1
# 深信服 aES Agent 配置
2
agent:
3
  install_path: /opt/sangfor/
4

5
  capabilities:
6
    process_monitor: true
7
    network_monitor: true
8
    file_monitor: true
9
    registry_monitor: true
10
    memory_monitor: true
11
    dll_injection_detect: true
12

13
  upload:
14
    buffer_size: 1000 # 事件缓冲
15
    flush_interval: 5s
16
    compress: true
17
    encryption: aes256

1
// 进程创建事件
2
struct process_event {
3
    uint64_t event_id;
4
    uint64_t timestamp;
5

6
    // 进程信息
7
    pid_t pid;
8
    pid_t ppid;
9
    uid_t uid;
10
    char path[PATH_MAX];
11
    char cmdline[ARG_MAX];
12
    char cwd[PATH_MAX];
13

14
    // 父进程信息
15
    pid_t parent_pid;
16
    char parent_path[PATH_MAX];
17

18
    // 血统信息
19
    char lineage[1024];  // 进程链
20

21
    // 哈希
22
    char md5[32];
23
    char sha256[64];
24
};

1
// 网络连接事件
2
struct network_event {
3
    uint64_t event_id;
4
    pid_t pid;
5

6
    // 连接信息
7
    uint8_t family;      // AF_INET/IPv4/IPv6
8
    uint16_t protocol;     // TCP/UDP
9

10
    // 地址
11
    ip_addr_t src_ip;
12
    uint16_t src_port;
13
    ip_addr_t dst_ip;
14
    uint16_t dst_port;
15

16
    // 连接状态
17
    uint8_t state;  // ESTABLISHED/TIME_WAIT/etc
18

19
    // TLS 信息
20
    char sni[256];       // TLS Server Name
21
    char tls_version[8];
22
    char cipher_suite[16];
23

24
    // 威胁指标
25
    uint8_t is_proxy;
26
    uint8_t is_tunnel;
27
    char threat_category[32];
28
};

1
// 文件操作事件
2
struct file_event {
3
    uint64_t event_id;
4
    pid_t pid;
5

6
    // 文件操作
7
    enum file_operation {
8
        OP_CREATE,
9
        OP_OPEN,
10
        OP_WRITE,
11
        OP_DELETE,
12
        OP_RENAME,
13
        OP_ATTR_MODIFY
14
    } op;
15

16
    // 文件路径
17
    char path[PATH_MAX];
18
    char old_path[PATH_MAX];  // rename 操作
19

20
    // 文件属性
21
    uint64_t size;
22
    char md5[32];
23
    char owner[64];
24

25
    // 敏感操作
26
    uint8_t is_credential_access;
27
    uint8_t is_exfiltration;
28
};

1
# ATT&CK 技战术覆盖
2
attack_coverage:
3
  # 初始访问
4
  T1566:
5
    - T1566.001 钓鱼附件
6
    - T1566.002 钓鱼链接
7

8
  # 执行
9
  T1059:
10
    - T1059.001 PowerShell
11
    - T1059.003 Windows 命令外壳
12
    - T1059.004 Unix Shell
13

14
  # 持久化
15
  T1547:
16
    - T1547.001 启动项
17
    - T1547.006 注册表 Run key
18

19
  # 权限提升
20
  T1068:
21
    - 内核漏洞利用
22
    - Sudo 提权

1
// 多步攻击序列
2
struct attack_sequence {
3
    struct event_node *events[10];  // 最多10步
4
    int count;
5

6
    // 序列评分
7
    float similarity_score;
8
    float confidence;
9

10
    // 匹配到的 ATT&CK 技术
11
    char technique_id[16];
12
    char tactic[32];
13
};
14

15
int detect_sequence(struct event_stream *stream) {
16
    // 1. 事件归一化
17
    normalize_events(stream);
18

19
    // 2. 时间窗口过滤
20
    struct event_window *window = sliding_window(stream, 3600); // 1小时
21

22
    // 3. 序列匹配
23
    for each pattern in attack_patterns {
24
        if (sequence_match(window, pattern)) {
25
            alert(pattern.id);
26
        }
27
    }
28

29
    // 4. AI 异常检测
30
    if (ai_score(window) > threshold) {
31
        alert(ALERT_ANOMALY);
32
    }
33
}

1
# 异常行为检测模型
2
class EDRAnomalyDetector:
3
    def __init__(self):
4
        self.process_embedding = ProcessEmbedding()
5
        self.network_encoder = NetworkEncoder()
6

7
    def detect(self, event_batch):
8
        features = self.extract_features(event_batch)
9

10
        # 1. 进程异常
11
        if self.process_model.predict(features.process) > 0.9:
12
            return ALERT_PROCESS_ANOMALY
13

14
        # 2. 网络异常
15
        if self.network_model.predict(features.network) > 0.85:
16
            return ALERT_NETWORK_ANOMALY
17

18
        # 3. 文件异常
19
        if self.file_model.predict(features.file) > 0.8:
20
            return ALERT_FILE_ANOMALY
21

22
        return OK

1
// 事件与情报关联
2
struct intel_match {
3
    struct event *evt;
4
    struct ioc_record *ioc;
5

6
    // 命中信息
7
    char ioc_type[32];      // ip/domain/hash
8
    char ioc_value[512];
9
    int confidence;           // 置信度 0-100
10
    int severity;            // 严重度 1-10
11
    char threat_actor[64];   // 归属组织
12
    char malware_family[64];   // 恶意家族
13
};
14

15
// 批量查询优化
16
struct intel_cache {
17
    // LRU 缓存
18
    struct hash_table *cache;
19
    uint32_t cache_ttl;  // 默认5分钟
20

21
    // 批量查询
22
    int batch_lookup(struct ioc **iocs, int count);
23
};

1
# 威胁狩猎查询示例
2
class ThreatHunter:
3
    def suspicious_process_tree(self, hostname):
4
        """查找可疑进程树"""
5
        query = """
6
        MATCH (p:Process)-[r:PARENT]->(parent:Process)
7
        WHERE p.hostname = $hostname
8
          AND p.path NOT LIKE '%Program Files%'
9
          AND p.path NOT LIKE '%Windows%'
10
          AND parent.powershell_usage > 0.8
11
        RETURN p.pid, p.path, p.cmdline
12
        """
13
        return self.graph_db.query(query)
14

15
    def beaconing_detection(self, hostname):
16
        """C2 心跳检测"""
17
        query = """
18
        SELECT dst_ip, COUNT(*) as count
19
        FROM network_events
20
        WHERE hostname = $hostname
21
          AND protocol = 'TCP'
22
        GROUP BY dst_ip
23
        HAVING
24
          variance(timestamp) < 10  -- 心跳间隔稳定
25
          AND count > 100
26
        """
27
        return self.timeseries_db.query(query)

1
# 响应动作配置
2
response_playbooks:
3
  # 挖矿检测
4
  - name: "挖矿程序处置"
5
    trigger:
6
      process:
7
        - path_contains: "miner"
8
        - cpu_usage > 0.8
9

10
    actions:
11
      - isolate_endpoint
12
      - kill_process
13
      - block_hash
14
      - alert_soc
15
      - collect_forensics
16

17
  # 横向移动
18
  - name: "横向移动检测"
19
    trigger:
20
      network:
21
        - internal_scan
22
        - pass_the_hash
23

24
    actions:
25
      - block_src_ip
26
      - isolate_endpoint
27
      - force_password_reset

1
// 网络隔离
2
struct isolation_request {
3
    char hostname[128];
4
    enum isolation_level {
5
        ISOLATION_FULL,       // 完全隔离
6
        ISOLATION_NETWORK,    // 网络隔离
7
        ISOLATION_PROCESS     // 仅限异常进程
8
    } level;
9

10
    char reason[256];
11
    uint64_t isolation_id;
12
};
13

14
int isolate_endpoint(struct isolation_request *req) {
15
    // 1. 下发隔离策略到 Agent
16
    send_to_agent(req->hostname, CMD_ISOLATE, req->level);
17

18
    // 2. 记录审计日志
19
    audit_log(ISOLATION, req->hostname, req->reason);
20

21
    // 3. 联动防火墙
22
   联动防火墙封禁 IP
23
   联动 802.1X 禁用网络访问
24
}

1
// 进程内存扫描
2
struct memory_scan {
3
    struct process_handle *handle;
4
    uint8_t *memory_regions[MAX_REGIONS];
5
    int region_count;
6

7
    // 扫描配置
8
    struct yara_rule *rules[100];
9
    int min_confidence;
10

11
    // 检测结果
12
    struct match_result {
13
        char rule_name[64];
14
        uint64_t offset;
15
        uint8_t *matched_data;
16
    } results[50];
17
};
18

19
int scan_process_memory(struct memory_scan *scan) {
20
    for each memory_region in scan->process {
21
        if (!is_code_region(region)) continue;
22

23
        // 扫描内存
24
        for each rule in scan->rules {
25
            if (yara_match(rule, region) > scan->min_confidence) {
26
                add_result(scan->results, rule);
27
            }
28
        }
29
    }
30
}

1
// API Hook 检测
2
struct api_monitor {
3
    // 监控的 API
4
    const char *monitored_apis[] = {
5
        "NtCreateProcess",
6
        "NtCreateThread",
7
        "VirtualAllocEx",
8
        "WriteProcessMemory",
9
        "RegSetValueEx",
10
        "HttpSendRequest"
11
    };
12

13
    // 行为评分
14
    struct behavior_score {
15
        int process_injection_score;
16
        int credential_access_score;
17
        int network_exfil_score;
18
    } score;
19
};
20

21
int monitor_api_call(struct api_event *evt) {
22
    if (is_monitoring_target(evt->api_name)) {
23
        update_score(&evt->process->score, evt->api_name);
24

25
        if (evt->process->score > THRESHOLD) {
26
            alert(ALERT_SUSPICIOUS_BEHAVIOR);
27
            trigger_response(evt->process);
28
        }
29
    }
30
}

1
# Agent 配置文件示例
2
agent:
3
  # 基础标识
4
  tenant_id: "tenant-001"
5
  group: "production-servers"
6
  agent_id: "${HOSTNAME}"
7

8
  # 采集能力开关
9
  collectors:
10
    process:
11
      enabled: true
12
      include_cmdline: true
13
      track_child_processes: true
14
    network:
15
      enabled: true
16
      capture_dns: true
17
      capture_tls_sni: true
18
    file:
19
      enabled: true
20
      watch_paths:
21
        - "/etc"
22
        - "/tmp"
23
        - "/var/log"
24
      ignore_paths:
25
        - "/proc"
26
        - "/sys"
27
    registry:
28
      enabled: true
29
      watch_hives:
30
        - "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
31
        - "HKLM\\SYSTEM\\CurrentControlSet\\Services"
32
    memory:
33
      enabled: true
34
      scan_interval: 3600
35
      max_scan_duration: 300
36

37
  # 通信配置
38
  communication:
39
    server_url: "https://edr-server.internal:8443"
40
    heartbeat_interval: 60
41
    event_upload_interval: 5
42
    max_batch_size: 500
43
    compression: zstd
44
    encryption: tls_1_3
45
    retry_max: 3
46
    retry_backoff: exponential
47

48
  # 断连缓存策略
49
  offline_cache:
50
    enabled: true
51
    max_size_mb: 512
52
    eviction_policy: "priority_aware"
53
    high_priority_retention: 72h
54
    low_priority_retention: 24h
55
    flush_on_reconnect: true
56

57
  # 端侧推理
58
  local_inference:
59
    enabled: true
60
    model: "lightweight_behavior_v3"
61
    max_cpu_percent: 5
62
    max_memory_mb: 128
63
    inference_interval: 10

1
// Agent 通信协议结构
2
struct agent_heartbeat {
3
    uint32_t version;           // 协议版本
4
    char agent_id[64];          // Agent 唯一标识
5
    char tenant_id[64];         // 租户标识
6
    uint64_t timestamp;         // 时间戳
7

8
    // Agent 状态
9
    struct agent_status {
10
        uint8_t  cpu_usage;     // CPU 占用百分比
11
        uint16_t memory_mb;     // 内存占用 MB
12
        uint32_t event_count;   // 缓存事件数
13
        uint32_t alert_count;   // 本地告警数
14
        uint8_t  connectivity;  // 0=离线 1=在线 2=弱网
15
    } status;
16

17
    // 校验
18
    uint32_t crc32;
19
};
20

21
// 事件批量上传协议
22
struct event_batch {
23
    uint32_t batch_id;
24
    uint16_t count;
25
    uint8_t  compression;     // 0=none 1=zstd 2=lz4
26
    uint8_t  encryption;      // 0=none 1=aes256 2=tls
27

28
    struct event_header {
29
        uint8_t  event_type;  // 进程/网络/文件/注册表
30
        uint8_t  priority;    // 0=低 1=中 2=高 3=紧急
31
        uint64_t timestamp;
32
        uint32_t data_len;
33
    } headers[];
34

35
    uint8_t  payload[];       // 压缩加密后的事件数据
36
};
37

38
// 配置下发协议
39
struct config_update {
40
    uint32_t config_version;
41
    uint8_t  config_type;     // 0=全量 1=增量
42
    uint32_t data_len;
43
    uint8_t  data[];          // YAML 格式配置
44
    uint8_t  signature[64];   // Ed25519 签名
45
};

1
# 特征提取伪代码
2
class FeatureExtractor:
3
    """EDR 多维度特征提取器"""
4

5
    def extract_process_features(self, process_event):
6
        """进程行为特征"""
7
        return {
8
            # 进程链特征
9
            "lineage_depth": len(process_event.lineage.split("->")),
10
            "has_unusual_parent": self._check_parent_anomaly(process_event),
11
            # 命令行特征
12
            "cmdline_entropy": self._shannon_entropy(process_event.cmdline),
13
            "has_encoded_payload": self._detect_base64(process_event.cmdline),
14
            "suspicious_keywords": self._count_suspicious_keywords(process_event.cmdline),
15
            # 行为序列特征
16
            "api_sequence": self._encode_api_sequence(process_event.api_calls),
17
            "privilege_escalation_score": self._calc_privesc_score(process_event),
18
        }
19

20
    def extract_network_features(self, network_events, window=300):
21
        """网络流量特征（滑动窗口聚合）"""
22
        return {
23
            # 连接模式特征
24
            "conn_frequency_var": self._time_variance(network_events, window),
25
            "unique_dst_ratio": self._unique_dst_ratio(network_events),
26
            # DNS 特征
27
            "dns_query_entropy": self._domain_entropy(network_events.dns_queries),
28
            "newly_registered_ratio": self._check_domain_age(network_events.dns_queries),
29
            # TLS 指纹
30
            "tls_ja3_hash": network_events.tls_ja3,
31
            "tls_sni_mismatch": self._check_sni_mismatch(network_events),
32
            # Beaconing 检测
33
            "beaconing_score": self._detect_beaconing(network_events, window),
34
        }
35

36
    def extract_file_features(self, file_events, window=300):
37
        """文件操作特征"""
38
        return {
39
            # 敏感路径操作
40
            "sensitive_path_writes": self._count_sensitive_writes(file_events),
41
            "credential_access": self._detect_credential_access(file_events),
42
            # 熵值突变（勒索检测）
43
            "entropy_delta": self._calc_entropy_delta(file_events),
44
            "mass_encrypt_score": self._detect_mass_encrypt(file_events, window),
45
            # 隐藏行为
46
            "hidden_attribute_count": self._count_hidden_mods(file_events),
47
            "extension_rename_count": self._count_extension_renames(file_events),
48
        }
49

50
    def _shannon_entropy(self, data):
51
        """计算香农熵"""
52
        if not data:
53
            return 0.0
54
        freq = {}
55
        for ch in data:
56
            freq[ch] = freq.get(ch, 0) + 1
57
        length = len(data)
58
        return -sum((c / length) * math.log2(c / length) for c in freq.values())

1
# EDR 部署 checklist
2
deployment_phases:
3
  # 第一阶段：观察期（1-2 周）
4
  phase1_observe:
5
    objective: "了解环境基线，不产生阻断动作"
6
    steps:
7
      - item: "部署 Agent 到 10% 终端（非核心业务优先）"
8
        status: pending
9
      - item: "开启全部采集能力，响应模式设为仅告警"
10
        status: pending
11
      - item: "收集 7 天基线数据，建立行为画像"
12
        status: pending
13
      - item: "评估 Agent 对业务应用的性能影响"
14
        status: pending
15
      - item: "梳理现有白名单（已知合法工具、脚本、内部应用）"
16
        status: pending
17

18
  # 第二阶段：调优期（2-4 周）
19
  phase2_tune:
20
    objective: "降低误报率，建立响应流程"
21
    steps:
22
      - item: "扩展部署到 50% 终端"
23
        status: pending
24
      - item: "基于基线数据调优检测规则阈值"
25
        status: pending
26
      - item: "配置白名单，消除已知误报"
27
        status: pending
28
      - item: "建立告警分级与响应 SOP"
29
        status: pending
30
      - item: "开展联动响应演练（防火墙/IAM/SIEM）"
31
        status: pending
32
      - item: "验证断连缓存与重连回传机制"
33
        status: pending
34

35
  # 第三阶段：运营期（持续）
36
  phase3_operate:
37
    objective: "全面部署，持续运营优化"
38
    steps:
39
      - item: "部署到 100% 终端"
40
        status: pending
41
      - item: "开启自动化响应（高危告警自动隔离）"
42
        status: pending
43
      - item: "建立威胁狩猎常态化机制"
44
        status: pending
45
      - item: "定期回顾检测规则，更新威胁情报"
46
        status: pending
47
      - item: "每季度评估 Agent 性能影响，优化采集策略"
48
        status: pending
49

50
# 性能影响评估基准
51
performance_baseline:
52
  cpu_overhead_max: "5%"
53
  memory_overhead_max: "200MB"
54
  disk_io_overhead_max: "2%"
55
  network_bandwidth_max: "50KB/s"
56
  boot_time_delay_max: "3s"