CN115459988A - Security defense method and device based on ATT & CK model, electronic equipment and storage medium - Google Patents

Abstract

The embodiments of this specification relate to the technical field of network security, and in particular to a security defense method, device, electronic device, and storage medium based on the ATT&CK model. Wherein, the security defense method based on the ATT&CK model includes: monitoring the process startup on the terminal device, determining the rule base currently used by the terminal device for security defense; responding to monitoring the process startup on the terminal device , determining the hardware resource consumption on the terminal device after the process is started, and the matching between the process and the rules in the rule base; based on the hardware resource consumption and the matching, the rule base Perform an update so that the terminal device uses the updated target rule base for security defense, and return to the step of determining the rule base currently used by the terminal device for security defense. The technical solution provided in this manual solves the problem that the ATT&CK model cannot be adapted to different terminal devices.

Description

Security defense method, device, electronic equipment and storage based on ATT&CK model medium

technical field

The embodiments of this specification relate to the technical field of network security, and in particular to a security defense method, device, electronic device and storage medium based on the ATT&CK model.

Background technique

As a fine-grained attack-defense framework, the ATT&CK model provides defense rule information of processes that can be illegally exploited and their corresponding startup parameters.

Although the rules of the ATT&CK model cover a wide range, because different terminal devices have their own usage scenarios, the rules of the ATT&CK model cannot be adapted to different terminal devices (for example, not all suspected attacks are illegal and need to be intercepted).

Contents of the invention

In order to solve the problem that the ATT&CK model cannot be adapted to different terminal devices, the embodiments of this specification provide a security defense method, device, electronic device, and storage medium based on the ATT&CK model.

In the first aspect, the embodiment of this specification provides a security defense method based on the ATT&CK model, which is applied to the terminal device, and the initial rule base is pre-installed on the terminal device, and the rule base is based on the existing ATT&CK model. The rules are extracted according to the preset method, and the method includes:

Monitoring the process startup status on the terminal device, and determining the rule base currently used by the terminal device for security defense;

In response to monitoring the start of a process on the terminal device, determining the hardware resource consumption on the terminal device after the start of the process and the matching between the process and the rules in the rule base;

Based on the hardware resource consumption and the matching situation, update the rule base, so that the terminal device uses the updated target rule base for security defense, and return the information that determines that the terminal device is currently performing security defense. Steps for the rule base.

In a possible design, the rules in the rule base are stored in an XML file encrypted according to a specified algorithm;

The rule at least includes: a process name, a startup parameter, and a default operation of the current rule, and the default operation includes interception and release.

In a possible design, the rule further includes a parent process and custom parameters, where the custom parameters include a verification result of a digital signature, and/or a verification result of a Microsoft CAT signature, and/or manufacturer information.

In a possible design, in response to monitoring the start of a process on the terminal device, determine the hardware resource consumption on the terminal device after the process starts to start, and the relationship between the process and the rules in the rule base matches, including:

In response to monitoring the start of the process on the terminal device, monitor the total CPU usage and the total memory usage on the terminal device after the process starts to start, and calculate the total CPU usage and the total memory usage As the hardware resource consumption on the terminal device;

and / or,

In response to monitoring the start of a process on the terminal device, monitor the CPU usage rate and memory usage rate corresponding to the process after the process starts to start, and use the CPU usage rate and memory usage rate corresponding to the process as the terminal hardware resource consumption on the device;

Matching the process name and startup parameters of the process with the rules in the rule base to obtain the matching situation between the process and the rules in the rule base.

In a possible design, updating the rule base based on the hardware resource consumption situation and the matching situation includes:

In a case where the total CPU usage is higher than a first preset threshold and/or the total memory usage is higher than a second preset threshold within a first specified time;

Or, the total CPU usage is not higher than the first preset threshold and the total memory usage is not higher than the second preset threshold within the first specified time, but the second specified time after the process is fully started Within a certain period of time, when the CPU usage rate corresponding to the process is higher than the third preset threshold and/or the memory usage rate corresponding to the process is higher than the fourth preset threshold;

If the process name and startup parameters corresponding to the process are not matched in the rule base, the process name and startup parameters corresponding to the process are stored in the XML file; wherein, the default operation of the process set to intercept;

If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is changed to intercept.

In a possible design, updating the rule base based on the hardware resource consumption situation and the matching situation includes:

When the process is not fully started, the CPU usage rate corresponding to the process is higher than the fifth preset threshold and/or the memory usage rate corresponding to the process is higher than the sixth preset threshold;

And/or, when the process is not fully started, the rate of increase of the CPU usage rate corresponding to the process is higher than the seventh preset threshold and/or the rate of increase of the memory usage rate corresponding to the process is higher than the seventh preset threshold. Eight preset threshold cases;

If the process name and startup parameters corresponding to the process are not matched in the rule base, the process name and startup parameters corresponding to the process are stored in the XML file; wherein, the default operation of the process set to intercept;

If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is changed to intercept.

In a possible design, the rule base has an external call interface, and the external call interface is used to add, delete and/or modify rules;

The method also includes:

In response to detecting that the external call interface of the rule base is called, matching the process targeted by the external call interface with the rules in the rule base;

Acquire the matching result of the process returned by the external call interface, and update the rule base according to the modification instruction in response to the received modification instruction sent by the user based on the matching result.

In the second aspect, the embodiment of this specification also provides a security defense device based on the ATT&CK model, which is applied to terminal equipment, and the initial rule base is pre-installed on the terminal equipment, and the rule base is based on the existing ATT&CK model. The rules are extracted according to the preset method, and the device includes:

The first determination module is configured to monitor the process startup status on the terminal device, and determine the rule base currently used by the terminal device for security defense;

The second determining module is configured to, in response to monitoring the startup of the process on the terminal device, determine the consumption of hardware resources on the terminal device after the startup of the process, and the matching situation between the process and the rules in the rule base ;

An update module, configured to update the rule base based on the hardware resource consumption and the matching situation, so that the terminal device uses the updated target rule base for security defense, and returns to determine the current status of the terminal device. The steps of the rule base used for security defense.

In the third aspect, the embodiment of this specification also provides an electronic device, including a memory and a processor, the computer program is stored in the memory, and when the processor executes the computer program, the computer program described in any embodiment of this specification is realized. described method.

In the fourth aspect, the embodiment of this specification also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed in a computer, the computer is instructed to execute the method described in any embodiment of this specification .

The embodiment of this specification provides a security defense method, device, electronic equipment, and storage medium based on the ATT&CK model. First, the process startup status on the terminal equipment is monitored, and the rule base currently used by the terminal equipment for security defense is determined; then respond Based on monitoring the start of the process on the terminal device, determine the hardware resource consumption on the terminal device after the process starts, and the matching between the process and the rules in the rule base; finally, update the rule base based on the hardware resource consumption and matching , so that the terminal device uses the updated target rule base for security defense, and returns to the step of determining the rule base currently used by the terminal device for security defense. Therefore, the above technical solution can solve the localization problem of the ATT&CK model in different usage scenarios, that is, it can make the ATT&CK model adapt to the usage requirements of different terminal devices, thereby preventing false positives of the rules of the ATT&CK model; and considering the consumption of hardware resources, System performance degradation of the terminal device can be prevented.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are For some embodiments of this specification, those skilled in the art can also obtain other drawings based on these drawings without creative work.

Fig. 1 is a flow chart of a security defense method based on the ATT&CK model provided by an embodiment of this specification;

FIG. 2 is a hardware architecture diagram of an electronic device provided by an embodiment of this specification;

Fig. 3 is a structural diagram of a security defense device based on the ATT&CK model provided by an embodiment of this specification.

detailed description

In order to make the purpose, technical solutions and advantages of the embodiments of this specification more clear, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments It is a part of the embodiments of this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by those of ordinary skill in the art without making creative efforts belong to the protection of this specification. scope.

As mentioned above, although the rules of the ATT&CK model cover a wide range, because different terminal devices have their own usage scenarios, the rules of the ATT&CK model cannot be adapted to different terminal devices (for example, not all suspected attacks are illegal and require intercepted).

Therefore, according to different user needs and usage scenarios of the ATT&CK model, it cannot be completely one-size-fits-all, and the ATT&CK model must be adaptive and localized.

The inventor discovered during the research and development process that the rules of the ATT&CK model can be summarized to form an initial rule base, and then after the process of the terminal device to be defended is started, the current hardware resource consumption of the terminal device and the process and rules can be monitored Finally, based on the hardware resource consumption and matching situation, the rule base can be updated to use the updated target rule base to protect the terminal device. This can prevent false positives of the rules of the ATT&CK model, and It is possible to prevent the degradation of the system performance of the terminal device.

The following introduces the inventive concept of the illustrated embodiment.

Please refer to Figure 1, the embodiment of this specification provides a security defense method based on the ATT&CK model, the method includes:

Step 100: Monitor the process startup status on the terminal device, and determine the rule base currently used by the terminal device for security defense;

Step 102: In response to monitoring the start of the process on the terminal device, determine the consumption of hardware resources on the terminal device after the start of the process, and the matching between the process and the rules in the rule base;

Step 104: Update the rule base based on hardware resource consumption and matching, so that the terminal device uses the updated target rule base for security defense, and return to the step of determining the rule base currently used by the terminal device for security defense.

In the embodiment of this specification, firstly, monitor the start-up of the process on the terminal device, and determine the rule base currently used by the terminal device for security defense; hardware resource consumption, and the matching between the process and the rules in the rule base; finally, based on the hardware resource consumption and matching, the rule base is updated so that the terminal device uses the updated target rule base for security defense, and returns OK Steps of the rule base currently used by the terminal device for security defense. Therefore, the above technical solution can solve the localization problem of the ATT&CK model in different usage scenarios, that is, it can make the ATT&CK model adapt to the usage requirements of different terminal devices, thereby preventing false positives of the rules of the ATT&CK model; and considering the consumption of hardware resources, System performance degradation of the terminal device can be prevented.

The execution manner of each step shown in FIG. 1 is described below.

For step 100:

It can be known that the ATT&CK model mainly integrates historical hacker organizations and attack events, and uses attack strategies as clues to connect attack technologies and software corresponding to different attack strategies, which provides information security practitioners with an executable medium Abstract model.

In one embodiment of this specification, for the safety of the terminal device, an initial rule base is pre-installed on the terminal device, and the initial rule base is obtained by extracting the rules of the existing ATT&CK model in a preset manner. Based on the initial rule base installed on the terminal device, the rule base currently used by the terminal device for security defense in this embodiment may be the initial rule base or an updated rule base.

In one embodiment of this specification, the rules in the rule base are stored in an XML file encrypted according to a specified algorithm;

The rules at least include: process name, startup parameters, and default actions of the current rule, and the default actions include interception and release.

In this embodiment, the initial rule base is formed by extracting the rules of the existing ATT&CK model, which facilitates the matching of subsequent processes, and further facilitates meeting the usage scenario requirements of different users. In addition, by landing the extracted information in the form of an encrypted XML file, it is convenient to prevent tampering and match with subsequent processes. Wherein, the encryption method may be an algorithm such as MD5 or SHA.

Of course, the extracted information can also be implemented as an encrypted database to obtain the initial rule base. Here, the specific implementation manner of the extracted information is not limited.

Generally speaking, the rules of the existing ATT&CK model include at least the process name, startup parameters and default actions corresponding to the current rules, but there are also some other rules, such as parent process and custom parameters.

In an embodiment of the present specification, the rule further includes a parent process and a custom parameter, and the custom parameter includes a verification result of a digital signature, and/or a verification result of a Microsoft CAT signature, and/or manufacturer information.

In this embodiment, the rules of the existing ATT&CK model can be completely summarized by configuring the rules that also include the parent process and user-defined parameters, thereby helping to ensure the integrity and comprehensiveness of the initial rule base.

For step 102:

In an embodiment of this specification, step 102 may specifically include:

In response to monitoring the start of the process on the terminal device, monitor the total CPU usage rate and the total memory usage rate on the terminal device after the monitoring process starts, and use the total CPU usage rate and the total memory usage rate as the hardware resource consumption on the terminal device;

and / or,

In response to monitoring the start of the process on the terminal device, monitor the CPU usage rate and memory usage rate corresponding to the process after the process starts, and use the CPU usage rate and memory usage rate corresponding to the process as the hardware resource consumption on the terminal device;

Match the process name and startup parameters of the process with the rules in the rule base to obtain the matching situation between the process and the rules in the rule base.

In this embodiment, by considering the total CPU occupancy rate and total memory occupancy rate on the terminal device after the process is started, and the matching situation between the process and the initial rule base, and/or, the CPU occupancy rate and the corresponding CPU occupancy rate of the process after the process is started. The memory occupancy rate and the matching between the process and the initial rule base can not only prevent false positives of the rules of the ATT&CK model, but also prevent the system performance of the terminal device from degrading.

It should be noted that, in addition to the CPU occupancy rate and the memory occupancy rate, the hardware resource consumption may also include the consumption of external devices such as DMA terminal devices and hard disks, and the hardware resource consumption is not limited here.

For step 104:

In an embodiment of this specification, step 104 may specifically include:

When the total CPU usage is higher than a first preset threshold and/or the total memory usage is higher than a second preset threshold within the first specified time;

Or, the total CPU usage is not higher than the first preset threshold and the total memory usage is not higher than the second preset threshold within the first specified time, but within the second specified time after the process is fully started, the corresponding When the CPU usage is higher than the third preset threshold and/or the memory usage corresponding to the process is higher than the fourth preset threshold;

If the process name and the startup parameter corresponding to the process are not matched in the rule base, the process name and the startup parameter corresponding to the process are stored in the XML file; wherein, the default operation of the process is set to intercept;

If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is modified to intercept.

In this embodiment, when the total CPU usage is higher than the first preset threshold and/or the total memory usage is higher than the second preset threshold within the first specified time; or, the total CPU usage is higher than the second preset threshold within the first specified time The CPU usage rate is not higher than the first preset threshold and the total memory usage rate is not higher than the second preset threshold, but within the second specified time after the process is fully started, the corresponding CPU usage rate of the process is higher than the third preset threshold and/or the memory occupancy rate corresponding to the process is higher than the fourth preset threshold, so it can be considered that the current startup method of the process is "unfriendly" to the terminal device, so if the initial rule base does not match the process corresponding When the corresponding process name and start parameters are found, the process name and start parameters corresponding to the process can be stored in the XML file to obtain the target rule library corresponding to the terminal device, and the default operation of the process is set to intercept.

It can be known that, in addition to monitoring the total CPU of the system, this embodiment also monitors the CPU occupancy rate of each process after starting for a period of time, so as to reduce the problem that a process A starts the process when determining whether the rule is friendly by monitoring the total CPU occupancy rate. Among them, the CPU occupation caused by the start of another process B, which makes the total CPU soar, has an impact on judging whether the rule is friendly, and further improves the accuracy of judging whether the process is friendly.

It should be noted that the specific interception operation needs to be implemented by the caller through the driver layer or by directly invoking the system API, and the specific implementation manner of the interception operation is not limited here. In addition, the embodiment of this specification does not limit the specific values of the first preset threshold, the second preset threshold, the third preset threshold, and the fourth preset threshold.

In an embodiment of this specification, step 104 may specifically include:

When the process is not fully started, the CPU usage rate corresponding to the process is higher than the fifth preset threshold and/or the memory usage rate corresponding to the process is higher than the sixth preset threshold;

And/or, when the process is not fully started, the rate of increase of the CPU usage rate corresponding to the process is higher than the seventh preset threshold and/or the rate of increase of the memory usage rate corresponding to the process is higher than the eighth preset threshold Down;

If the process name and the startup parameter corresponding to the process are not matched in the rule base, the process name and the startup parameter corresponding to the process are stored in the XML file; wherein, the default operation of the process is set to intercept;

If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is modified to intercept.

In this embodiment, it can be known from the above analysis that when the process is not fully started, the CPU usage rate corresponding to the process is higher than the fifth preset threshold and/or the memory usage rate corresponding to the process is higher than the sixth preset threshold and/or, when the process is not fully started, the rate of increase of the CPU usage rate corresponding to the process is higher than the seventh preset threshold and/or the rate of increase of the memory usage rate corresponding to the process is higher than the eighth preset threshold In the case of , it can be considered that the current startup method of the process is "unfriendly" to the terminal device, so if the default operation corresponding to the process in the XML file is release, it will directly be detrimental to other processes of the terminal device, so the XML file needs to be The default action corresponding to the process in is changed to intercept.

It can be known that, in addition to monitoring the total CPU of the system, this embodiment also monitors the CPU occupancy rate of each process after starting for a period of time, so as to reduce the problem that a process A starts the process when determining whether the rule is friendly by monitoring the total CPU occupancy rate. Among them, the CPU occupation caused by the start of another process B, which makes the total CPU soar, has an impact on judging whether the rule is friendly, and further improves the accuracy of judging whether the process is friendly.

It can be understood that, the above solution automatically updates the initial rule base, and the following describes a manual update solution for the initial rule base.

In an embodiment of the present specification, the rule base has an external call interface, and the external call interface is used to add, delete and/or modify rules;

Methods also include:

In response to detecting that the external call interface of the rule base is called, matching the process targeted by the external call interface with the rules in the rule base;

Obtain the matching result of the process returned by the external call interface, and update the rule base according to the modification instruction in response to the received modification instruction sent by the user based on the matching result.

In this embodiment, by configuring an external call interface for the initial rule base, the initial rule base can be actively or adaptively modified by the caller, thereby further increasing the adaptability of the rule base on the terminal device.

Specifically, when a process is started, after the caller of the rule calls the rule matching interface, the interface will return the judgment result: whether the rule exists and whether the process is allowed to start or prevented from starting.

If this rule does not exist in the original rulebase:

At this time, the default returns to allow the process to start. However, if the caller wants to prohibit the startup of this process, the interface that prevents the startup of the process will be called. In this case, the corresponding process and startup parameters will be saved in the rule base by default, and the interception or release option in the rule is changed to interception;

If this rule exists in the rule base:

1) If the interface returns to allow the process to start, the caller does not need to perform any operations at this time. However, if the caller does not want to release the start of the process, the caller will call another interface: prevent the start of the process. At this time, the rules of the corresponding XML file will be modified to intercept, and the next time the process starts with the same parameters, directly will be blocked.

2) If the interface returns to prevent the process from starting, the process will be killed by default if the caller acquiesces. However, if the caller wants to allow the start of this process, the caller calls another interface: allow the process to start. At this time, the rules of the corresponding XML file will be modified to allow, and the next time the process is started with the same parameters, directly will be released.

According to the above policy process, ATT&CK’s adaptive mechanism for different terminals is completed: a certain (or some) process can be started when it has a certain (or some) parameters, and it is not allowed when it has a certain (or some) parameters start up.

As shown in FIG. 2 and FIG. 3 , the embodiment of this specification provides a security defense device based on the ATT&CK model. The device embodiments can be implemented by software, or by hardware or a combination of software and hardware. From the hardware level, as shown in Figure 2, it is a hardware architecture diagram of the electronic equipment where the security defense device based on the ATT&CK model is provided in the embodiment of this specification, except for the processor, memory, and network shown in Figure 2 In addition to the interface and the non-volatile memory, the electronic device where the device in the embodiment is located may generally include other hardware, such as a forwarding chip responsible for processing messages, and the like. Taking software implementation as an example, as shown in Figure 3, as a device in a logical sense, it is formed by reading the corresponding computer program in the non-volatile memory into the memory and running it through the CPU of the electronic device where it is located.

As shown in Figure 3, a security defense device based on the ATT&CK model provided by this embodiment is applied to a terminal device, and an initial rule base is pre-installed on the terminal device, and the rule base is based on the existing ATT&CK model The rules are extracted according to the preset method, and the device includes:

The first determination module 300 is configured to monitor the process startup status on the terminal device, and determine the rule base currently used by the terminal device for security defense;

The second determining module 302 is configured to, in response to monitoring the startup of the process on the terminal device, determine the consumption of hardware resources on the terminal device after the startup of the process, and the matching between the process and the rules in the rule base Condition;

An update module 304, configured to update the rule base based on the hardware resource consumption and the matching status, so that the terminal device uses the updated target rule base for security defense, and return to determine the terminal device The steps of the rule base currently used for security defense.

In this embodiment of the specification, the first determination module 300 can be used to execute step 100 in the above method embodiment, the second determination module 302 can be used to execute step 102 in the above method embodiment, and the update module 304 can be used to execute the above method implementation Step 104 in the example.

In one embodiment of this specification, the rules in the rule base are stored in an XML file encrypted according to a specified algorithm;

The rule at least includes: a process name, a startup parameter, and a default operation of the current rule, and the default operation includes interception and release.

In an embodiment of the specification, the rule further includes a parent process and custom parameters, and the custom parameters include digital signature verification results, and/or Microsoft CAT signature verification results, and/or vendor information.

In an embodiment of this specification, the second determination module 302 is configured to perform the following operations:

In response to monitoring the start of the process on the terminal device, monitor the total CPU usage and the total memory usage on the terminal device after the process starts to start, and calculate the total CPU usage and the total memory usage As the hardware resource consumption on the terminal device;

and / or,

In response to monitoring the start of a process on the terminal device, monitor the CPU usage rate and memory usage rate corresponding to the process after the process starts to start, and use the CPU usage rate and memory usage rate corresponding to the process as the terminal hardware resource consumption on the device;

Matching the process name and startup parameters of the process with the rules in the rule base to obtain the matching situation between the process and the rules in the rule base.

In an embodiment of this specification, the update module 304 is configured to perform the following operations:

In a case where the total CPU usage is higher than a first preset threshold and/or the total memory usage is higher than a second preset threshold within a first specified time;

Or, the total CPU usage is not higher than the first preset threshold and the total memory usage is not higher than the second preset threshold within the first specified time, but the second specified time after the process is fully started Within a certain period of time, when the CPU usage rate corresponding to the process is higher than the third preset threshold and/or the memory usage rate corresponding to the process is higher than the fourth preset threshold;

If the process name and startup parameters corresponding to the process are not matched in the rule base, the process name and startup parameters corresponding to the process are stored in the XML file; wherein, the default operation of the process set to intercept;

If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is changed to intercept.

In an embodiment of this specification, the update module 304 is configured to perform the following operations:

When the process is not fully started, the CPU usage rate corresponding to the process is higher than the fifth preset threshold and/or the memory usage rate corresponding to the process is higher than the sixth preset threshold;

And/or, when the process is not fully started, the rate of increase of the CPU usage rate corresponding to the process is higher than the seventh preset threshold and/or the rate of increase of the memory usage rate corresponding to the process is higher than the seventh preset threshold. Eight preset threshold cases;

If the process name and startup parameters corresponding to the process are not matched in the rule base, the process name and startup parameters corresponding to the process are stored in the XML file; wherein, the default operation of the process set to intercept;

If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is changed to intercept.

In one embodiment of this specification, the rule base has an external call interface, and the external call interface is used to add, delete and/or modify rules;

The device also includes:

A calling module, configured to match the process targeted by the external calling interface with the rules in the rule base in response to detecting that the external calling interface of the rule base is called;

The obtaining module is configured to obtain the matching result of the process returned by the external call interface, and update the rule base according to the modification instruction received in response to the modification instruction sent by the user based on the matching result.

It can be understood that the structure shown in the embodiment of this specification does not constitute a specific limitation on a security defense device based on the ATT&CK model. In other embodiments of this specification, a security defense device based on the ATT&CK model may include more or fewer components than shown in the illustration, or combine some components, or split some components, or arrange different components . The illustrated components may be realized in hardware, software, or a combination of software and hardware.

The information interaction and execution process among the modules in the above-mentioned device are based on the same idea as the method embodiment of this specification, and the specific content can refer to the description in the method embodiment of this specification, and will not be repeated here.

The embodiment of this specification also provides an electronic device, including a memory and a processor, where a computer program is stored in the memory, and when the processor executes the computer program, a method based on any one of the embodiments of this specification is implemented. The security defense method of ATT&CK model.

The embodiment of this specification also provides a computer-readable storage medium, where a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, the processor executes any one of the implementations of this specification. A security defense method based on the ATT&CK model in the example.

Specifically, a system or device equipped with a storage medium may be provided, on which a software program code for realizing the functions of any of the above embodiments is stored, and the computer (or CPU or MPU of the system or device) ) to read and execute the program code stored in the storage medium.

In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, so the program code and the storage medium storing the program code constitute a part of this specification.

Examples of storage media for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), Tape, non-volatile memory card, and ROM. Alternatively, the program code can be downloaded from a server computer via a communication network.

In addition, it should be clear that not only by executing the program code read by the computer, but also by making the operating system on the computer complete part or all of the actual operations through instructions based on the program code, so as to realize the function of any one of the embodiments.

In addition, it can be understood that the program code read from the storage medium is written into the memory provided in the expansion board inserted into the computer or written into the memory provided in the expansion module connected to the computer, and then based on the program code The instruction causes the CPU installed on the expansion board or the expansion module to perform some or all of the actual operations, thereby realizing the functions of any one of the above-mentioned embodiments.

It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is a relationship between these entities or operations. There is no such actual relationship or sequence. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a" does not exclude the presence of additional same elements in the process, method, article or apparatus comprising said element.

Those of ordinary skill in the art can understand that all or part of the steps to realize the above method embodiments can be completed by program instructions related hardware, and the aforementioned programs can be stored in a computer-readable storage medium. When the program is executed, the It includes the steps of the above method embodiments; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other various media that can store program codes.

Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of this specification, not to limit them; although this specification has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it can still Modifications are made to the technical solutions described in the foregoing embodiments, or equivalent replacements are made to some of the technical features; these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments in this specification.

Claims (10)

1. A security defense method based on the ATT&CK model, characterized in that it is applied to a terminal device, the terminal device is pre-installed with an initial rule base, and the rule base is based on the preset rules of the existing ATT&CK model The method is obtained by extracting, and the method includes: Monitoring the process startup status on the terminal device, and determining the rule base currently used by the terminal device for security defense; In response to monitoring the start of a process on the terminal device, determining the hardware resource consumption on the terminal device after the start of the process and the matching between the process and the rules in the rule base; Based on the hardware resource consumption and the matching situation, update the rule base, so that the terminal device uses the updated target rule base for security defense, and return the information that determines that the terminal device is currently performing security defense. Steps for the rule base. 2. The method according to claim 1, wherein the rules in the rule base are stored in an XML file encrypted according to a specified algorithm; The rule at least includes: a process name, a startup parameter, and a default operation of the current rule, and the default operation includes interception and release. 3. The method according to claim 2, wherein the rule also includes a parent process and a custom parameter, and the custom parameter includes a verification result of a digital signature, and/or a verification result of a Microsoft CAT signature, and / or vendor information. 4. The method according to claim 2, characterized in that, in response to monitoring the start of the process on the terminal device, determining the hardware resource consumption on the terminal device after the start of the process and the process Matching with the rules in the rule base, including: In response to monitoring the start of the process on the terminal device, monitor the total CPU usage and the total memory usage on the terminal device after the process starts to start, and calculate the total CPU usage and the total memory usage As the hardware resource consumption on the terminal device; and / or, In response to monitoring the start of a process on the terminal device, monitor the CPU usage rate and memory usage rate corresponding to the process after the process starts to start, and use the CPU usage rate and memory usage rate corresponding to the process as the terminal hardware resource consumption on the device; Matching the process name and startup parameters of the process with the rules in the rule base to obtain the matching situation between the process and the rules in the rule base. 5. The method according to claim 4, wherein said updating said rule base based on said hardware resource consumption and said matching situation comprises: In a case where the total CPU usage is higher than a first preset threshold and/or the total memory usage is higher than a second preset threshold within a first specified time; Or, the total CPU usage is not higher than the first preset threshold and the total memory usage is not higher than the second preset threshold within the first specified time, but the second specified time after the process is fully started Within a certain period of time, when the CPU usage rate corresponding to the process is higher than the third preset threshold and/or the memory usage rate corresponding to the process is higher than the fourth preset threshold; If the process name and startup parameters corresponding to the process are not matched in the rule base, the process name and startup parameters corresponding to the process are stored in the XML file; wherein, the default operation of the process set to intercept; If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is changed to intercept. 6. The method according to claim 4, wherein said updating said rule base based on said hardware resource consumption and said matching situation comprises: When the process is not fully started, the CPU usage rate corresponding to the process is higher than the fifth preset threshold and/or the memory usage rate corresponding to the process is higher than the sixth preset threshold; And/or, when the process is not fully started, the rate of increase of the CPU usage rate corresponding to the process is higher than the seventh preset threshold and/or the rate of increase of the memory usage rate corresponding to the process is higher than the seventh preset threshold. Eight preset threshold cases; If the process name and startup parameters corresponding to the process are not matched in the rule base, the process name and startup parameters corresponding to the process are stored in the XML file; wherein, the default operation of the process set to intercept; If the process name and startup parameters corresponding to the process are matched in the rule base, the default operation of the rule matching the process in the XML file is changed to intercept. 7. The method according to any one of claims 1-6, wherein the rule base has an external calling interface, and the external calling interface is used to add, delete and/or modify rules; The method also includes: In response to detecting that the external call interface of the rule base is called, matching the process targeted by the external call interface with the rules in the rule base; Acquire the matching result of the process returned by the external call interface, and update the rule base according to the modification instruction in response to the received modification instruction sent by the user based on the matching result. 8. A security defense device based on the ATT&CK model, characterized in that it is applied to a terminal device, and the terminal device is pre-installed with an initial rule base, and the rule base is based on the rules of the existing ATT&CK model according to the preset Extracted by way of extraction, the device includes: The first determination module is configured to monitor the process startup status on the terminal device, and determine the rule base currently used by the terminal device for security defense; The second determining module is configured to, in response to monitoring the startup of the process on the terminal device, determine the consumption of hardware resources on the terminal device after the startup of the process, and the matching situation between the process and the rules in the rule base ; An update module, configured to update the rule base based on the hardware resource consumption and the matching situation, so that the terminal device uses the updated target rule base for security defense, and returns to determine the current status of the terminal device. The steps of the rule base used for security defense. 9. An electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the method according to any one of claims 1-7 is implemented. 10. A computer-readable storage medium, on which a computer program is stored, and when the computer program is executed in a computer, it causes the computer to execute the method according to any one of claims 1-7.

Images