280 lines
10 KiB
C#
280 lines
10 KiB
C#
|
using System;
|
|||
|
|
using System.Collections.Generic;
|
|||
|
|
using System.Diagnostics;
|
|||
|
|
using System.Linq;
|
|||
|
|
using System.Threading.Tasks;
|
|||
|
|
using MemScanEDR.Models;
|
|||
|
|
|
|||
|
|
namespace MemScanEDR.Services;
|
|||
|
|
|
|||
|
|
/// <summary>
|
|||
|
|
/// 三级联动检测管线 —— 2.0 核心编排引擎
|
|||
|
|
///
|
|||
|
|
/// 流程：
|
|||
|
|
/// [快速预过滤] → [第一层: 基线异常检测] → [第二层: 监督分类] → [第三层: MITRE规则复核] → 输出
|
|||
|
|
///
|
|||
|
|
/// 速度优化：
|
|||
|
|
/// - 预过滤阶段不读内存，仅元数据判断，跳过 >80% 的进程
|
|||
|
|
/// - 只在可疑进程上执行完整特征提取
|
|||
|
|
/// - 基线匹配失败时提前退出，节省计算
|
|||
|
|
/// </summary>
|
|||
|
|
public class DetectionPipeline
|
|||
|
|
{
|
|||
|
|
private readonly BaselineEngine _baselineEngine;
|
|||
|
|
private readonly ClassificationEngine _classificationEngine;
|
|||
|
|
private readonly RuleEngine _ruleEngine;
|
|||
|
|
private readonly FeatureExtractor _featureExtractor;
|
|||
|
|
private readonly MemoryScanner _memoryScanner;
|
|||
|
|
private readonly BaselineLibrary _baselineLibrary;
|
|||
|
|
|
|||
|
|
// 扫描模式
|
|||
|
|
private readonly ScanMode _mode;
|
|||
|
|
|
|||
|
|
public DetectionPipeline(ScanMode mode = ScanMode.Balanced)
|
|||
|
|
{
|
|||
|
|
_mode = mode;
|
|||
|
|
_baselineLibrary = BaselineLibrary.CreateDefault();
|
|||
|
|
_baselineEngine = new BaselineEngine(_baselineLibrary);
|
|||
|
|
_classificationEngine = new ClassificationEngine();
|
|||
|
|
_ruleEngine = new RuleEngine();
|
|||
|
|
_featureExtractor = new FeatureExtractor();
|
|||
|
|
_memoryScanner = new MemoryScanner();
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/// <summary>
|
|||
|
|
/// 完整三级检测流程
|
|||
|
|
/// </summary>
|
|||
|
|
public Task<ScanResult> AnalyzeAsync(ProcessInfo proc, List<Signature> signatures)
|
|||
|
|
{
|
|||
|
|
return Task.FromResult(Analyze(proc, signatures));
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/// <summary>
|
|||
|
|
/// 完整三级检测流程（同步核心）
|
|||
|
|
/// </summary>
|
|||
|
|
private ScanResult Analyze(ProcessInfo proc, List<Signature> signatures)
|
|||
|
|
{
|
|||
|
|
var sw = Stopwatch.StartNew();
|
|||
|
|
|
|||
|
|
// ─── 阶段0: 快速预过滤（不读内存）───
|
|||
|
|
var memoryRegions = _memoryScanner.GetMemoryRegions(proc.Pid);
|
|||
|
|
proc.MemoryRegions = memoryRegions;
|
|||
|
|
var signatureMatches = new List<SignatureMatch>();
|
|||
|
|
|
|||
|
|
var preFilterResult = QuickPreFilter(proc, memoryRegions);
|
|||
|
|
if (preFilterResult.canSkip)
|
|||
|
|
{
|
|||
|
|
return new ScanResult
|
|||
|
|
{
|
|||
|
|
Pid = proc.Pid,
|
|||
|
|
ProcessName = proc.Name,
|
|||
|
|
RiskLevel = RiskLevel.Safe,
|
|||
|
|
RiskScore = preFilterResult.score,
|
|||
|
|
Indicators = new List<string>(),
|
|||
|
|
Reasoning = preFilterResult.reason,
|
|||
|
|
AIProvider = "pipeline-v2/fast-filter",
|
|||
|
|
DetectionLayer = "PreFilter",
|
|||
|
|
ScanTime = DateTime.Now
|
|||
|
|
};
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ─── 阶段1: 内存区域扫描（轻量）───
|
|||
|
|
if (_mode != ScanMode.Fast)
|
|||
|
|
{
|
|||
|
|
var suspiciousRegions = _memoryScanner.GetSuspiciousRegions(proc.Pid);
|
|||
|
|
if (suspiciousRegions.Count > 0 || proc.IsTempPath || !proc.IsSigned)
|
|||
|
|
{
|
|||
|
|
signatureMatches = _memoryScanner.ScanProcess(proc.Pid, signatures);
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ─── 阶段2: 特征提取 ───
|
|||
|
|
MemoryFeatures features;
|
|||
|
|
if (_mode == ScanMode.Fast)
|
|||
|
|
{
|
|||
|
|
features = _featureExtractor.QuickExtract(proc, memoryRegions);
|
|||
|
|
}
|
|||
|
|
else
|
|||
|
|
{
|
|||
|
|
features = _featureExtractor.Extract(proc, memoryRegions, signatureMatches, signatures);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ─── 第一层: 无监督基线检测 ───
|
|||
|
|
var baselineResult = _baselineEngine.Analyze(features);
|
|||
|
|
|
|||
|
|
// 完全匹配基线 → 直接判定为正常
|
|||
|
|
if (baselineResult.Classification == BaselineClassification.Normal &&
|
|||
|
|
baselineResult.AnomalyScore < 0.20)
|
|||
|
|
{
|
|||
|
|
return BuildSafeResult(proc, features, baselineResult, signatureMatches,
|
|||
|
|
$"第一层 | 进程内存结构完全匹配正常基线 [{baselineResult.BaselineName}] | 异常分数={baselineResult.AnomalyScore:F3}");
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ─── 第二层: 监督分类 ───
|
|||
|
|
var classificationResult = _classificationEngine.Classify(features);
|
|||
|
|
|
|||
|
|
// 分类为良性 + 基线无异常 → 安全
|
|||
|
|
if (classificationResult.Classification == MalwareClass.Benign &&
|
|||
|
|
baselineResult.AnomalyScore < 0.40)
|
|||
|
|
{
|
|||
|
|
return BuildSafeResult(proc, features, baselineResult, signatureMatches,
|
|||
|
|
$"第二层 | 分类器判定良性 | {classificationResult.SuspectedFamily}");
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ─── 第三层: MITRE ATT&CK规则复核 ───
|
|||
|
|
var ruleResult = _ruleEngine.Validate(features, classificationResult, baselineResult);
|
|||
|
|
|
|||
|
|
// ─── 构建最终结果 ───
|
|||
|
|
var indicators = BuildIndicators(features, baselineResult, classificationResult, ruleResult);
|
|||
|
|
var layer = DetermineDetectionLayer(baselineResult, classificationResult, ruleResult);
|
|||
|
|
|
|||
|
|
return new ScanResult
|
|||
|
|
{
|
|||
|
|
Pid = proc.Pid,
|
|||
|
|
ProcessName = proc.Name,
|
|||
|
|
RiskLevel = ruleResult.FinalRiskLevel,
|
|||
|
|
RiskScore = ruleResult.CombinedScore,
|
|||
|
|
Indicators = indicators,
|
|||
|
|
Reasoning = ruleResult.Reasoning,
|
|||
|
|
Matches = signatureMatches,
|
|||
|
|
AIProvider = $"pipeline-v2/{_mode.ToString().ToLower()}",
|
|||
|
|
DetectionLayer = layer,
|
|||
|
|
ScanTime = DateTime.Now
|
|||
|
|
};
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// ─── 快速预过滤 ───
|
|||
|
|
private static (bool canSkip, double score, string reason) QuickPreFilter(
|
|||
|
|
ProcessInfo proc, List<MemoryRegion> regions)
|
|||
|
|
{
|
|||
|
|
double score = 0;
|
|||
|
|
var reasons = new List<string>();
|
|||
|
|
|
|||
|
|
// 已签名 + 系统路径 + 无网络 → 几乎肯定安全
|
|||
|
|
if (proc.IsSigned && proc.IsSystemPath && proc.Connections.Count == 0)
|
|||
|
|
{
|
|||
|
|
// 再检查是否有可疑内存区域
|
|||
|
|
var hasRwx = regions.Any(r =>
|
|||
|
|
r.Protect.Contains("EXECUTE_READWRITE") && r.Type == "PRIVATE");
|
|||
|
|
|
|||
|
|
if (!hasRwx && !proc.IsTempPath)
|
|||
|
|
{
|
|||
|
|
return (true, 0, $"预过滤 | 已签名系统程序 | PID={proc.Pid} {proc.Name}");
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// 脚本引擎/Shell 有合法RWX(JIT)，即使有RWX也是正常的
|
|||
|
|
if (hasRwx && FeatureExtractor.IsScriptingEngine(proc))
|
|||
|
|
{
|
|||
|
|
return (true, 0.05, $"预过滤 | 已签名脚本引擎(RWX为JIT正常行为) | PID={proc.Pid} {proc.Name}");
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// 未签名 + 临时路径 → 需要进一步分析
|
|||
|
|
if (!proc.IsSigned && proc.IsTempPath)
|
|||
|
|
score += 0.30;
|
|||
|
|
|
|||
|
|
// 系统进程名 + 非系统路径 → 可疑
|
|||
|
|
if (FeatureExtractor.IsSystemProcessName(proc.Name) && !proc.IsSystemPath)
|
|||
|
|
score += 0.35;
|
|||
|
|
|
|||
|
|
// 网络连接到可疑端口
|
|||
|
|
if (proc.Connections.Any(c => IsSuspiciousPort(c.RemotePort)))
|
|||
|
|
score += 0.25;
|
|||
|
|
|
|||
|
|
// RWX 私有页
|
|||
|
|
if (regions.Any(r => r.Protect.Contains("EXECUTE_READWRITE") && r.Type == "PRIVATE"))
|
|||
|
|
score += 0.20;
|
|||
|
|
|
|||
|
|
if (score < 0.05)
|
|||
|
|
return (true, 0, $"预过滤 | 无可疑特征 | PID={proc.Pid} {proc.Name}");
|
|||
|
|
|
|||
|
|
if (score < 0.15 && proc.IsSigned)
|
|||
|
|
return (true, score * 0.5, $"预过滤 | 已签名低风险 | PID={proc.Pid} {proc.Name} | score={score:F2}");
|
|||
|
|
|
|||
|
|
return (false, score, $"预过滤 | 进入AI分析 | PID={proc.Pid} {proc.Name} | score={score:F2}");
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
private static bool IsSuspiciousPort(int port) => port switch
|
|||
|
|
{
|
|||
|
|
4444 or 5555 or 6666 or 7777 or 1337 or 31337 or 9999 or 12345 or 27015 => true,
|
|||
|
|
_ => false
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
private static ScanResult BuildSafeResult(ProcessInfo proc, MemoryFeatures features,
|
|||
|
|
BaselineResult baseline, List<SignatureMatch> matches, string reasoning)
|
|||
|
|
{
|
|||
|
|
return new ScanResult
|
|||
|
|
{
|
|||
|
|
Pid = proc.Pid,
|
|||
|
|
ProcessName = proc.Name,
|
|||
|
|
RiskLevel = RiskLevel.Safe,
|
|||
|
|
RiskScore = Math.Min(baseline.AnomalyScore, 0.15),
|
|||
|
|
Indicators = new List<string>(),
|
|||
|
|
Reasoning = reasoning,
|
|||
|
|
Matches = matches,
|
|||
|
|
AIProvider = "pipeline-v2/baseline",
|
|||
|
|
DetectionLayer = "Layer1_Baseline",
|
|||
|
|
ScanTime = DateTime.Now
|
|||
|
|
};
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
private static List<string> BuildIndicators(MemoryFeatures f, BaselineResult baseline,
|
|||
|
|
ClassificationResult classification, RuleValidationResult rule)
|
|||
|
|
{
|
|||
|
|
var indicators = new List<string>();
|
|||
|
|
|
|||
|
|
if (baseline.IsAnomalous)
|
|||
|
|
{
|
|||
|
|
indicators.Add($"基线异常(分数={baseline.AnomalyScore:F2})");
|
|||
|
|
foreach (var idx in baseline.DeviantFeatureIndices.Take(3))
|
|||
|
|
indicators.Add($"偏离特征#{idx}");
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if (classification.Classification == MalwareClass.Malicious)
|
|||
|
|
indicators.Add($"AI分类:恶意({classification.SuspectedFamily})");
|
|||
|
|
else if (classification.Classification == MalwareClass.Suspicious)
|
|||
|
|
indicators.Add("AI分类:可疑");
|
|||
|
|
|
|||
|
|
if (rule.MatchedRuleCount > 0)
|
|||
|
|
{
|
|||
|
|
foreach (var tech in rule.MatchedTechniques.Take(5))
|
|||
|
|
indicators.Add(tech);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
if (f.RwxPrivatePages > 0)
|
|||
|
|
indicators.Add($"RWX私有页={f.RwxPrivatePages}");
|
|||
|
|
|
|||
|
|
if (f.PeMismatchDisk)
|
|||
|
|
indicators.Add("ProcessHollowing");
|
|||
|
|
|
|||
|
|
if (f.SuspiciousStringHits > 0)
|
|||
|
|
indicators.Add($"敏感字符串={f.SuspiciousStringHits}");
|
|||
|
|
|
|||
|
|
return indicators;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
private static string DetermineDetectionLayer(BaselineResult baseline,
|
|||
|
|
ClassificationResult classification, RuleValidationResult rule)
|
|||
|
|
{
|
|||
|
|
if (rule.MatchedRuleCount >= 2) return "L3_Rules+L2_AI+L1_Baseline";
|
|||
|
|
if (classification.Classification == MalwareClass.Malicious) return "L2_AI+L1_Baseline";
|
|||
|
|
if (baseline.IsAnomalous) return "L1_Baseline";
|
|||
|
|
return "PreFilter";
|
|||
|
|
}
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/// <summary>
|
|||
|
|
/// 扫描模式
|
|||
|
|
/// </summary>
|
|||
|
|
public enum ScanMode
|
|||
|
|
{
|
|||
|
|
/// <summary>快速模式：仅元数据，不读取内存</summary>
|
|||
|
|
Fast,
|
|||
|
|
|
|||
|
|
/// <summary>平衡模式：采样熵值 + 特征提取</summary>
|
|||
|
|
Balanced,
|
|||
|
|
|
|||
|
|
/// <summary>深度模式：全量内存扫描 + 完整特征提取</summary>
|
|||
|
|
Deep
|
|||
|
|
}
|