A method, device, equipment and medium for tracing and analyzing terminal behavior alarms

Abstract

The present application discloses a method, device, equipment and medium for tracing the source of terminal behavior alarms, including: monitoring terminal behavior data, reading and parsing the terminal behavior data in real time, obtaining behavior logs and storing them in a local database; matching and colliding predefined behavior features with behavior logs as preset alarm rules to obtain collision record results; automatically tracing the context according to the alarm points of the collision record results to form a traceability chain, and automatically submitting the traceability chain to the data platform; and assessing the risk level of the traceability chain through the data platform. In this way, the data of the traceability chain is analyzed and processed, and its risk level is assessed, which provides strong data support and judgment basis for the alarm behavior, can improve the event relevance and accuracy of risk alarms, obtain behavioral log records of the ins and outs of risk alarm events, reduce the cumbersome process of manual retrieval analysis, manual judgment and manual traceability, improve the detection rate, and reduce the false alarm rate.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a method, device, equipment and medium for tracing and analyzing terminal behavior alarms. Background Art

[0002] In the actual application scenarios of terminal security products, a large number of various high, medium and low risk alarms will be generated. When security workers need to make decisions and judgments on these single alarms, they are not 100% sure whether the risk alarm is normal behavior or real attack penetration behavior. They need to conduct in-depth investigations and research in conjunction with other products or manual terminals, or a large number of alarms encountered may be false alarms. Excessive security alarms or false alarms will bring risk alarm review fatigue to the handling of security incidents.

[0003] At present, current technologies all use malicious file rule features or intelligence compromise detection (Indicator Of Compromise, IOC) to perform instant tracing. The tracing data is reported as a single alarm, and the alarm risk level is the same or consistent with the alarm risk level of the tracing origin point. It is not possible to re-trace the source afterwards or perform a second complete tracing of a certain alarm or risk point. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for tracing the source of terminal behavior alarms, which can realize terminal rule collision analysis and automatic tracing, improve the detection rate and reduce the false alarm rate. The specific scheme is as follows:

[0005] A method for tracing and analyzing terminal behavior alarms, comprising:

[0006] Monitor terminal behavior data, read and analyze the terminal behavior data in real time, obtain behavior logs and store them in a local database;

[0007] Using predefined behavior features as preset alarm rules to match and collide with the behavior log to obtain a collision record result;

[0008] Automatic context tracing is performed according to the alarm points of the collision record results to form a traceability chain, and the traceability chain is automatically submitted to the data platform;

[0009] The risk level of the traceability chain is assessed through the data platform.

[0010] Preferably, in the method for tracing and analyzing the terminal behavior alarm provided in the embodiment of the present invention, the method further includes:

[0011] The alarm behavior is presented to the user in the form of a complete event; the complete event form is to associate and merge multiple related alarm points into one event.

[0012] Preferably, in the method for tracing and analyzing the terminal behavior alarm provided in the embodiment of the present invention, the automatic context tracing is performed according to the alarm point of the collision record result to form a tracing chain, including:

[0013] Tracking the parent-child processes and related node operation objects associated with the warning point context of the collision record result from the local database;

[0014] The tree structure data of the parent-child relationship formed by splicing the entire tracking process chain and node operation objects is used as the traceability chain.

[0015] Preferably, in the method for tracing and analyzing the terminal behavior alarm provided in an embodiment of the present invention, the step of tracking the parent-child processes and related node operation objects associated with the alarm point context of the collision record result from the local database includes:

[0016] Obtain the parent process ID and child process ID of the current node operation object corresponding to the alarm point of the collision record result;

[0017] Tracking the log information of the parent process ID upward from the local database through the parent process ID until no process node of the parent process ID is found;

[0018] The log information of the sub-process ID is traced downward from the local database through the sub-process ID until no process node is found for the sub-process ID.

[0019] Preferably, in the method for tracing and analyzing the terminal behavior alarm provided in the embodiment of the present invention, while forming the tracing chain, it also includes:

[0020] The terminal traceability interface is used to receive the platform traceability instruction and obtain the corresponding traceability chain.

[0021] Preferably, in the method for tracing and analyzing terminal behavior alarms provided in an embodiment of the present invention, the risk level assessment of the traceability chain through the data platform includes:

[0022] The traceability chain is parsed through the data platform, and each node of the traceability chain is compared and referenced with a known alarm list to assess the risk weight of each node in the traceability chain and reassess the risk level of the traceability chain.

[0023] Preferably, in the method for tracing and analyzing the terminal behavior alarm provided by an embodiment of the present invention, presenting the alarm behavior to the user in the form of a complete event includes:

[0024] The information of each node in the traceability chain and the risk level corresponding to the alarm behavior are displayed in the form of a complete event through diagrams and data.

[0025] The embodiment of the present invention further provides a device for tracing and analyzing terminal behavior alarms, including:

[0026] Data monitoring module, used to monitor terminal behavior data;

[0027] A log analysis module is used to read and analyze the terminal behavior data in real time, obtain the behavior log and store it in a local database;

[0028] A collision recording module, used for matching the predefined behavior features as preset alarm rules with the behavior log to obtain a collision record result;

[0029] An automatic tracing module is used to automatically trace the context according to the alarm point of the collision record result, form a tracing chain, and automatically submit the tracing chain to the data platform;

[0030] The data platform is used to assess the risk level of the traceability chain.

[0031] An embodiment of the present invention also provides a device for tracing and analyzing terminal behavior alarms, comprising a processor and a memory, wherein the processor implements the method for tracing and analyzing terminal behavior alarms as provided in the embodiment of the present invention when executing a computer program stored in the memory.

[0032] An embodiment of the present invention further provides a computer-readable storage medium for storing a computer program, wherein the computer program, when executed by a processor, implements the above-mentioned method for tracing and analyzing terminal behavior alarms provided in an embodiment of the present invention.

[0033] It can be seen from the above technical scheme that a method for tracing and analyzing terminal behavior alarms provided by the present invention includes: monitoring terminal behavior data, reading and parsing the terminal behavior data in real time, obtaining behavior logs and storing them in a local database; matching pre-defined behavior features with behavior logs as preset alarm rules to obtain collision record results; automatically tracing the context according to the alarm points of the collision record results to form a traceability chain, and automatically submitting the traceability chain to the data platform; and assessing the risk level of the traceability chain through the data platform.

[0034] The present invention can realize terminal rule collision analysis and automatic traceability log correlation analysis to form a traceability chain through the above-mentioned terminal behavior alarm traceability analysis method, and then automatically submit it to the data platform to analyze and process the data of the traceability chain and assess its risk level. This provides strong data support and judgment basis for the alarm behavior, can improve the event correlation and accuracy of risk alarms, obtain behavioral log records of the ins and outs of risk alarm events, reduce the tedious process of manual retrieval analysis, manual judgment and manual tracing, improve the detection rate, and reduce the false alarm rate.

[0035] In addition, the present invention also provides corresponding devices, equipment and computer-readable storage media for the method of terminal behavior alarm tracing analysis, which further makes the above method more practical. The device, equipment and computer-readable storage medium have corresponding advantages. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0037] Figure 1 A flowchart of a method for tracing and analyzing terminal behavior alarms provided by an embodiment of the present invention;

[0038] Figure 2 A schematic diagram of the structure of a device for tracing and analyzing terminal behavior alarms provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0039] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] The present invention provides a method for tracing and analyzing terminal behavior alarms, such as Figure 1 As shown, the following steps are included:

[0041] S101, monitoring terminal behavior data, reading and analyzing the terminal behavior data in real time, obtaining behavior logs and storing them in a local database;

[0042] It should be noted that the above-mentioned local database has a full log storage function, and the present invention can dynamically store the full amount of behavior logs locally through the terminal. The behavior log is a behavior log that monitors the file operations, registry operations, process operations, network connections, etc. of the operating system through process hooks, or an event log obtained by monitoring tools like sysmon. The behavior log may include file operations, registry operations, process creation, network connections, driver loading, process access, and WMI (Windows Management Instrumentation) events, etc. Preferably, the behavior log can be stored through a high-performance IO database (such as leveldb, rocksdb, berkeleydb, etc.) so that relevant data can be retrieved later according to conditions.

[0043] S102, using the predefined behavior features as preset alarm rules to match and collide with the behavior log to obtain a collision record result;

[0044] Specifically, the predefined behavior features can be pre-written alarm abnormal behavior features. The preset alarm rules are a summary of abnormal behavior analysis, and feature regular expressions with alarm risks are written to match collisions with behavior logs to obtain collision record results (i.e., the behavior logs that collided). In the process of performing matching collisions, it is also possible to first determine whether the collision meets the risk level active or any passive node (including process, file, registry, network, etc.) conditions. When the conditions are met, proceed to the next step.

[0045] S103, automatically tracing the context according to the alarm point of the collision record result, forming a traceability chain, and automatically submitting the traceability chain to the data platform;

[0046] It should be pointed out that the collision record results include multiple alarm points. According to the alarm points and risk levels, it can be decided to conduct automatic traceability log correlation analysis to form a traceability chain. Tracing is to find the behavior log of the parent process and the parent process of the parent process upwards through the node of a certain event until the top node, and to find the behavior log of the child process and the child process of the child process downwards until the end node. The traceability chain is a behavior log chain with a parent-child relationship by connecting the above traceability data through node relationships. The data platform can be a big data analysis platform.

[0047] S104. Assess the risk level of the traceability chain through the data platform.

[0048] It is understandable that the data platform has the function of secondary retrieval and analysis of the traceability chain nodes, which can comprehensively analyze and assess the risk level of each node, intelligence analysis and alarm volume to make the alarm event rating more accurate. In actual applications, if there are other high-risk confirmation alarms and other related alarms in the alarm context traceability chain, the alarm is to determine suspicious or dangerous behavior, and provide the traceability chain of the alarm and the behavioral parameters and additional information of the cause and effect, providing strong data support and judgment basis for the alarm behavior, and trying to find the source of the event, such as malicious files, program vulnerabilities, fileless attacks and intrusion methods, etc., to provide network security personnel with intuitive, simple, accurate and efficient judgment basis for data analysis.

[0049] In the above-mentioned method of terminal behavior alarm tracing analysis provided by an embodiment of the present invention, terminal rule collision analysis and automatic traceability log association analysis can be implemented to form a traceability chain, which is then automatically submitted to the data platform to analyze and process the data in the traceability chain and assess its risk level. This provides strong data support and judgment basis for the alarm behavior, can improve the event correlation and accuracy of risk alarms, obtain behavioral log records of the ins and outs of risk alarm events, reduce the tedious process of manual retrieval analysis, manual judgment and manual tracing, improve the detection rate, and reduce the false alarm rate.

[0050] Furthermore, in specific implementation, the method for tracing and analyzing the terminal behavior alarm provided in the embodiment of the present invention may also include: displaying the alarm behavior to the user in the form of a complete event; the complete event form is to associate and merge multiple related alarm points into one event. Specifically, the information and risk level of each node in the traceability chain corresponding to the alarm behavior can be displayed in the form of a complete event through diagrams and data. In this way, the alarm is displayed to the user in the form of a complete event rather than in the form of a traditional alarm element, making the analysis and judgment of the terminal alarm behavior more intuitive, simple, accurate and efficient, and the user can perform in-depth data analysis and disposal operations. Traditional alarm elements are in the form of a single alarm list or the same alarm is merged, and there is no inherent connection between the alarms.

[0051] In the specific implementation, in the above-mentioned terminal behavior alarm tracing analysis method provided in an embodiment of the present invention, step S103 performs automatic context tracing according to the alarm point of the collision record result to form a traceability chain, including: tracking the parent and child processes and related node operation objects (such as files, processes, networks, registries, etc.) contextually associated with the alarm point of the collision record result from the local database; and using the tree structure data of the parent-child relationship formed by splicing the entire tracking process chain and node operation objects as the traceability chain.

[0052] In the specific implementation, the above steps track the parent-child processes and related node operation objects associated with the alarm point context of the collision record result from the local database, which can specifically include: obtaining the parent process ID and child process ID of the current node operation object corresponding to the alarm point of the collision record result; tracing the log information of the parent process ID upward from the local database through the parent process ID until the parent process ID is traced to a process node without a process; judging whether the child process has ended, in order to obtain more and richer behaviors, if it has not ended, it will wait for a period of time, and then trace the log information of the child process ID downward from the local database through the child process ID until the child process ID is traced to a process node without a process. Afterwards, the parent-child relationship node data can be spliced ​​into json format to form a traceability chain.

[0053] Furthermore, in specific implementation, in the method for tracing and analyzing the terminal behavior alarm provided in the embodiment of the present invention, while forming the traceability chain, it may also include: using the terminal traceability interface to receive the platform traceability instruction and obtain the corresponding traceability chain. In this way, a certain event can be traced back at any time through the traceability interface to obtain the behavior and context records of each node in the risk alarm traceability chain. The traceability conditions can be third-party intelligence sources, traffic alarms, or manual retrieval, and are not limited to IP; wherein the traffic alarm traceability is to identify risks through traffic characteristics and retrieve the traceability chain of related process events through its five-tuple linkage with the terminal. The obtained traceability chain can be automatically submitted to the data platform, and then the present invention effectively supports post-manual or third-party intelligence data for node tracing, and obtains and analyzes the traceability chain risk rating.

[0054] In the specific implementation, in the method for tracing and analyzing the terminal behavior alarms provided in the embodiment of the present invention, step S104 assesses the risk level of the traceability chain through the data platform, which may specifically include: parsing the traceability chain through the data platform, comparing and referring to each node of the traceability chain with the known alarm list, assessing the risk weight of each node of the traceability chain, and re-assessing the risk level of the traceability chain. In this way, the data platform conducts secondary retrieval and analysis of each node of the traceability chain and associates it with the known alarm list, and redefines and assesses the risk level through comprehensive research and evaluation, which can further reduce the false alarm rate and improve the detection rate. In addition, the data platform can also combine multiple data sources, such as threat situations, traffic alarms, manual retrieval and other source alarms, and call the traceability interface to initiate a custom parameter traceability request to the specified terminal. If the traceability interface obtains the relevant traceability chain according to the traceability request parameters and automatically uploads it to the data platform.

[0055] It should be noted that the present invention uses behavioral rules as the source of risk warnings, and adopts an active tracing method and adds a secondary analysis of the traceability chain nodes. Finally, the comprehensive risk level of the traceability chain is scored, and third-party intelligence sources are taken into consideration. It is not restricted by the time point of tracing (depending on the log storage space setting), such as threat intelligence, traffic alarms, manual retrieval and other sources to perform terminal passive tracing, obtain more and more complete traceability chain data containing other intelligence node data, thereby improving the terminal detection rate and reducing the false alarm rate.

[0056] Based on the same inventive concept, an embodiment of the present invention also provides a device for tracing and analyzing terminal behavior alarms. Since the principle of solving the problem by the device is similar to that of the aforementioned method for tracing and analyzing terminal behavior alarms, the implementation of the device can refer to the implementation of the method for tracing and analyzing terminal behavior alarms, and the repeated parts will not be repeated.

[0057] In a specific implementation, the terminal behavior alarm tracing and analysis device provided by the embodiment of the present invention is as follows: Figure 2 As shown, specifically including:

[0058] The data monitoring module 11 is used to monitor the terminal behavior data; the data monitoring module 11 can be a lightweight system monitoring tool sysmon, which records the process creation, file access and network information through system services and drivers, and writes the relevant information into the windows log event; sysmon can collect all events according to the configuration file xml and can set the filter tag; when running the sysmon program, the configuration parameters are provided and the above-mentioned all event logs are started to be recorded after the installation is successful;

[0059] The log parsing module 12 is used to read and parse the terminal behavior data in real time, obtain the behavior log and store it in the local database; it should be noted that the event log can be browsed and viewed in the application and service log> Microsoft> Windows> Sysmon> Operational in the event log viewer, and the sysmon event log can be parsed and formatted by the log parsing module 12, and the parsed formatted log is stored in the local database;

[0060] The collision recording module 13 is used to match the predefined behavior features as preset alarm rules with the behavior logs to obtain the collision record results; it should be noted that the collision recording module 13 can learn to write regular expression preset alarm rules through formatted logs, and mark the risk level for the rules;

[0061] The automatic tracing module 14 is used to automatically trace the context according to the alarm point of the collision record result, form a traceability chain, and automatically submit the traceability chain to the data platform 15;

[0062] Data platform 15 is used to assess the risk level of the traceability chain.

[0063] In the above-mentioned terminal behavior alarm tracing analysis device provided in the embodiment of the present invention, the interaction between the above-mentioned four modules and the data platform can provide strong data support and judgment basis for the alarm behavior, improve the event correlation and accuracy of the risk alarm, obtain the behavioral log record of the cause and effect of the risk alarm event, reduce the tedious process of manual retrieval analysis, manual judgment and manual tracing, improve the detection rate, and reduce the false alarm rate.

[0064] For more specific working processes of the above modules and data platforms, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0065] Correspondingly, an embodiment of the present invention also discloses a device for tracing and analyzing terminal behavior alarms, comprising a processor and a memory; wherein, when the processor executes a computer program stored in the memory, the method for tracing and analyzing terminal behavior alarms disclosed in the aforementioned embodiment is implemented.

[0066] For more specific processes of the above method, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0067] Furthermore, the present invention also discloses a computer-readable storage medium for storing a computer program; when the computer program is executed by a processor, the method for tracing and analyzing the terminal behavior alarm disclosed above is implemented.

[0068] For more specific processes of the above method, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0069] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the devices, equipment, and storage media disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method part.

[0070] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0071] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0072] In summary, a method for tracing and analyzing terminal behavior alarms provided by an embodiment of the present invention includes: monitoring terminal behavior data, reading and parsing the terminal behavior data in real time, obtaining behavior logs and storing them in a local database; matching and colliding predefined behavior features with behavior logs as preset alarm rules to obtain collision record results; automatically tracing the context according to the alarm points of the collision record results to form a traceability chain, and automatically submitting the traceability chain to the data platform; and assessing the risk level of the traceability chain through the data platform. In this way, terminal rule collision analysis can be realized and automatic traceability log association analysis can be performed to form a traceability chain, which is then automatically submitted to the data platform to analyze and process the data of the traceability chain and assess its risk level, providing strong data support and judgment basis for the alarm behavior, improving the event relevance and accuracy of risk alarms, obtaining behavioral log records of the ins and outs of risk alarm events, reducing the tedious process of manual retrieval analysis, manual judgment and manual traceability, improving the detection rate, and reducing the false alarm rate. In addition, the present invention also provides corresponding devices, equipment and computer-readable storage media for the method of terminal behavior alarm tracing analysis, which further makes the above method more practical. The device, equipment and computer-readable storage medium have corresponding advantages.

[0073] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0074] The method, device, equipment and medium for tracing and analyzing terminal behavior alarms provided by the present invention are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technical personnel in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for tracing and analyzing terminal behavior alarms, characterized in that: include: Monitor terminal behavior data, read and analyze the terminal behavior data in real time, obtain behavior logs and store them in a local database; The local database has a full log storage function; the behavior log includes file operations, registry operations, process creation, network connections, driver loading, process access and WMI events; The predefined behavior feature is used as a preset alarm rule to match and collide with the behavior log to obtain a collision record result; the predefined behavior feature is a pre-written alarm abnormal behavior feature; the preset alarm rule is a summary of the abnormal behavior analysis, and a feature regular expression with an alarm risk is written to match and collide with the behavior log to obtain a collision record result; the collision record result includes multiple alarm points; Automatic context tracing is performed according to the alarm point of the collision record result to form a traceability chain, including: tracking the parent-child processes and related node operation objects contextually associated with the alarm point of the collision record result from the local database; obtaining the parent process ID and child process ID of the current node operation object corresponding to the alarm point of the collision record result; tracing the log information of the parent process ID upward from the local database through the parent process ID until the parent process ID is traced to a process node without a process; judging whether the child process ID has ended, if not, waiting for a set time, and then tracing the log information of the child process ID downward from the local database through the child process ID until the child process ID is traced to a process node without a process; using the tree structure data of the parent-child relationship formed by splicing the entire tracing process chain and the node operation object as the traceability chain; While forming the traceability chain, the platform traceability instruction is received by using the terminal traceability interface to obtain the corresponding traceability chain; the traceability interface is used to perform a backtracking query on an event at any time to obtain the behavior and context records of each node in the risk warning traceability chain; The traceability chain is automatically submitted to the data platform; the data platform has a secondary search and analysis function for the traceability chain nodes, which is used to comprehensively analyze each node, intelligence analysis and alarm volume to assess the risk level of the event; The traceability chain is parsed through the data platform, and each node of the traceability chain is compared and referenced with a known alarm list to assess the risk weight of each node in the traceability chain and reassess the risk level of the traceability chain.

2. The method for tracing and analyzing terminal behavior alarms according to claim 1 is characterized in that: Also includes: Display the alarm behavior to the user in the form of a complete event; The complete event form is to associate and merge multiple related alarm points into one event.

3. The method for tracing and analyzing terminal behavior alarms according to claim 2 is characterized in that: The alarm behavior is presented to the user in the form of a complete event, including: The information of each node in the traceability chain and the risk level corresponding to the alarm behavior are displayed in the form of a complete event through diagrams and data.

4. A device for tracing and analyzing terminal behavior alarms, characterized in that: include: Data monitoring module, used to monitor terminal behavior data; A log parsing module is used to read and parse the terminal behavior data in real time, obtain behavior logs and store them in a local database; the local database has a full log storage function; the behavior logs include file operations, registry operations, process creation, network connections, driver loading, process access and WMI events; A collision recording module is used to match and collide the predefined behavior features as preset alarm rules with the behavior log to obtain a collision recording result; the predefined behavior features are pre-written alarm abnormal behavior features; the preset alarm rules are a summary of abnormal behavior analysis, and feature regular expressions with alarm risks are written to match and collide with the behavior log to obtain a collision recording result; the collision recording result includes multiple alarm points; The automatic tracing module is used to perform automatic context tracing according to the alarm point of the collision record result to form a tracing chain, including: tracking the parent and child processes and related node operation objects associated with the alarm point context of the collision record result from the local database; obtaining the parent process ID and child process ID of the current node operation object corresponding to the alarm point of the collision record result; tracing the log information of the parent process ID upward from the local database through the parent process ID until the parent process ID is traced to a process node without a process node; judging whether the child process ID has ended, and if not, waiting for the child process ID to end. After the set time, the log information of the sub-process ID is traced downward from the local database through the sub-process ID until the sub-process ID is traced to a process node without a process; the tree structure data of the parent-child relationship formed by splicing the entire tracing process chain and the node operation object is used as the traceability chain; and the traceability chain is automatically submitted to the data platform; while forming the traceability chain, the platform traceability instruction is received by using the terminal traceability interface to obtain the corresponding traceability chain; the traceability interface is used to perform backtracking query on a certain event at any time to obtain the behavior and context records of each node in the risk warning traceability chain; The data platform is used to parse the traceability chain, compare and refer to each node of the traceability chain with the known alarm list, so as to assess the risk weight of each node in the traceability chain and re-assess the risk level of the traceability chain; the data platform has a secondary retrieval and analysis function for the traceability chain nodes, which is used to comprehensively analyze and assess the risk level of each node, intelligence analysis and alarm volume.

5. A device for tracing and analyzing terminal behavior alarms, characterized in that: The method comprises a processor and a memory, wherein the processor implements the method for tracing and analyzing terminal behavior alarms as described in any one of claims 1 to 3 when executing a computer program stored in the memory.

6. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the method for tracing and analyzing terminal behavior alarms as described in any one of claims 1 to 3 is implemented.

Images