Threat detection and response method and apparatus, electronic device, and storage medium

Abstract

This application provides a threat detection and response method, apparatus, electronic device, and storage medium. The method includes: acquiring a real-time data stream; inputting the real-time data stream into a preset deep learning model to obtain a threat detection result for the real-time data stream; and, if the threat detection result indicates the existence of a threat and determines that the threat detection result meets a preset threat severity, executing a response strategy related to the real-time data stream. This application achieves the purpose of attack detection, achieving the technical effects of being signature-free, having high detection accuracy, being able to handle unknown threats, and having a fast response speed, thus solving the problems existing in related technologies.

Description

Technical Field

[0001] This application relates to the field of security technology, and in particular to a threat detection and response method and apparatus, electronic device and storage medium. Background Technology

[0002] As cyberattack methods continue to evolve, traditional signature-based defenses (such as firewalls and virus scans) are no longer effective in preventing increasingly sophisticated attacks, especially zero-day attacks and advanced persistent threats (APTs). These attacks are often unknown and difficult to predict; therefore, enterprises and organizations need an intelligent system capable of automatically identifying and responding to unknown security threats. The product requirement is to provide an intelligent threat detection and response system based on machine learning (ML) and deep learning (DL) algorithms, reducing reliance on manual monitoring through automation and improving the efficiency and accuracy of threat identification and response.

[0003] In existing technologies, most security protection systems rely on signature-based detection methods, such as antivirus software and intrusion detection systems (IDS). These methods depend on known attack patterns and attack signatures, and therefore cannot effectively detect unknown attacks such as zero-day attacks, APTs, and variant malware. Furthermore, most protection systems respond manually to new types of attacks, requiring professional personnel to analyze and handle them. Therefore, the following problems exist:

[0004] Signature dependency: Traditional products rely on attack patterns and virus database signatures, and cannot identify them when attack samples are not updated or new attacks emerge.

[0005] Insufficient detection accuracy: Traditional detection methods may produce false positives and false negatives, especially for complex APT attacks and covert malicious behaviors.

[0006] Slow response time: Most traditional security products cannot achieve automated response and require human intervention, which makes it slow to respond to threats.

[0007] Unable to handle unknown threats: Traditional defense mechanisms struggle to detect and respond to zero-day attacks or new, unidentified attacks. Summary of the Invention

[0008] This application provides a threat detection and response method and apparatus, electronic device and storage medium to at least solve the technical problems existing in the related art.

[0009] According to one aspect of the embodiments of this application, a threat detection and response method is provided, including:

[0010] Obtain real-time data stream;

[0011] The real-time data stream is input into a preset deep learning model to obtain the threat detection results of the real-time data stream;

[0012] If the threat detection result indicates the existence of a threat and it is determined that the threat detection result meets the preset threat severity, a response strategy related to the real-time data stream is executed.

[0013] Optionally, as described above, the step of inputting the real-time data stream into a preset deep learning model to obtain the threat detection result of the real-time data stream includes:

[0014] The network traffic, user behavior data, and system logs in the real-time data stream are input into the preset deep learning model;

[0015] Obtain the traffic behavior analysis results output by the preset deep learning model based on the network traffic, obtain the user behavior analysis results output by the preset deep learning model based on the user behavior data, and obtain the security vulnerability analysis results output by the preset deep learning model based on the system logs;

[0016] The threat detection results are obtained based on the traffic behavior analysis results, the user behavior analysis results, and the security vulnerability analysis results.

[0017] Optionally, as described above, obtaining the threat detection result based on the traffic behavior analysis result, the user behavior analysis result, and the security vulnerability analysis result includes:

[0018] By jointly analyzing the traffic behavior analysis results, the user behavior analysis results, and the security vulnerability analysis results, potential attack patterns can be obtained.

[0019] And / or, the traffic behavior analysis results, the user behavior analysis results, and the security vulnerability analysis results are compared with external threat intelligence in real time to obtain real-time comparison results.

[0020] Optionally, as described above, determining that the threat detection result meets a preset threat severity includes:

[0021] If the attack characteristics indicated by the threat detection result are determined to be preset attack characteristics, and the threat level indicated by the threat detection result is greater than or equal to the preset threat level, then the threat detection result is determined to meet the preset threat severity.

[0022] Optionally, as described above, executing a response strategy related to the real-time data stream includes:

[0023] If it is determined that there are infected devices that have been infected by the real-time data stream, the infected devices shall be isolated.

[0024] Based on the attack source information of the initiator of the real-time data stream, the attack source indicated by the attack source information is blocked;

[0025] If a target vulnerability is identified as being exploited by the real-time data stream, the target vulnerability is patched or the service containing the target vulnerability is shut down.

[0026] Optionally, as described above, the method further includes:

[0027] Obtain the original dataset;

[0028] The original dataset is preprocessed to obtain structured data for training.

[0029] The preset deep learning model is obtained by using reinforcement learning and / or adaptive learning algorithms and training the original deep learning model with the structured data.

[0030] Optionally, as described above, the method further includes:

[0031] The preset deep learning model is incrementally learned through the real-time data stream to optimize the preset deep learning model; and / or,

[0032] Obtain feedback information corresponding to the response strategy, and optimize the preset deep learning model by referring to the feedback information and the real-time data stream.

[0033] According to another aspect of the embodiments of this application, a threat detection and response apparatus is also provided, comprising:

[0034] The acquisition module is used to acquire real-time data streams;

[0035] The detection module is used to input the real-time data stream into a preset deep learning model to obtain the threat detection result of the real-time data stream;

[0036] The response module is used to execute a response strategy related to the real-time data stream when the threat detection result indicates the existence of a threat and the threat detection result is determined to meet a preset threat severity.

[0037] According to another aspect of the embodiments of this application, an electronic device is also provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; wherein the memory is used to store a computer program; and the processor is used to execute the method steps of any of the above embodiments by running the computer program stored in the memory.

[0038] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to execute the method steps of any of the above embodiments when running.

[0039] In this embodiment, a method is employed: acquiring a real-time data stream; inputting the real-time data stream into a preset deep learning model to obtain a threat detection result for the real-time data stream; and executing a response strategy related to the real-time data stream when the threat detection result indicates the existence of a threat and the threat detection result meets a preset threat severity. Since the threat detection result of the real-time data stream can be obtained through a deep learning model, threat detection can be performed even without relying on attack patterns and virus database signatures. It can effectively detect unknown threats such as zero-day attacks, APTs, and variant malware. Furthermore, when the threat detection result meets a preset threat severity, a response strategy related to the amount of real-time data is executed, thus addressing the threat without manual intervention. This achieves the goal of attack detection, resulting in high detection accuracy, the ability to handle unknown threats, and fast response speed, thereby solving the aforementioned technical problems existing in related technologies. Attached Figure Description

[0040] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0041] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a schematic diagram of the hardware environment of an optional threat detection and response method according to an embodiment of this application;

[0043] Figure 2 This is a flowchart illustrating an optional threat detection and response method according to an embodiment of this application;

[0044] Figure 3 This is a flowchart illustrating another optional threat detection and response method according to an embodiment of this application;

[0045] Figure 4 This is a flowchart illustrating another optional threat detection and response method according to an embodiment of this application;

[0046] Figure 5 This is a structural block diagram of an optional threat detection and response device according to an embodiment of this application;

[0047] Figure 6 This is a structural block diagram of an optional electronic device according to an embodiment of this application. Detailed Implementation

[0048] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0049] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0050] First, some nouns or terms that appear in the description of the embodiments of this application shall be interpreted as follows:

[0051] 1. Deep Neural Networks (DNNs): Used to learn complex attack patterns, especially zero-day attacks and APT attacks.

[0052] 2. Convolutional Neural Network (CNN): Used to analyze temporal patterns and spatial features in network traffic data.

[0053] 3. Recurrent Neural Network (RNN) / LSTM: Used to analyze temporal behavioral patterns, such as user behavior and system logs.

[0054] 4. Ensemble learning methods (such as random forest and XGBoost): used to enhance the robustness of the model and reduce the risk of overfitting.

[0055] According to one aspect of the embodiments of this application, a threat detection and response method is provided. Optionally, in this embodiment, the above-described threat detection and response method can be applied to, for example... Figure 1 The hardware environment shown consists of terminal 1402 and server 1404. For example... Figure 1 As shown, server 1404 is connected to terminal 1402 via a network and can be used to provide services (such as game services, application services, etc.) to the terminal or clients installed on the terminal. A database can be set up on the server or independently of the server to provide data storage services for server 1404.

[0056] The aforementioned network may include, but is not limited to, at least one of the following: wired network, wireless network. The aforementioned wired network may include, but is not limited to, at least one of the following: wide area network, metropolitan area network, local area network. The aforementioned wireless network may include, but is not limited to, at least one of the following: Wi-Fi (Wireless Fidelity), Bluetooth. The terminal is not limited to PC, mobile phone, tablet computer, etc.

[0057] The threat detection and response method of this application embodiment can be executed by a server, a terminal, or both. Alternatively, the threat detection and response method of this application embodiment can be executed by a client installed on the terminal.

[0058] Taking the threat detection and response method in this embodiment as an example, which is executed by a server, Figure 1 A threat detection and response method provided in this application includes the following steps:

[0059] Step S202: Obtain the real-time data stream.

[0060] The threat detection and response method in this embodiment can be applied to scenarios where threats need to be identified during network access. Real-time traffic may include, but is not limited to, network traffic generated by the requesting party, as well as data such as terminal behavior and system logs generated based on the access.

[0061] Step S204: Input the real-time data stream into the preset deep learning model to obtain the threat detection results of the real-time data stream.

[0062] Specifically, after acquiring the real-time data stream, in order to determine whether there is a threat, this embodiment inputs it into a preset deep learning model for processing. The preset deep learning model can obtain a threat detection result based on all the data in the real-time data stream, or it can obtain a corresponding threat detection result based on each piece of data in the real-time data stream.

[0063] Step S206: If the threat detection result indicates the existence of a threat and it is determined that the threat detection result meets the preset threat severity, execute the response strategy related to the real-time data stream.

[0064] Specifically, upon receiving the threat detection result, it can be determined whether the real-time data stream poses a threat. If the threat detection result indicates that there is no threat, no response is required. Conversely, if the threat detection result indicates that there is a threat, the severity of the threat needs to be further determined. In this embodiment, the severity of the threat may include, but is not limited to, threat type, level, and degree of severity. If it is determined that the threat detection result meets the preset threat severity, a response strategy related to the real-time data stream needs to be executed. The response strategy related to the real-time data stream may involve processing aspects such as the device attacked by the real-time data stream and the attack channel to respond in a timely manner.

[0065] In this embodiment, threat detection results from real-time data streams are obtained through a deep learning model. This allows for threat detection even without relying on attack patterns or signatures in virus databases. It effectively detects unknown threats such as zero-day attacks, APTs, and variant malware. When the threat detection results meet a preset threat severity threshold, a response strategy related to the amount of real-time data is executed, thus addressing the threat without manual intervention. This achieves the goal of attack detection, demonstrating high accuracy, the ability to handle unknown threats, and fast response times, thereby solving the aforementioned technical problems in related technologies.

[0066] like Figure 3 As shown, as an optional embodiment, the method described above is implemented through the following steps: Step S202 inputs the real-time data stream into a preset deep learning model to obtain the threat detection result of the real-time data stream.

[0067] Step S302: Input the network traffic, user behavior data and system logs from the real-time data stream into the preset deep learning model.

[0068] Specifically, network traffic, logs, and behavioral data can be received in real time from various devices (such as firewalls, intrusion detection systems, and terminals) and treated as a real-time data stream. This real-time data stream is then transmitted to the threat detection module implementing the method of this embodiment via the data acquisition module and fed into a preset deep learning model within the threat detection module.

[0069] Step S304: Obtain the traffic behavior analysis results output by the preset deep learning model based on network traffic, obtain the user behavior analysis results output by the preset deep learning model based on user behavior data, and obtain the security vulnerability analysis results output by the preset deep learning model based on system logs.

[0070] Specifically, after acquiring the above data, the preset deep learning model performs the following analysis:

[0071] Traffic analysis: Analyzes network traffic transmission patterns, detects abnormal traffic behaviors such as DDoS attacks and scanning behavior, and ultimately obtains traffic behavior analysis results.

[0072] User behavior analysis: By analyzing user behavior data such as login history and access behavior, it detects whether there are abnormal behaviors, such as unauthorized access or account hijacking, and finally obtains the user behavior analysis results.

[0073] System log analysis: By analyzing system logs such as those of the operating system and applications, we can identify whether system vulnerabilities have been exploited, backdoor programs, etc., and ultimately obtain the security vulnerability analysis results.

[0074] Step S306: Based on the traffic behavior analysis results, user behavior analysis results, and security vulnerability analysis results, threat detection results are obtained.

[0075] In other words, after obtaining the results of traffic behavior analysis, user behavior analysis, and security vulnerability analysis, the final threat detection result can be determined based on the above analysis results.

[0076] As an optional embodiment, the method described above can be implemented by the following method to obtain threat detection results based on traffic behavior analysis results, user behavior analysis results, and security vulnerability analysis results: jointly analyzing the traffic behavior analysis results, user behavior analysis results, and security vulnerability analysis results to obtain potential attack patterns; and / or, comparing the traffic behavior analysis results, user behavior analysis results, and security vulnerability analysis results with external threat intelligence in real time to obtain real-time comparison results. In other words, correlation analysis and / or cross-domain detection can be performed. Specifically, correlation analysis involves combining multi-dimensional data (i.e., traffic behavior analysis results, user behavior analysis results, and security vulnerability analysis results) for joint analysis to identify potential attack patterns. Cross-domain detection involves obtaining external threat intelligence (such as malicious IPs, domain names, and file hashes), and comparing the traffic behavior analysis results, user behavior analysis results, and security vulnerability analysis results with the external threat intelligence in real time to obtain real-time comparison results, thereby enhancing detection accuracy.

[0077] The method described in this embodiment can improve the accuracy and precision of attack pattern detection through multi-dimensional detection.

[0078] As an optional embodiment, the method described above can be implemented in step S206 by determining that the threat detection result meets the preset threat severity: If the attack characteristics indicated by the threat detection result are preset attack characteristics, and the threat level indicated by the threat detection result is greater than or equal to the preset threat level, then the threat detection result is determined to meet the preset threat severity. In other words, it is necessary to obtain the attack characteristics and threat level based on the threat detection result, and then determine the severity of the threat based on the attack characteristics and the threat level. The attack characteristics may include, but are not limited to: attack type: for example, SQL injection; attack vector: for example, passing malicious SQL statements through URL parameters; attack source: for example, IP address 192.XXX, located in a certain city; affected assets: for example, web application database; timestamp: for example, 14:00 to 14:05 on December 26, 2024; behavioral pattern: for example, a large number of similar requests within a short period of time, attempting to bypass authentication, etc. The threat level can be determined based on the following factors: scope of impact: the number and importance of systems that the attack may affect; degree of damage: the data leakage, system interruption, or other losses that the attack may cause; attacker's skill level: the attacker's technical capabilities and resources. Urgency level: The degree to which an immediate response is required. Historical background: Whether the attack is part of a known threat and whether there is a similar historical record. If the attack characteristics and threat level both meet the above requirements, then the threat detection result is determined to meet the preset threat severity.

[0079] As an optional embodiment, the method described above can be implemented by the following method: executing the response strategy related to the real-time data stream in step S206, including:

[0080] If an infected device is identified as being infected by the real-time data stream, the infected device is isolated. In other words, this method is used to isolate infected devices: removing them from the network to prevent the threat from spreading. The isolation method can be physical or logical, and the choice is made based on the specific circumstances; no specific limitation is made here. Furthermore, the isolation can be lifted after the infection is removed.

[0081] Based on the attack source information from the initiator of the real-time data stream, the attack source indicated by the attack source information is blocked. In other words, this method is used to block attack channels: based on information such as the IP address and port number of the attack source, firewall rules or IDS / IPS policies are dynamically adjusted to block the attack source.

[0082] If a target vulnerability is identified that can be exploited by real-time data streams, the vulnerability can be patched or the service containing the vulnerability can be shut down. In other words, a response can also be made through automated vulnerability remediation: if a system vulnerability or weakness is discovered, patches can be automatically deployed to fix it or the affected service can be shut down.

[0083] In addition, an alarm system can be triggered to send alerts to administrators and relevant personnel, provide detailed attack information, and remind them to take further action.

[0084] like Figure 4 As shown, as an optional embodiment, the preset deep learning model can be obtained through the method described above:

[0085] Step S402: Obtain the original dataset.

[0086] Optionally, raw datasets can be obtained through data collection operations, such as through network proxies, endpoint monitoring, IDS / IPS, and other devices. Furthermore, the types of raw datasets can include one or more of the following: network traffic data: including transmission protocols, IP addresses, port numbers, traffic volume, timestamps, etc.; system logs: including operating system events, application logs, error reports, etc.; user behavior logs: collecting information such as user login and operational behavior to establish user behavior patterns; external threat information: collecting threat intelligence from external sources such as malicious IP addresses, domain names, file hashes, etc.

[0087] Step S404: Preprocess the original dataset to obtain structured data for training.

[0088] Specifically, after obtaining the original dataset, it can be preprocessed by data cleaning and feature extraction to obtain structured data for training. Data cleaning is used to remove redundant data from the original dataset and correct outliers or missing values; feature extraction is used to extract meaningful features (such as traffic features, behavioral features, etc.) from the cleaned original dataset and convert it into structured data for model training.

[0089] Step S406: Using reinforcement learning and / or adaptive learning algorithms, and training the original deep learning model with structured data, a preset deep learning model is obtained.

[0090] Specifically, after acquiring structured data, the original deep learning model can be trained using reinforcement learning and / or adaptive learning algorithms. The original deep learning model can be a deep neural network, convolutional neural network, recurrent neural network, ensemble learning methods such as random forest or XGBoost.

[0091] After selecting the initial deep learning model, supervised learning can be performed on it using labeled structured data to generate a preliminary classification model. The model automatically adjusts weights based on different features (such as traffic, user behavior, system anomalies, etc.). Furthermore, in this embodiment, reinforcement learning and / or adaptive learning algorithms are used to enable the model to continuously learn and optimize from new attack samples through online learning.

[0092] Furthermore, after obtaining the aforementioned preset deep learning model, the system can automatically adjust the model parameters based on changes in real-time network behavior. A reinforcement learning mechanism is introduced, enabling the system to continuously optimize its decision-making and response strategies through a reward mechanism when facing new threats.

[0093] As an optional embodiment, the method described above further includes: incrementally learning a preset deep learning model through real-time data streams to optimize the preset deep learning model; and / or obtaining feedback information corresponding to the response strategy, and optimizing the preset deep learning model by referring to the feedback information and real-time data streams. In other words, it is possible to record and analyze all detected threat fact data streams and their response processes. The preset deep learning model can automatically adjust its learning based on the feedback of attack results (such as successful blocking, false positives, etc.) to improve its ability to identify and respond to similar attacks in the future. Furthermore, the preset deep learning model can undergo incremental learning and / or reinforcement learning. Incremental learning refers to the ability of a model to continuously update and improve based on new data or samples without retraining the entire dataset. This is particularly useful for handling dynamically changing data distributions, such as constantly evolving network threats. In this embodiment, incremental learning can be implemented as follows: after each threat occurs, the preset deep learning model will perform incremental learning based on new samples (i.e., new real-time data streams and corresponding response strategies) to optimize detection performance. Reinforcement learning is a learning paradigm that learns optimal behavioral strategies by interacting with the environment and based on feedback (rewards or penalties). This approach is suitable for tasks requiring long-term planning and decision-making, such as threat response in cybersecurity. In this embodiment, reinforcement learning is implemented by using real-time feedback (i.e., feedback information corresponding to each response strategy) to progressively optimize decision-making strategies and enhance adaptability to unknown threats. Feedback information may include, but is not limited to, response effectiveness and the nature of attacks corresponding to real-time data streams.

[0094] According to another aspect of the embodiments of this application, an electronic device is also provided, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; wherein the memory is used to store a computer program; and the processor is used to execute the method steps of any of the above embodiments by running the computer program stored in the memory.

[0095] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to execute the method steps of any of the above embodiments when running.

[0096] In this embodiment, a method is employed: acquiring a real-time data stream; inputting the real-time data stream into a preset deep learning model to obtain threat detection results for the real-time data stream; and executing a response strategy related to the real-time data stream when the threat detection results indicate the presence of a threat and the threat detection results meet a preset threat severity. Since threat detection results for the real-time data stream can be obtained through a deep learning model, threat detection can be performed even without relying on attack patterns and signatures in virus databases. It can effectively detect unknown threats such as zero-day attacks, APTs, and variant malware. Furthermore, when the threat detection results meet a preset threat severity, a response strategy related to the amount of real-time data is executed, thus addressing threats without manual intervention. This achieves the goal of attack detection, resulting in high detection accuracy, the ability to handle unknown threats, and fast response speed, thereby solving the aforementioned technical problems existing in related technologies.

[0097] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0098] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM (Read-Only Memory) / RAM (Random Access Memory), magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0099] According to another aspect of the embodiments of this application, a threat detection and response apparatus for implementing the above-described threat detection and response method is also provided. Figure 5 This is a structural block diagram of an optional threat detection and response device according to an embodiment of this application, such as... Figure 5 As shown, the device may include:

[0100] Module 51 is used to acquire real-time data streams;

[0101] The detection module 52 is used to input the real-time data stream into a preset deep learning model to obtain the threat detection results of the real-time data stream;

[0102] The response module 53 is used to execute a response strategy related to the real-time data stream when the threat detection result indicates the existence of a threat and determines that the threat detection result meets the preset threat severity.

[0103] It should be noted that the acquisition module 51 in this embodiment can be used to perform the above step S202, the detection module 52 in this embodiment can be used to perform the above step S204, and the response module 53 in this embodiment can be used to perform the above step S206.

[0104] Through the modules described above, threat detection results are obtained from real-time data streams using deep learning models. This allows for threat detection even without relying on attack patterns or signature databases. It effectively detects unknown threats such as zero-day attacks, APTs, and variant malware. When the threat detection results meet a preset threat severity threshold, a response strategy related to the amount of real-time data is executed, thus addressing the threat without manual intervention. This achieves the goal of attack detection, demonstrating high accuracy, the ability to handle unknown threats, and fast response times, thereby resolving problems existing in related technologies.

[0105] In addition to the modules described above, the apparatus in this embodiment may also include modules that perform any method in any of the aforementioned threat detection and response methods.

[0106] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the content disclosed in the above embodiments. It should also be noted that the above modules, as part of a device, can operate in environments such as... Figure 1 The hardware environment shown can be implemented through software or hardware, and the hardware environment includes the network environment.

[0107] According to another aspect of the embodiments of this application, an electronic device for implementing the above-described threat detection and response method is also provided. The electronic device may be a server, a terminal, or a combination thereof.

[0108] According to another embodiment of this application, an electronic device is also provided, comprising: Figure 6As shown, the electronic device may include: a processor 1501, a communication interface 1502, a memory 1503, and a communication bus 1504, wherein the processor 1501, the communication interface 1502, and the memory 1503 communicate with each other through the communication bus 1504.

[0109] Memory 1503 is used to store computer programs;

[0110] When processor 1501 executes the program stored in memory 1503, it performs the following steps:

[0111] Step S202: Obtain the real-time data stream.

[0112] Step S204: Input the real-time data stream into the preset deep learning model to obtain the threat detection results of the real-time data stream.

[0113] Step S206: If the threat detection result indicates the existence of a threat and it is determined that the threat detection result meets the preset threat severity, execute the response strategy related to the real-time data stream.

[0114] Optionally, in this embodiment, the communication bus can be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus, etc. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used to represent it in the figure, but this does not mean that there is only one bus or one type of bus. The communication interface is used for communication between the aforementioned electronic device and other devices.

[0115] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the memory may also be at least one storage device located remotely from the aforementioned processor.

[0116] As an example, the memory 1503 described above may include, but is not limited to, the acquisition module 51, the detection module 52, and the response module 53 of the threat detection and response device. Furthermore, it may include, but is not limited to, other module units of the threat detection and response device described above, which will not be elaborated upon in this example.

[0117] The processors mentioned above can be general-purpose processors, including but not limited to: CPU (Central Processing Unit), NP (Network Processor), etc.; they can also be DSP (Digital Signal Processor), ASIC (Application Specific Integrated Circuit), FPGA (Field-Programmable Gate Array) or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0118] This application also provides a computer-readable storage medium, which includes a stored program, wherein the program executes the method steps of the above method embodiments when it runs.

[0119] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, ROMs, RAMs, portable hard drives, magnetic disks, or optical disks.

[0120] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0121] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application.

[0122] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0123] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between units or modules, and may be electrical or other forms.

[0124] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the solution provided in this embodiment, depending on actual needs.

[0125] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0126] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A threat detection and response method, characterized in that, include: Obtain real-time data stream; The real-time data stream is input into a preset deep learning model to obtain the threat detection results of the real-time data stream; If the threat detection result indicates the existence of a threat and it is determined that the threat detection result meets the preset threat severity, a response strategy related to the real-time data stream is executed.

2. The method according to claim 1, characterized in that, The step of inputting the real-time data stream into a preset deep learning model to obtain the threat detection result of the real-time data stream includes: The network traffic, user behavior data, and system logs in the real-time data stream are input into the preset deep learning model; Obtain the traffic behavior analysis results output by the preset deep learning model based on the network traffic, obtain the user behavior analysis results output by the preset deep learning model based on the user behavior data, and obtain the security vulnerability analysis results output by the preset deep learning model based on the system logs; The threat detection results are obtained based on the traffic behavior analysis results, the user behavior analysis results, and the security vulnerability analysis results.

3. The method according to claim 2, characterized in that, The threat detection result is obtained based on the traffic behavior analysis result, the user behavior analysis result, and the security vulnerability analysis result, including: By jointly analyzing the traffic behavior analysis results, the user behavior analysis results, and the security vulnerability analysis results, potential attack patterns can be obtained. And / or, the traffic behavior analysis results, the user behavior analysis results, and the security vulnerability analysis results are compared with external threat intelligence in real time to obtain real-time comparison results.

4. The method according to claim 1, characterized in that, Determining that the threat detection result meets the preset threat severity includes: If the attack characteristics indicated by the threat detection result are determined to be preset attack characteristics, and the threat level indicated by the threat detection result is greater than or equal to the preset threat level, then the threat detection result is determined to meet the preset threat severity.

5. The method according to claim 1, characterized in that, The execution of the response strategy related to the real-time data stream includes at least one of the following: If it is determined that there are infected devices that have been infected by the real-time data stream, the infected devices shall be isolated. Based on the attack source information of the initiator of the real-time data stream, the attack source indicated by the attack source information is blocked; If a target vulnerability is identified as being exploited by the real-time data stream, the target vulnerability is patched or the service containing the target vulnerability is shut down.

6. The method according to claim 1, characterized in that, The method further includes: Obtain the original dataset; The original dataset is preprocessed to obtain structured data for training. The preset deep learning model is obtained by using reinforcement learning and / or adaptive learning algorithms and training the original deep learning model with the structured data.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: The preset deep learning model is incrementally learned through the real-time data stream to optimize the preset deep learning model; and / or, Obtain feedback information corresponding to the response strategy, and optimize the preset deep learning model by referring to the feedback information and the real-time data stream.

8. A threat detection and response device, characterized in that, include: The acquisition module is used to acquire real-time data streams; The detection module is used to input the real-time data stream into a preset deep learning model to obtain the threat detection result of the real-time data stream; The response module is used to execute a response strategy related to the real-time data stream when the threat detection result indicates the existence of a threat and the threat detection result is determined to meet a preset threat severity.

9. An electronic device comprising a processor, a communication interface, a memory, and a communication bus, wherein, The processor, the communication interface, and the memory communicate with each other via the communication bus, characterized in that... The memory is used to store computer programs; The processor is configured to perform the method of any one of claims 1 to 7 by running the computer program stored in the memory.

10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, wherein the computer program is configured to execute the method described in any one of claims 1 to 7 when it is run.

Images