Abnormal process detection method and device, storage medium and electronic device

Abstract

The present invention discloses a method and device for detecting an abnormal process, a storage medium and an electronic device. The method comprises: obtaining the operation information of a target process in a current cycle, determining a first abnormal coefficient of the target process in a spatial dimension according to the operation information of the target process in the current cycle, determining a second abnormal coefficient of the target process in a time dimension according to historical operation information of the target process in multiple historical cycles before the current cycle, and determining whether the target process in a first host is an abnormal process according to the first abnormal coefficient and the second abnormal coefficient. The present invention solves the technical problem that the detection accuracy of abnormal processes in the related art is low and easy to cause false detection.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a method and device for detecting an abnormal process, a storage medium and an electronic device. Background Art

[0002] In the key fields of finance, energy, communications and industrial Internet, intrusion detection has become an indispensable service. And data leakage is one of the links of intrusion attacks.

[0003] In recent years, the continuous occurrence of data leakage incidents has caused various enterprises and institutions to gradually increase their efforts to detect such behaviors. However, the mainstream solutions currently provided by various security vendors use traditional statistical rule-based methods. For example, when the outbound traffic of a host is greater than a certain threshold, an alarm is generated. This type of method is not only poor in applicability, but also, normal network traffic is diverse and complex, making it difficult to effectively distinguish abnormal behaviors, resulting in a high false alarm rate.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a method and device for detecting an abnormal process, a storage medium and an electronic device, so as to at least solve the technical problem in the related art that the detection accuracy of the abnormal process is low and false detection is easily caused.

[0006] According to one aspect of an embodiment of the present invention, a method for detecting an abnormal process is provided, comprising: obtaining running information of a target process in a current cycle, wherein the running information includes running data of multiple dimensions, and the target process is a process in a first host in a group of hosts that transmits data from an internal network in which the group of hosts are located to an external network to which the group of hosts are connected; determining a first abnormal coefficient of the target process in a spatial dimension according to the running information of the target process in the current cycle, wherein the first abnormal coefficient is used to represent the distance between the current running information of the target process in the current cycle and pre-acquired center point running information, and the center point running information is running information determined based on the running information of the target process in the current cycle; determining a second abnormal coefficient of the target process in a time dimension according to historical running information of the target process in multiple historical cycles before the current cycle, wherein the second abnormal coefficient is used to represent the offset of the current running information of the target process relative to the historical running information of the target process; and determining whether the target process in the first host is an abnormal process according to the first abnormal coefficient and the second abnormal coefficient.

[0007] According to another aspect of an embodiment of the present invention, there is also provided an abnormal process detection device, comprising: an acquisition module, configured to acquire running information of a target process in a current cycle, wherein the running information comprises running data of multiple dimensions, and the target process is a process in a first host in a group of hosts that transmits data from an internal network in which the group of hosts are located to an external network to which the group of hosts are connected; a first determination module, configured to determine a first abnormal coefficient of the target process in a spatial dimension according to the running information of the target process in the current cycle, wherein the first abnormal coefficient is used to represent the distance between the current running information of the target process in the current cycle and the pre-acquired center point running information, and the center point running information is running information determined according to the running information of the target process in the current cycle; a second determination module, configured to determine a second abnormal coefficient of the target process in a time dimension according to the historical running information of the target process in multiple historical cycles before the current cycle, wherein the second abnormal coefficient is used to represent the offset of the current running information of the target process relative to the historical running information of the target process; and a third determination module, configured to determine whether the target process in the first host is an abnormal process according to the first abnormal coefficient and the second abnormal coefficient.

[0008] Optionally, the first determination module is used to determine the first abnormality coefficient of the target process in the spatial dimension according to the running information of the target process in the current cycle in the following manner: when the target process is running in a second host other than the first host in the group of hosts, the center point running information is determined according to the running information of the target process running in the first host in the current cycle, and the running information of the target process running in the second host in the current cycle, wherein the second host includes one or more hosts, and the center point running information includes the center point running data of the multiple dimensions; determine the distance between the running data of the multiple dimensions and the center point running data of the multiple dimensions to obtain the first abnormality coefficient.

[0009] Optionally, the first determination module is used to determine the center point operation information according to the operation information of the target process running in the first host in the current cycle and the operation information of the target process running in the second host in the current cycle in the following manner: when the multiple dimensions are N dimensions, determine the mean of the operation information of the target process in the first host and the second host in each dimension to obtain average operation data of N dimensions, wherein the center point operation information includes average operation data of N dimensions, N≥2 and is a natural number.

[0010] Optionally, the first determination module is used to determine the first abnormality coefficient of the target process in the spatial dimension according to the running information of the target process in the current cycle in the following manner: when the target process is not running in a host other than the first host in the group of hosts, determine the center point running information according to the running information of each process running in the group of hosts in the current cycle, wherein the center point running information includes the center point running data of the multiple dimensions; determine the distance between the running data of the multiple dimensions and the center point running data of the multiple dimensions to obtain the first abnormality coefficient.

[0011] Optionally, the first determination module is used to determine the center point operation information according to the operation information of each process running in the group of hosts in the current cycle in the following manner: when the multiple dimensions are N dimensions, determine the mean of the operation information of each process running in the group of hosts in each dimension to obtain average operation data of N dimensions, wherein the center point operation information includes average operation data of N dimensions, N≥2 and is a natural number.

[0012] Optionally, the first determination module is used to determine the distance between the operating data of the multiple dimensions and the center point operating data of the multiple dimensions to obtain the first abnormality coefficient in the following manner: when the multiple dimensions are N dimensions, determine the difference between the operating data of the N dimensions and the center point operating data of the N dimensions in each dimension to obtain N differences, wherein N≥2 and is a natural number; determine the first abnormality coefficient as the value obtained by taking the square root of an intermediate value, wherein the intermediate value is the sum of the squares of the N differences.

[0013] Optionally, the second determination module is used to determine the second abnormality coefficient of the target process in the time dimension according to the historical operation information of the target process in multiple historical periods before the current period in the following manner: when the multiple dimensions are N dimensions and the multiple historical periods are M historical periods, according to the historical operation information of the target process in the M historical periods, determine the quantile operation data of the target process in each dimension in the M historical periods to obtain the quantile operation data of N dimensions, wherein N≥2 and is a natural number, and M≥2 and is a natural number; determine the second abnormality coefficient according to the operation data of the N dimensions and the quantile operation data of the N dimensions, wherein the operation information of the target process in the current period includes the operation data of the N dimensions.

[0014] Optionally, the second determination module is used to determine the second abnormality coefficient according to the operating data of the N dimensions and the quantile operating data of the N dimensions in the following manner: when the N dimensions include a target dimension, and the operating data of the target dimension of the target process in the current cycle represents the amount of data uploaded by the target process in the current cycle, a target magnification factor is set for the target dimension, wherein the target magnification factor is greater than 1, and the target magnification factor is used to increase the offset value between the operating data of the target dimension and the quantile operating data of the target dimension; according to the operating data of the N dimensions and the quantile operating data of the N dimensions, the offset between the operating data of each dimension and the quantile operating data is determined to obtain N offset values, and the second abnormality coefficient is determined according to the N offset values ​​and the target magnification factor.

[0015] Optionally, the second determination module is used to determine the offset between the operating data of each dimension and the quantile operating data according to the operating data of the N dimensions and the quantile operating data of the N dimensions in the following manner to obtain N offset values, and determine the second abnormality coefficient according to the N offset values ​​and the target magnification factor: the second abnormality coefficient is determined by the following formula:

[0016]

[0017]

[0018] in, represents the second anomaly coefficient, represents the running data of the target process in the i-th dimension in the current cycle, It represents the quantile operation data of the i-th dimension of the target process in the multiple historical periods, l represents the target magnification factor, and i=1 represents the target dimension.

[0019] Optionally, the device is used to determine whether the target process in the first host is an abnormal process according to the first abnormality coefficient and the second abnormality coefficient in the following manner:

[0020] Determine, according to the first abnormal coefficient and the second abnormal coefficient, a first weight value corresponding to the first abnormal coefficient and a second weight value corresponding to the second abnormal coefficient;

[0021] Determine a set of control coefficients according to pre-acquired upload information of the target process in the current cycle, wherein the upload information is used to indicate the amount of data uploaded by the target process to different destination addresses in the current cycle;

[0022] Determine a total abnormality coefficient of the target process in the current cycle according to the first abnormality coefficient, the second abnormality coefficient, the first weight value, the second weight value, and the set of control coefficients;

[0023] When the total abnormality coefficient is greater than a preset threshold, it is determined that the target process in the first host is an abnormal process.

[0024] Optionally, the device is used to determine a first weight value corresponding to the first abnormal coefficient and a second weight value corresponding to the second abnormal coefficient according to the first abnormal coefficient and the second abnormal coefficient in the following manner:

[0025] Obtaining the first abnormality coefficient and the second abnormality coefficient of each process running in the group of hosts to obtain a group of first abnormality coefficients and a group of second abnormality coefficients;

[0026] Determine a quantile weighted average of the set of first abnormal coefficients to obtain a first quantile weighted value, and determine a quantile weighted average of the set of second abnormal coefficients to obtain a second quantile weighted value;

[0027] The value obtained by dividing the second quantile weighted value by the target value is determined as the first weight value, and the value obtained by dividing the first quantile weighted value by the target value is determined as the second weight value, wherein the target value is the sum of the first quantile weighted value and the second quantile weighted value.

[0028] Optionally, the device is used to determine a set of control coefficients according to the pre-acquired upload information of the target process in the current cycle in the following manner:

[0029] When the target process is a process in a preset process set, determine, based on the upload information, a first amount of data uploaded by the target process to a first destination address within the current cycle and a first number of times of uploading data to the first destination address within the current cycle; when the first amount is greater than a first preset threshold and the first number of times is less than a second preset threshold, set a first control coefficient in the set of control coefficients to a preset first value, wherein the first value is greater than 1; when the first number of times is greater than or equal to a second preset threshold, set the first control coefficient to a preset second value, wherein 0<the second value<1; wherein the first control coefficient is a control coefficient of the first abnormal coefficient and the second abnormal coefficient; and / or

[0030] Determine, according to the upload information, a second amount of data uploaded by the target process in the current cycle; when the second amount is greater than a third preset threshold, set the second control coefficient in the set of control coefficients to Among them, count host (p) represents the number of hosts in the group of hosts on which the target process is running.

[0031] Optionally, the device is used to determine the total abnormality coefficient of the target process in the current cycle according to the first abnormality coefficient, the second abnormality coefficient, the first weight value, the second weight value and the set of control coefficients in the following manner:

[0032] The total abnormal coefficient of the target process in the current cycle is determined by the following formula:

[0033]

[0034] Among them, S t represents the total abnormal coefficient of the target process in the current cycle, represents the first anomaly coefficient, represents the second anomaly coefficient, represents the first weight value, represents the second weight value, and the set of control coefficients includes

[0035] Optionally, the device is used to obtain the running information of the target process in the current cycle in the following manner:

[0036] Obtain the operating data of the target process in the current cycle in the multiple dimensions, wherein the operating data in the multiple dimensions include the amount of data uploaded by the target process, the total session time of the target process, and the total number of sessions of the target process.

[0037] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned abnormal process detection method when running.

[0038] According to another aspect of an embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the abnormal process detection method through the computer program.

[0039] In an embodiment of the present invention, an abnormality coefficient based on spatial distribution and temporal distribution is obtained, and whether the target process is an abnormal process is determined based on the abnormality coefficient. A more fine-grained risk judgment is achieved in combination with the running data of the process, thereby solving the technical problem of low detection accuracy of abnormal processes and easy misdetection in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0041] Figure 1 is a schematic diagram of an application environment of an optional abnormal process detection method according to an embodiment of the present invention;

[0042] Figure 2 is a flow chart of an optional abnormal process detection method according to an embodiment of the present invention;

[0043] Figure 3 is a schematic diagram of an optional abnormal process detection method according to an embodiment of the present invention;

[0044] Figure 4 is a schematic diagram of another optional abnormal process detection method according to an embodiment of the present invention;

[0045] Figure 5 is a schematic diagram of another optional abnormal process detection method according to an embodiment of the present invention;

[0046] Figure 6 is a schematic diagram of another optional abnormal process detection method according to an embodiment of the present invention;

[0047] Figure 7 is a schematic diagram of another optional abnormal process detection method according to an embodiment of the present invention;

[0048] Figure 8 is a schematic diagram of another optional abnormal process detection method according to an embodiment of the present invention;

[0049] Fig. 9 is a schematic structural diagram of an optional abnormal process detection device according to an embodiment of the present invention;

[0050] Fig.10 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0051] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0052] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0053] According to one aspect of an embodiment of the present invention, a method for detecting an abnormal process is provided. Optionally, in this embodiment, the method for detecting an abnormal process can be applied to: Figure 1 In the hardware environment composed of the server 101 and the user terminal 103 shown in FIG. Figure 1 As shown, the server 101 is connected to the terminal 103 via a network, and can be used to provide services for the user terminal or a client installed on the user terminal. The client can be a video client, an instant messaging client, a browser client, an education client, a game client, etc. A database 105 may be set up on the server or independently of the server to provide data storage services for the server 101, for example, an enterprise data storage server. The above-mentioned network may include but is not limited to: a wired network, a wireless network, wherein the wired network includes: a local area network, a metropolitan area network and a wide area network, and the wireless network includes: Bluetooth, WIFI and other networks that realize wireless communication. The user terminal 103 may include but is not limited to different hosts, for example, a first host 107 and a second host 109, a first application is running on the first host, and a second application is running on the second host, wherein the first application loads the first process to transfer data, and the second application loads the second process to transfer data. The above-mentioned user terminal 103 may include but is not limited to at least one of the following: a mobile phone (such as an Android phone, an iOS phone, etc.), a laptop computer, a tablet computer, a PDA, a MID (Mobile Internet Devices), a PAD, a desktop computer, a smart TV and other computer devices. The above-mentioned server may be a single server, or a server cluster composed of multiple servers, or a cloud server. The client using the above-mentioned abnormal process detection method is established on the server 101.

[0054] Combination Figure 1 As shown, the above abnormal process detection method can be implemented on the client of the server 101 through the following steps:

[0055] S1, a client installed on the server 101 obtains running information of a target process in a current cycle, wherein the running information includes running data of multiple dimensions, and the target process is a process in a first host among a group of hosts that transmits data from an internal network where the group of hosts are located to an external network to which the group of hosts are connected;

[0056] S2, the client installed on the server 101 determines a first abnormality coefficient of the target process in the spatial dimension according to the running information of the target process in the current cycle, wherein the first abnormality coefficient is used to represent the distance between the current running information of the target process in the current cycle and the pre-acquired center point running information, and the center point running information is the running information determined according to the running information of the target process in the current cycle;

[0057] S3, the client installed on the server 101 determines a second abnormality coefficient of the target process in the time dimension according to historical operation information of the target process in multiple historical periods before the current period, wherein the second abnormality coefficient is used to represent the offset of the current operation information of the target process relative to the historical operation information of the target process;

[0058] S4, the client installed on the server 101 determines whether the target process in the first host is an abnormal process according to the first abnormality coefficient and the second abnormality coefficient.

[0059] Optionally, in this embodiment, the above abnormal process detection method may include but is not limited to asynchronous use of clients on the user terminal 103 and the server 101 .

[0060] The above is only an example and is not specifically limited in this embodiment.

[0061] Optionally, as an optional implementation, as Figure 2 As shown, the above abnormal process detection method includes:

[0062] S202, obtaining running information of a target process in a current cycle, wherein the running information includes running data of multiple dimensions, and the target process is a process in a first host among a group of hosts that transmits data from an internal network where the group of hosts are located to an external network to which the group of hosts are connected;

[0063] Optionally, in this embodiment, the target process may include but is not limited to a process for transmitting data in the target terminal, specifically, may include but is not limited to a process running in the first host and transmitting data from the intranet to the extranet. The operation information may include but is not limited to the total size of data uploaded by the target process, the total session time of the target process, and the total number of sessions of the target process.

[0064] Optionally, in this embodiment, the above operation information may be determined by including but not limited to the following methods:

[0065] For example, the original record table of host process information is processed to generate two intermediate result tables, namely the host process statistics record table and the quantile weighted average record table.

[0066] In the host process original record table, information is recorded based on the granularity of the host process session. The fields required in this embodiment may include but are not limited to: host name, process name, upstream data size, session time, and initiation time.

[0067] In the host process statistics record table, it can include but not be limited to one day as the time granularity to count the session behavior of the host process on that day, including the total size of uploaded data, the total session time and the total number of sessions. Then, for each host process hp∈HP, HP is the set of recorded host processes, the statistical value vector on day t can be expressed as:

[0068]

[0069] In equation (1), the vector x t The three elements in (hp) represent the total size of uploaded data on day t. Total session time Total sessions

[0070] The purpose of applying the quantile weighted average record table is to alleviate the problem that each statistical value in the statistical record table presents a heavy-tailed distribution, which causes inconvenience in calculation.

[0071] The calculation formula of quantile weighted median (QWM) is shown in formula (2):

[0072]

[0073] Among them, Q k (D) represents the k-quantile of the data set D, Q 0.50 That is the median. Then, based on the statistical vector x t Calculate any host process hp on each component The formula for the standardized value of i∈{1,2,3} is shown in (3):

[0074]

[0075] Among them, X t represents the set of statistical value vectors of all host processes hp∈HP, Represents the statistical value set of the i-th component, vector x t Represents the normalized value.

[0076] S204, determining a first abnormality coefficient of the target process in the spatial dimension according to the running information of the target process in the current cycle, wherein the first abnormality coefficient is used to represent the distance between the current running information of the target process in the current cycle and the pre-acquired center point running information, and the center point running information is the running information determined according to the running information of the target process in the current cycle;

[0077] Optionally, in this embodiment, the above-mentioned current cycle may include but is not limited to being pre-configured by the staff or pre-configured according to the security level of the current network. For example, the current cycle may include but is not limited to being configured as the current day, then the running information of the target process in the current cycle is the running information of the target process on that day.

[0078] Optionally, in this embodiment, the first abnormality coefficient is the abnormality coefficient of the target process in the spatial dimension, which represents the distance between the vector corresponding to the current running information of the target process in the current cycle and the position corresponding to the pre-acquired center point running information. The center point running information is determined based on the running information of the target process in the current cycle. The running information obtained may include but is not limited to being determined in the original record table of the host process in the running information of the target process in the current cycle.

[0079] It should be noted that the above-mentioned first abnormal coefficient may include but is not limited to a risk coefficient that is calculated by using only the statistical value of the current period without relying on historical records.

[0080] S206, determining a second abnormality coefficient of the target process in the time dimension according to historical operation information of the target process in multiple historical cycles before the current cycle, wherein the second abnormality coefficient is used to represent the offset of the current operation information of the target process relative to the historical operation information of the target process;

[0081] Optionally, in this embodiment, the second abnormality coefficient is the abnormality coefficient of the target process in the time dimension, which represents the offset of the current running information of the target process relative to the historical running information of the target process.

[0082] It should be noted that the second abnormality coefficient refers to the risk coefficient of the data transmission behavior in the current period evaluated on the time dimension using the historical statistical value of the host process as a scale.

[0083] S208: Determine whether the target process in the first host is an abnormal process according to the first abnormality coefficient and the second abnormality coefficient.

[0084] Optionally, in this embodiment, the application scenarios of the above-mentioned abnormal process detection may include but are not limited to enterprise, medical, finance, credit reporting, banking, government affairs, government, energy, education, security, building, game, transportation, Internet of Things, industry and other application scenarios.

[0085] Taking the above-mentioned enterprise application scenarios as an example, it can be applied to multiple projects and product applications including smart gateways, intrusion detection systems, network security audit systems, etc. It can identify data transmission behaviors generated by malware, significantly improve the problems of existing technologies that are easy to be bypassed and have high false alarms, and improve the detection rate of such behaviors.

[0086] Specifically, in typical application scenarios such as smart gateways, Figure 3 is a schematic diagram of another optional abnormal process detection method according to the present invention, such as Figure 3 As shown, an Agent information collection program can be deployed in each intranet host to obtain statistical information about the process and its network connection; the Agent in each host will upload the collected monitoring data to the Server of the intelligent gateway, and the intelligent gateway will complete the detection of malware data transmission risk behavior.

[0087] Optionally, in this embodiment, it can include but is not limited to automatically learning the risk coefficient of each host process based on the outbound transmission behavior exhibited by the host process in the intranet, taking the spatial distribution and the temporal distribution as reference systems, to determine whether the target process is an abnormal process, thereby being able to effectively screen out host processes with high risk values, thereby improving the detection rate of malicious data outbound transmission behavior and overcoming the problem of false alarms when big data is transmitted by common processes.

[0088] Optionally, in this embodiment, the units of the above cycle may include but are not limited to days, weeks, months, years, etc.

[0089] Figure 4 is a schematic diagram of another optional abnormal process detection method according to the present invention, such as Figure 4 As shown, the above-mentioned abnormal process detection method may include but is not limited to the following steps:

[0090] S402, obtaining the original record table of host process information;

[0091] S404, determining a host process statistics record table;

[0092] S406, generating a quantile weighted average record table;

[0093] S408-1, the spatial dimension risk coefficient calculation module calculates the spatial risk coefficient;

[0094] S408-2, the time dimension risk coefficient calculation module calculates the time risk coefficient;

[0095] S410, calculating a risk value according to a spatial dimension risk coefficient and a temporal dimension risk coefficient;

[0096] S412: Perform an alarm operation on the process whose risk value exceeds the threshold.

[0097] The above is only an example, and this embodiment does not make any specific limitation.

[0098] Through this embodiment, the original record table of host process information is processed to generate two intermediate result tables, namely the host process statistical record table and the quantile weighted average record table; then the respective risk coefficients are calculated in the spatial and temporal dimensions respectively, and finally the calculation module obtains the final risk value and decides whether to generate an alarm depending on the size of the risk value. By obtaining the abnormality coefficient with spatial distribution and temporal distribution as the reference system, it is determined whether the target process is an abnormal process according to the abnormality coefficient, and a more fine-grained risk judgment is achieved in combination with the running data of the process, thereby solving the technical problem of low detection accuracy of abnormal processes and easy false detection existing in the related technology.

[0099] As an optional solution, according to the running information of the target process in the current cycle, the first abnormal coefficient of the target process in the spatial dimension is determined, including:

[0100] In a case where a target process is running in a second host other than the first host in a group of hosts, determining central point operation information according to operation information of the target process running in the first host in a current cycle and operation information of the target process running in the second host in a current cycle, wherein the second host includes one or more hosts, and the central point operation information includes central point operation data of multiple dimensions;

[0101] The distances between the operating data of multiple dimensions and the central point operating data of multiple dimensions are determined to obtain a first abnormality coefficient.

[0102] Optionally, in this embodiment, the above-mentioned group of hosts may include but is not limited to multiple hosts, each host independently running its own process. In other words, it may include but is not limited to the same process running in multiple hosts to generate respective operation information.

[0103] Optionally, in this embodiment, it may include but is not limited to representing the running information of the target process on the first host and the second host in the form of statistical vectors, and then aggregating the above multiple vectors to obtain the above central point running information.

[0104] Figure 5is a schematic diagram of another optional abnormal process detection method according to the present invention, such as Figure 5 The content may include but is not limited to the following:

[0105] For example, the above group of main forces includes host 1 and host 2, and the above target process includes process 1, process 2 and process 3. Then, if the target process is run in the second host other than the first host in the above group of hosts, it means that the above host 1 runs process 1 and host 2 also runs process 1. At this time, the center point running information is determined.

[0106] Through this embodiment, when the target process is running in the second host other than the first host in a group of hosts, the center point operation information is determined according to the operation information of the target process running in the first host in the current cycle and the operation information of the target process running in the second host in the current cycle. This can determine the first abnormality coefficient of the target process from the spatial dimension, and then facilitate determining whether the target process is an abnormal process according to the abnormality coefficient, and realize more fine-grained risk judgment in combination with the operation data of the process, thereby solving the technical problem of low detection accuracy of abnormal processes and easy false detection in related technologies.

[0107] As an optional solution, determining the central point operation information according to the operation information of the target process running in the first host in the current cycle and the operation information of the target process running in the second host in the current cycle includes:

[0108] When the number of dimensions is N, the mean of the running information of the target process in the first host and the second host in each dimension is determined to obtain the average running data of the N dimensions, wherein the center point running information includes the average running data of the N dimensions, and N≥2 is a natural number.

[0109] Optionally, in this embodiment, the N dimensions represent dimensions of the operation information; wherein the mean value of the operation information in each dimension can be determined by the following formula:

[0110] For example, taking process p as the granularity, p∈P, P is the set of monitored processes (running information), the statistical vectors of the same process are grouped together, including processes with the same name appearing in different hosts (corresponding to the target process mentioned above), and there is X t ={x t (p):p∈P}, then calculate the center point c(X t ) is:

[0111]

[0112] in, The statistical vector x represents the process p∈Pt The i-th element of , i∈{1,2,3}; |X t | indicates X t The cardinality is the number of elements in the set. Therefore, the center point of the statistical vector is the average value of the number of occurrences of each element relative to the process.

[0113] by Figure 5 For example, process 1 corresponds to |X t | is 2 times, that is, |X t |=2.

[0114] That is, the average running data of the above dimension is The average running data of N dimensions is c(X t ).

[0115] The above is only an example, and this embodiment does not make any specific limitation.

[0116] As an optional solution, according to the running information of the target process in the current cycle, the first abnormal coefficient of the target process in the spatial dimension is determined, including:

[0117] In a case where the target process is not running in a host other than the first host in a group of hosts, determining central point running information according to running information of each process running in the group of hosts in a current cycle, wherein the central point running information includes central point running data of multiple dimensions;

[0118] The distances between the operating data of multiple dimensions and the central point operating data of multiple dimensions are determined to obtain a first abnormality coefficient.

[0119] Also like Figure 5 As shown, it may include but is not limited to the following contents: the above-mentioned group of main forces includes host 1 and host 2, the above-mentioned target process includes process 1, process 2 and process 3, then the target process is not run in the hosts other than the first host in a group of hosts, that is, the above-mentioned host 1 runs process 2, host 2 runs process 1 and process 3, but does not run process 2. At this time, the center point running information is determined.

[0120] The above is only an example, and this embodiment does not make any specific limitation.

[0121] Through this embodiment, when the target process is not running in a host other than the first host in a group of hosts, the central point running information is determined according to the running information of each process running in a group of hosts in the current cycle. This can determine the first abnormality coefficient of the target process from the spatial dimension, and then facilitate determining whether the target process is an abnormal process according to the abnormality coefficient, and realize more fine-grained risk judgment in combination with the running data of the process, thereby solving the technical problem of low detection accuracy of abnormal processes and easy false detection in related technologies.

[0122] As an optional solution, the central point operation information is determined according to the operation information of each process running in a group of hosts in the current cycle, including:

[0123] When the number of dimensions is N, the mean of the running information of each process running in a group of hosts in each dimension is determined to obtain the average running data of the N dimensions, wherein the center point running information includes the average running data of the N dimensions, and N≥2 is a natural number.

[0124] Optionally, in this embodiment, when the target process is process 2, the host process is used as the granularity, hp∈HP, HP is the monitored host process set, and all host process statistical vectors are gathered together, and there is: X t ={x t (hp):hp∈HP}, the center point calculation formula is shown in formula (5):

[0125]

[0126] Formula (5) calculates the center point of the statistical vector of all host processes.

[0127] in, The statistical vector x representing the host process hp∈HP t The i-th element of , i∈{1,2,3}; |X t | indicates X t The cardinality is the number of elements in the set. Therefore, the center point of the statistical vector is the average value of the number of occurrences of each element relative to all host processes.

[0128] by Figure 5 For example, process 2 corresponds to |X t | is 4 times (including host process 1, host process 2, host process 3 and host process 4), that is, |X t |=4.

[0129] That is, the average running data of the above dimension is The average running data of N dimensions is c(X t).

[0130] The above is only an example, and this embodiment does not make any specific limitation.

[0131] As an optional solution, determining the distance between the operation data of multiple dimensions and the center point operation data of multiple dimensions to obtain the first abnormality coefficient includes:

[0132] When the number of dimensions is N, the difference between the running data of the N dimensions and the running data of the center point of the N dimensions in each dimension is determined to obtain N differences, where N ≥ 2 and is a natural number;

[0133] The first abnormal coefficient is determined as a value obtained by performing a square root operation on an intermediate value, wherein the intermediate value is the sum of squares of N difference values.

[0134] Optionally, in this embodiment, it can be implemented including but not limited to the following formula:

[0135] After obtaining the operation data of multiple dimensions and calculating the center points of multiple dimensions in the data domain, the distance between the statistical vector of each host process hp∈HP and the center point can be determined, for example, using the Euclidean distance function d t Complete the calculation, the size of the distance is also the risk factor The sizes are:

[0136]

[0137] As shown in equation (6), the greater the distance between the statistical vector and the center point, the greater the risk coefficient The higher the value.

[0138] The above is only an example, and this embodiment does not make any specific limitation.

[0139] Through this embodiment, when the number of dimensions is N, the difference between the running data of N dimensions and the running data of the center point of N dimensions in each dimension is determined to obtain N differences, and the first abnormality coefficient is determined as the value obtained by performing a square root operation on the intermediate value. This method can determine the first abnormality coefficient of the target process from the spatial dimension, and then facilitate determining whether the target process is an abnormal process based on the abnormality coefficient, and realize more fine-grained risk judgment in combination with the running data of the process, thereby solving the technical problem of low detection accuracy of abnormal processes and easy false detection in related technologies.

[0140] As an optional solution, the second abnormal coefficient of the target process in the time dimension is determined according to the historical operation information of the target process in multiple historical cycles before the current cycle, including:

[0141] When the number of dimensions is N and the number of historical periods is M, the quantile operation data of the target process in each dimension in the M historical periods is determined according to the historical operation information of the target process in the M historical periods, and the quantile operation data of N dimensions is obtained, wherein N ≥ 2 and is a natural number, and M ≥ 2 and is a natural number;

[0142] A second abnormality coefficient is determined according to the operation data of N dimensions and the quantile operation data of N dimensions, wherein the operation information of the target process in the current cycle includes the operation data of N dimensions.

[0143] Optionally, in this embodiment, the above-mentioned historical operation information may include but is not limited to the target process operation information uploaded by each host in the historical period. Furthermore, based on the historical operation information of the target process in M ​​historical periods, the quantile operation data of the target process in each dimension in the M historical periods is determined to obtain the quantile operation data of N dimensions.

[0144] Specifically, the risk represented by the second abnormality coefficient may be determined by, but not limited to, using the historical statistical value of the host process as a scale:

[0145] Use a time window W to calculate the benchmark of the host process hp∈HP statistics in the time window. t-1 (W) is used to represent the set of statistical vectors {x t-1 ,…,x t-1-W}, its calculation formula is:

[0146]

[0147] Among them, j∈{t-1-W,…,t-1}, β t-1 The i-th element of (W) represents the statistical vector x in the time window W. t Elements The median value of j Indicates that each of the M historical period data The union of the components.

[0148] It should be noted that the value of the above time window W may include but is not limited to the number of cycles corresponding to the above M historical cycle data. For example, taking the above time window as 21 days as an example, the above formula (7) calculates the historical operation information over the 21 historical cycles, and then determines the quantile operation data of the target process in each dimension over the M historical cycles.

[0149] In the specific calculation process, the following solutions may also be included but are not limited to:

[0150] 1) If the target process has no history, the default value may be used for calculation, including but not limited to:

[0151] β t-1 (W) default ={0.02,0.1,1} (8)

[0152] 2) To reduce the impact of the minimum value on the calculation results, it can include but is not limited to Values ​​less than 1 are customized, including:

[0153]

[0154] In formula (9), if the condition is met, the custom value is used for calculation; if the condition is not met, the original value is used for calculation.

[0155] Optionally, in this embodiment, in order to improve the detection rate of malware that uses process injection to complete data transmission, it can include but is not limited to setting a risk value magnification factor l to calculate the offset between the running data of the target process in the current cycle and the running data in the historical cycle, so that the calculated second anomaly coefficient is more accurate.

[0156] Optionally, in this embodiment, the second abnormal coefficient may be determined based on the N-dimensional operating data and the N-dimensional quantile operating data, including but not limited to calculation according to the following formula:

[0157]

[0158] in, This is the second abnormal coefficient mentioned above, That is, the statistical vector set {x t-1 ,…,x t-1-W} benchmark.

[0159] As an optional solution, determining the second abnormal coefficient according to the N-dimensional operating data and the N-dimensional quantile operating data includes:

[0160] When the N dimensions include a target dimension, and the running data of the target dimension of the target process in the current cycle represents the amount of data uploaded by the target process in the current cycle, a target magnification factor is set for the target dimension, wherein the target magnification factor is greater than 1, and the target magnification factor is used to increase the offset value between the running data of the target dimension and the quantile running data of the target dimension;

[0161] According to the operating data of N dimensions and the quantile operating data of N dimensions, the offset between the operating data and the quantile operating data of each dimension is determined to obtain N offset values, and the second abnormal coefficient is determined according to the N offset values ​​and the target magnification factor.

[0162] Optionally, in this embodiment, a risk value magnification factor l is set, and the calculation formula of l is:

[0163]

[0164] In formula (10), sum(up_bytes) represents the total size of data uploaded by the host process hp∈HP on that day. If it is greater than 10MB and the upload volume on that day is greater than 3 times the historical benchmark, the amplification factor l is the multiple of the upload load greater than 10MB. Otherwise, l is 1.

[0165] Get the historical benchmark β t-1 (W) and the magnification factor l, and then calculate the movement vector m of the current day and the historical record t We can use formula (11) to get:

[0166]

[0167] m t It can be used to easily calculate the degree of deviation of a host process from its historical behavior, and thus calculate the risk factor. As shown in formula (12).

[0168]

[0169] The greater the distance between the host process's statistical vector on the day and the historical benchmark, the greater the risk factor. The higher the value of This is the second abnormal coefficient mentioned above.

[0170] As an optional solution, according to the N-dimensional operating data and the N-dimensional quantile operating data, the offset between the operating data of each dimension and the quantile operating data is determined to obtain N offset values, and according to the N offset values ​​and the target magnification factor, the second abnormal coefficient is determined, including:

[0171] The second anomaly coefficient is determined by the following formula:

[0172]

[0173]

[0174] in, represents the second anomaly coefficient, Represents the running data of the target process in the i-th dimension in the current cycle, It represents the quantile operation data of the i-th dimension of the target process in multiple historical periods, l represents the target magnification factor, and i=1 represents the target dimension.

[0175] As an optional solution, determining whether the target process in the first host is an abnormal process according to the first abnormal coefficient and the second abnormal coefficient includes:

[0176] According to the first abnormal coefficient and the second abnormal coefficient, determining a first weight value corresponding to the first abnormal coefficient and a second weight value corresponding to the second abnormal coefficient;

[0177] Determine a set of control coefficients according to the pre-acquired upload information of the target process in the current cycle, wherein the upload information is used to represent the amount of data uploaded by the target process to different destination addresses in the current cycle;

[0178] Determine a total abnormality coefficient of the target process in a current cycle according to the first abnormality coefficient, the second abnormality coefficient, the first weight value, the second weight value, and a set of control coefficients;

[0179] When the total abnormality coefficient is greater than a preset threshold, the target process in the first host is determined to be an abnormal process.

[0180] Optionally, in this embodiment, the first weight value and the second weight value are used to make normal data transmission behavior obtain a lower risk value and make abnormal data transmission behavior obtain a higher risk value.

[0181] Figure 6 is a schematic diagram of another optional abnormal process detection method according to the present invention, such as Figure 6 As shown, the above-mentioned abnormal process detection method may include but is not limited to the following steps:

[0182] S602, obtaining the original record table of host process information;

[0183] S604, determining a host process statistics record table;

[0184] S606, generating a quantile weighted average record table;

[0185] S608-1, the spatial dimension risk coefficient calculation module calculates the spatial risk coefficient;

[0186] S608-2, the time dimension risk coefficient calculation module calculates the time risk coefficient;

[0187] S610, a weight learning and control coefficient setting module sets weights and control coefficients;

[0188] S612, calculating the risk value by weighting the spatial dimension risk coefficient and the temporal dimension risk coefficient;

[0189] S614: Perform an alarm operation on the process whose risk value exceeds the threshold.

[0190] The above is only an example, and this embodiment does not make any specific limitation.

[0191] Through this embodiment, a first weight value corresponding to the first abnormal coefficient and a second weight value corresponding to the second abnormal coefficient are determined according to the first abnormal coefficient and the second abnormal coefficient, a group of control coefficients are determined according to the pre-acquired upload information of the target process in the current cycle, and the total abnormal coefficient of the target process in the current cycle is determined according to the first abnormal coefficient, the second abnormal coefficient, the first weight value, the second weight value and a group of control coefficients. When the total abnormal coefficient is greater than a preset threshold, the target process in the first host is determined to be an abnormal process. Different control coefficients can be set according to actual business scenarios to amplify the risk value of abnormal data transmission.

[0192] As an optional solution, determining a first weight value corresponding to the first abnormal coefficient and a second weight value corresponding to the second abnormal coefficient according to the first abnormal coefficient and the second abnormal coefficient includes:

[0193] Obtaining a first abnormality coefficient and a second abnormality coefficient of each process running in a group of hosts to obtain a group of first abnormality coefficients and a group of second abnormality coefficients;

[0194] Determine a quantile weighted average of a set of first abnormal coefficients to obtain a first quantile weighted value, determine a quantile weighted average of a set of second abnormal coefficients to obtain a second quantile weighted value;

[0195] The value obtained by dividing the second quantile weighted value by the target value is determined as the first weighted value, and the value obtained by dividing the first quantile weighted value by the target value is determined as the second weighted value, wherein the target value is the sum of the first quantile weighted value and the second quantile weighted value.

[0196] Optionally, in this embodiment, the above-mentioned set of first abnormal coefficients and set of second abnormal coefficients may be determined including but not limited to using the following formula.

[0197] For example, the weight is based on The distribution of is calculated as shown in formula (13):

[0198]

[0199] In formula (13), the calculation method of QWM is the same as that in formula (2).

[0200] When k = 1, then That is the weighted value of the first quantile mentioned above. That is the first weight value mentioned above. When k = 2, then is the weighted value of the second quantile mentioned above, then This is the second weight value mentioned above, This is the target value mentioned above.

[0201] As an optional solution, a set of control coefficients is determined according to the pre-acquired upload information of the target process in the current cycle, including:

[0202] When the target process is a process in a preset process set, determine, based on the upload information, a first amount of data uploaded by the target process to a first destination address in a current cycle and a first number of times of uploading data to the first destination address in the current cycle; when the first amount is greater than a first preset threshold and the first number is less than a second preset threshold, set a first control coefficient in a set of control coefficients to a preset first value, wherein the first value is greater than 1; when the first number is greater than or equal to the second preset threshold, set the first control coefficient to a preset second value, wherein 0<second value<1; wherein the first control coefficient is a control coefficient of a first abnormal coefficient and a second abnormal coefficient; and / or

[0203] Determine a second amount of data uploaded by the target process in the current cycle according to the uploaded information; when the second amount is greater than a third preset threshold, set a second control coefficient in a set of control coefficients to Among them, coundt host (p) represents the number of hosts in a group of hosts that are running the target process.

[0204] Optionally, in this embodiment, the determination of a set of control coefficients based on the pre-acquired upload information of the target process in the current cycle may include but is not limited to the following:

[0205] For example, in order to alleviate the problem of high risk values ​​of large data volumes transmitted by common processes, the external network IP (dstIP) (corresponding to the aforementioned target address) connected to the common processes is used as a reference to set the control coefficient.

[0206] For certain types of common processes (corresponding to the aforementioned preset process set) (Common Process, CP), such as wps.exe, scvhost.exe, explorer.exe, etc.), most of the time they only establish connections with a fixed set of external IPs. It can be assumed that the risk value of the process's communication behavior with the commonly used external IPs is low, and the risk value of the process's communication behavior with the uncommonly used external IPs is high. The reason is that process injection attack behavior will result in the generation of uncommonly used external IPs.

[0207] First, obtain the control coefficient for the host process hp∈HP (corresponding to the first control coefficient mentioned above):

[0208]

[0209] Among them, sum dstIP (up_bytes) indicates the total amount of data uploaded by the host process when communicating with dstIP on that day, and count(dstIP) indicates the total number of times process p communicates with dstIP.

[0210] In formula (14), if process p is a common process, and the amount of data uploaded to dstIP is greater than 10MB (corresponding to the first number mentioned above), and the number of communications is less than 50 (corresponding to the first number mentioned above), then is 50 (corresponding to the first value mentioned above); if process p is a common process and the number of communications with dstIP is greater than or equal to 50, then is 0.0007 (corresponding to the second value mentioned above); if process p is not a common process, then is 1. As a control coefficient, on the one hand, it can reduce the risk value of normal big data outbound behavior; on the other hand, it can increase the risk value of malware using process injection to complete data outbound behavior. At the same time, in order to make such suspected injection behavior directly obtain a risk value higher than the threshold, this embodiment also includes but is not limited to configuring the control coefficient

[0211]

[0212] In formula (15), the determination condition of abnormal behavior is the same as that in formula (14) and will not be repeated here.

[0213] Finally, in order to further alleviate the high risk value problem of a large number of outbound transmission behaviors of normal processes, this embodiment also includes but is not limited to configuring the control coefficient (corresponding to the aforementioned second control coefficient), as shown in formula (16):

[0214]

[0215] Among them, sum(up_bytes) represents the total amount of data transmitted by the host process hp∈HP on that day, count host (p) represents the number of hosts that have process p∈P on that day. This control coefficient is based on the assumption that the more hosts that contain a process, the more normal the process is. Therefore, the risk value of such host processes needs to be lowered.

[0216] As an optional solution, determining the total abnormality coefficient of the target process in the current cycle according to the first abnormality coefficient, the second abnormality coefficient, the first weight value, the second weight value, and a group of control coefficients includes:

[0217] The total abnormal coefficient of the target process in the current cycle is determined by the following formula:

[0218]

[0219] Among them, S t Indicates the total abnormal coefficient of the target process in the current cycle. represents the first abnormal coefficient, represents the second anomaly coefficient, represents the first weight value, Represents the second weight value, a set of control coefficients includes

[0220] Optionally, in this embodiment, the total abnormality coefficient of the target process in the current cycle determined based on the first abnormality coefficient, the second abnormality coefficient, the first weight value, the second weight value and a group of control coefficients may include but is not limited to the formula (17):

[0221]

[0222] (17) is the weighted sum of all parameters, which is the final total risk value S t Then, by setting a reasonable threshold, abnormal data transmission behavior can be determined.

[0223] Optionally, in this embodiment, the data transmission behavior generated by the abnormal process may include but is not limited to at least one of the following methods: one is an incremental attack, which is completed by creating a new process; the other is an existing attack, which is completed by process injection and using other processes as a shell.

[0224] Using the above abnormal process detection method, a total of 40 intranet hosts were used in the test process, and 21 days of log data were recorded according to the original record table. In addition, when applying incremental attacks and stock attacks, 10MB, 20MB, 50MB, 100MB, and 500MB of data were sent to the external network respectively to calculate their risk values ​​and rankings, and compared with the rule ranking method.

[0225] Figure 7 is a schematic diagram of another optional abnormal process detection method according to the present invention. In the incremental attack, ghost.exe is used to transmit data. The calculation result is as follows: Figure 7 As shown, only the host process data transmission behaviors larger than 5M are ranked. When 10MB of data is transmitted using incremental attack, the total risk value reaches 684, ranking 2; when 20MB of data is transmitted, the total risk value reaches 1375, ranking 1. Compared with the rule ranking, that is, ranking only according to the amount of transmitted data, this embodiment can rank abnormal data transmission behaviors higher.

[0226] Figure 8 is a schematic diagram of another optional abnormal process detection method according to the present invention. In the stock attack, the injected process selected is svchost.exe. The calculation result is as follows: Figure 8 As shown, only the host process data transmission behaviors greater than 5M are ranked. It can be seen that compared with the rule ranking, this embodiment can also rank abnormal data transmission behaviors higher for stock attacks. However, compared with incremental attacks, stock attacks are more difficult to detect. When transmitting 20MB of data, the risk value is 312 and the ranking is 3; while the risk value of incremental attacks of the same magnitude reaches 1375 and ranks 1.

[0227] Finally, in order to reduce missed reports as much as possible and reduce the number of alarms checked every day, the threshold selected in this embodiment (total risk value) is 50; that is, when the total risk value is greater than or equal to 50, it is considered abnormal and an alarm is generated.

[0228] As an optional solution, obtain the running information of the target process in the current cycle, including:

[0229] The operation data of multiple dimensions of the target process in the current cycle are obtained, wherein the operation data of multiple dimensions include the amount of data uploaded by the target process, the total session time of the target process, and the total number of sessions of the target process.

[0230] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0231] According to another aspect of the embodiments of the present invention, there is also provided an abnormal process detection device for implementing the abnormal process detection method described above. Fig. 9 As shown, the device comprises:

[0232] An acquisition module 902 is used to acquire running information of a target process in a current cycle, wherein the running information includes running data of multiple dimensions, and the target process is a process in a first host among a group of hosts that transmits data from an internal network where the group of hosts are located to an external network to which the group of hosts are connected;

[0233] A first determination module 904 is used to determine a first abnormality coefficient of the target process in a spatial dimension according to the operation information of the target process in the current cycle, wherein the first abnormality coefficient is used to represent the distance between the current operation information of the target process in the current cycle and the pre-acquired center point operation information, and the center point operation information is the operation information determined according to the operation information of the target process in the current cycle;

[0234] A second determination module 906 is configured to determine a second abnormality coefficient of the target process in a time dimension according to historical operation information of the target process in a plurality of historical cycles before the current cycle, wherein the second abnormality coefficient is used to represent an offset of the current operation information of the target process relative to the historical operation information of the target process;

[0235] The third determination module 908 is used to determine whether the target process in the first host is an abnormal process according to the first abnormality coefficient and the second abnormality coefficient.

[0236] As an optional scheme, the first determination module is used to determine the first abnormality coefficient of the target process in the spatial dimension according to the running information of the target process in the current cycle in the following manner: when the target process is running in a second host other than the first host in the group of hosts, the center point running information is determined according to the running information of the target process running in the first host in the current cycle and the running information of the target process running in the second host in the current cycle, wherein the second host includes one or more hosts, and the center point running information includes the center point running data of the multiple dimensions; determine the distance between the running data of the multiple dimensions and the center point running data of the multiple dimensions to obtain the first abnormality coefficient.

[0237] As an optional scheme, the first determination module is used to determine the center point operation information according to the operation information of the target process running in the first host in the current cycle and the operation information of the target process running in the second host in the current cycle in the following manner: when the multiple dimensions are N dimensions, determine the mean of the operation information of the target process in the first host and the second host in each dimension to obtain the average operation data of N dimensions, wherein the center point operation information includes the average operation data of N dimensions, N≥2 and is a natural number.

[0238] As an optional scheme, the first determination module is used to determine the first abnormality coefficient of the target process in the spatial dimension according to the running information of the target process in the current cycle in the following manner: when the target process is not running in a host other than the first host in the group of hosts, determine the center point running information according to the running information of each process running in the group of hosts in the current cycle, wherein the center point running information includes the center point running data of the multiple dimensions; determine the distance between the running data of the multiple dimensions and the center point running data of the multiple dimensions to obtain the first abnormality coefficient.

[0239] As an optional scheme, the first determination module is used to determine the center point operation information according to the operation information of each process running in the group of hosts in the current cycle in the following manner: when the multiple dimensions are N dimensions, determine the mean of the operation information of each process running in the group of hosts in each dimension to obtain the average operation data of N dimensions, wherein the center point operation information includes the average operation data of N dimensions, N≥2 and is a natural number.

[0240] As an optional scheme, the first determination module is used to determine the distance between the operating data of the multiple dimensions and the center point operating data of the multiple dimensions to obtain the first abnormality coefficient in the following manner: when the multiple dimensions are N dimensions, determine the difference between the operating data of the N dimensions and the center point operating data of the N dimensions in each dimension to obtain N differences, where N≥2 and is a natural number; determine the first abnormality coefficient as the value obtained by taking the square root of an intermediate value, where the intermediate value is the sum of the squares of the N differences.

[0241] As an optional scheme, the second determination module is used to determine the second abnormality coefficient of the target process in the time dimension according to the historical operation information of the target process in multiple historical periods before the current period in the following manner: when the multiple dimensions are N dimensions and the multiple historical periods are M historical periods, according to the historical operation information of the target process in the M historical periods, determine the quantile operation data of the target process in each dimension in the M historical periods to obtain the quantile operation data of N dimensions, wherein N≥2 and is a natural number, and M≥2 and is a natural number; determine the second abnormality coefficient according to the operation data of the N dimensions and the quantile operation data of the N dimensions, wherein the operation information of the target process in the current period includes the operation data of the N dimensions.

[0242] As an optional scheme, the second determination module is used to determine the second abnormality coefficient according to the operating data of the N dimensions and the quantile operating data of the N dimensions in the following manner: when the N dimensions include a target dimension, and the operating data of the target dimension of the target process in the current cycle represents the amount of data uploaded by the target process in the current cycle, a target magnification factor is set for the target dimension, wherein the target magnification factor is greater than 1, and the target magnification factor is used to increase the offset value between the operating data of the target dimension and the quantile operating data of the target dimension; according to the operating data of the N dimensions and the quantile operating data of the N dimensions, the offset between the operating data of each dimension and the quantile operating data is determined to obtain N offset values, and the second abnormality coefficient is determined according to the N offset values ​​and the target magnification factor.

[0243] As an optional solution, the second determination module is used to determine the offset between the operating data of each dimension and the quantile operating data according to the operating data of the N dimensions and the quantile operating data of the N dimensions in the following manner to obtain N offset values, and determine the second abnormality coefficient according to the N offset values ​​and the target magnification factor: the second abnormality coefficient is determined by the following formula:

[0244]

[0245]

[0246] in, represents the second anomaly coefficient, represents the running data of the target process in the i-th dimension in the current cycle, It represents the quantile operation data of the i-th dimension of the target process in the multiple historical periods, l represents the target magnification factor, and i=1 represents the target dimension.

[0247] As an optional solution, the device is used to determine whether the target process in the first host is an abnormal process according to the first abnormality coefficient and the second abnormality coefficient in the following manner:

[0248] Determine, according to the first abnormal coefficient and the second abnormal coefficient, a first weight value corresponding to the first abnormal coefficient and a second weight value corresponding to the second abnormal coefficient;

[0249] Determine a set of control coefficients according to pre-acquired upload information of the target process in the current cycle, wherein the upload information is used to indicate the amount of data uploaded by the target process to different destination addresses in the current cycle;

[0250] Determine a total abnormality coefficient of the target process in the current cycle according to the first abnormality coefficient, the second abnormality coefficient, the first weight value, the second weight value, and the set of control coefficients;

[0251] When the total abnormality coefficient is greater than a preset threshold, it is determined that the target process in the first host is an abnormal process.

[0252] As an optional solution, the device is used to determine a first weight value corresponding to the first abnormal coefficient and a second weight value corresponding to the second abnormal coefficient according to the first abnormal coefficient and the second abnormal coefficient in the following manner:

[0253] Obtaining the first abnormality coefficient and the second abnormality coefficient of each process running in the group of hosts to obtain a group of first abnormality coefficients and a group of second abnormality coefficients;

[0254] Determine a quantile weighted average of the set of first abnormal coefficients to obtain a first quantile weighted value, and determine a quantile weighted average of the set of second abnormal coefficients to obtain a second quantile weighted value;

[0255] The value obtained by dividing the second quantile weighted value by the target value is determined as the first weight value, and the value obtained by dividing the first quantile weighted value by the target value is determined as the second weight value, wherein the target value is the sum of the first quantile weighted value and the second quantile weighted value.

[0256] As an optional solution, the device is used to determine a set of control coefficients according to the pre-acquired upload information of the target process in the current cycle in the following manner:

[0257] When the target process is a process in a preset process set, determine, based on the upload information, a first amount of data uploaded by the target process to a first destination address within the current cycle and a first number of times of uploading data to the first destination address within the current cycle; when the first amount is greater than a first preset threshold and the first number of times is less than a second preset threshold, set a first control coefficient in the set of control coefficients to a preset first value, wherein the first value is greater than 1; when the first number of times is greater than or equal to a second preset threshold, set the first control coefficient to a preset second value, wherein 0<the second value<1; wherein the first control coefficient is a control coefficient of the first abnormal coefficient and the second abnormal coefficient; and / or

[0258] Determine, according to the upload information, a second amount of data uploaded by the target process in the current cycle; when the second amount is greater than a third preset threshold, set the second control coefficient in the set of control coefficients to Among them, count host (p) represents the number of hosts in the group of hosts on which the target process is running.

[0259] As an optional solution, the device is used to determine the total abnormality coefficient of the target process in the current cycle according to the first abnormality coefficient, the second abnormality coefficient, the first weight value, the second weight value and the set of control coefficients in the following manner:

[0260] The total abnormal coefficient of the target process in the current cycle is determined by the following formula:

[0261]

[0262] Among them, S t represents the total abnormal coefficient of the target process in the current cycle, represents the first anomaly coefficient, represents the second anomaly coefficient, represents the first weight value, represents the second weight value, and the set of control coefficients includes

[0263] As an optional solution, the device is used to obtain the running information of the target process in the current cycle in the following manner:

[0264] Obtain the operating data of the target process in the current cycle in the multiple dimensions, wherein the operating data in the multiple dimensions include the amount of data uploaded by the target process, the total session time of the target process, and the total number of sessions of the target process.

[0265] According to another aspect of the embodiments of the present invention, there is also provided an electronic device for implementing the above abnormal process detection method. The electronic device may be Figure 1 The terminal device or server shown in the figure. This embodiment is described by taking the electronic device as a server as an example. Fig.10 As shown, the electronic device includes a memory 1002 and a processor 1004. The memory 1002 stores a computer program, and the processor 1004 is configured to execute the steps in any of the above method embodiments through the computer program.

[0266] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0267] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0268] S1, obtaining running information of a target process in a current cycle, wherein the running information includes running data of multiple dimensions, and the target process is a process in a first host among a group of hosts that transmits data from an internal network where the group of hosts are located to an external network to which the group of hosts are connected;

[0269] S2, determining a first abnormality coefficient of the target process in the spatial dimension according to the running information of the target process in the current cycle, wherein the first abnormality coefficient is used to represent the distance between the current running information of the target process in the current cycle and the pre-acquired center point running information, and the center point running information is the running information determined according to the running information of the target process in the current cycle;

[0270] S3, determining a second abnormality coefficient of the target process in the time dimension according to historical operation information of the target process in multiple historical cycles before the current cycle, wherein the second abnormality coefficient is used to represent the offset of the current operation information of the target process relative to the historical operation information of the target process;

[0271] S4: Determine whether the target process in the first host is an abnormal process according to the first abnormal coefficient and the second abnormal coefficient.

[0272] Alternatively, a person skilled in the art may understand that: Fig.10 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (MID), a PAD, and other terminal devices. Fig.10 The electronic device and the electronic equipment described above are not limited in structure. Fig.10 More or fewer components (such as network interfaces, etc.) as shown in, or with Fig.10 Different configurations shown.

[0273] Among them, the memory 1002 can be used to store software programs and modules, such as the program instructions / modules corresponding to the abnormal process detection method and device in the embodiment of the present invention. The processor 1004 executes various functional applications and data processing by running the software programs and modules stored in the memory 1002, that is, to implement the above-mentioned abnormal process detection method. The memory 1002 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 1002 may further include a memory remotely arranged relative to the processor 1004, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 1002 can be specifically, but not limited to, used to store process data and other information. As an example, such as Fig.10 As shown, the memory 1002 may include, but is not limited to, the acquisition module 902, the first determination module 904, the second determination module 906, and the third determination module 908 in the abnormal process detection device. In addition, other module units in the abnormal process detection device may also be included but are not limited to, which will not be repeated in this example.

[0274] Optionally, the transmission device 1006 is used to receive or send data via a network. Specific examples of the above-mentioned network may include a wired network and a wireless network. In one example, the transmission device 1006 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 1006 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0275] In addition, the electronic device further includes: a display 1008 for displaying the abnormal process; and a connection bus 1010 for connecting various module components in the electronic device.

[0276] In other embodiments, the terminal device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. Among them, the nodes may form a peer-to-peer (P2P, Peer To Peer) network, and any form of computing device, such as a server, terminal and other electronic devices, may become a node in the blockchain system by joining the peer-to-peer network.

[0277] According to one aspect of the present application, a computer program product or computer program is provided, the computer program product or computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in various optional implementations of the above-mentioned abnormal process detection. The computer program is configured to execute the steps of any of the above-mentioned method embodiments when it is run.

[0278] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for performing the following steps:

[0279] S1, obtaining running information of a target process in a current cycle, wherein the running information includes running data of multiple dimensions, and the target process is a process in a first host among a group of hosts that transmits data from an internal network where the group of hosts are located to an external network to which the group of hosts are connected;

[0280] S2, determining a first abnormality coefficient of the target process in the spatial dimension according to the running information of the target process in the current cycle, wherein the first abnormality coefficient is used to represent the distance between the current running information of the target process in the current cycle and the pre-acquired center point running information, and the center point running information is the running information determined according to the running information of the target process in the current cycle;

[0281] S3, determining a second abnormality coefficient of the target process in the time dimension according to historical operation information of the target process in multiple historical cycles before the current cycle, wherein the second abnormality coefficient is used to represent the offset of the current operation information of the target process relative to the historical operation information of the target process;

[0282] S4: Determine whether the target process in the first host is an abnormal process according to the first abnormal coefficient and the second abnormal coefficient.

[0283] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0284] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0285] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling one or more computer devices (which can be personal computers, servers or network devices, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.

[0286] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0287] In the several embodiments provided in the present application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0288] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0289] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0290] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for detecting an abnormal process, characterized in that: include: Obtaining running information of a target process in a current cycle, wherein the running information includes running data of multiple dimensions, and the target process is a process in a first host among a group of hosts that transmits data from an internal network where the group of hosts are located to an external network to which the group of hosts are connected; Determine a first abnormality coefficient of the target process in a spatial dimension according to the running information of the target process in the current cycle, wherein the first abnormality coefficient is used to represent the distance between the current running information of the target process in the current cycle and the pre-acquired center point running information, and the center point running information is the running information determined according to the running information of the target process in the current cycle; Determine a second abnormality coefficient of the target process in a time dimension according to historical operation information of the target process in a plurality of historical cycles before the current cycle, wherein the second abnormality coefficient is used to represent an offset of the current operation information of the target process relative to the historical operation information of the target process; Determining whether the target process in the first host is an abnormal process according to the first abnormal coefficient and the second abnormal coefficient; The method also includes: determining a first weight value corresponding to the first abnormal coefficient and a second weight value corresponding to the second abnormal coefficient according to the first abnormal coefficient and the second abnormal coefficient; determining a set of control coefficients according to pre-acquired upload information of the target process in the current cycle, wherein the upload information is used to indicate the amount of data uploaded by the target process to different destination addresses in the current cycle; determining a total abnormal coefficient of the target process in the current cycle according to the first abnormal coefficient, the second abnormal coefficient, the first weight value, the second weight value and the set of control coefficients; and determining that the target process in the first host is an abnormal process when the total abnormal coefficient is greater than a preset threshold.

2. The method according to claim 1, characterized in that: The step of determining a first abnormal coefficient of the target process in a spatial dimension according to the running information of the target process in the current cycle includes: In a case where the target process is running in a second host other than the first host in the group of hosts, determining the central point running information according to the running information of the target process running in the first host in the current cycle and the running information of the target process running in the second host in the current cycle, wherein the second host includes one or more hosts, and the central point running information includes the central point running data of the multiple dimensions; The distance between the operating data of the multiple dimensions and the central point operating data of the multiple dimensions is determined to obtain the first abnormality coefficient.

3. The method according to claim 2, characterized in that The determining the central point operation information according to the operation information of the target process running in the first host in the current cycle and the operation information of the target process running in the second host in the current cycle includes: When the multiple dimensions are N dimensions, determine the mean of the operation information of the target process in the first host and the second host in each dimension to obtain average operation data of N dimensions, wherein the center point operation information includes average operation data of N dimensions, N≥2 and is a natural number.

4. The method according to claim 1, characterized in that: The step of determining a first abnormal coefficient of the target process in a spatial dimension according to the running information of the target process in the current cycle includes: In a case where the target process is not running in a host other than the first host in the group of hosts, determining the central point running information according to the running information of each process running in the group of hosts in the current cycle, wherein the central point running information includes the central point running data of the multiple dimensions; The distance between the operating data of the multiple dimensions and the central point operating data of the multiple dimensions is determined to obtain the first abnormality coefficient.

5. The method according to claim 4, characterized in that The determining the central point operation information according to the operation information of each process running in the group of hosts in the current cycle includes: When the multiple dimensions are N dimensions, determine the mean of the operation information of each process running in the group of hosts in each dimension to obtain average operation data of N dimensions, wherein the center point operation information includes average operation data of N dimensions, N≥2 and is a natural number.

6. The method according to claim 2 or 4, characterized in that: The determining the distance between the operating data of the multiple dimensions and the central point operating data of the multiple dimensions to obtain the first abnormality coefficient includes: When the multiple dimensions are N dimensions, determine the difference between the running data of the N dimensions and the center point running data of the N dimensions in each dimension to obtain N differences, where N≥2 and is a natural number; The first abnormal coefficient is determined as a value obtained by performing a square root operation on an intermediate value, wherein the intermediate value is the sum of the squares of the N difference values.

7. The method according to claim 1, characterized in that The determining, based on historical operation information of the target process in a plurality of historical cycles before the current cycle, a second abnormal coefficient of the target process in the time dimension includes: When the multiple dimensions are N dimensions and the multiple historical periods are M historical periods, the quantile operation data of the target process in each dimension in the M historical periods is determined according to the historical operation information of the target process in the M historical periods, and the quantile operation data of N dimensions is obtained, wherein N≥2 is a natural number, and M≥2 is a natural number; The second abnormality coefficient is determined according to the operating data of the N dimensions and the quantile operating data of the N dimensions, wherein the operating information of the target process in the current cycle includes the operating data of the N dimensions.

8. The method according to claim 7, characterized in that The determining the second abnormality coefficient according to the N-dimensional operation data and the N-dimensional quantile operation data includes: When the N dimensions include a target dimension, and the operating data of the target dimension of the target process in the current cycle represents the amount of data uploaded by the target process in the current cycle, a target magnification factor is set for the target dimension, wherein the target magnification factor is greater than 1, and the target magnification factor is used to increase the offset value between the operating data of the target dimension and the quantile operating data of the target dimension; According to the operating data of the N dimensions and the quantile operating data of the N dimensions, the offset between the operating data of each dimension and the quantile operating data is determined to obtain N offset values, and the second abnormality coefficient is determined according to the N offset values ​​and the target magnification factor.

9. The method according to claim 8, characterized in that The step of determining the offset between the operating data of each dimension and the quantile operating data according to the operating data of the N dimensions and the quantile operating data of the N dimensions to obtain N offset values, and determining the second abnormality coefficient according to the N offset values ​​and the target magnification coefficient includes: The second anomaly coefficient is determined by the following formula: in, represents the second anomaly coefficient, represents the running data of the target process in the i-th dimension in the current cycle, It represents the quantile operation data of the i-th dimension of the target process in the multiple historical periods, l represents the target magnification factor, and i=1 represents the target dimension.

10. The method according to claim 1, characterized in that The determining, according to the first abnormal coefficient and the second abnormal coefficient, a first weight value corresponding to the first abnormal coefficient and a second weight value corresponding to the second abnormal coefficient comprises: Obtaining the first abnormality coefficient and the second abnormality coefficient of each process running in the group of hosts to obtain a group of first abnormality coefficients and a group of second abnormality coefficients; Determine a quantile weighted average of the set of first abnormal coefficients to obtain a first quantile weighted value, and determine a quantile weighted average of the set of second abnormal coefficients to obtain a second quantile weighted value; The value obtained by dividing the second quantile weighted value by the target value is determined as the first weight value, and the value obtained by dividing the first quantile weighted value by the target value is determined as the second weight value, wherein the target value is the sum of the first quantile weighted value and the second quantile weighted value.

11. The method according to claim 1, characterized in that: The step of determining a set of control coefficients according to the pre-acquired upload information of the target process in the current cycle includes: When the target process is a process in a preset process set, determine, based on the upload information, a first amount of data uploaded by the target process to a first destination address within the current cycle and a first number of times of uploading data to the first destination address within the current cycle; when the first amount is greater than a first preset threshold and the first number of times is less than a second preset threshold, set a first control coefficient in the set of control coefficients to a preset first value, wherein the first value is greater than 1; when the first number of times is greater than or equal to a second preset threshold, set the first control coefficient to a preset second value, wherein 0<the second value<1; wherein the first control coefficient is a control coefficient of the first abnormal coefficient and the second abnormal coefficient; and / or Determine, according to the upload information, a second amount of data uploaded by the target process in the current cycle; when the second amount is greater than a third preset threshold, set the second control coefficient in the set of control coefficients to Among them, count host (p) represents the number of hosts in the group of hosts on which the target process is running.

12. The method according to claim 1, characterized in that Determining the total abnormality coefficient of the target process in the current cycle according to the first abnormality coefficient, the second abnormality coefficient, the first weight value, the second weight value, and the set of control coefficients includes: The total abnormal coefficient of the target process in the current cycle is determined by the following formula: Among them, S t represents the total abnormal coefficient of the target process in the current cycle, represents the first anomaly coefficient, represents the second anomaly coefficient, represents the first weight value, represents the second weight value, and the set of control coefficients includes 13. A device for detecting abnormal processes, characterized in that: include: an acquisition module, configured to acquire operation information of a target process in a current cycle, wherein the operation information includes operation data of multiple dimensions, and the target process is a process in a first host among a group of hosts that transmits data from an internal network where the group of hosts are located to an external network to which the group of hosts are connected; A first determination module is used to determine a first abnormality coefficient of the target process in a spatial dimension according to the operation information of the target process in the current cycle, wherein the first abnormality coefficient is used to represent the distance between the current operation information of the target process in the current cycle and the pre-acquired center point operation information, and the center point operation information is the operation information determined according to the operation information of the target process in the current cycle; A second determination module is used to determine a second abnormality coefficient of the target process in a time dimension according to historical operation information of the target process in multiple historical cycles before the current cycle, wherein the second abnormality coefficient is used to represent an offset of the current operation information of the target process relative to the historical operation information of the target process; a third determining module, configured to determine whether the target process in the first host is an abnormal process according to the first abnormal coefficient and the second abnormal coefficient; The device is used to determine whether the target process in the first host is an abnormal process according to the first abnormal coefficient and the second abnormal coefficient in the following manner: determine a first weight value corresponding to the first abnormal coefficient and a second weight value corresponding to the second abnormal coefficient according to the first abnormal coefficient and the second abnormal coefficient; determine a set of control coefficients according to pre-acquired upload information of the target process in the current cycle, wherein the upload information is used to indicate the amount of data uploaded by the target process to different destination addresses in the current cycle; determine a total abnormal coefficient of the target process in the current cycle according to the first abnormal coefficient, the second abnormal coefficient, the first weight value, the second weight value and the set of control coefficients; when the total abnormal coefficient is greater than a preset threshold, determine that the target process in the first host is an abnormal process.

14. The device according to claim 13, characterized in that The first determination module is used to determine a first abnormal coefficient of the target process in a spatial dimension according to the running information of the target process in the current cycle in the following manner: In a case where the target process is running in a second host other than the first host in the group of hosts, determining the central point running information according to the running information of the target process running in the first host in the current cycle and the running information of the target process running in the second host in the current cycle, wherein the second host includes one or more hosts, and the central point running information includes the central point running data of the multiple dimensions; The distance between the operating data of the multiple dimensions and the central point operating data of the multiple dimensions is determined to obtain the first abnormality coefficient.

15. The device according to claim 14, characterized in that The first determining module is used to determine the central point operation information according to the operation information of the target process running in the first host in the current cycle and the operation information of the target process running in the second host in the current cycle in the following manner: When the multiple dimensions are N dimensions, determine the mean of the operation information of the target process in the first host and the second host in each dimension to obtain average operation data of N dimensions, wherein the center point operation information includes average operation data of N dimensions, N≥2 and is a natural number.

16. The device according to claim 13, characterized in that The first determination module is used to determine a first abnormal coefficient of the target process in a spatial dimension according to the running information of the target process in the current cycle in the following manner: In a case where the target process is not running in a host other than the first host in the group of hosts, determining the central point running information according to the running information of each process running in the group of hosts in the current cycle, wherein the central point running information includes the central point running data of the multiple dimensions; The distance between the operating data of the multiple dimensions and the central point operating data of the multiple dimensions is determined to obtain the first abnormality coefficient.

17. The device according to claim 16, characterized in that The first determining module is used to determine the central point operation information according to the operation information of each process running in the group of hosts in the current cycle in the following manner: When the multiple dimensions are N dimensions, determine the mean of the operation information of each process running in the group of hosts in each dimension to obtain average operation data of N dimensions, wherein the center point operation information includes average operation data of N dimensions, N≥2 and is a natural number.

18. The device according to claim 14 or 16, characterized in that The first determination module is used to determine the distance between the operation data of the multiple dimensions and the center point operation data of the multiple dimensions in the following manner to obtain the first abnormality coefficient: When the multiple dimensions are N dimensions, determine the difference between the running data of the N dimensions and the center point running data of the N dimensions in each dimension to obtain N differences, where N≥2 and is a natural number; The first abnormal coefficient is determined as a value obtained by performing a square root operation on an intermediate value, wherein the intermediate value is the sum of the squares of the N difference values.

19. The device according to claim 13, characterized in that The second determination module is used to determine the second abnormal coefficient of the target process in the time dimension according to the historical operation information of the target process in multiple historical cycles before the current cycle in the following manner: When the multiple dimensions are N dimensions and the multiple historical periods are M historical periods, the quantile operation data of the target process in each dimension in the M historical periods is determined according to the historical operation information of the target process in the M historical periods, and the quantile operation data of N dimensions is obtained, wherein N≥2 is a natural number, and M≥2 is a natural number; The second abnormality coefficient is determined according to the operating data of the N dimensions and the quantile operating data of the N dimensions, wherein the operating information of the target process in the current cycle includes the operating data of the N dimensions.

20. The device according to claim 19, characterized in that The second determination module is used to determine the second abnormality coefficient according to the operation data of the N dimensions and the quantile operation data of the N dimensions in the following manner: When the N dimensions include a target dimension, and the operating data of the target dimension of the target process in the current cycle represents the amount of data uploaded by the target process in the current cycle, a target magnification factor is set for the target dimension, wherein the target magnification factor is greater than 1, and the target magnification factor is used to increase the offset value between the operating data of the target dimension and the quantile operating data of the target dimension; According to the operating data of the N dimensions and the quantile operating data of the N dimensions, the offset between the operating data of each dimension and the quantile operating data is determined to obtain N offset values, and the second abnormality coefficient is determined according to the N offset values ​​and the target magnification factor.

21. The device according to claim 20, characterized in that The second determination module is used to determine the offset between the operating data of each dimension and the quantile operating data according to the operating data of the N dimensions and the quantile operating data of the N dimensions in the following manner to obtain N offset values, and determine the second abnormality coefficient according to the N offset values ​​and the target magnification factor: The second anomaly coefficient is determined by the following formula: in, represents the second anomaly coefficient, represents the running data of the target process in the i-th dimension in the current cycle, It represents the quantile operation data of the i-th dimension of the target process in the multiple historical periods, l represents the target magnification factor, and i=1 represents the target dimension.

22. The device according to claim 13, characterized in that The device is used to determine a first weight value corresponding to the first abnormal coefficient and a second weight value corresponding to the second abnormal coefficient according to the first abnormal coefficient and the second abnormal coefficient in the following manner: Obtaining the first abnormality coefficient and the second abnormality coefficient of each process running in the group of hosts to obtain a group of first abnormality coefficients and a group of second abnormality coefficients; Determine a quantile weighted average of the set of first abnormal coefficients to obtain a first quantile weighted value, and determine a quantile weighted average of the set of second abnormal coefficients to obtain a second quantile weighted value; The value obtained by dividing the second quantile weighted value by the target value is determined as the first weight value, and the value obtained by dividing the first quantile weighted value by the target value is determined as the second weight value, wherein the target value is the sum of the first quantile weighted value and the second quantile weighted value.

23. The device according to claim 13, characterized in that The device is used to determine a set of control coefficients according to the pre-acquired upload information of the target process in the current cycle in the following manner: When the target process is a process in a preset process set, determining, according to the upload information, a first amount of data uploaded by the target process to a first destination address in the current cycle and a first number of times data is uploaded to the first destination address in the current cycle; When the first number is greater than a first preset threshold and the first number of times is less than a second preset threshold, setting a first control coefficient in the set of control coefficients to a preset first value, wherein the first value is greater than 1; When the first number is greater than or equal to a second preset threshold, the first control coefficient is set to a preset second value, wherein 0<the second value<1; wherein the first control coefficient is a control coefficient of the first abnormal coefficient and the second abnormal coefficient; and / or Determine, according to the upload information, a second amount of data uploaded by the target process in the current cycle; when the second amount is greater than a third preset threshold, set the second control coefficient in the set of control coefficients to Among them, count host (p) represents the number of hosts in the group of hosts on which the target process is running.

24. The device according to claim 13, characterized in that The device is used to determine the total abnormality coefficient of the target process in the current cycle according to the first abnormality coefficient, the second abnormality coefficient, the first weight value, the second weight value and the set of control coefficients in the following manner: The total abnormal coefficient of the target process in the current cycle is determined by the following formula: Among them, S t represents the total abnormal coefficient of the target process in the current cycle, represents the first anomaly coefficient, represents the second anomaly coefficient, represents the first weight value, represents the second weight value, and the set of control coefficients includes 25. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein the program can be executed by a terminal device or a computer to execute the method described in any one of claims 1 to 12.

26. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 12 through the computer program.

Images