Windows PowerShell是一种命令行外壳程序和脚本环境,使用户可扩展Windows命令提示符。其旨在改进命令行和脚本环境,PowerShell远程也已经逐渐成为在网络上进行管理通信的主要方式。PowerShell命令在系统管理中的便捷性也使得其在很多...Windows PowerShell是一种命令行外壳程序和脚本环境,使用户可扩展Windows命令提示符。其旨在改进命令行和脚本环境,PowerShell远程也已经逐渐成为在网络上进行管理通信的主要方式。PowerShell命令在系统管理中的便捷性也使得其在很多情况下有着多种用途,诸如在维护系统安全方面。展开更多
采用PowerShell可以实现生成组策略安全报告的功能,这有时对于我们日常网络安全管理来说,也是非常有益的事情。P o w e r S h e l l在组策略管理方面的命令非常丰富,它可以新建组策略对象,修改组策略设置等等。但它还能够生成组策略安...采用PowerShell可以实现生成组策略安全报告的功能,这有时对于我们日常网络安全管理来说,也是非常有益的事情。P o w e r S h e l l在组策略管理方面的命令非常丰富,它可以新建组策略对象,修改组策略设置等等。但它还能够生成组策略安全报告,这项功能容易被人忽略,却颇具实用价值。在PowerShell 中有一个专门生成有关组策略对象报告的命令即Get-GPOReport。在生成该报告时,首先需要提供组策略对象名称比如Default Domain Policy;其次还须设定报告类型,此时选项为HTML 与XML,最后给出该报告存放的位置。展开更多
Power Shell has been widely deployed in fileless malware and advanced persistent threat(APT)attacks due to its high stealthiness and live-off-theland technique.However,existing works mainly focus on deobfuscation and ...Power Shell has been widely deployed in fileless malware and advanced persistent threat(APT)attacks due to its high stealthiness and live-off-theland technique.However,existing works mainly focus on deobfuscation and malicious detection,lacking the malicious Power Shell families classification and behavior analysis.Moreover,the state-of-the-art methods fail to capture fine-grained features and semantic relationships,resulting in low robustness and accuracy.To this end,we propose Power Detector,a novel malicious Power Shell script detector based on multimodal semantic fusion and deep learning.Specifically,we design four feature extraction methods to extract key features from character,token,abstract syntax tree(AST),and semantic knowledge graph.Then,we intelligently design four embeddings(i.e.,Char2Vec,Token2Vec,AST2Vec,and Rela2Vec) and construct a multi-modal fusion algorithm to concatenate feature vectors from different views.Finally,we propose a combined model based on transformer and CNN-Bi LSTM to implement Power Shell family detection.Our experiments with five types of Power Shell attacks show that PowerDetector can accurately detect various obfuscated and stealth PowerShell scripts,with a 0.9402 precision,a 0.9358 recall,and a 0.9374 F1-score.Furthermore,through singlemodal and multi-modal comparison experiments,we demonstrate that PowerDetector’s multi-modal embedding and deep learning model can achieve better accuracy and even identify more unknown attacks.展开更多
文摘采用PowerShell可以实现生成组策略安全报告的功能,这有时对于我们日常网络安全管理来说,也是非常有益的事情。P o w e r S h e l l在组策略管理方面的命令非常丰富,它可以新建组策略对象,修改组策略设置等等。但它还能够生成组策略安全报告,这项功能容易被人忽略,却颇具实用价值。在PowerShell 中有一个专门生成有关组策略对象报告的命令即Get-GPOReport。在生成该报告时,首先需要提供组策略对象名称比如Default Domain Policy;其次还须设定报告类型,此时选项为HTML 与XML,最后给出该报告存放的位置。
基金This work was supported by National Natural Science Foundation of China(No.62172308,No.U1626107,No.61972297,No.62172144,and No.62062019).
文摘Power Shell has been widely deployed in fileless malware and advanced persistent threat(APT)attacks due to its high stealthiness and live-off-theland technique.However,existing works mainly focus on deobfuscation and malicious detection,lacking the malicious Power Shell families classification and behavior analysis.Moreover,the state-of-the-art methods fail to capture fine-grained features and semantic relationships,resulting in low robustness and accuracy.To this end,we propose Power Detector,a novel malicious Power Shell script detector based on multimodal semantic fusion and deep learning.Specifically,we design four feature extraction methods to extract key features from character,token,abstract syntax tree(AST),and semantic knowledge graph.Then,we intelligently design four embeddings(i.e.,Char2Vec,Token2Vec,AST2Vec,and Rela2Vec) and construct a multi-modal fusion algorithm to concatenate feature vectors from different views.Finally,we propose a combined model based on transformer and CNN-Bi LSTM to implement Power Shell family detection.Our experiments with five types of Power Shell attacks show that PowerDetector can accurately detect various obfuscated and stealth PowerShell scripts,with a 0.9402 precision,a 0.9358 recall,and a 0.9374 F1-score.Furthermore,through singlemodal and multi-modal comparison experiments,we demonstrate that PowerDetector’s multi-modal embedding and deep learning model can achieve better accuracy and even identify more unknown attacks.
