230 lines
7.3 KiB
C#
230 lines
7.3 KiB
C#
using System;
|
||
using System.Collections.Generic;
|
||
|
||
namespace MemScanEDR.Models;
|
||
|
||
/// <summary>
|
||
/// AI 输入特征向量 —— 从进程内存提取的全部多维特征
|
||
/// 作为无监督基线检测和监督分类的输入
|
||
/// </summary>
|
||
public class MemoryFeatures
|
||
{
|
||
// ========== 一、进程元数据特征 ==========
|
||
|
||
/// <summary>进程名</summary>
|
||
public string ProcessName { get; set; } = "";
|
||
|
||
/// <summary>原始镜像路径</summary>
|
||
public string ExePath { get; set; } = "";
|
||
|
||
/// <summary>父进程 PID</summary>
|
||
public int ParentPid { get; set; }
|
||
|
||
/// <summary>父进程名</summary>
|
||
public string ParentName { get; set; } = "";
|
||
|
||
/// <summary>命令行</summary>
|
||
public string CmdLine { get; set; } = "";
|
||
|
||
/// <summary>启动时间</summary>
|
||
public DateTime StartTime { get; set; }
|
||
|
||
/// <summary>工作集大小 (MB)</summary>
|
||
public long WorkingSetMB { get; set; }
|
||
|
||
/// <summary>线程数</summary>
|
||
public int ThreadCount { get; set; }
|
||
|
||
/// <summary>是否已签名</summary>
|
||
public bool IsSigned { get; set; }
|
||
|
||
/// <summary>签名者</summary>
|
||
public string Signer { get; set; } = "";
|
||
|
||
/// <summary>是否在系统路径</summary>
|
||
public bool IsSystemPath { get; set; }
|
||
|
||
/// <summary>是否在临时路径</summary>
|
||
public bool IsTempPath { get; set; }
|
||
|
||
// ========== 二、内存页权限分布特征 ==========
|
||
|
||
/// <summary>内存区域总数</summary>
|
||
public int TotalRegions { get; set; }
|
||
|
||
/// <summary>只读页数 (R)</summary>
|
||
public int ReadOnlyPages { get; set; }
|
||
|
||
/// <summary>读写页数 (RW)</summary>
|
||
public int ReadWritePages { get; set; }
|
||
|
||
/// <summary>只读执行页数 (RX) —— 正常代码段</summary>
|
||
public int ExecuteReadPages { get; set; }
|
||
|
||
/// <summary>读写执行页数 (RWX) —— 高可疑指标</summary>
|
||
public int ExecuteReadWritePages { get; set; }
|
||
|
||
/// <summary>私有内存页数 (PRIVATE)</summary>
|
||
public int PrivatePages { get; set; }
|
||
|
||
/// <summary>映射文件页数 (MAPPED)</summary>
|
||
public int MappedPages { get; set; }
|
||
|
||
/// <summary>磁盘镜像页数 (IMAGE)</summary>
|
||
public int ImagePages { get; set; }
|
||
|
||
/// <summary>无文件匿名可执行内存页数 (PRIVATE + EXECUTE 且非 IMAGE)</summary>
|
||
public int AnonymousExecPages { get; set; }
|
||
|
||
/// <summary>RWX私有页数量 (恶意注入核心标志)</summary>
|
||
public int RwxPrivatePages { get; set; }
|
||
|
||
/// <summary>RWX页总大小 (bytes)</summary>
|
||
public ulong RwxTotalSize { get; set; }
|
||
|
||
// ========== 三、内存代码特征 ==========
|
||
|
||
/// <summary>内存中是否存在 PE 头</summary>
|
||
public bool HasInMemoryPE { get; set; }
|
||
|
||
/// <summary>内存PE与磁盘是否不一致 (Process Hollowing 标志)</summary>
|
||
public bool PeMismatchDisk { get; set; }
|
||
|
||
/// <summary>检测到的可疑API字符串</summary>
|
||
public List<string> SuspiciousApiStrings { get; set; } = new();
|
||
|
||
/// <summary>内存敏感字符串命中数</summary>
|
||
public int SuspiciousStringHits { get; set; }
|
||
|
||
/// <summary>检测到的内存敏感字符串样本</summary>
|
||
public List<string> SuspiciousStrings { get; set; } = new();
|
||
|
||
/// <summary>签名匹配数量</summary>
|
||
public int SignatureMatchCount { get; set; }
|
||
|
||
/// <summary>高危签名匹配数</summary>
|
||
public int HighSeverityMatches { get; set; }
|
||
|
||
// ========== 四、熵/字节统计特征 ==========
|
||
|
||
/// <summary>代码段平均熵值 (0-8)</summary>
|
||
public double AvgCodeEntropy { get; set; }
|
||
|
||
/// <summary>最高熵值</summary>
|
||
public double MaxEntropy { get; set; }
|
||
|
||
/// <summary>高熵区域数量 (熵 > 7.0)</summary>
|
||
public int HighEntropyRegions { get; set; }
|
||
|
||
/// <summary>高熵区域总大小</summary>
|
||
public ulong HighEntropyTotalSize { get; set; }
|
||
|
||
/// <summary>熵值标准差 (均匀性指标)</summary>
|
||
public double EntropyStdDev { get; set; }
|
||
|
||
// ========== 五、网络行为特征 ==========
|
||
|
||
/// <summary>网络连接数</summary>
|
||
public int ConnectionCount { get; set; }
|
||
|
||
/// <summary>监听端口数</summary>
|
||
public int ListeningPorts { get; set; }
|
||
|
||
/// <summary>出站连接到非标准端口数</summary>
|
||
public int NonStandardPortConnections { get; set; }
|
||
|
||
/// <summary>可疑端口连接数 (4444, 1337 等)</summary>
|
||
public int SuspiciousPortConnections { get; set; }
|
||
|
||
/// <summary>连接到境外IP数 (简化：非私有IP)</summary>
|
||
public int ForeignConnections { get; set; }
|
||
|
||
// ========== 六、进程树关系特征 ==========
|
||
|
||
/// <summary>是否为系统关键进程名</summary>
|
||
public bool IsSystemProcessName { get; set; }
|
||
|
||
/// <summary>父进程是否合法</summary>
|
||
public bool HasLegitimateParent { get; set; }
|
||
|
||
/// <summary>进程树深度</summary>
|
||
public int ProcessTreeDepth { get; set; }
|
||
|
||
// ========== 七、DLL加载特征 ==========
|
||
|
||
/// <summary>已加载模块数量</summary>
|
||
public int LoadedModuleCount { get; set; }
|
||
|
||
/// <summary>无磁盘路径模块数</summary>
|
||
public int UnmappedModules { get; set; }
|
||
|
||
/// <summary>从临时目录加载的模块数</summary>
|
||
public int TempPathModules { get; set; }
|
||
|
||
// ========== 辅助方法 ==========
|
||
|
||
/// <summary>
|
||
/// 将特征向量转为数值数组，用于 AI 模型输入
|
||
/// 特征顺序必须与训练时一致
|
||
/// </summary>
|
||
public double[] ToFeatureVector()
|
||
{
|
||
return new double[]
|
||
{
|
||
// 进程元数据 (9维)
|
||
IsSigned ? 1.0 : 0.0,
|
||
IsSystemPath ? 1.0 : 0.0,
|
||
IsTempPath ? 1.0 : 0.0,
|
||
WorkingSetMB,
|
||
ThreadCount,
|
||
IsSystemProcessName ? 1.0 : 0.0,
|
||
HasLegitimateParent ? 1.0 : 0.0,
|
||
ProcessTreeDepth,
|
||
StartTime != default ? (DateTime.Now - StartTime).TotalHours : 0,
|
||
|
||
// 内存页权限分布 (7维)
|
||
TotalRegions,
|
||
ReadOnlyPages / Math.Max(TotalRegions, 1.0),
|
||
ReadWritePages / Math.Max(TotalRegions, 1.0),
|
||
ExecuteReadPages / Math.Max(TotalRegions, 1.0),
|
||
ExecuteReadWritePages / Math.Max(TotalRegions, 1.0),
|
||
AnonymousExecPages / Math.Max(TotalRegions, 1.0),
|
||
RwxPrivatePages,
|
||
|
||
// 内存类型分布 (3维)
|
||
PrivatePages / Math.Max(TotalRegions, 1.0),
|
||
MappedPages / Math.Max(TotalRegions, 1.0),
|
||
ImagePages / Math.Max(TotalRegions, 1.0),
|
||
|
||
// 代码特征 (6维)
|
||
HasInMemoryPE ? 1.0 : 0.0,
|
||
PeMismatchDisk ? 1.0 : 0.0,
|
||
SuspiciousApiStrings.Count,
|
||
SuspiciousStringHits,
|
||
SignatureMatchCount,
|
||
HighSeverityMatches,
|
||
|
||
// 熵特征 (4维)
|
||
AvgCodeEntropy / 8.0, // 归一化到 [0,1]
|
||
MaxEntropy / 8.0,
|
||
HighEntropyRegions,
|
||
EntropyStdDev / 4.0,
|
||
|
||
// 网络特征 (5维)
|
||
ConnectionCount,
|
||
ListeningPorts,
|
||
NonStandardPortConnections,
|
||
SuspiciousPortConnections,
|
||
ForeignConnections,
|
||
|
||
// DLL加载特征 (3维)
|
||
LoadedModuleCount,
|
||
UnmappedModules,
|
||
TempPathModules
|
||
};
|
||
}
|
||
|
||
/// <summary>特征向量维度</summary>
|
||
public static int FeatureDimension => 40;
|
||
}
|