本帖最后由 驭龙 于 2016-6-13 13:46 编辑
昨天看到这话，我实在是忍不住了，就回来MSE区发个帖子，我虽经常黑WD，可它依然是我爱过的，我怎么能不出来，磨叽磨叽，是吧？
大概意思是这样的：
ATP只不过是WD的行为遥测可视化而已，不是什么新技术。
好吧，我很意外，也很惊讶，今天来说说ATP传感器吧。
关于WD的行为监控遥测，我说过详细内容，就不重复了，今天说ATP的传感器，虽然也是遥测技术，可细节上却大不相同，根本不是什么之前的WD遥测改为可视化，首先看官方对WD ATP的描述：
Q: What is Windows Defender Advanced Threat Protection (ATP)?
•Windows Defender Advanced Threat Protection is a new service that will enable our enterprise customers to detect, investigate, and respond to advanced and targeted attacks on their networks.
•Building on the existing security features and services Windows 10 offers today (Pre-breach), Windows Defender ATP adds a new post-breach layer of protection to the Windows 10 security stack.
•Windows Defender ATP is augmenting the traditional OS security features that are designed to prevent or resist threats as well and our protection services working to block new threats from downloading or launching on the endpoint.
•Windows Defender ATP provides the enterprise security teams with powerful tools to detect those attacks that have made it past all other defenses and forensics user experience to investigate the attack scope across all endpoints.
•To achieve this, Windows Defender ATP uses a combination of client-side sensor technology built into Windows 10 (out of the box, no need to deploy yet another agent) and a robust cloud service, it will help detect targeted threats and attacks that have made it past other defenses, provide enterprises with information to investigate the breach across endpoints, and offer response recommendations.
Endpoint APT detection built into Windows
It’s simple, native part of the Windows 10 Operating System, no additional deployment required, onboarding to service through configuration. Continuously up-to-date, lowers costs.
•Behavior based, cloud powered, advanced attack detection
Finds the attacks that made it past all other defenses (Post breach detection), provides actionable, correlated alerts for known and unknown adversaries trying to hide their activities on endpoints. Provides key information on the attack and what actions have been performed on the specific machine.
•Rich timeline for forensic investigation and mitigation
Easily investigate scope of breach or suspect behaviors on any machine through a rich machine timeline. File, URLs and network connection inventory across the network. Gain further insights using detonation for any file.
Windows Defender ATP examines the state of machines and their activities for up to six months back to maximize historical investigation capabilities and provides information through an attack timeline.
•Built in threat intelligence knowledge base
Unparalleled threat optics provides actor details and intent context for every threat intel-based detection – combining 1st and 3rd party intelligence sources
Microsoft’s immense security graph provides big-data security analytics that look across aggregate behaviors to identify anomalies augmented by expertise from our own world-class security experts and ATP experts.
简单的说就是WD ATP客户端是个传感器，将Windows 10 RS1的行为全部遥测与云联动，通过ATP云面板查看本地的行为，结合云基础和行为检测，提供检测高级威胁的能力，注意这里与WD行为遥测不同，ATP据说是可阻止高级可持续性威胁（只是据说，因为我还没有体验过WD ATP，正在下载RS1 14361 Insider版本）。
仅仅通过官方简介就可以看出WD ATP并不是WD行为遥测的一种可视化，是吧，可大家不要认为本帖到此结束，因为毕竟是我发帖，怎么可能就发一点官方文档就结束，是吧？
接下来是关于ATP技术细节的东西，以及相关信息。
ATP包含云端的机器学习分析，本地的突破口检测，以及传感器效果。
ATP拥有威胁智能系统以及本地微乎其微的文件量等。
云端控制面板的相关记录，就是因为这个，有人说ATP仅仅是WD行为遥测的可视化。
ATP 在客户端上是全方位的传感器，这是WD行为遥测比不了的，这也跟WD行为遥测并不冲突或者重复。
其他内容，我明天编辑，敬请期待，我先工作去了。
==============================================================
今天说的是ATP技术细节，下面截图中的文件是WD ATP独立的Agent客户端文件。
其中MSSENSE是主传感器本身，包含的传感器事件内容包括：
因此sense传感器的行为监控是相当全面的，而且不仅如此，ATP在内核驱动层也添加了驱动级的传感器过滤，名为”微软安全事件组件文件系统筛选器驱动”
驱动的名称是mssecflt驱动，属于FS Filter类，专门负责行为传感器的Kernel层的监控。
另外WD ATP虽然是独立的组件，但它是依托于WD的，换句话说：Windows Defender 高级威胁防护服务在 Windows Defender 中启用 SENSE 感知模式。
WD ATP依然是WD的一部分，ATP可视为是WD行为监控遥测的一次大升级了，要知道MA是很少添加新驱动文件的，这次MSSECFLT驱动隶属于ATP，却跟WD有密不可分的联动，在最新的MA引擎中也含有SENSE部分的ATP代码，所以ATP是WD的一次功能更新，虽然不是什么吃惊的突破，但也是很重要的改进了。
要知道ATP是有很多种模式的，帮助行为监控传感器的识别行为：
由于我没有公测ID，无法通过ATP启动脚本启动ATP，所以关于ATP的具体情况，我们以后再说了，我想说的是WD ATP不仅仅是WD 行为遥测的可视化，而是WD行为遥测的升级和更新。
追根究底，什么机器学习、自动化分析、云端沙箱、文件信誉、行为传感器，不都是云技术的成功产物么？何必追寻ATP是不是新技术？反病毒大多数不都是特征对比么，所以只要是技术提升就好，没必要强调某某功能是不是全新技术，毕竟反病毒原理就那么几种方式啊。
好了，我们下次有机会再见！ |
发表于 2016-6-12 13:40:56
楼主