIG. 3, steps S301 to S303 can be used to discover attack behavior.

In step S301, the actual execution of the file operation is monitored, and the actual instruction execution logic sequence of the file operation is obtained.

In this step, the file operation can specifically be an operation on a "secret" file.

In step S302, the actual instruction execution logic sequence of the file operation is compared with the preset instruction execution logic sequence of the file operation.

In step S303, if the actual instruction execution logic sequence of the file operation is inconsistent with the preset instruction execution logic sequence of the file operation, it is determined that the APT attack behavior is occurring.

If the actual instruction execution logic sequence of the file operation is consistent with the preset instruction execution logic sequence of the file operation, it is determined that the APT attack has not occurred, and step S301 can be returned to continue to monitor the actual execution of the file operation.

Here is another example that actually happened in reality. When Stuxnet virus launched an APT attack on a nuclear plant in a certain country, it used a Windows operating system shortcut analysis vulnerability (vulnerability number: MS10-046). Its utilization principle and instruction execution process are shown in Figure 4 below.

The execution logic of the Windows operating system when parsing shortcuts is as follows (simplified here):

1. Call GetIconLocationW;

2. Judge a special flag in the shortcut;

3. If the flag bit is non-zero, call LookupIconIndex;

4. If the flag bit is zero, call CPL_FindCPLInfo;

5. Continue to call CPL_LoadAndFindApplet;

6. Finally, LoadLibrary is called to load the specified DLL/CPL file.

The first three execution logics 1, 2, and 3 are normal shortcut parsing logic, because the flag bit is always non-zero under normal circumstances.

However, when an APT attacker performs an attack, he sets the special flag in the shortcut used for the attack to "zero", then the special execution logic is triggered, and the shortcut parsing logic also changes, starting to enter 4, 5 6. The execution link of 6, thus loads and executes the attacker's malicious DLL program, completing the attack.

In the embodiment of the present invention, when the instruction execution logic sequence of the normal shortcut parsing operation is collected, it is obvious that only steps 1 to 3 of the execution logic can be collected, and it is impossible to collect steps 4 to 6.

But when an APT attack occurs, 4 to 6 steps of instruction logic must appear in the instruction execution logic sequence. When the instruction execution logic sequence is compared, this APT attack will inevitably be discovered.

It should be noted that not only file operations, but any other operations, the present invention can be used to judge the instruction execution logic sequence to discover the existence of abnormal logic caused by the APT attack.

For example, during the system startup phase, the codes in the BIOS (Basic Input Output System) and hardware firmware are collected for normal instruction logic. If there is malicious code in it, it will do evil when it meets certain conditions (such as specific Time), when it starts to do evil, its logic will inevitably change, and it will be discovered by the comparison of the instruction execution logic sequence.

Although the embodiment of the present invention takes the discovery of APT attacks as an example, it is just that APT attacks are more difficult to detect than ordinary attacks, but it does not mean that the present invention can only detect APT attacks, which still has a good effect on ordinary attacks.

It should be noted that the present invention has nothing to do with platforms (such as Intel, AMD, ARM, etc.), and has nothing to do with operating systems (such as Windows\Linux, etc.), and can be applied to any platform and system.

In actual applications, all the above optional implementation manners can be combined arbitrarily to form optional embodiments of the present invention, which will not be repeated here.

Based on the method for judging attack behavior provided by the above embodiments, and based on the same inventive concept, an embodiment of the present invention also provides a device for judging attack behavior.

Fig. 5 shows a structural diagram of a device for determining an attack behavior according to an embodiment of the present invention. As shown in FIG. 5, the device may include a monitoring module 510, a comparison module 520, and a determination module 530.

Now introduces the functions of each component or device of the device for judging attack behavior and the connection relationship between the various parts of the embodiment of the present invention:

The monitoring module 510 is adapted to monitor the actual execution of the specified operation and obtain the actual instruction execution logic sequence of the specified operation;

The comparison module 520, coupled with the monitoring module 510, is adapted to compare the actual instruction execution logic sequence of the specified operation with the preset instruction execution logic sequence of the specified operation;

The determination module 530, coupled with the comparison module 520, is adapted to determine that an attack is occurring if the actual instruction execution logic sequence of the specified operation is inconsistent with the preset instruction execution logic sequence of the specified operation.

In an alternative embodiment of the present invention, the designated operation includes an operation on a key file or a key location.

In an optional embodiment of the present invention, the monitoring module 510 is further adapted to: monitor the actual flow of the code executed by the central processing unit, record and save relevant information about the branch instructions actually executed by the central processing unit; In the related information of the instruction, extract the actual instruction execution logic sequence of the specified operation.

In an optional embodiment of the present invention, the monitoring module 510 is further adapted to: apply to the platform or operating system to monitor the actual flow of the CPU executing code, record and save the relevant branch instructions actually executed by the CPU Information capability: Based on the applied capability, extract the actual instruction execution logic sequence of the specified operation from the relevant information of the branch instruction.

In an optional embodiment of the present invention, the monitoring module 510 is further adapted to: set a hook for monitoring the actual execution of the specified operation; use the set hook to capture the specified operation during the actual execution of the specified operation, and obtain The actual instruction execution logic sequence of the specified operation.

In an optional embodiment of the present invention, as shown in FIG. 6, the device for determining the attack behavior shown in FIG. 5 above may further include:

The first collection module 610 is coupled with the comparison module 520, and is adapted to collect a predetermined instruction execution logic sequence of a specified operation in a trusted environment.

In an optional embodiment of the present invention, as shown in FIG. 6, the device for determining the attack behavior shown in FIG. 5 above may further include:

The second collection module 620, coupled with the comparison module 520, is adapted to collect multiple instruction execution logic sequences involved in the actual execution process of the specified operation in a single computer; determine the execution logic sequence of the specified operation based on the multiple instruction execution logic sequences Preset instruction execution logic sequence;

and / or

In multiple computers, collect one or more instruction execution logic sequences involved in the actual execution process of the specified operation of each computer; based on the one or more instruction execution logic sequences corresponding to each computer, determine the preset operation of the specified operation The instruction executes a logical sequence.

Based on the same inventive concept, the embodiments of the present invention also provide a computer storage medium, the computer storage medium stores computer program code, and when the computer program code runs on a computing device, it causes the computing device to perform the aforementioned attack determination method .

Based on the same inventive concept, an embodiment of the present invention also provides a computing device, including: a processor; a memory storing computer program code; when the computer program code is executed by the processor, the computing device is caused to perform the determination of the aforementioned attack behavior method.

Those skilled in the art can clearly understand that the specific working process of the above-described system, device, unit, and module can refer to the corresponding process in the foregoing method embodiment, and for the sake of brevity, it will not be repeated here.

In addition, the functional units in the various embodiments of the present invention may be physically independent of each other, or two or more functional units may be integrated together, or all functional units may be integrated in one processing unit. The above-mentioned integrated functional unit can be implemented in the form of hardware, or in the form of software or firmware.

A person of ordinary skill in the art can understand that if the integrated functional unit is implemented in the form of software and sold or used as an independent product, it can be stored in a computer readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions to make a computer A computing device (for example, a personal computer, a server, or a network device, etc.) executes all or part of the steps of the methods described in the embodiments of the present invention when running the instructions. The aforementioned storage media include: U disk, mobile hard disk, read only memory (ROM), random access memory (RAM), magnetic disk or optical disk and other media that can store program codes.

Alternatively, all or part of the steps of the foregoing method embodiments may be implemented by a program instructing related hardware (computing devices such as a personal computer, a server, or a network device), and the program instructions may be stored in a computer readable storage In the medium, when the program instructions are executed by the processor of the computing device, the computing device executes all or part of the steps of the methods described in the embodiments of the present invention.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: Within the spirit and principle of the present invention, it is still possible to modify the technical solutions recorded in the foregoing embodiments, or equivalently replace some or all of the technical features; and these modifications or substitutions do not depart from the corresponding technical solutions The scope of protection of the present invention.

Claims (16)

A method for judging aggressive behavior, which is characterized in that it includes: Monitor the actual execution of the specified operation, and obtain the actual instruction execution logic sequence of the specified operation; Comparing the actual instruction execution logic sequence of the specified operation with the preset instruction execution logic sequence of the specified operation; If the actual instruction execution logic sequence of the specified operation is inconsistent with the preset instruction execution logic sequence of the specified operation, it is determined that an attack is occurring. The method according to claim 1, wherein the designated operation includes an operation on a key file or a key location. The method according to claim 1 or 2, wherein monitoring the actual execution of the specified operation and obtaining the actual instruction execution logic sequence of the specified operation comprises: Monitor the actual process of code execution by the central processing unit, record and save relevant information about the branch instructions actually executed by the central processing unit; Extract the actual instruction execution logic sequence of the specified operation from the stored related information of the branch instruction. The method according to claim 1 or 2, wherein monitoring the actual execution of the specified operation and obtaining the actual instruction execution logic sequence of the specified operation comprises: Apply to the platform or operating system for the ability to monitor the actual process of the CPU executing code, record and save the relevant information about the branch instructions actually executed by the CPU; Based on the capability of the application, extract the actual instruction execution logic sequence of the specified operation from the related information of the branch instruction. The method according to claim 1 or 2, wherein monitoring the actual execution of the specified operation and obtaining the actual instruction execution logic sequence of the specified operation comprises: Set up hooks that monitor the actual execution of the specified operation; By using the set hook, the specified operation is captured during the actual execution of the specified operation, and the actual instruction execution logic sequence of the specified operation is obtained. The method according to claim 1 or 2, characterized in that the preset instruction execution logic sequence of the specified operation is collected in the following manner: In a trusted environment, the preset instructions of the specified operation are collected to execute the logic sequence. The method according to claim 1 or 2, characterized in that the preset instruction execution logic sequence of the specified operation is collected in the following manner: In a single computer, collecting multiple instruction execution logic sequences involved in the actual execution of the specified operation; determining a preset instruction execution logic sequence of the specified operation based on the multiple instruction execution logic sequences; and / or In multiple computers, collect one or more instruction execution logic sequences involved in the actual execution process of the specified operation of each computer; based on the one or more instruction execution logic sequences corresponding to each computer, determine The preset instructions of the specified operation execute a logic sequence. A device for judging aggressive behavior, which is characterized in that it includes: The monitoring module is adapted to monitor the actual execution of the specified operation, and obtain the actual instruction execution logic sequence of the specified operation; The comparison module is adapted to compare the actual instruction execution logic sequence of the specified operation with the preset instruction execution logic sequence of the specified operation; The determination module is adapted to determine that an attack is occurring if the actual instruction execution logic sequence of the designated operation is inconsistent with the preset instruction execution logic sequence of the designated operation. The device according to claim 8, wherein the designated operation includes an operation on a key file or a key location. The device according to claim 8 or 9, wherein the monitoring module is further adapted to: monitor the actual process of code execution by the central processing unit, record and save the relevant branch instructions actually executed by the central processing unit Information; extract the actual instruction execution logic sequence of the specified operation from the stored related information of the branch instruction. The device according to claim 8 or 9, wherein the monitoring module is further adapted to: apply to the platform or operating system to monitor the actual process of the CPU executing code, record and save the actual execution of the CPU The ability of the related information of the branch instruction to be obtained; based on the ability of the application, the actual instruction execution logic sequence of the specified operation is extracted from the related information of the branch instruction. The device according to claim 8 or 9, characterized in that the monitoring module is further adapted to: set a hook for monitoring the actual execution of a specified operation; use the set hook to set a hook in the actual execution of the specified operation During the execution process, the specified operation is captured, and the actual instruction execution logic sequence of the specified operation is obtained. The device according to claim 8 or 9, further comprising: The first collection module is adapted to collect the preset instruction execution logic sequence of the specified operation in a trusted environment. The device according to claim 8 or 9, further comprising: The second collection module is adapted to collect multiple instruction execution logic sequences involved in the actual execution process of the specified operation in a single computer; based on the multiple instruction execution logic sequences, determine the preset value of the specified operation Instruction execution logic sequence; and / or In multiple computers, collect one or more instruction execution logic sequences involved in the actual execution process of the specified operation of each computer; based on the one or more instruction execution logic sequences corresponding to each computer, determine The preset instructions of the specified operation execute a logic sequence. A computer storage medium storing computer program code, which when the computer program code runs on a computing device, causes the computing device to perform the attack described in any one of claims 1-7 The method of determination. A computing device, comprising: a processor; a memory storing computer program code; when the computer program code is executed by the processor, the computing device causes the computing device to execute any one of claims 1-7 How to determine aggressive behavior.

Images