CN118278005A - A method for detecting ransomware in industrial control systems based on multi-file feature monitoring and program behavior analysis - Google Patents

Abstract

The invention belongs to the field of industrial Internet information security, and discloses an industrial control system Lesovirus detection method based on multi-element file feature monitoring and program behavior analysis. Aiming at the problems of high false alarm rate, multiple redundant characteristics and the like of the current Leucavirus detection method, a more accurate and comprehensive detection method is provided. By inserting a decoy file into a target system to attract potential intruders to operate, monitoring file characteristic changes and designing a change function, analyzing program behaviors by using a memory evidence obtaining tool and a rule matching tool, and designing a matching degree function. And finally, integrating file characteristic change, suspicious program behavior matching condition and target system equipment display screen change, designing a scoring system, and judging whether the suspicious program is industrial lux virus. The comprehensive detection method can timely respond to the invasion of the Leucavirus, reduce the false alarm rate, improve the accuracy, enhance the safety and the efficiency of the system, and provide a new detection means for the field of information safety of the industrial Internet.

Description

An industrial control system based on multi-file feature monitoring and program behavior analysis Ransomware detection method

Technical Field

The present invention belongs to the field of industrial Internet information security and discloses an industrial control system ransomware virus detection method based on multi-file feature monitoring and program behavior analysis.

Background technique

With the development of industrial Internet technology, ransomware, a malware that encrypts user files or systems and forces them to pay for decryption keys, has become a serious network threat to industrial control systems. Attackers first attack machines inside industrial control systems through phishing, weak passwords, or vulnerabilities. When a networked machine is invaded, they will detect machines with vulnerabilities in the local area network and eventually implant industrial ransomware programs into the machines with vulnerabilities. Once the virus infects the user system, it will begin to encrypt important files such as production technical documents and data information tables, making them inaccessible. Therefore, a more accurate and comprehensive industrial ransomware detection method is needed to prevent such threats.

At present, there are two main methods for detecting industrial ransomware: static detection and dynamic detection. For example, in the "Study on the Effectiveness of System API-related Information for Android Ransomware Detection" proposed by SCALAS M et al. in the "Computer and Security" journal, the ransomware was statically screened by matching the pre-set ransomware API (Application Programming Interface) list. Although it is very effective for discovering known threats and the detection method has a high accuracy rate, the detection speed is slow. In addition, most ransomware will use code obfuscation, junk instructions and other means to counter static analysis methods; in the "Ransomware Homology Analysis Based on Sequence Alignment" proposed by Gong Qi et al. in the "Computer and Modernization" journal, the dynamic behavior characteristics used in the combination of sequence alignment methods are used to dynamically monitor the ransomware. This detection method can discover unknown threats, but because industrial ransomware mostly uses anti-virtual environment technology, the samples captured based on the sandbox cannot fully reflect the behavior of the samples and are prone to false positives. If you want to improve the accuracy and robustness of industrial ransomware detection, you must find a new detection method for industrial ransomware.

Therefore, we adopt a method based on combining multi-file feature monitoring with program behavior analysis. We dynamically analyze the behavioral activities of suspicious programs during runtime, monitor file changes from multiple levels of file features, and analyze suspicious program behaviors using memory forensics tools and rule matching tools. Finally, we comprehensively evaluate whether the malicious program is an industrial ransomware virus based on comprehensive file feature monitoring, suspicious program behavior matching, and changes in the display screen of the target system device.

Summary of the invention

In view of the problems of slow detection speed and easy false alarm in existing detection methods, the purpose of the present invention is to provide a ransomware virus detection method for industrial control systems based on multi-file feature monitoring and program behavior analysis. This method can comprehensively monitor the matching degree of file feature changes and program behavior, and has the advantages of high reliability, strong robustness, and low complexity.

The technical solution of the present invention is as follows:

A method for detecting ransomware in industrial control systems based on multi-file feature monitoring and program behavior analysis, the steps are as follows:

Step 1: Create a decoy document

Insert the pre-set bait files into different paths in the operating environment of the protected target system; the bait files include various user type files (such as: production technical documents.txt, customer information tables.csv, important system configuration files.ini, etc.); the bait files cannot be empty and the file size needs to occupy a certain number of bytes;

Step 2: Multivariate monitoring of file feature changes

To protect the target system, the file name, file type, and file content will be monitored for feature changes. After being attacked by the industrial ransomware, there are two main changes in the file name and file type: one is that the industrial ransomware directly names the original file as a custom file name; the other is that the industrial ransomware uses the original file name and modifies the file type (suffix) to a custom format; the file content, after the industrial ransomware encrypts the file, the hash value generated according to the file content will change, which is inconsistent with the hash value of the original file before encryption. Therefore, by detecting the hash value, it is possible to quickly find out whether the file is encrypted and to verify the integrity and accuracy of the file content after the suspicious program is run. In summary, a file feature change function is designed to quantitatively describe its feature changes.

Step 3: Program Behavior Analysis

After analyzing the file features, use the memory forensics tool to export the memory image, and then use the rule matching tool to analyze the memory image according to the matching rules to obtain the suspicious program behavior; then, through the previous analysis of the industrial ransomware virus, match the constructed ransomware virus behavior with the obtained behavior to help identify whether the suspicious program sample belongs to the virus sample family; based on this, design a matching degree function between the suspicious program sample behavior and the matching rules and the industrial ransomware virus behavior characteristics.

Step 4: Monitor changes in the target operating system

When an industrial control system is infected with a ransomware virus, the most obvious feature is that the device display of the target engineer station will change significantly, usually in the form of modifying the desktop background, changing file icons, or displaying ransomware information. Automatically taking screenshots of the desktop before and after the execution of the suspicious program sample, and using image analysis methods to analyze and compare a series of screenshots, can determine whether the sudden change in the screen occurred during the operation of the suspicious program sample. Therefore, based on the change information of the desktop display of the monitoring target system, a function of the degree of impact on the target system is designed.

Step 5: Comprehensively determine whether it is an industrial ransomware virus

Based on the above steps, we proposed a scoring system based on multi-file feature monitoring and program behavior analysis to detect and evaluate the risk of ransomware in the system. The system covers the weight assignment and weighted evaluation of file feature changes, suspicious program behavior matching, and target system device display change functions, which can comprehensively determine whether the system is threatened by industrial ransomware to help related companies take corresponding prevention and response measures in a timely manner.

The beneficial effects of the present invention are as follows: First, it solves the problems of code obfuscation, junk instructions and other means that are difficult to analyze with static detection methods; second, it adopts a detection method that combines multivariate file feature monitoring with program behavior analysis. Compared with single-level detection methods, multivariate analysis is more comprehensive, and can comprehensively evaluate the behavior of suspicious program samples from multiple angles such as file name, type, content, and program behavior matching, thereby improving the accuracy of detection and reducing the false alarm rate; third, an image analysis method is introduced in the detection to monitor changes in the screen display of the target engineer station equipment. This helps to capture the obvious features of industrial ransomware virus infection in a timely manner, such as modifying the desktop background, changing file icons, or displaying ransomware information, thereby improving the detection effect of malicious programs.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a structural diagram of a ransomware detection method based on a combination of multi-dimensional file status changes and memory feature analysis.

FIG2 is a flow chart of a ransomware detection method based on a combination of multi-dimensional file status changes and memory feature analysis.

Detailed ways

The specific implementation of the present invention is further described below in conjunction with the accompanying drawings and technical solutions.

In a basic implementation of the present invention, there are five steps. The purpose of the invention is to comprehensively, accurately and robustly detect whether a malicious program is an industrial ransomware virus based on multi-file feature monitoring and program behavior matching. The specific implementation steps are as follows:

Step 1: Create a decoy document

In the operating environment of the protected target system, the suspicious program samples are dynamically analyzed. In order to enhance the attractiveness of the bait file, the bait file is considered to be associated with common industrial control system applications and data files. Therefore, the configuration files of the SCADA system, PLC programming files, HMI project files and other bait files that are pre-set are inserted into different paths. The bait files can include various user type files, such as .ladder, .db, .txt, .csv, etc. It should be noted that the bait file cannot be empty and the file size needs to occupy a certain number of bytes.

Step 2: Multivariate monitoring of file feature changes

The target operating system will monitor feature changes from multiple levels, including file name, type, and content. There are two main situations in which the file name and file type change after a ransomware attack: one is that the industrial ransomware directly names the original file as a custom file name; the other is that the industrial ransomware will use the file name of the original file and modify the file type (suffix) to a custom format; and as for the file content, after the industrial ransomware encrypts the file, the MD5 hash value generated according to the file content will change, which is inconsistent with the MD5 hash value of the original file before encryption. Therefore, the open source file integrity monitoring tool AIDE or Tripwire can be used to automatically calculate the MD5 hash value of the file and perform comparison monitoring. In addition, this function can also be achieved by writing a simple script to use the system's built-in MD5 calculation tool: the md5sum command in Linux. It can verify whether the file is encrypted and can be used to detect whether the content of the file is damaged and the degree of damage after the ransomware.

Based on this, the design file feature change function is:

(1) File name change (FN): Score is given based on the degree of change of the file name: Where: len(new_filename _j ), len(old_filename _j ) represent the lengths of the new and old file names of the j-th modified file respectively, semantic_change _j represents the degree of semantic change of the j-th modified file name, which can be calculated by the text similarity algorithm, and n is the total number of files.

(2) File type change (FT): The score is given according to the degree of change of the file type (suffix):

Where: old_num _k and new_num _k are the number of different file types before and after the suspicious program is run, m is the total number of file types, weight _k is the user-defined weight of the file type, which is used to indicate the danger level of the kth file type (e.g., .txt documents that are easily modified will be assigned a higher value).

(3) File content change (FC): By comparing the hash value difference and content similarity change of the file before and after encryption, a score is given:

Among them: hash_difference _l represents the difference in hash values before and after the lth file is encrypted; content_similarity _l represents the similarity before and after the lth file is encrypted, which can be calculated using a text similarity algorithm; and n is the total number of files.

Step 3: Program Behavior Analysis

After analyzing the file features, use the memory forensics tool to export the memory image, and then use the rule matching tool to analyze the image according to the matching rules to obtain the behavioral features of the suspicious program, such as API calls, injections, code execution, and network activities. After that, through the early analysis of industrial ransomware, the constructed ransomware behavior features are matched with the obtained behavior features to help identify whether the suspicious program sample belongs to the virus sample family.

Therefore, the matching function of suspicious program sample behavior and matching rules and industrial ransomware virus behavior characteristics is designed as follows:

Wherein: behavior_similarity _t represents the similarity between the behavior characteristics of the t-th suspicious program and the corresponding matching rule, frequency _t represents the frequency of the t-th suspicious program behavior, duration _t represents the duration of the t-th suspicious program behavior, malware_correlation _t represents the similarity between the t-th suspicious program behavior and the ransomware virus behavior characteristics, and the suspicious program generates a total of u behavior characteristics.

Step 4: Monitor changes in the target operating system

When an industrial control system is infected with a ransomware virus, the most obvious feature is that the device screen display of the target engineer station will change significantly, usually in the form of modifying the desktop background, changing file icons, or displaying ransomware information. Automatically taking screenshots of the desktop before and after the execution of suspicious program samples, and using image analysis methods to analyze and compare a series of screenshots in terms of image brightness, contrast, and structure, can determine whether the sudden screen change occurred during the sample operation.

Therefore, according to the change information displayed on the desktop of the monitoring target system, the function of the degree of impact on the target system is designed as follows:

Impact _s represents the degree of influence of the sth user-defined change on the system (e.g., background modifications with greater degrees of change will be assigned higher values), and a total of v changes are generated (e.g., background modifications, file icon changes, etc.).

Step 5: Comprehensively determine whether it is an industrial ransomware virus

Based on the above steps, a scoring system based on multi-file feature monitoring and program behavior analysis is proposed to detect and evaluate the possible risks in the system. The system assigns weights to the relevant functions of file feature changes, suspicious program behavior matching, and target system device display changes, and then performs a weighted evaluation based on their correlation with ransomware features. The specific evaluation rules are as follows:

Total Score:

Taking into account the scores of the above three aspects and five dimensions, and assigning weights to them according to prior knowledge: W(1) = 0.2, W(2) = 0.1, W(3) = 0.2, W(4) = 0.3, W(5) = 0.2, the comprehensive score can be calculated as:

Where: W(i) is the weight corresponding to the i-th dimension, i=1, 2, 3, 4, 5 in Factor(i) correspond to Factor(i)=F(degree of change), G(degree of change), H(degree of change), I(degree of change), J(degree of change) respectively; Normalization(TotalScore) is the function for normalizing the total score:

At this point, a comprehensive score including the above five dimensions can be obtained. Now set the threshold to β, 0＜β＜1. When the obtained Total Score is higher than β, the system will be judged as having suffered a ransomware attack; otherwise, the system has not been attacked.

With the above-mentioned ideal embodiments of the present invention as inspiration, through the above-mentioned description, those skilled in the art can make various changes and modifications without departing from the technical concept of the present invention. The technical scope of the present invention is not limited to the contents of the specification, and its technical scope must be determined according to the scope of the claims.

Claims (5)

1. An industrial control system Lesovirus detection method based on multi-element file feature monitoring and program behavior analysis is characterized by comprising the following steps:

Step one: creating a decoy file

Inserting the preset bait files into different paths in the operation environment of the protection target system; wherein the decoy file comprises various user type files; the bait file cannot be empty, and the file size needs to occupy a certain byte;

Step two: multiple monitoring file feature changes

The protection target system monitors characteristic changes from multiple layers of file names, file types and file contents; after being attacked by the industrial lux virus, there are mainly two cases of changes in file name and file type: firstly, the industrial Lesovirus directly names an original file as a custom file name; secondly, the industrial Leucovirus adopts the file name of the original file, and modifies the file type into a self-defined format; after the file content is encrypted by the industrial Leucovirus, the hash value generated according to the file content is changed and is inconsistent with the hash value of the original file before encryption, so that whether the file is encrypted or not is rapidly found through detecting the hash value, and the integrity and the accuracy of the file content after the suspicious program to be tested is operated are checked;

Step three: program behavior analysis

After the file characteristics are analyzed, a memory evidence obtaining tool is used for exporting a memory mirror image, and a rule matching tool is used for analyzing the memory mirror image according to a matching rule, so that suspicious program behaviors are obtained; then, through early-stage analysis of industrial Leucavirus, the structured Leucavirus behavior is matched with the acquired behavior so as to help identify whether a suspicious program sample belongs to a virus sample family;

Step four: monitoring target operating system changes

When the industrial control system is infected by the lux virus, the most obvious characteristic is that the equipment display of the target engineer station is greatly changed to modify the desktop background, change the file icon or display the lux information form; automatically capturing a screen desktop before and after execution of the suspicious program sample, and analyzing and comparing a series of screen shots by using an image analysis method to determine whether a sudden screen change occurs during the running of the suspicious program sample;

Step five: full evaluation of whether it is an industrial Lexovirus

Providing a scoring system based on multi-element file feature monitoring and program behavior analysis for detecting and evaluating possible risk of the Leucavirus in the system; the scoring system comprises the steps of assigning weights for file characteristic changes, suspicious program behavior matching and target system equipment display change functions and carrying out weighted evaluation, so that whether the system is threatened by industrial Leuch viruses can be comprehensively judged.

2. The method for detecting the Lesovirus of the industrial control system based on the multi-file feature monitoring and the program behavior analysis according to claim 1, wherein,

In the second step, the second step is to carry out the process,

The characteristic change function of the design file is as follows:

(1) File name change: a score is given according to the degree of change in file name:

Wherein: len (new_filename _j),len(old_filename_j) represents the length of the j-th modified new and old filenames, semantic _change _j represents the semantic change degree of the j-th modified filename, and n is the total number of files;

(2) File type change: a score is given according to the degree of change in the file type:

Wherein: old_num _k、new_num_k is the number of different file types before and after the suspicious program runs, m is the total number of file types, weight _k is the weight of the user-defined file types and is used for representing the risk degree of the kth file type;

(3) File content change: by comparing the hash value difference and the content similarity change of the files before and after encryption, scoring is given:

Wherein: hash_difference _l represents the difference in hash values before and after the first file is encrypted,

Content_similarity _l represents the similarity of the first file before and after being encrypted, calculated by a text similarity algorithm, and n is the total number of files.

3. The method for detecting the Lesovirus of the industrial control system based on the multi-file feature monitoring and the program behavior analysis according to claim 1, wherein,

In the third step, the first step is performed,

The matching degree function of the suspicious program sample behaviors and the matching rules and the industrial Leesvirus behavior characteristics is designed as follows:

Wherein: behavior _similarity _t represents the similarity between the behavior characteristics of the t-th suspicious program and the corresponding matching rules formulated, frequency _t represents the frequency of the t-th suspicious program behavior, duration _t represents the duration of the t-th suspicious program behavior, and software_classification _t represents the similarity between the t-th suspicious program behavior and the behavior characteristics of the lux virus, and the suspicious programs produce u behavior characteristics altogether.

4. The method for detecting the Lesovirus of the industrial control system based on the multi-file feature monitoring and the program behavior analysis according to claim 1, wherein,

In the fourth step, the first step is performed,

According to the change information displayed on the desktop of the monitoring target system, the function of the influence degree on the target system is designed as follows:

Wherein, the image _i represents the influence degree of the user-defined s-th change on the system, and v changes are generated in total.

5. The method for detecting the Lesovirus of the industrial control system based on the multi-file feature monitoring and the program behavior analysis according to claim 1, wherein,

In the fifth step, the first step is to carry out the process,

And (3) scoring system, namely assigning weights to the scoring system according to priori knowledge: w (1) =0.2, W (2) =0.1, W (3) =0.2, W (4) =0.3, W (5) =0.2, the composite score is calculated as

Where W (i) is the corresponding weight of the i-th dimension, and i=1, 2,3,4,5 in Factor (i) corresponds to Factor(i)＝F(degree of change)、G(degree of change)、H(degree of change)、I(degree of change)、J(degree of change);Normalization(x), respectively, is a function of normalizing the total score: