Terminal security monitoring and response solution method and device, equipment and storage medium

Abstract

The invention relates to the technical field of computer security monitoring, in particular to a terminal security monitoring and response solving method and device, equipment and a storage medium. The terminal security monitoring and response solution method comprises the following steps: acquiring historical security event data, mining an association rule in the historical security event data, calculating an abnormal score of each piece of historical security event data according to the association rule, and generating a risk value according to the abnormal score; training a pre-constructed basic model by adopting the historical event data and the risk values thereof to obtain a decision tree model; acquiring real-time security event data, system logs and network activity records, encrypting the data and transmitting the data to the cloud platform; analyzing the encrypted data, classifying the analyzed data by adopting a pre-constructed rule, and generating a preliminary report; and analyzing the preliminary report by adopting a decision tree model to generate a response action and a comprehensive report. Through correlation analysis of the data, the monitoring efficiency and the response speed of the terminal equipment can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of computer security monitoring, and in particular to a terminal security monitoring and response solution, device, equipment and storage medium. Background Art

[0002] With the increasing complexity of enterprise IT environments and the diversification of endpoint devices, traditional endpoint security monitoring and response methods face numerous challenges and struggle to meet current security needs. With traditional monitoring methods, enterprises often need to deploy security software separately on each endpoint device, which not only increases deployment and management costs but also leads to fragmented and chaotic management. Differences in operating systems, configurations, and applications across devices make it difficult to uniformly implement and adjust security policies, leading to management loopholes. Furthermore, traditional methods rely on local monitoring and analysis capabilities, which is inefficient for large-scale endpoints and makes it difficult to detect and respond to security threats in a timely manner.

[0003] Furthermore, as cyberattacks become increasingly complex and diverse, traditional security monitoring methods can only detect known threats and struggle to effectively identify and prevent new, unknown attacks. Furthermore, traditional methods require manual analysis and processing, making it difficult to respond quickly to security incidents, which in turn increases the scope of security incidents. Summary of the Invention

[0004] In view of the above-mentioned deficiencies in the prior art, the object of the present invention is to provide a terminal security monitoring and response solution, device, equipment and storage medium, aiming to improve the monitoring efficiency and response speed of terminal devices.

[0005] In order to achieve the above object, the present invention adopts the following technical solutions:

[0006] The first aspect of the present invention provides a terminal security monitoring and response solution, including the following steps: obtaining historical security event data, mining association rules in the historical security event data, calculating the anomaly score of each historical security event data according to the association rules, and generating a risk value according to the anomaly score; using the historical event data and its risk value to train a pre-built basic model to obtain a decision tree model; obtaining real-time security event data, system logs and network activity records, encrypting the data and transmitting it to a cloud platform; parsing the encrypted data of the cloud platform, using pre-built rules to classify the parsed data and generate a preliminary report; using a decision tree model to analyze the preliminary report to generate response actions and a comprehensive report.

[0007] Optionally, in a first implementation method of the first aspect of the present invention, obtaining historical security event data, mining association rules in the historical security event data, calculating the anomaly score of each historical security event data according to the association rules, and generating a risk value according to the anomaly score, specifically includes: obtaining historical security event data, using the FP-Growth algorithm to perform pattern recognition on the historical security event data to obtain frequent item sets, and generating association rules based on the frequent item sets; performing anomaly detection on each historical security event data according to the association rules to obtain anomaly scores, using a multi-factor scoring model, and generating risk values ​​based on the anomaly scores.

[0008] Optionally, in a second implementation of the first aspect of the present invention, anomaly detection is performed on each historical security event data according to association rules to obtain an anomaly score, and a multi-factor scoring model is used to generate a risk value based on the anomaly score, specifically including: using an isolation forest algorithm in combination with association rules to perform anomaly detection on each historical security event data to obtain an anomaly score, and calculating the impact based on the anomaly score; constructing a multi-factor scoring model, the multi-factor scoring model is: risk value = impact × probability of occurrence × value of assets involved; obtaining the impact, probability of occurrence and value of assets involved of the security event, and calculating the risk value.

[0009] Optionally, in a third implementation of the first aspect of the present invention, the use of historical event data and its risk values ​​to train a pre-constructed basic model to obtain a decision tree model specifically includes: obtaining historical event data, classifying the historical event data based on classification rules, and obtaining classification results; extracting key feature data from the historical event data, wherein the key feature data includes historical response actions and attack source IPs; constructing a training set with the key feature data, classification results, and risk values, and using the training set to train the pre-constructed basic model to obtain a decision tree model.

[0010] Optionally, in a fourth implementation method of the first aspect of the present invention, the obtaining of real-time security event data, system logs and network activity records, encrypting the data and transmitting it to the cloud platform includes: collecting security event data, system logs and network activity records through timed polling; sorting the obtained data by timestamp and encapsulating it in JSON format; encrypting the encapsulated data using the AES-256 algorithm, and pushing it to the cloud platform after encryption.

[0011] Optionally, in a fifth implementation of the first aspect of the present invention, the encrypted data of the cloud platform is parsed, and pre-built rules are used to classify the parsed data and generate a preliminary report, specifically including: decrypting the encrypted data, and performing type matching on the decrypted security event data through a pre-trained regular expression library, and parsing the security event data based on the matching results; inputting the parsed data into a rule engine, classifying the data that meets predetermined conditional rules, and obtaining classification results; generating a preliminary report based on the security event data and the classification results, and the preliminary report includes event ID, timestamp, type, and severity level.

[0012] Optionally, in a sixth implementation of the first aspect of the present invention, the use of a decision tree model to analyze the preliminary report to generate response actions and a comprehensive report specifically includes: using a decision tree model to analyze the preliminary report to generate response actions; aggregating data near the security event through a time window to obtain aggregated data, and using the TF-IDF algorithm to extract key event feature words from the aggregated data; generating an event background description based on the key event feature words based on a pre-built knowledge base; calculating the historical 24-hour occurrence frequency of the security event, and if the occurrence frequency exceeds a threshold, triggering an alarm and generating recommended measures; summarizing the response actions, background descriptions, risk values, and recommended measures to generate a comprehensive report.

[0013] The second aspect of the present invention provides a terminal security monitoring and response solution device, including: a risk assessment module, which is used to obtain historical security event data, mine association rules in the historical security event data, calculate the anomaly score of each historical security event data according to the association rules, and generate a risk value according to the anomaly score; a construction module, which is used to use historical event data and its risk value to train a pre-built basic model to obtain a decision tree model; a data acquisition module, which is used to obtain real-time security event data, system logs and network activity records, encrypt the data and transmit it to a cloud platform; a parsing module, which is used to parse the encrypted data of the cloud platform, use pre-built rules to classify the parsed data and generate a preliminary report; an analysis module, which is used to analyze the preliminary report using a decision tree model to generate response actions and a comprehensive report.

[0014] Optionally, in a first implementation method of the second aspect of the present invention, the risk assessment module includes: a pattern recognition unit, used to obtain historical security event data, use the FP-Growth algorithm to perform pattern recognition on the historical security event data to obtain frequent item sets, and generate association rules based on the frequent item sets; an anomaly detection unit, used to perform anomaly detection on each historical security event data according to the association rules to obtain anomaly scores, and use a multi-factor scoring model to generate a risk value based on the anomaly scores.

[0015] Optionally, in a second implementation of the second aspect of the present invention, the anomaly detection unit includes: a scoring subunit, used to use the isolation forest algorithm in combination with association rules to perform anomaly detection on each historical security event data to obtain an anomaly score, and calculate the impact based on the anomaly score; a construction subunit, used to construct a multi-factor scoring model, and the multi-factor scoring model is: risk value = impact × probability of occurrence × value of assets involved; a risk calculation subunit, used to obtain the impact, probability of occurrence and value of assets involved of the security event, and calculate the risk value.

[0016] Optionally, in a third implementation of the second aspect of the present invention, the construction module includes: a classification subunit, used to obtain historical event data, classify the historical event data based on classification rules, and obtain classification results; an extraction subunit, used to extract key feature data from the historical event data, wherein the key feature data includes historical response actions and attack source IP; a training subunit, used to construct a training set with key feature data, classification results, and risk values, and use the training set to train a pre-built basic model to obtain a decision tree model.

[0017] Optionally, in a fourth implementation of the second aspect of the present invention, the data acquisition module includes: a collection unit, used to collect security event data, system logs and network activity records through timed polling; a sorting unit, used to sort the acquired data by timestamp and encapsulate it in JSON format; an encryption unit, used to encrypt the encapsulated data using the AES-256 algorithm, and push the encrypted data to the cloud platform.

[0018] Optionally, in a fifth implementation of the second aspect of the present invention, the parsing module includes: a parsing unit, used to decrypt encrypted data, and perform type matching on the decrypted security event data through a pre-trained regular expression library, and parse the security event data based on the matching results; a classification unit, used to input the parsed data into a rule engine, classify the data that meets predetermined condition rules, and obtain classification results; a first generation unit, used to generate a preliminary report based on the security event data and the classification results, and the preliminary report includes an event ID, timestamp, type, and severity level.

[0019] Optionally, in a sixth implementation of the second aspect of the present invention, the analysis module includes: an analysis unit for analyzing the preliminary report using a decision tree model to generate a response action; an extraction unit for aggregating data near the security event through a time window to obtain aggregated data, and extracting key event feature words from the aggregated data using the TF-IDF algorithm; a second generation unit for generating an event background description based on the key event feature words according to a pre-built knowledge base; a calculation unit for calculating the historical 24-hour occurrence frequency of the security event, and if the occurrence frequency exceeds a threshold, triggering an alarm and generating recommended measures; and a third generation unit for summarizing the response action, background description, risk value, and recommended measures to generate a comprehensive report.

[0020] The third aspect of the present invention provides a terminal security monitoring and response solution device, including a memory and at least one processor, wherein the memory stores computer-readable instructions; the at least one processor calls the computer-readable instructions in the memory to execute the various steps of the terminal security monitoring and response solution as described above.

[0021] A fourth aspect of the present invention provides a computer-readable storage medium having computer-readable instructions stored thereon, wherein the computer-readable instructions, when executed by a processor, implement the various steps of the terminal security monitoring and response solution as described above.

[0022] Beneficial effect: The present invention provides a terminal security monitoring and response solution, which first obtains historical security event data, mines the association rules in the historical security event data, and provides more data for comprehensive analysis of security event risks. Then, the anomaly score of each historical security event data is calculated according to the association rules, and a risk value is generated based on the anomaly score. Data conversion is performed for each security event to facilitate subsequent analysis; then, the historical event data and its risk value are used to train a pre-built basic model to obtain a decision tree model, so that real-time data can be automatically analyzed; when real-time security event data, system logs and network activity records are obtained, the data is encrypted and transmitted to the cloud platform; then the encrypted data of the cloud platform is parsed, and the pre-built rules are used to classify the parsed data and generate a preliminary report, which is equivalent to pre-processing the real-time data to facilitate the recognition of subsequent models; finally, the decision tree model is used to analyze the preliminary report to generate response actions and comprehensive reports, so that managers can respond according to the comprehensive report, thereby improving monitoring efficiency and response speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A first flow chart of a terminal security monitoring and response solution provided by an embodiment of the present invention;

[0024] Figure 2 A second flow chart of a terminal security monitoring and response solution provided by an embodiment of the present invention;

[0025] Figure 3 A third flow chart of the terminal security monitoring and response solution provided by an embodiment of the present invention;

[0026] Figure 4 A fourth flow chart of a terminal security monitoring and response solution provided by an embodiment of the present invention;

[0027] Figure 5 A fifth flow chart of a terminal security monitoring and response solution provided by an embodiment of the present invention;

[0028] Figure 6 A sixth flow chart of a terminal security monitoring and response solution provided by an embodiment of the present invention;

[0029] Figure 7 A seventh flow chart of a terminal security monitoring and response solution provided by an embodiment of the present invention;

[0030] Figure 8 A schematic diagram of the structure of a terminal security monitoring and response solution device provided by an embodiment of the present invention;

[0031] Figure 9 Another structural diagram of the terminal security monitoring and response solution device provided by an embodiment of the present invention;

[0032] Figure 10 This is a schematic diagram of the structure of a terminal security monitoring and response solution device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0033] The present invention provides a terminal security monitoring and response solution, device, equipment, and storage medium. The present invention first collects historical security event data and mines association rules therein to enrich the data foundation for comprehensive analysis of security event risks. Subsequently, an anomaly score is calculated for each historical security event data item based on the association rules, and a risk value is generated based on this score, enabling data conversion for each security event to facilitate subsequent analysis. Next, a pre-built basic model is trained using the historical event data and its risk value to form a decision tree model, enabling automated analysis of real-time data. During real-time data processing, after acquiring real-time security event data, system logs, and network activity records, they are encrypted and transmitted to a cloud platform. The encrypted data is parsed on the cloud platform and classified using pre-built rules to generate a preliminary report, completing the pre-processing of the real-time data and facilitating subsequent model recognition. Finally, the preliminary report is analyzed using a decision tree model to generate response actions and a comprehensive report, enabling management personnel to respond based on the comprehensive report, thereby improving monitoring efficiency and response speed.

[0034] The terms "first," "second," "third," "fourth," and the like (if any) in the description and claims of the present invention and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" or "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or apparatus that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to these processes, methods, products, or apparatus.

[0035] For ease of understanding, the specific process of the embodiment of the present invention is described below. Figure 1 The first embodiment of the terminal security monitoring and response solution in the embodiment of the present invention includes:

[0036] S101. Obtain historical security event data, mine association rules in the historical security event data, calculate the anomaly score of each historical security event data according to the association rules, and generate a risk value based on the anomaly score;

[0037] S102. Use historical event data and its risk value to train a pre-built basic model to obtain a decision tree model;

[0038] S103. Obtain real-time security event data, system logs, and network activity records, encrypt the data, and transmit it to the cloud platform;

[0039] S104. Parse the encrypted data on the cloud platform, classify the parsed data using pre-built rules, and generate a preliminary report;

[0040] S105. Analyze the preliminary report using a decision tree model to generate response actions and a comprehensive report.

[0041] In this embodiment, historical security event data can be obtained from the enterprise's database, specifically including system logs and network activity records. After a security event occurs, it may trigger a chain reaction, resulting in other types of security events, or a security event may be caused by other hidden issues. By mining association rules in historical security event data, the connections between various security events can be discovered, allowing for a better comprehensive analysis of their impact and the formulation of response measures. After mining the association rules, an anomaly score is assigned to each piece of historical security event data based on the association rules to better quantify the degree of anomaly in each piece of historical security event data, facilitating subsequent analysis. During this quantification process, the association rules are used to thoroughly consider the overall impact, whether it triggers other security events, and the scope of impact, thereby obtaining a more reasonable anomaly score. After obtaining the anomaly score, a risk value is further calculated. In addition to the anomaly score, the risk value also considers other factors, such as the probability of occurrence and the impact on asset value.

[0042] After calculating the risk value for each security incident, the historical event data is preprocessed to extract key data. This key data and the corresponding risk values ​​are then used to train a pre-built basic model to create a decision tree model. The decision tree model can analyze real-time data and provide timely warnings and response measures to reduce losses.

[0043] When acquiring real-time security event data, system logs, and network activity records from terminal devices, different types of data can be obtained through various channels. The acquired data is encrypted and transmitted to the cloud platform for subsequent processing. The cloud platform provides centralized monitoring, intelligent analysis, and automated response for terminal devices, providing comprehensive terminal security protection.

[0044] When the cloud platform receives encrypted data, it must first decrypt and parse it. Different parsing methods are used for different data sources and types, and the parsing process also involves data classification, such as by security incident type. After parsing, key parameters and information within the data are extracted. This key information is summarized into a preliminary report for further in-depth analysis. The data and content in the preliminary report are converted into a format suitable for decision tree model analysis, enabling a quick synthesis report. Simultaneously, the decision tree model uses learned response actions to quickly generate initial responses to security incidents. The comprehensive report details further response measures, prompting management to decide whether to execute them.

[0045] See also Figure 2 The second embodiment of the terminal security monitoring and response solution in the embodiment of the present invention includes:

[0046] S201. Obtain historical security event data, use FP-Growth algorithm to perform pattern recognition on historical security event data to obtain frequent item sets, and generate association rules based on frequent item sets;

[0047] S202. Perform anomaly detection on each historical security event data according to the association rules to obtain an anomaly score, and use a multi-factor scoring model to generate a risk value based on the anomaly score.

[0048] In this embodiment, pattern recognition is first performed: historical security event data is converted into a transaction database, and the FP-Growth algorithm is used to mine frequent item sets, with the support threshold set to 0.05. Specifically, the steps of the FP-Growth algorithm are as follows: first, all records are collected, and the number of times each item appears in all transactions is counted, which is their support count. A minimum support threshold is set, such as 5%. Only items with support counts exceeding this threshold will be retained. These retained items are called frequent items. Then, the frequent items are sorted from high to low according to the support size to form an ordered list. An empty FP tree is created as the root node. All records are traversed again. For each record, the frequent items are filtered out according to the order of the previously sorted frequent item list, and their order is adjusted to be consistent with the list. Starting from the root node of the FP tree, these frequent items are inserted into the tree in sequence. If an existing path is encountered, the count of the corresponding node on the path is increased. If the path does not exist, a new node and branch are created. At the same time, a head pointer table is established to record the first occurrence position of each frequent item in the tree for subsequent quick access. The frequent items are sorted from the lowest support node. The method starts with the lowest frequent item and uses it as the conditional pattern base. Using the head pointer table, it finds all occurrences of the frequent item in the FP tree. The paths from these locations to the root node are traced back, and the frequent items and their counts contained in these paths are extracted to form the conditional pattern base. A conditional FP tree is constructed based on the conditional pattern base. During this process, the support of the frequent items is again calculated, and items that do not meet the minimum support are removed. Frequent item sets are then recursively mined within the conditional FP tree, combining the current conditional pattern base with the newly mined frequent item sets to form larger frequent item sets. This process is repeated until all frequent items have been processed. While mining the conditional FP tree, item sets that meet the minimum support are continuously collected. Starting with a single frequent item, larger item sets are gradually combined to form larger item sets. Ultimately, all mined item sets that meet the conditions are the desired frequent item sets. These frequent item sets reflect the associations between items in the data. Association rules can then be generated based on the frequent item sets, with a confidence threshold set to 0.8. Anomaly detection is then performed on each historical security event data set based on the association rules to obtain an anomaly score. A multi-factor scoring model is used to generate a risk value based on the anomaly score.

[0049] See also Figure 3 The third embodiment of the terminal security monitoring and response solution in the embodiment of the present invention includes:

[0050] S301. Use the isolation forest algorithm and association rules to perform anomaly detection on each historical security event data to obtain an anomaly score, and calculate the impact based on the anomaly score;

[0051] S302. Construct a multi-factor scoring model, wherein the multi-factor scoring model is: risk value = impact × probability of occurrence × value of assets involved;

[0052] S303. Obtain the impact, probability of occurrence, and value of assets involved in the security incident and calculate the risk value.

[0053] In this embodiment, anomaly detection specifically employs the Isolation Forest algorithm. This algorithm is an effective anomaly detection algorithm that can quickly identify anomalies in historical security event data. By combining it with association rules, it can more accurately mine potential connections and patterns in the data, thereby more accurately identifying anomalies that might otherwise be overlooked, improving the accuracy and reliability of anomaly detection.

[0054] The Isolation Forest algorithm first constructs a binary tree forest and then calculates the path length of each data point in the tree. Shorter path lengths are associated with higher anomaly scores, with a threshold of 0.6. This yields an anomaly score, which is then converted into an influence factor suitable for a multi-factor scoring model. The anomaly score can be categorized into 11 levels, with each level corresponding to a score of 0 to 10.

[0055] The multi-factor scoring model is: Risk Value = Impact (0-10) × Probability of Occurrence (0-1) × Asset Value (0-10). The probability of occurrence is derived from historical frequency. The asset value is calculated using a pre-set asset value table. This table estimates asset value based on the business scope impacted by the security incident. For example, the greater the impact, the higher the score.

[0056] The multi-factor scoring model comprehensively considers three key factors: impact, probability of occurrence, and the value of the assets involved. This provides a more comprehensive and objective assessment of the risk of a security incident. Compared to single-factor assessments, this model more accurately reflects the actual risk level of a security incident, avoiding bias.

[0057] See also Figure 4 The fourth embodiment of the terminal security monitoring and response solution in the embodiment of the present invention includes:

[0058] S401. Obtain historical event data, classify the historical event data based on classification rules, and obtain classification results;

[0059] S402. Extract key feature data from historical event data, including historical response actions and attack source IP;

[0060] S403. Construct a training set based on key feature data, classification results, and risk values, and use the training set to train a pre-built basic model to obtain a decision tree model.

[0061] Specifically, the historical security event data collected by an enterprise includes various types of network security incidents, such as DDoS attacks, malware intrusions, and data leaks. This historical event data is categorized based on classification rules, such as attack type, attack source, and victim system characteristics. For example, all DDoS attack events can be grouped into one category, and malware intrusion events into another, resulting in detailed classification results. By categorizing historical event data, different types of security incidents can be handled separately, allowing security analysts to conduct more targeted and in-depth research on each type of incident, improving analysis efficiency and accuracy. For example, the patterns and characteristics of DDoS attacks and malware intrusions can be analyzed separately to avoid interference caused by data aliasing.

[0062] From the classified DDoS attack event data, key feature data is extracted, such as historical response actions such as throttling or IP blocking, and whether the attack source IP address is a specific IP address or IP segment. Extracting key feature data can filter the most valuable information for security analysis and decision-making from a large amount of historical event data, reducing data noise and improving data usability. For example, the attack source IP address can help track the source of the attack, and historical response actions can provide a reference for handling similar subsequent incidents. Key feature data serves as an important input for model training, and its accuracy and relevance directly impact model quality. Extracting accurate key feature data lays a solid foundation for building an effective decision tree model, enabling the model to better learn and identify characteristic patterns of security events.

[0063] See also Figure 5 The fifth embodiment of the terminal security monitoring and response solution in the embodiment of the present invention includes:

[0064] S501. Collect security event data, system logs and network activity records through regular polling;

[0065] S502. Sort the acquired data by timestamp and encapsulate it in JSON format;

[0066] S503. Use the AES-256 algorithm to encrypt the packaged data and push it to the cloud platform after encryption.

[0067] In this embodiment, a data collection agent can be deployed on the terminal device to collect security event data, system logs and network activity records in a timed polling manner; for security events, the system API hook function is used to monitor key system calls; the system log uses file tail tracking technology (such as Linux tail -f) to obtain new logs in real time; network activities capture data packets through the traffic mirror port.

[0068] The collected raw data is sorted by timestamp, encapsulated in JSON format, encrypted using the AES-256 algorithm, and pushed to the cloud platform through a WebSocket long connection established via the TLS1.3 protocol.

[0069] When encrypting, you must first determine a 32-byte key, which is like a special key to open the encrypted data. To make the key more secure, a key derivation function is usually used to stretch the input passphrase to increase the difficulty of cracking. Then, a key expansion algorithm is used to convert the original key into 44 subkeys of a specific length, which will be used sequentially in the subsequent encryption process. AES-256 encryption requires that the length of the data processed each time is an integer multiple of 16 bytes. If the length of the data to be encrypted does not meet the requirements, some specific bytes are added to the end of the data. The number of bytes added is fixed, and the value of each byte is equal to the number of bytes added. For example, if the data is 2 bytes away from a multiple of 16 bytes, 2 bytes with a value of 2 are added. If the data is exactly 16 bytes, 16 bytes with a value of 16 are added. After processing, the data is divided into 16-byte data blocks. Each 16-byte data block is rearranged into a matrix of 4 rows and 4 columns. This is the starting state of the encryption operation. ; Then, take out the first subkey from the previously prepared subkeys, arrange this subkey into a matrix of the same size, and perform an "XOR" operation with the bytes at the corresponding position in the data matrix to obtain the initial encryption result; AES-256 encryption requires a total of 14 rounds of operations, each round contains four steps, but the last round will have one less step; use a pre-set replacement table to replace each byte in the data matrix with the corresponding byte in the table to make the data chaotic; according to the rules, shift each row of the data matrix to the left, the first row does not move, the second row moves 1 byte, the third row moves 2 bytes, and the fourth row moves 3 bytes; the first 13 rounds use a specific calculation method to recombine the data in each column to make the data correlation more complex; combine with the subkey again: take out the subkey corresponding to this round from the subkey sequence, and perform an "XOR" operation with the processed data matrix again; after completing 14 rounds of encryption, connect all the processed data blocks in sequence to obtain the final encrypted data.

[0070] When decrypting data later, the decryption process will be reversed and the previously added padding bytes will be removed to restore the original data. A heartbeat detection mechanism can also be implemented during the transmission process. When three consecutive heartbeat timeouts (each 5 seconds) are exceeded, the connection will be automatically reconnected to ensure the real-time and integrity of the data.

[0071] See also Figure 6 The sixth embodiment of the terminal security monitoring and response solution in the embodiment of the present invention includes:

[0072] S601 decrypts the encrypted data and performs type matching on the decrypted security event data through a pre-trained regular expression library, and parses the security event data based on the matching results;

[0073] S602. The parsed data is input into the rule engine, and the data that meets the predetermined condition rules is classified to obtain the classification results;

[0074] S603. Generate a preliminary report based on the security event data and classification results, wherein the preliminary report includes event ID, timestamp, type, and severity level.

[0075] This embodiment uses multi-threaded parallel parsing of received data. For security events, pattern matching is performed using a pre-trained regular expression library; for system log data, fields are segmented by delimiters (such as spaces and commas); for network packets, DPDK technology is used to quickly parse IP headers and TCP / UDP headers to obtain five-tuple information.

[0076] The parsed data enters the rules engine and is processed using a forward-chaining inference algorithm. Specifically, the predefined rule set is loaded, and then the data is matched against the rule conditions. When the rule conditions are met, the event is classified (e.g., login event, permission change event), and a preliminary report is generated containing the event ID, timestamp, type, and severity level.

[0077] See also Figure 7 The seventh embodiment of the terminal security monitoring and response solution in the embodiment of the present invention includes:

[0078] S701. Analyze the preliminary report using a decision tree model to generate a response action;

[0079] S702. Aggregate data around the security event through the time window to obtain aggregated data, and use the TF-IDF algorithm to extract key event feature words from the aggregated data;

[0080] S703. Generate event background description based on key event feature words according to the pre-built knowledge base;

[0081] S704. Calculate the historical 24-hour frequency of security events. If the frequency exceeds the threshold, trigger an alarm and generate recommended measures;

[0082] S705. Summarize the response actions, background description, risk value and recommended measures to generate a comprehensive report.

[0083] In this embodiment, comprehensive reports are generated using data fusion technology. After acquiring security event data, the event data is aggregated by time window (e.g., 5 minutes) to provide more complete data, facilitate the subsequent formation of logically clear report content, and enable managers to quickly understand the ins and outs of the comprehensive report. After aggregating more data, the TF-IDF algorithm is used to extract key event feature words. These extracted key event features are then combined with the knowledge base to generate a description of the event context.

[0084] For example, the TF-IDF algorithm extracts key event signatures from aggregated data, including "brute force," "high-frequency login attempts," and "suspicious IP address." Based on a pre-built knowledge base, the system matches these key event signatures with entries in the knowledge base to generate a description of the event context: "This incident is a typical brute force attack, where the attacker attempted to illegally log into the server by trying numerous username and password combinations. This type of attack is often initiated by automated tools, and the source IP address may be from a botnet."

[0085] For the setting of triggering alarms, you can set it dynamically through the alarm threshold. For example, calculate the mean μ and standard deviation σ of the historical 24-hour event frequency, set the threshold to μ+3σ, and trigger an alarm when the threshold is exceeded.

[0086] Once an alert is triggered, notification channels (SMS, email, app push) can be selected based on pre-set priorities (e.g., urgent, important, general). The comprehensive report notification includes an event summary, risk score, and recommended actions. Sending is done asynchronously through a message queue to ensure successful notifications.

[0087] The above describes the terminal security monitoring and response solution method in the embodiment of the present invention. The following describes the terminal security monitoring and response solution device in the embodiment of the present invention. Figure 8 In one embodiment of the present invention, a terminal security monitoring and response solution device includes:

[0088] The risk assessment module 10 is used to obtain historical security event data, mine association rules in the historical security event data, calculate anomaly scores for each historical security event data according to the association rules, and generate risk values ​​based on the anomaly scores;

[0089] A construction module 20 is used to train a pre-built basic model using historical event data and its risk value to obtain a decision tree model;

[0090] Data acquisition module 30, used to obtain real-time security event data, system logs and network activity records, encrypt the data and transmit it to the cloud platform;

[0091] The parsing module 40 is used to parse the encrypted data of the cloud platform, classify the parsed data using pre-built rules, and generate a preliminary report;

[0092] The analysis module 50 is used to analyze the preliminary report using a decision tree model to generate a response action and a comprehensive report.

[0093] See also Figure 9 In one embodiment of the present invention, a terminal security monitoring and response solution device includes:

[0094] The risk assessment module 10 is used to obtain historical security event data, mine association rules in the historical security event data, calculate anomaly scores for each historical security event data according to the association rules, and generate risk values ​​based on the anomaly scores;

[0095] A construction module 20 is used to train a pre-built basic model using historical event data and its risk value to obtain a decision tree model;

[0096] Data acquisition module 30, used to obtain real-time security event data, system logs and network activity records, encrypt the data and transmit it to the cloud platform;

[0097] The parsing module 40 is used to parse the encrypted data of the cloud platform, classify the parsed data using pre-built rules, and generate a preliminary report;

[0098] an analysis module 50 for analyzing the preliminary report using a decision tree model to generate response actions and a comprehensive report;

[0099] In this embodiment, the risk assessment module 10 includes:

[0100] The pattern recognition unit 11 is used to obtain historical security event data, perform pattern recognition on the historical security event data using the FP-Growth algorithm to obtain frequent item sets, and generate association rules based on the frequent item sets;

[0101] An anomaly detection unit 12 is used to perform anomaly detection on each historical security event data according to the association rules to obtain an anomaly score, and to generate a risk value according to the anomaly score using a multi-factor scoring model;

[0102] In this embodiment, the anomaly detection unit 12 includes:

[0103] Scoring subunit 121, configured to use an isolation forest algorithm in combination with association rules to perform anomaly detection on each historical security event data to obtain an anomaly score, and calculate the impact based on the anomaly score;

[0104] The construction subunit 122 is used to construct a multi-factor scoring model, wherein the multi-factor scoring model is: risk value = impact × probability of occurrence × value of assets involved;

[0105] The risk calculation subunit 123 is used to obtain the impact, probability of occurrence and value of assets involved in the security incident and calculate the risk value;

[0106] In this embodiment, the building module 20 includes:

[0107] The classification subunit 21 is used to obtain historical event data, classify the historical event data based on classification rules, and obtain classification results;

[0108] An extraction subunit 22 is used to extract key feature data from historical event data, wherein the key feature data includes historical response actions and attack source IP addresses;

[0109] The training subunit 23 is used to construct a training set based on key feature data, classification results, and risk values, and use the training set to train a pre-built basic model to obtain a decision tree model;

[0110] In this embodiment, the data acquisition module 30 includes:

[0111] The collection unit 31 is used to collect security event data, system logs and network activity records through regular polling;

[0112] The sorting unit 32 is used to sort the acquired data by timestamp and encapsulate it in JSON format;

[0113] The encryption unit 33 is used to encrypt the encapsulated data using the AES-256 algorithm and push the encrypted data to the cloud platform;

[0114] In this embodiment, the parsing module 40 includes:

[0115] The parsing unit 41 is used to decrypt the encrypted data, perform type matching on the decrypted security event data using a pre-trained regular expression library, and parse the security event data based on the matching results;

[0116] The classification unit 42 is used to input the parsed data into the rule engine, classify the data that meets the predetermined condition rules, and obtain the classification results;

[0117] A first generating unit 43 is configured to generate a preliminary report based on the security event data and the classification result, wherein the preliminary report includes an event ID, a timestamp, a type, and a severity level;

[0118] In this embodiment, the analysis module 50 includes:

[0119] an analysis unit 51 for analyzing the preliminary report using a decision tree model to generate a response action;

[0120] An extraction unit 52 is configured to aggregate data around a security event through a time window to obtain aggregated data, and extract key event feature words from the aggregated data using a TF-IDF algorithm;

[0121] The second generating unit 53 is used to generate an event background description based on the key event feature words according to the pre-built knowledge base;

[0122] A calculation unit 54 is used to calculate the historical 24-hour frequency of security events, and if the frequency exceeds a threshold, trigger an alarm and generate recommended measures;

[0123] The third generating unit 55 is used to summarize the response action, background description, risk value and recommended measures to generate a comprehensive report.

[0124] The terminal security monitoring and response device of the present invention first collects historical security event data and mines association rules from it to expand the data foundation for comprehensive security event risk analysis. Next, an anomaly score is calculated for each historical security event data item based on the mined association rules, and a risk value is generated based on this score, completing data conversion for subsequent analysis. Subsequently, a pre-built basic model is trained using the historical event data and its risk values ​​to generate a decision tree model, enabling automated analysis of real-time data. When processing real-time data, the device encrypts the acquired real-time security event data, system logs, and network activity records and transmits them to a cloud platform. Within the cloud platform, the encrypted data is parsed and classified according to pre-built rules to generate a preliminary report, completing the pre-processing of the real-time data and preparing for subsequent model recognition. Finally, the preliminary report is analyzed using a decision tree model to generate response actions and a comprehensive report, which managers can then respond to, thereby improving monitoring efficiency and response speed.

[0125] The above is a detailed description of the terminal security monitoring and response solution device in the embodiment of the present invention from the perspective of modular functional entities. The following is a detailed description of the terminal security monitoring and response solution device in the embodiment of the present invention from the perspective of hardware processing.

[0126] Figure 10This is a schematic diagram of the structure of a terminal security monitoring and response solution device provided in an embodiment of the present invention. The terminal security monitoring and response solution device 900 may vary significantly due to different configurations or performance. It may include one or more processors (central processing units, CPUs) 910 (for example, one or more processors) and a memory 920, and one or more storage media 930 (for example, one or more mass storage devices) storing application programs 933 or data 932. The memory 920 and storage medium 930 may be temporary storage or permanent storage. The program stored in the storage medium 930 may include one or more modules (not shown), each of which may include a series of instruction operations in the terminal security monitoring and response solution device 900. Furthermore, the processor 910 may be configured to communicate with the storage medium 930, and execute the series of instruction operations in the storage medium 930 on the terminal security monitoring and response solution device 900 to implement the steps of the terminal security monitoring and response solution provided in each of the above-mentioned method embodiments.

[0127] The terminal security monitoring and response solution device 900 may also include one or more power supplies 940, one or more wired or wireless network interfaces 950, one or more input and output interfaces 960, and / or one or more operating systems 931, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, etc. It will be understood by those skilled in the art that Figure 10 The illustrated terminal security monitoring and response solution device structure does not constitute a limitation on the terminal security monitoring and response solution device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0128] The present invention also provides a computer-readable storage medium, which can be a non-volatile computer-readable storage medium or a volatile computer-readable storage medium. The computer-readable storage medium stores instructions, which, when executed on a computer, enable the computer to execute the steps of a terminal security monitoring and response solution.

[0129] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working process of the above-described equipment or device can refer to the corresponding process in the aforementioned method embodiment and will not be repeated here.

[0130] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc., various media that can store program code.

[0131] It is understandable that those skilled in the art can make equivalent substitutions or changes based on the technical solution and inventive concept of the present invention, and all these changes or substitutions should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A terminal security monitoring and response solution, characterized in that: The steps include: Obtain historical security event data, mine association rules in the historical security event data, calculate the anomaly score of each historical security event data based on the association rules, and generate a risk value based on the anomaly score; Use historical event data and their risk values ​​to train a pre-built basic model to obtain a decision tree model; Obtain real-time security event data, system logs, and network activity records, encrypt the data, and transmit it to the cloud platform; Parse encrypted data from the cloud platform, classify the parsed data using pre-built rules, and generate preliminary reports; The preliminary reports were analyzed using a decision tree model to generate response actions and a comprehensive report.

2. The terminal security monitoring and response solution according to claim 1, characterized in that: The process of obtaining historical security event data, mining association rules in the historical security event data, calculating anomaly scores for each historical security event data according to the association rules, and generating risk values ​​according to the anomaly scores specifically includes: Obtain historical security event data, use the FP-Growth algorithm to perform pattern recognition on the historical security event data to obtain frequent item sets, and generate association rules based on the frequent item sets; Anomaly detection is performed on each historical security event data based on association rules to obtain anomaly scores, and a multi-factor scoring model is used to generate risk values ​​based on the anomaly scores.

3. The terminal security monitoring and response solution according to claim 2, characterized in that: The anomaly detection is performed on each historical security event data according to the association rules to obtain an anomaly score, and a multi-factor scoring model is used to generate a risk value according to the anomaly score, specifically including: Use the isolation forest algorithm and association rules to detect anomalies in each historical security event data to obtain anomaly scores, and calculate the impact based on the anomaly scores; Construct a multi-factor scoring model, wherein the multi-factor scoring model is: risk value = impact × probability of occurrence × value of assets involved; Obtain the impact, probability of occurrence, and value of assets involved in security incidents to calculate the risk value.

4. The terminal security monitoring and response solution according to claim 1, characterized in that: The method of using historical event data and its risk value to train a pre-built basic model to obtain a decision tree model specifically includes: Acquire historical event data, classify the historical event data based on classification rules, and obtain classification results; Extract key feature data from historical event data, including historical response actions and attack source IP addresses; A training set is constructed using key feature data, classification results, and risk values. The pre-built basic model is trained using the training set to obtain a decision tree model.

5. The terminal security monitoring and response solution according to claim 1, characterized in that: Acquiring real-time security event data, system logs, and network activity records, encrypting the data, and transmitting the data to the cloud platform includes: Collect security event data, system logs, and network activity records through scheduled polling; Sort the acquired data by timestamp and encapsulate it in JSON format; The packaged data is encrypted using the AES-256 algorithm and then pushed to the cloud platform.

6. The terminal security monitoring and response solution according to claim 1, characterized in that: The encrypted data of the cloud platform is parsed, and pre-built rules are used to classify the parsed data and generate a preliminary report, specifically including: Decrypt the encrypted data, perform type matching on the decrypted security event data using a pre-trained regular expression library, and parse the security event data based on the matching results. The parsed data is input into the rule engine, and the data that meets the predetermined condition rules is classified to obtain the classification results; A preliminary report is generated based on the security event data and classification results, wherein the preliminary report includes event ID, timestamp, type, and severity level.

7. The terminal security monitoring and response solution according to claim 1, characterized in that: The decision tree model is used to analyze the preliminary report to generate response actions and a comprehensive report, specifically including: Analyze the preliminary report using a decision tree model to generate response actions; Aggregate data around security events through time windows to obtain aggregated data, and use the TF-IDF algorithm to extract key event feature words from the aggregated data. Generate event context description based on key event feature words according to the pre-built knowledge base; Calculate the historical 24-hour frequency of security events. If the frequency exceeds the threshold, trigger an alert and generate recommended actions. Summarize response actions, background descriptions, risk values, and recommended measures to generate a comprehensive report.

8. A terminal security monitoring and response solution device, characterized in that: include: The risk assessment module is used to obtain historical security event data, mine association rules in the historical security event data, calculate the anomaly score of each historical security event data based on the association rules, and generate a risk value based on the anomaly score; A construction module is used to train a pre-built basic model using historical event data and its risk value to obtain a decision tree model; Data acquisition module, used to obtain real-time security event data, system logs and network activity records, encrypt the data and transmit it to the cloud platform; The parsing module is used to parse the encrypted data of the cloud platform, classify the parsed data using pre-built rules, and generate preliminary reports; The analysis module is used to analyze the preliminary report using a decision tree model to generate response actions and comprehensive reports.

9. A terminal security monitoring and response solution device, characterized in that: comprising a memory and at least one processor, wherein the memory has computer-readable instructions stored therein; The at least one processor calls the computer-readable instructions in the memory to execute the steps of the terminal security monitoring and response solution according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer-readable instructions stored thereon, characterized in that: When the computer-readable instructions are executed by a processor, the steps of the terminal security monitoring and response solution according to any one of claims 1 to 7 are implemented.

Images