Abnormal process detection method and device, electronic device and storage medium

Abstract

The present disclosure relates to an abnormal process detection method and device, an electronic device and a computer-readable storage medium, and relates to the field of network and information security technology. The method includes: obtaining process execution information of the process to be analyzed; the process execution information includes basic process information, execution command information and execution user information; constructing a process set according to the basic process information; the process set includes a process hierarchical relationship between multiple processes; determining a command relationship set according to the execution command information and the process hierarchical relationship, and determining a command relationship feature value corresponding to the command relationship set; determining a user relationship set for the process set according to the execution user information and the process hierarchical relationship, and determining a user relationship feature value corresponding to the user relationship set; comparing the command relationship feature value and the user relationship feature value with the feature comparison reference value respectively to determine the abnormal process information. The present disclosure can realize the detection and alarm of abnormal processes in the host.

Description

Background Art

[0002] With the rapid development of computer technology, various technologies such as big data, distributed, and blockchain have penetrated into all walks of life. In the technical applications of various industries, security is the biggest problem facing all networks. In order to prevent hackers and intruders from invading networks and websites, general enterprises usually deploy intrusion detection systems in advance.

[0003] At present, the field of host abnormal behavior detection and analysis mainly includes two types of technical solutions: network-based intrusion detection and host-based intrusion detection system. The relevant technologies are usually based on statistical or rule matching technology, and detect intrusion behaviors through protocol analysis and behavioral analysis. However, they cannot detect and analyze encrypted traffic and are more dependent on anomaly rule libraries.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The purpose of the present disclosure is to provide an abnormal process detection method, an abnormal process detection device, an electronic device and a computer-readable storage medium, thereby at least to a certain extent overcoming the problem that existing host intrusion detection schemes have lags or are unable to detect and warn of unknown behaviors.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present invention.

[0007] According to a first aspect of the present disclosure, a method for detecting an abnormal process is provided, comprising: obtaining process execution information of a process to be analyzed; the process execution information comprising basic process information, execution command information and execution user information; constructing a process set according to the basic process information; the process set comprising a process hierarchical relationship between multiple processes; structurally adjusting the process set according to the execution command information and the process hierarchical relationship to obtain a command relationship set, and determining a command relationship feature value corresponding to the command relationship set; structurally adjusting the process set according to the execution user information and the process hierarchical relationship to obtain a user relationship set, and determining a user relationship feature value corresponding to the user relationship set; obtaining a predetermined feature comparison reference value, and comparing the command relationship feature value and the user relationship feature value with the feature comparison reference value respectively, to determine the abnormal process information.

[0008] In an exemplary embodiment of the present disclosure, the feature comparison reference value includes a command relationship reference feature value and a user relationship reference feature value, and the above method also includes: acquiring historical process data, and generating a sample process data set according to the historical process data; the sample process data set includes execution information of multiple sample processes; the execution information includes sample process basic information, sample process command information and sample process user information; constructing a sample process set according to the sample process basic information; the sample process set includes a sample process hierarchical relationship between multiple sample processes; structurally adjusting the sample process set according to the sample process command information and the sample process hierarchical relationship to obtain a sample process command set, and determining the command relationship reference feature value corresponding to the sample process command set; structurally adjusting the sample process set according to the sample process user information and the sample process hierarchical relationship to obtain a sample process user set, and determining the user relationship reference feature value corresponding to the sample process user set.

[0009] In an exemplary embodiment of the present disclosure, sample process command information includes a process type mapping table; the sample process set is stored in a tree structure; the sample process set is structurally adjusted according to the sample process command information and the sample process hierarchical relationship to obtain a sample process command set, and a command relationship reference characteristic value corresponding to the sample process command set is determined, including: determining a first node to be merged according to the process type mapping table and the sample process hierarchical relationship; the first node to be merged is a process node with a parent-child relationship and belonging to the same command type; merging the first node to be merged, adjusting the tree structure corresponding to the sample process set according to the merged process node to generate a command relationship tree corresponding to the sample process command set; and determining the command relationship reference characteristic value according to the command relationship tree.

[0010] In an exemplary embodiment of the present disclosure, a command relationship reference characteristic value is determined according to a command relationship tree, including: obtaining a command type root node corresponding to the command relationship tree; traversing the command relationship tree based on the command type root node to determine a command relationship process chain contained in the command relationship tree; determining a command type operand value and a command type hierarchy value corresponding to the command relationship tree; determining a command relationship chain value corresponding to the command relationship process chain according to the command type operand value and the command type hierarchy value; and determining a command relationship reference characteristic value according to the command relationship chain value.

[0011] In an exemplary embodiment of the present disclosure, a sample process set is stored in a tree structure; the sample process set is structurally adjusted according to sample process user information and a sample process hierarchical relationship to obtain a sample process user set, and a user relationship reference feature value corresponding to the sample process user set is determined, including: determining a second node to be merged according to the sample process user information and the sample process hierarchical relationship; the second node to be merged is a process node that has a parent-child relationship and belongs to the same execution user, or a process node that has a parent-child relationship and belongs to the same execution user group; merging the second node to be merged, adjusting the tree structure corresponding to the sample process set according to the merged process nodes to generate a user relationship tree corresponding to the sample process user set; and determining the user relationship reference feature value according to the user relationship tree.

[0012] In an exemplary embodiment of the present disclosure, determining a user relationship reference feature value based on a user relationship tree includes: obtaining a user relationship root node corresponding to the user relationship tree; traversing the user relationship tree based on the user relationship root node to determine a user relationship process chain contained in the user relationship tree; determining a user execution value and a user conversion value corresponding to the user relationship tree; determining a user relationship chain value corresponding to the user relationship process chain based on the user execution value and the user conversion value; and determining a user relationship reference feature value based on the user relationship chain value.

[0013] In an exemplary embodiment of the present disclosure, the command relationship feature value and the user relationship feature value are respectively compared with the feature comparison reference value to determine abnormal process information, including: if the command relationship feature value is greater than the command feature reference value, and the user relationship feature value is greater than the user relationship feature reference value, it is determined that the process to be analyzed is running normally; if the command relationship feature value is greater than the command feature reference value, and the user relationship feature value is less than the user relationship feature reference value, it is determined that the user behavior of the executing user of the process to be analyzed is abnormal, and a first alarm event is output; if the command relationship feature value is less than the command feature reference value, and the user relationship feature value is greater than the user relationship feature reference value, it is determined that there is an abnormality in the process execution of the process to be analyzed, and a second alarm event is output; if the command relationship feature value is less than the command feature reference value, and the user relationship feature value is less than the user relationship feature reference value, it is determined that there is an abnormality in the running device corresponding to the process to be analyzed, and a third alarm event is output.

[0014] According to a second aspect of the present disclosure, an abnormal process detection device is provided, including: an information acquisition module, used to obtain process execution information of a process to be analyzed; the process execution information includes process basic information, execution command information and execution user information; a process set construction module, used to construct a process set according to the process basic information; the process set includes a process hierarchical relationship between multiple processes; a command value determination module, used to structurally adjust the process set according to the execution command information and the process hierarchical relationship, obtain a command relationship set, and determine the command relationship feature value corresponding to the command relationship set; a user value determination module, used to structurally adjust the process set according to the execution user information and the process hierarchical relationship, obtain a user relationship set, and determine the user relationship feature value corresponding to the user relationship set; an abnormality detection module, used to obtain a predetermined feature comparison reference value, and compare the command relationship feature value and the user relationship feature value with the feature comparison reference value respectively to determine the abnormal process information.

[0015] In an exemplary embodiment of the present disclosure, the feature comparison reference value includes a command relationship reference feature value and a user relationship reference feature value, and the abnormal process detection module also includes a reference feature value determination module, which is used to obtain historical process data and generate a sample process data set based on the historical process data; the sample process data set includes execution information of multiple sample processes; the execution information includes sample process basic information, sample process command information and sample process user information; a sample process set is constructed based on the sample process basic information; the sample process set includes a sample process hierarchical relationship between multiple sample processes; the sample process set is structurally adjusted according to the sample process command information and the sample process hierarchical relationship to obtain a sample process command set, and the command relationship reference feature value corresponding to the sample process command set is determined; the sample process set is structurally adjusted according to the sample process user information and the sample process hierarchical relationship to obtain a sample process user set, and the user relationship reference feature value corresponding to the sample process user set is determined.

[0016] In an exemplary embodiment of the present disclosure, the sample process command information includes a process type mapping table; the sample process set is stored in a tree structure; the reference characteristic value determination module includes a command reference value determination unit, which is used to determine the first node to be merged according to the process type mapping table and the sample process hierarchical relationship; the first node to be merged is a process node with a parent-child relationship and belonging to the same command type; the first node to be merged is merged, and the tree structure corresponding to the sample process set is adjusted according to the merged process node to generate a command relationship tree corresponding to the sample process command set; the command relationship reference characteristic value is determined according to the command relationship tree.

[0017] In an exemplary embodiment of the present disclosure, a command reference value determination unit includes a command reference value determination sub-unit, which is used to obtain a command type root node corresponding to a command relationship tree; traverse the command relationship tree based on the command type root node to determine the command relationship process chain contained in the command relationship tree; determine the command type operation value and the command type hierarchy value corresponding to the command relationship tree; determine the command relationship chain value corresponding to the command relationship process chain according to the command type operation value and the command type hierarchy value; and determine the command relationship reference feature value according to the command relationship chain value.

[0018] In an exemplary embodiment of the present disclosure, the sample process set is stored in a tree structure; the reference feature value determination module includes a user reference value determination unit, which is used to determine the second node to be merged according to the sample process user information and the sample process hierarchical relationship; the second node to be merged is a process node that has a parent-child relationship and belongs to the same execution user, or a process node that has a parent-child relationship and belongs to the same execution user group; the second node to be merged is merged, and the tree structure corresponding to the sample process set is adjusted according to the merged process nodes to generate a user relationship tree corresponding to the sample process user set; and the user relationship reference feature value is determined according to the user relationship tree.

[0019] In an exemplary embodiment of the present disclosure, a user reference value determination unit includes a user reference value determination sub-unit, which is used to obtain a user relationship root node corresponding to a user relationship tree; traverse the user relationship tree based on the user relationship root node to determine a user relationship process chain contained in the user relationship tree; determine a user execution value and a user conversion value corresponding to the user relationship tree; determine a user relationship chain value corresponding to the user relationship process chain based on the user execution value and the user conversion value; and determine a user relationship reference feature value based on the user relationship chain value.

[0020] In an exemplary embodiment of the present disclosure, the anomaly detection module includes an anomaly detection unit, which is used to determine that the process to be analyzed is running normally if the command relationship characteristic value is greater than the command characteristic reference value and the user relationship characteristic value is greater than the user relationship characteristic reference value; if the command relationship characteristic value is greater than the command characteristic reference value and the user relationship characteristic value is less than the user relationship characteristic reference value, it is determined that the user behavior of the executing user of the process to be analyzed is abnormal, and a first alarm event is output; if the command relationship characteristic value is less than the command characteristic reference value and the user relationship characteristic value is greater than the user relationship characteristic reference value, it is determined that there is an abnormality in the process execution of the process to be analyzed, and a second alarm event is output; if the command relationship characteristic value is less than the command characteristic reference value and the user relationship characteristic value is less than the user relationship characteristic reference value, it is determined that there is an abnormality in the running device corresponding to the process to be analyzed, and a third alarm event is output.

[0021] According to a third aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the abnormal process detection method according to any one of the above items is implemented.

[0022] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the abnormal process detection method according to any one of the above items is implemented.

[0023] The technical solution provided by the present disclosure may have the following beneficial effects:

[0024] The abnormal process detection method in the exemplary embodiment of the present disclosure, on the one hand, because malicious programs often start multiple processes to perform different intrusion behaviors, it is difficult to analyze the complete behavior and characteristics of malicious processes from the perspective of a single process. This solution constructs a process set through the hierarchical relationship of different processes, and analyzes the startup commands and execution user information of the process running process based on the process set, so as to realize the analysis and detection of abnormal processes. On the other hand, by analyzing the comparison results of the command relationship feature value and the user relationship feature value with the feature comparison reference value, the possibility of abnormal execution of the command corresponding to the process can be determined, and the analysis and detection of abnormal user operation behavior can be realized.

[0025] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings herein are incorporated into the specification and constitute a part of the specification, showing embodiments consistent with the present disclosure, and together with the specification, are used to explain the principles of the present disclosure. Obviously, the drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0027] Figure 1 A flowchart of an abnormal process detection method according to an exemplary embodiment of the present disclosure is schematically shown;

[0028] Figure 2 Schematically shows a flow chart of determining a feature comparison reference value according to an exemplary embodiment of the present disclosure;

[0029] Figure 3 Schematically shows a tree structure diagram corresponding to a sample process set according to an exemplary embodiment of the present disclosure;

[0030] Figure 4The tree structure diagram schematically shows a command relationship tree corresponding to a sample process set according to an exemplary embodiment of the present disclosure;

[0031] Figure 5 A tree structure diagram schematically shows a user relationship tree corresponding to a sample process set according to an exemplary embodiment of the present disclosure;

[0032] Figure 6 A flowchart of a process for detecting anomalies in a process to be analyzed according to an exemplary embodiment of the present disclosure is schematically shown;

[0033] Figure 7 A block diagram schematically shows an abnormal process detection device according to an exemplary embodiment of the present disclosure;

[0034] Figure 8 A block diagram schematically shows an electronic device according to an exemplary embodiment of the present disclosure;

[0035] Fig. 9 A schematic diagram of a computer-readable storage medium according to an exemplary embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0036] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be comprehensive and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The same reference numerals in the figures represent the same or similar parts, and thus their repeated description will be omitted.

[0037] In addition, the described features, structures or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced without one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known structures, methods, devices, implementations, materials or operations are not shown or described in detail to avoid blurring the various aspects of the present disclosure.

[0038] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or these functional entities or parts of functional entities may be implemented in one or more software hardened modules, or these functional entities may be implemented in different networks and / or processor devices and / or microcontroller devices.

[0039] At present, the field of host abnormal behavior detection and analysis mainly includes two types of technical solutions: network-based intrusion detection and host-based intrusion detection system. The relevant technologies are usually based on statistical or rule matching technology, and detect intrusion behaviors through protocol analysis and behavior analysis. They cannot detect and analyze encrypted traffic, and are more dependent on anomaly rule libraries, and cannot detect and warn of unknown threat behaviors.

[0040] Based on this, in this example embodiment, an abnormal process detection method is first provided. The abnormal process detection method of the present disclosure can be implemented using a server, or the method described in the present disclosure can be implemented using a terminal device, wherein the terminal described in the present disclosure may include mobile terminals such as mobile phones, tablet computers, laptops, PDAs, personal digital assistants (PDAs), and fixed terminals such as desktop computers. Figure 1 The following is a schematic diagram showing the abnormal process detection method according to some embodiments of the present disclosure. Figure 1 , the abnormal process detection method may include the following steps:

[0041] Step S110, obtaining process execution information of the process to be analyzed; the process execution information includes basic process information, execution command information and execution user information;

[0042] Step S120, constructing a process set according to the basic process information; the process set includes a process hierarchical relationship between multiple processes;

[0043] Step S130, adjusting the structure of the process set according to the execution command information and the process hierarchy relationship to obtain a command relationship set, and determining the command relationship feature value corresponding to the command relationship set;

[0044] Step S140, adjusting the structure of the process set according to the execution user information and the process hierarchy relationship to obtain a user relationship set, and determining a user relationship feature value corresponding to the user relationship set;

[0045] Step S150, obtaining a predetermined feature comparison reference value, and comparing the command relationship feature value and the user relationship feature value with the feature comparison reference value respectively to determine abnormal process information.

[0046] According to the abnormal process detection method in this example embodiment, on the one hand, since malicious programs often start multiple processes to perform different intrusion behaviors, it is difficult to analyze the complete behavior and characteristics of malicious processes from the perspective of a single process. This solution constructs a process set through the hierarchical relationship of different processes, and analyzes the startup commands and execution user information of the process running process based on the process set, so as to realize the analysis and detection of abnormal processes. On the other hand, by analyzing the comparison results of the command relationship feature value and the user relationship feature value with the feature comparison reference value, the possibility of abnormal execution of the command corresponding to the process can be determined, and the analysis and detection of abnormal user operation behavior can be realized.

[0047] Next, the abnormal process detection method in this example embodiment will be further described.

[0048] In step S110, the process execution information of the process to be analyzed is obtained; the process execution information includes basic process information, execution command information and execution user information.

[0049] In some exemplary embodiments of the present disclosure, the process to be analyzed may be a process waiting to be analyzed for anomaly detection. The process execution information may be all relevant information required for the execution of the process. The basic process information may be relevant information of the process to be analyzed itself, such as the process name, the process identifier and the process identifier of the corresponding parent process. The execution command information may be relevant information of the execution command corresponding to the process to be analyzed. For example, the execution command information may include the command number and command type corresponding to the process. The execution user information may be relevant information of the execution user corresponding to the process to be analyzed. For example, the execution user information may include the execution user's own information, and may also include information of the user group to which the execution user belongs.

[0050] When analyzing and detecting a process in a running device, the process can be determined as a process to be analyzed. Before the analysis and detection, the process execution information corresponding to the process to be analyzed can be obtained first, and the basic process information, execution command information and execution user information can be extracted from the process execution information. For example, by performing information extraction processing on the process execution information, the process name, process identification number (Process Identifier, PID), parent process identification number (Parent Process Identifier, PPID), process execution user identification number (User Identifier, UID), user group identification number (Group Identifier, GID) and / or execution command data of the process to be analyzed can be obtained.

[0051] In step S120, a process set is constructed according to the basic process information; the process set includes the process hierarchical relationship between multiple processes.

[0052] In some exemplary embodiments of the present disclosure, a process set may be a set generated based on basic process information of a process to be analyzed, and the process set may serve as a basis for analyzing the process to be analyzed, and the process set may include multiple processes. A process hierarchical relationship may be a hierarchical association relationship between multiple processes in a process set. For example, a process set may be stored in a tree structure, and the process hierarchical relationship may include a hierarchical association relationship between a parent process node, a child process node, and a root process node corresponding to the process to be analyzed.

[0053] After obtaining the basic information of the process, a process set can be constructed based on the basic information of the process. Before constructing the process set, pre-configured auxiliary information can also be obtained, for example, pre-configured process whitelists, process type mapping tables and other auxiliary information can be obtained. After obtaining the process whitelist list, the processes in the process whitelist list contained in the process execution information can be filtered out. After the process filtering operation is completed, the process name, PID, PPID and other information of the remaining processes after the filtering operation can be determined, and the process set can be constructed based on the extracted information. For example, the process set can be stored in a tree structure, and the tree structure of the process set is constructed through the PID information and PPID information of the process. Each node in the tree is a process, including the process name, PID (process ID number), PPID (parent process ID number), process execution user UID, user group GID and other information, and the parent node of the tree points to the parent process. The multiple process trees generated by the above construction method eventually generate a process set to be analyzed (process tree set). Since the process set is stored in a tree structure, for example, each element in the set can be a process tree. Therefore, each process tree contains the process hierarchical relationship between the processes contained in the tree.

[0054] In an exemplary embodiment of the present disclosure, historical process data is obtained, and a sample process data set is generated based on the historical process data; the sample process data set includes execution information of multiple sample processes; the execution information includes sample process basic information, sample process command information and sample process user information; a sample process set is constructed based on the sample process basic information; the sample process set includes a sample process hierarchical relationship between multiple sample processes; the sample process set is structurally adjusted based on the sample process command information and the sample process hierarchical relationship to obtain a sample process command set, and a command relationship reference feature value corresponding to the sample process command set is determined; the sample process set is structurally adjusted based on the sample process user information and the sample process hierarchical relationship to obtain a sample process user set, and a user relationship reference feature value corresponding to the sample process user set is determined.

[0055] Among them, the historical process data may be all relevant data of the processes historically run by a certain running device. The sample process data set may be a data set consisting of the sample processes and related information used to determine the feature comparison reference value. The sample process may be a process included in the sample process data set. The execution information of the sample process may be the relevant information included in the sample process execution process. The sample process basic information may be the relevant information of the sample process itself, and the sample process basic information is similar to the process basic information corresponding to the process to be analyzed. The sample process command information may be the relevant information of the execution command corresponding to the sample process, and the sample process command information is similar to the execution command information of the process to be analyzed. The sample process user information may be the relevant information of the execution user corresponding to the process to be analyzed, and the sample process user information is similar to the execution user information of the process to be analyzed.

[0056] The sample process set may be a set formed by multiple sample processes according to a certain hierarchical structure. The sample process hierarchical relationship may be a hierarchical relationship between multiple sample processes. The sample process command set may be a set obtained by structurally adjusting the sample process set according to the association relationship between command types. The command relationship reference characteristic value may be a reference characteristic value corresponding to the sample process command set. The sample process user set may be a set obtained by structurally adjusting the sample process set according to the association relationship between executing users. The user relationship reference characteristic value may be a reference characteristic value corresponding to the sample process user set.

[0057] refer to Figure 2 , Figure 2 The flowchart of determining the feature comparison reference value according to the exemplary embodiment of the present disclosure is schematically shown. In step S210, a sample process data set is determined. Before determining the feature comparison reference value, historical process record data corresponding to certain running devices can be input to generate a sample process data set. Similar to obtaining the process execution information of the process to be analyzed, after obtaining the historical process record data, a data extraction operation can be performed based on the historical process record data to extract information such as the sample process name, sample PID (process ID number), sample PPID (parent process ID number), sample process execution user UID, and sample process user group GID.

[0058] After determining the basic information of the sample process, a sample process set can be constructed based on the basic information of the sample process. For example, the sample process set can be stored in a tree structure, and the constructed sample process set corresponds to the corresponding sample process tree. Before constructing the sample process tree, other auxiliary information can also be obtained, such as a process whitelist list; for example, the process whitelist list can be {command 99, command 98, command 97...}.

[0059] In step S220, a sample process tree is constructed. When constructing the sample process tree, a process whitelist list may be input, and sample processes included in the process whitelist list in the historical process data may be filtered out. Next, the remaining sample processes after filtering are processed as follows: extract information such as the sample process name, sample process PID (process ID number), and sample process PPID (parent process ID number). The sample process tree is constructed using information such as the PID and PPID of the sample process. Each node in the sample process tree is a process node, including information such as the sample process name, PID (process ID number), PPID (parent process ID number), sample process execution user UID, user group GID, and the parent node of the tree points to the parent process. Since multiple sample process trees may be generated in the process of constructing the sample process tree, a set of process trees to be analyzed may be formed based on the multiple sample process trees generated to obtain a final set of sample processes.

[0060] refer to Figure 3 , Figure 3 The tree structure diagram corresponding to the sample process set according to the exemplary embodiment of the present disclosure is schematically shown. Figure 3 The tree structure corresponding to a sample process set is shown in FIG. Figure 3 The sample process set includes 6 sample processes, sample process 1 to sample process 6; wherein sample process 1 is the root node, and the tree structure reflects the sample process hierarchical relationship between the 6 sample processes, for example, the parent process of process 2 is process 1, and the child process is process 3. Similarly, since the sample process set is stored in a tree structure, the sample process set can include the sample process hierarchical relationship between multiple sample processes, for example, the parent-child relationship between two sample processes.

[0061] In an exemplary embodiment of the present disclosure, a first node to be merged is determined based on a process type mapping table and a sample process hierarchical relationship; the first node to be merged is a process node having a parent-child relationship and belonging to the same command type; the first node to be merged is merged, and a tree structure corresponding to the sample process set is adjusted based on the merged process nodes to generate a command relationship tree corresponding to the sample process command set; and a command relationship reference feature value is determined based on the command relationship tree.

[0062] Among them, the process type mapping table can be a mapping relationship between various commands and their corresponding types in the running device. For example, the process type mapping table can be {(command 1, command type 1), (command 2, command type 1), (command 3, command type 2), ..., (command x, command type y)}. The first node to be merged can be a node to be merged determined according to the command type of the process node in the sample process tree. The characteristics of the first node to be merged are that the two nodes have a parent-child relationship and belong to the same command type. The command relationship tree can be a tree structure generated after merging the first node to be merged in the sample process tree and adjusting the tree structure corresponding to the sample process set.

[0063] Obtain the process type mapping table contained in the sample process command information. The process type mapping table may include mapping relationships between various commands of the sample process in the host and their corresponding types, such as {(command 1, command type 1), (command 2, command type 2), (command 3, command type 3)...}. After obtaining the process type mapping table, the tree structure of the sample process set (i.e., the sample process tree) may be adjusted according to the process type mapping table and the hierarchical relationship of the sample process and in combination with the basic information of the sample process to generate a sample process command set. The sample process command set is also stored in a tree structure. Therefore, the sample process command set has a corresponding command relationship tree. The specific construction process of the command relationship tree is as follows:

[0064] Determine the process node in the sample process tree where the child process and the parent process belong to the same command type, and use it as the first node to be merged. The first node to be merged can be merged into the same node. For example, process 1 (pid1) belongs to command type 1, process 2 (pid2) belongs to command type 2, process 3 (pid3), process 4 (pid4), process 5 (pid5) belong to command type 3, and process 6 (pid6) belongs to command type 4. After the above node merging process, a command relationship tree is constructed. Reference Figure 4 , Figure 4 The tree structure diagram of the command relationship tree corresponding to the sample process set according to the exemplary embodiment of the present disclosure is schematically shown. Figure 3 and Figure 4 From the comparison, we can see that pid4 and pid5 are the first nodes to be merged. After the two process nodes are merged, they are converted into one process node. After the above processing, the command relationship tree is finally obtained to determine the command relationship reference feature value corresponding to the command relationship tree.

[0065] In an exemplary embodiment of the present disclosure, a command type root node corresponding to a command relationship tree is obtained; the command relationship tree is traversed based on the command type root node to determine the command relationship process chain contained in the command relationship tree; the command type operand value and the command type hierarchy value corresponding to the command relationship tree are determined; based on the command type operand value and the command type hierarchy value, a command relationship chain value corresponding to the command relationship process chain is determined; and the command relationship reference feature value is determined based on the command relationship chain value.

[0066] The command type root node may be a root process node in the command relationship tree. The command relationship process chain may be a path chain corresponding to the path from the root node to each leaf node in the command relationship tree. The command type operand value may be an operand value corresponding to each command type. For example, the command type operand value may be an operation probability of a certain command type. The command type hierarchy value may be a corresponding probability of a parent-child relationship between two different command types. The command relationship chain value may be a probability value corresponding to each command relationship process chain in the command relationship tree.

[0067] In step S230, feature value calculation. After the command relationship tree is determined, the corresponding feature value can be calculated according to the tree structure of the command relationship tree, including the command type operation value and the command type hierarchy value. Before determining the feature value, the total number of processes included in the sample process data set can be determined first, denoted as n. Among them, the command type operation value includes the command type operation probability, and the command type hierarchy value includes the parent-child relationship probability between command types.

[0068] (1) Calculate the operation probability of the command type, and calculate the probability values ​​of each type of command in the sample process data set, such as p (command type 1), p (command type 2), etc.; among which, the operation probability calculation method of command type 1 is shown in Formula 1.

[0069] p(command type 1) = count(command type 1) / n (Formula 1)

[0070] Wherein, count(command type 1) may be the number of processes of command type 1 in the sample process data set.

[0071] (2) Calculate the probability of the parent-child relationship between command types. Calculate the probability that each command type in the sample process data set is a child process of all command types. That is, command type j is the probability value of the command child process of command type i. For example, type 2 is the probability value of the command child process of type 1 (command type 2|command type 1). The specific calculation method for calculating the probability values ​​of all situations is shown in Formula 2.

[0072]

[0073] Among them, i,j∈[1,y], y is the number of command types.

[0074] In step S240, the command relationship reference feature value of the sample process tree is determined. After the command relationship tree is generated, the command type root node corresponding to the command relationship tree can be determined. Then, starting from the command type root node of the command relationship tree, the command relationship tree is traversed to determine all command relationship process chains contained in the command relationship tree. Before traversing the command relationship tree, the command types corresponding to the sample processes involved in the path from the root node to the leaf node in the command relationship tree can be saved to determine the command relationship process chain; wherein the previous process in each chain is the parent process of the next process. Reference Figure 4 ,from Figure 4 The command relationship process chains determined in the command relationship tree include: (command type 1, command type 2, command type 3); (command type 1, command type 3, command type 4).

[0075] Traverse each command relationship process chain in the command relationship tree and calculate the command relationship chain value corresponding to the command relationship process chain in the command relationship tree. For example, the command relationship process chain (command type 1, command type 2, command type 3), the command relationship chain value corresponding to this chain is recorded as p1, and the specific calculation process of p1 is shown in Formula 3.

[0076] p=p(command type 1)×p(command type 2|command type 1)×p(command type 3|command type 2)

[0077] (Formula 3)

[0078] After determining the command relationship chain value corresponding to each command relationship process chain, determining the command relationship chain values ​​C corresponding to the plurality of command relationship process chains 样 Get the preset error factor α, where α∈(0,10). According to the operating equipment environment setting, the error factor can be set to 0.9. According to the minimum command relationship chain value C 样 The command relationship reference characteristic value C' is determined in detail as shown in Formula 4.

[0079] C'=α×min(C 样 ) (Formula 4)

[0080] In an exemplary embodiment of the present disclosure, a second node to be merged is determined based on sample process user information and a sample process hierarchical relationship; the second node to be merged is a process node that has a parent-child relationship and belongs to the same execution user, or a process node that has a parent-child relationship and belongs to the same execution user group; the second node to be merged is merged, and the tree structure corresponding to the sample process set is adjusted according to the merged process nodes to generate a user relationship tree corresponding to the sample process user set; and the user relationship reference feature value is determined based on the user relationship tree.

[0081] The second node to be merged may be a node to be merged determined according to the executing user for the process node in the sample process tree, and the characteristics of the second node to be merged are that the two nodes have a parent-child relationship and belong to the same executing user, or the two nodes have a parent-child relationship and belong to the same user group. In actual application, one of the methods can be selected to determine the second node to be merged according to the specific scenario requirements. The user relationship tree may be a tree structure generated after merging the second node to be merged in the sample process tree and adjusting the tree structure corresponding to the sample process set.

[0082] After obtaining the sample process user information, the second node to be merged can be determined in the sample process tree based on the sample process user information and the sample process hierarchical relationship, combined with the sample process basic information. For example, based on the sample process name, PID, UID, GID and other information, determine the process node in the sample process tree where the child process and the parent process belong to the same execution user, and use it as the second node to be merged. The second node to be merged is merged into one node to adjust the tree structure corresponding to the sample process tree and generate a user relationship tree.

[0083] For example, in this embodiment, the second node to be merged has a parent-child relationship and belongs to the process node of the same execution user as an example for explanation. Figure 3 In the sample process tree, the execution user of pid1 process is user 1 (user1), the execution user of pid2 process is user 2 (user2), the execution user of pid3 process is user 3 (user3), the execution user of pid4 and pid5 processes is user (user4), and the execution user of pid6 process is user (user5). After the above processing, the user relationship tree is obtained as follows Figure 5 As shown, Figure 5 The tree structure diagram of the user relationship tree corresponding to the sample process set according to the exemplary embodiment of the present disclosure is schematically shown. Figure 5 The user relationship tree contains 5 nodes, according to Figure 3 and Figure 5From the comparison, we can see that the node corresponding to user 4 is obtained by merging the pid4 and pid5 process nodes and converting them into one process node. After obtaining the user relationship tree, the user relationship reference feature value corresponding to the user relationship tree can be further determined.

[0084] It is easy for those skilled in the art to understand that in some other embodiments of the present disclosure, the method for determining the second node to be merged can be configured as a process node having a parent-child relationship and belonging to the same execution user group, and the rest of the merging processing is the same as the above embodiment, and the present disclosure will not elaborate on this.

[0085] In an exemplary embodiment of the present disclosure, a user relationship root node corresponding to a user relationship tree is obtained; the user relationship tree is traversed based on the user relationship root node to determine a user relationship process chain contained in the user relationship tree; a user execution value and a user conversion value corresponding to the user relationship tree are determined; a user relationship chain value corresponding to the user relationship process chain is determined based on the user execution value and the user conversion value; and a user relationship reference feature value is determined based on the user relationship chain value.

[0086] Among them, the user relationship root node may be the root process node in the user relationship tree. The user relationship process chain may be the path chain corresponding to the path from the root node to each leaf node in the user relationship tree. The user execution value may be the operation value corresponding to the execution user executing various commands. For example, the user execution value may be the probability value of user A executing command type 1. The user conversion value may be the probability value of the child process of the process executed by a specific execution user still being the execution user. The user relationship chain value may be the probability value corresponding to each user relationship process chain in the user relationship tree.

[0087] Continue to refer Figure 2 Before determining the user relationship reference characteristic value corresponding to the user relationship tree, a characteristic value may be calculated in step S230. For example, the characteristic value of the user relationship tree is calculated according to the tree structure of the user relationship tree, including the user execution value and the user conversion value. Specifically, the user execution value may be the user execution probability, which is the probability value of each executing user executing various commands; the user conversion value may be the user-to-user conversion probability, which may be the probability that the subprocess of the process executed by a specific executing user is still the specific user.

[0088] (1) Calculate the user execution probability. Calculate the probability of each user executing each type of command in the sample process data set. For example, the probability of user 1 executing a command is p(user1). The calculation method of p(user1) is shown in Formula 5. The same method is used to calculate the probability of each user executing each type of command.

[0089]

[0090] (2) Calculate the probability of transition between users. Calculate the probability that the child process of a process executed by a specific executing user in the sample process data set is the executing user. For example, process 2 is a child process of process 1, where the executing user of process 2 is user2 and the executing user of process 1 is user1. Then the transition probability value of user1 relative to user2 is p(user2|user1). The calculation method of p(user2|user1) is shown in Formula 6. Traverse all situations and use the same calculation method to obtain the transition probability values ​​of all users.

[0091]

[0092] In step S250, the user relationship reference feature value of the sample process tree is determined. After obtaining the user relationship tree, the user relationship root node corresponding to the user relationship tree can be determined. Starting from the user relationship root node, the user relationship tree is traversed. Before traversing the command relationship tree, the relevant information of the executing user involved in the path from the root node to the leaf node in the user relationship tree can be saved to determine the user relationship process chain; wherein the previous process in each chain is the parent process of the next process. Reference Figure 5 ,from Figure 5 The user relationship process chains determined in the user relationship tree include: (user1, user2, user3); (user1, user4, user5).

[0093] Traverse each user relationship process chain in the user relationship tree and calculate the user relationship chain value corresponding to the user relationship process chain in the user relationship tree, that is, the user relationship chain probability. For example, the calculation method of the user relationship chain probability p corresponding to the user relationship process chain (user1, user2, user3) is shown in Formula 7.

[0094] p=p(user1)×p(user2|user1)×p(user3|user2) (Formula 7)

[0095] After determining the user relationship chain value corresponding to each user relationship process chain, multiple user relationship chain values ​​U can be determined. 样 The minimum value of . Obtain a preset error factor α, where the error factor α is the same as the error factor used when determining the command relationship reference feature value. According to the minimum user relationship chain value U 样 The user relationship reference characteristic value U' can be determined. The calculation method of the user relationship reference characteristic value U' is shown in Formula 8,

[0096] U'=α×min(U 样 ) (Formula 8)

[0097] In step S130, the process set is structurally adjusted according to the execution command information and the process hierarchical relationship to obtain a command relationship set, and a command relationship feature value corresponding to the command relationship set is determined.

[0098] In some exemplary embodiments of the present disclosure, the command relationship set may be a set obtained by adjusting the structure of the process set according to the command type corresponding to the process to be analyzed. The command relationship feature value may be a feature value corresponding to the command relationship set.

[0099] refer to Figure 6 , Figure 6 The flowchart of the process of performing anomaly detection on the process to be analyzed according to an exemplary embodiment of the present disclosure is schematically shown. In step S610, the process execution information of the process to be analyzed is obtained. After the process execution information is obtained, a process set can be generated based on the process execution information, and the process set is stored in a tree structure, that is, a process tree to be analyzed. This process has been described in detail above and will not be repeated here.

[0100] In step S620, the characteristic value of the process to be analyzed is determined. For the process to be analyzed, the tree structure of the process tree to be analyzed can be adjusted according to the execution command information and the process hierarchy relationship in the process tree to be analyzed to obtain a command relationship tree corresponding to the command relationship set. The command relationship tree corresponding to the command relationship set is generated in the same way as the command relationship tree corresponding to the sample process command set described above, and will not be repeated here.

[0101] After generating the command relationship tree corresponding to the command relationship set, the command relationship feature value corresponding to the command relationship set can be determined based on the command relationship tree corresponding to the command relationship set. Specifically, the command relationship feature value is also calculated based on the command type operation probability of the process tree to be analyzed, the probability of the parent-child relationship between command types, and other feature values. The calculation process will not be repeated here.

[0102] In step S140, the process set is structurally adjusted according to the execution user information and the process hierarchical relationship to obtain a user relationship set, and a user relationship feature value corresponding to the user relationship set is determined.

[0103] In some exemplary embodiments of the present disclosure, the user relationship set is a set obtained by adjusting the structure of the process set according to the executing user corresponding to the process to be analyzed. The user relationship feature value may be a feature value corresponding to the user relationship set.

[0104] In step S620, the characteristic value of the process to be analyzed is determined. For the process to be analyzed, the tree structure of the process tree to be analyzed can be adjusted according to the executing user information and the process hierarchy relationship in the process tree to be analyzed to obtain a user relationship tree corresponding to the user relationship set. The user relationship tree corresponding to the user relationship set is generated in the same way as the user relationship tree corresponding to the sample process command set above, and will not be repeated here.

[0105] After generating the user relationship tree corresponding to the user relationship set, the user relationship feature value corresponding to the user relationship set can be determined based on the user relationship tree corresponding to the user relationship set. Specifically, the user relationship feature value is also calculated based on the feature values ​​of the user execution probability and the user-to-user conversion probability of the process tree to be analyzed, and the calculation process will not be described in detail here.

[0106] In step S150, a predetermined feature comparison reference value is obtained, and the command relationship feature value and the user relationship feature value are respectively compared with the feature comparison reference value to determine abnormal process information.

[0107] In some exemplary embodiments of the present disclosure, the feature comparison reference value may be a reference value for comparing the command relationship feature value with the user relationship feature value. The abnormal process information may be all relevant information corresponding to the abnormal process, such as the PID, UID and corresponding alarm event of the abnormal process.

[0108] In step S630, the abnormal state of the process is detected. The feature comparison reference value determined by the above steps is obtained, and the feature comparison reference value may include a command relationship reference feature value and a user relationship reference feature value. Then, the command relationship feature value is numerically compared with the command relationship reference feature value, and the user relationship feature value is numerically compared with the user relationship reference feature value, and the numerical comparison result is determined, and the abnormal process information is determined according to the obtained numerical comparison result.

[0109] In an exemplary embodiment of the present disclosure, if the command relationship characteristic value is greater than the command characteristic reference value, and the user relationship characteristic value is greater than the user relationship characteristic reference value, it is determined that the process to be analyzed is running normally; if the command relationship characteristic value is greater than the command characteristic reference value, and the user relationship characteristic value is less than the user relationship characteristic reference value, it is determined that the user behavior of the executing user of the process to be analyzed is abnormal, and a first alarm event is output; if the command relationship characteristic value is less than the command characteristic reference value, and the user relationship characteristic value is greater than the user relationship characteristic reference value, it is determined that there is an abnormality in the process execution of the process to be analyzed, and a second alarm event is output; if the command relationship characteristic value is less than the command characteristic reference value, and the user relationship characteristic value is less than the user relationship characteristic reference value, it is determined that there is an abnormality in the running device corresponding to the process to be analyzed, and a third alarm event is output.

[0110] The first alarm event may be an alarm event corresponding to an abnormality in the user behavior of the executing user. The second alarm event may be an alarm event corresponding to an abnormality in the execution process of the process to be analyzed. The third alarm event may be an alarm event corresponding to an abnormality in the running device (such as a host) corresponding to the process to be analyzed.

[0111] The command relationship feature value C is compared with the command relationship reference feature value C', and the user relationship feature value U is compared with the user relationship reference feature value U', and the specific content of the corresponding abnormal process information is determined according to the comparison results as follows:

[0112] If C-C'>0 and U-U'>0, the host process is considered to be running normally and no alarm event is output.

[0113] If C-C'>0 and U-U'<0, the user behavior of the host execution process is considered to be risky, and a level A alarm event is output.

[0114] If C-C'<0 and U-U'>0, the host process execution is considered to be at risk, and a Level B alarm event is output.

[0115] If C-C'<0 and U-U'<0, the host is considered to have an operation risk and a level C alarm event is output.

[0116] Furthermore, the levels of alarm events A / B / C can be defined according to the application scenario. For example, the abnormal level corresponding to alarm event C can be set to high, the abnormal level corresponding to alarm event B can be set to medium, and the abnormal level corresponding to alarm event A can be set to low.

[0117] In summary, the process execution information of the process to be analyzed is obtained; the process execution information includes basic process information, execution command information and execution user information; a process set is constructed according to the basic process information; the process set includes the process hierarchical relationship between multiple processes; the process set is structurally adjusted according to the execution command information and the process hierarchical relationship to obtain a command relationship set, and the command relationship feature value corresponding to the command relationship set is determined; the process set is structurally adjusted according to the execution user information and the process hierarchical relationship to obtain a user relationship set, and the user relationship feature value corresponding to the user relationship set is determined; a predetermined feature comparison reference value is obtained, and the command relationship feature value and the user relationship feature value are respectively compared with the feature comparison reference value to determine the abnormal process information. On the one hand, since malicious programs often perform different intrusion behaviors by starting multiple processes, it is difficult to analyze the complete behavior and characteristics of malicious processes from the perspective of a single process. This solution constructs a process set through the hierarchical relationship of different processes, and analyzes the startup command and execution user information of the process running process based on the process set, so as to realize the analysis and detection of abnormal processes. On the other hand, by classifying process commands in combination with the device operating environment, calculating the conversion probability of the parent-child relationship between various processes, and analyzing the process command relationship characteristics, the calculation of the abnormal probability value of command execution in the device operating environment can be realized. On the other hand, based on the execution user information of the process, a user relationship tree is constructed in combination with the process tree structure, and then based on the conversion relationship between the parent and child processes of the executing user in the host operating environment, the calculation and detection of abnormal user operation behavior of the host can be realized.

[0118] It should be noted that, although the steps of the method of the present invention are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0119] In addition, in this exemplary embodiment, an abnormal process detection device is also provided. Figure 7 The abnormal process detection device 700 may include: an information acquisition module 710, a process set construction module 720, a command value determination module 730, a user value determination module 740 and an abnormality detection module 750.

[0120] Specifically, the information acquisition module 710 is used to obtain the process execution information of the process to be analyzed; the process execution information includes the basic process information, the execution command information and the execution user information; the process set construction module 720 is used to construct the process set according to the basic process information; the process set includes the process hierarchical relationship between multiple processes; the command value determination module 730 is used to adjust the structure of the process set according to the execution command information and the process hierarchical relationship, obtain the command relationship set, and determine the command relationship feature value corresponding to the command relationship set; the user value determination module 740 is used to adjust the structure of the process set according to the execution user information and the process hierarchical relationship, obtain the user relationship set, and determine the user relationship feature value corresponding to the user relationship set; the anomaly detection module 750 is used to obtain a predetermined feature comparison reference value, and compare the command relationship feature value and the user relationship feature value with the feature comparison reference value respectively to determine the abnormal process information.

[0121] In an exemplary embodiment of the present disclosure, the feature comparison reference value includes a command relationship reference feature value and a user relationship reference feature value, and the abnormal process detection module also includes a reference feature value determination module, which is used to obtain historical process data and generate a sample process data set based on the historical process data; the sample process data set includes execution information of multiple sample processes; the execution information includes sample process basic information, sample process command information and sample process user information; a sample process set is constructed based on the sample process basic information; the sample process set includes a sample process hierarchical relationship between multiple sample processes; the sample process set is structurally adjusted according to the sample process command information and the sample process hierarchical relationship to obtain a sample process command set, and the command relationship reference feature value corresponding to the sample process command set is determined; the sample process set is structurally adjusted according to the sample process user information and the sample process hierarchical relationship to obtain a sample process user set, and the user relationship reference feature value corresponding to the sample process user set is determined.

[0122] In an exemplary embodiment of the present disclosure, the sample process command information includes a process type mapping table; the sample process set is stored in a tree structure; the reference characteristic value determination module includes a command reference value determination unit, which is used to determine the first node to be merged according to the process type mapping table and the sample process hierarchical relationship; the first node to be merged is a process node with a parent-child relationship and belonging to the same command type; the first node to be merged is merged, and the tree structure corresponding to the sample process set is adjusted according to the merged process node to generate a command relationship tree corresponding to the sample process command set; the command relationship reference characteristic value is determined according to the command relationship tree.

[0123] In an exemplary embodiment of the present disclosure, a command reference value determination unit includes a command reference value determination sub-unit, which is used to obtain a command type root node corresponding to a command relationship tree; traverse the command relationship tree based on the command type root node to determine the command relationship process chain contained in the command relationship tree; determine the command type operation value and the command type hierarchy value corresponding to the command relationship tree; determine the command relationship chain value corresponding to the command relationship process chain according to the command type operation value and the command type hierarchy value; and determine the command relationship reference feature value according to the command relationship chain value.

[0124] In an exemplary embodiment of the present disclosure, the sample process set is stored in a tree structure; the reference feature value determination module includes a user reference value determination unit, which is used to determine the second node to be merged according to the sample process user information and the sample process hierarchical relationship; the second node to be merged is a process node that has a parent-child relationship and belongs to the same execution user, or a process node that has a parent-child relationship and belongs to the same execution user group; the second node to be merged is merged, and the tree structure corresponding to the sample process set is adjusted according to the merged process nodes to generate a user relationship tree corresponding to the sample process user set; and the user relationship reference feature value is determined according to the user relationship tree.

[0125] In an exemplary embodiment of the present disclosure, a user reference value determination unit includes a user reference value determination sub-unit, which is used to obtain a user relationship root node corresponding to a user relationship tree; traverse the user relationship tree based on the user relationship root node to determine a user relationship process chain contained in the user relationship tree; determine a user execution value and a user conversion value corresponding to the user relationship tree; determine a user relationship chain value corresponding to the user relationship process chain based on the user execution value and the user conversion value; and determine a user relationship reference feature value based on the user relationship chain value.

[0126] In an exemplary embodiment of the present disclosure, the anomaly detection module includes an anomaly detection unit, which is used to determine that the process to be analyzed is running normally if the command relationship characteristic value is greater than the command characteristic reference value and the user relationship characteristic value is greater than the user relationship characteristic reference value; if the command relationship characteristic value is greater than the command characteristic reference value and the user relationship characteristic value is less than the user relationship characteristic reference value, it is determined that the user behavior of the executing user of the process to be analyzed is abnormal, and a first alarm event is output; if the command relationship characteristic value is less than the command characteristic reference value and the user relationship characteristic value is greater than the user relationship characteristic reference value, it is determined that there is an abnormality in the process execution of the process to be analyzed, and a second alarm event is output; if the command relationship characteristic value is less than the command characteristic reference value and the user relationship characteristic value is less than the user relationship characteristic reference value, it is determined that there is an abnormality in the running device corresponding to the process to be analyzed, and a third alarm event is output.

[0127] The specific details of the virtual modules of each abnormal process detection device mentioned above have been described in detail in the corresponding abnormal process detection method, so they will not be repeated here.

[0128] It should be noted that although several modules or units of the abnormal process detection device are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0129] In addition, in an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above method is also provided.

[0130] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as systems, methods or program products. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: complete hardware embodiments, complete software embodiments (including firmware, microcode, etc.), or embodiments combining hardware and software aspects, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0131] Reference below Figure 8 800 according to this embodiment of the present disclosure is described. Figure 8 The electronic device 800 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0132] like Figure 8 As shown, the electronic device 800 is in the form of a general computing device. The components of the electronic device 800 may include, but are not limited to: the at least one processing unit 810, the at least one storage unit 820, a bus 830 connecting different system components (including the storage unit 820 and the processing unit 810), and a display unit 840.

[0133] The storage unit stores program codes, which can be executed by the processing unit 810, so that the processing unit 810 executes the steps according to various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification.

[0134] The storage unit 820 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 821 and / or a cache memory unit 822 , and may further include a read-only memory unit (ROM) 823 .

[0135] The storage unit 820 may include a program / utility 824 having a set (at least one) of program modules 825, such program modules 825 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include the implementation of a network environment.

[0136] Bus 830 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0137] The electronic device 800 may also communicate with one or more external devices 870 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 800, and / or communicate with any device that enables the electronic device 800 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 850. Furthermore, the electronic device 800 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 860. As shown, the network adapter 860 communicates with other modules of the electronic device 800 via a bus 830. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 800, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0138] Through the description of the above embodiments, it is easy for those skilled in the art to understand that the example embodiments described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the embodiment of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiment of the present disclosure.

[0139] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible embodiments, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to perform the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0140] refer to Fig. 9 As shown, a program product 900 for implementing the above method according to an embodiment of the present invention is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0141] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0142] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0143] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0144] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., through the Internet using an Internet service provider).

[0145] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0146] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are to be considered as exemplary only, and the true scope and spirit of the present disclosure are indicated by the claims.

[0147] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for detecting abnormal processes, characterized in that: include: Get the process execution information of the process to be analyzed; The process execution information includes basic process information, execution command information and execution user information; Constructing a process set according to the basic process information; the process set includes a process hierarchical relationship between multiple processes; According to the execution command information and the process hierarchical relationship, the process set is structurally adjusted to obtain a command relationship set, and a command relationship feature value corresponding to the command relationship set is determined; According to the execution user information and the process hierarchical relationship, the process set is structurally adjusted to obtain a user relationship set, and a user relationship feature value corresponding to the user relationship set is determined; Obtaining a predetermined feature comparison reference value, and comparing the command relationship feature value and the user relationship feature value with the feature comparison reference value respectively to determine abnormal process information, wherein the feature comparison reference value includes a command relationship reference feature value and a user relationship reference feature value; The feature comparison reference value is determined by the following steps: acquiring historical process data, and generating a sample process data set according to the historical process data; the sample process data set includes execution information of a plurality of sample processes; the execution information includes basic information of the sample process, command information of the sample process, and user information of the sample process; Constructing a sample process set according to the basic information of the sample process; the sample process set includes a sample process hierarchical relationship between multiple sample processes; Adjusting the structure of the sample process set according to the sample process command information and the sample process hierarchical relationship to obtain a sample process command set, and determining a command relationship reference feature value corresponding to the sample process command set; The sample process set is structurally adjusted according to the sample process user information and the sample process hierarchical relationship to obtain a sample process user set, and a user relationship reference feature value corresponding to the sample process user set is determined.

2. The method according to claim 1, characterized in that The sample process command information includes a process type mapping table; the sample process set is stored in a tree structure; The sample process set is structurally adjusted according to the sample process command information and the sample process hierarchical relationship to obtain a sample process command set, and a command relationship reference feature value corresponding to the sample process command set is determined, including: Determine a first node to be merged according to the process type mapping table and the hierarchical relationship of the sample process; the first node to be merged is a process node having a parent-child relationship and belonging to the same command type; Performing a merging process on the first nodes to be merged, and adjusting the tree structure corresponding to the sample process set according to the merged process nodes to generate a command relationship tree corresponding to the sample process command set; The command relationship reference feature value is determined according to the command relationship tree.

3. The method according to claim 2, characterized in that Determining the command relationship reference feature value according to the command relationship tree includes: Obtaining a command type root node corresponding to the command relationship tree; Traversing the command relationship tree based on the command type root node, determining a command relationship process chain included in the command relationship tree; Determine the command type operation value and the command type hierarchy value corresponding to the command relationship tree; Determine a command relationship chain value corresponding to the command relationship process chain according to the command type operation value and the command type hierarchy value; The command relationship reference characteristic value is determined according to the command relationship chain value.

4. The method according to claim 1, characterized in that: The sample process set is stored in a tree structure; The sample process set is structurally adjusted according to the sample process user information and the sample process hierarchical relationship to obtain a sample process user set, and a user relationship reference feature value corresponding to the sample process user set is determined, including: Determine a second node to be merged according to the sample process user information and the sample process hierarchical relationship; the second node to be merged is a process node that has a parent-child relationship and belongs to the same execution user, or a process node that has a parent-child relationship and belongs to the same execution user group; Performing merging processing on the second nodes to be merged, and adjusting the tree structure corresponding to the sample process set according to the merged process nodes, so as to generate a user relationship tree corresponding to the sample process user set; The user relationship reference feature value is determined according to the user relationship tree.

5. The method according to claim 4, characterized in that Determining the user relationship reference feature value according to the user relationship tree includes: Obtaining a user relationship root node corresponding to the user relationship tree; Traversing the user relationship tree based on the user relationship root node to determine a user relationship process chain included in the user relationship tree; Determine a user execution value and a user conversion value corresponding to the user relationship tree; Determining a user relationship chain value corresponding to the user relationship process chain according to the user execution value and the user conversion value; The user relationship reference feature value is determined according to the user relationship chain value.

6. The method according to claim 1, characterized in that Comparing the command relationship feature value and the user relationship feature value with the feature comparison reference value respectively to determine abnormal process information, including: If the command relationship feature value is greater than the command relationship reference feature value, and the user relationship feature value is greater than the user relationship reference feature value, it is determined that the process to be analyzed is running normally; If the command relationship feature value is greater than the command relationship reference feature value, and the user relationship feature value is less than the user relationship reference feature value, it is determined that the user behavior of the executing user of the process to be analyzed is abnormal, and a first alarm event is output; If the command relationship feature value is less than the command relationship reference feature value, and the user relationship feature value is greater than the user relationship reference feature value, it is determined that there is an abnormality in the process execution of the process to be analyzed, and a second alarm event is output; If the command relationship feature value is smaller than the command relationship reference feature value, and the user relationship feature value is smaller than the user relationship reference feature value, it is determined that an abnormality exists in the running device corresponding to the process to be analyzed, and a third alarm event is output.

7. An abnormal process detection device, characterized in that: include: An information acquisition module, used to obtain process execution information of the process to be analyzed; The process execution information includes basic process information, execution command information and execution user information; A process set building module, used to build a process set according to the basic information of the process; the process set includes a process hierarchical relationship between multiple processes; A command value determination module, configured to perform structural adjustment on the process set according to the execution command information and the process hierarchical relationship, obtain a command relationship set, and determine a command relationship characteristic value corresponding to the command relationship set; A user value determination module, configured to perform structural adjustment on the process set according to the execution user information and the process hierarchical relationship, obtain a user relationship set, and determine a user relationship feature value corresponding to the user relationship set; an abnormality detection module, used to obtain a predetermined feature comparison reference value, and compare the command relationship feature value and the user relationship feature value with the feature comparison reference value respectively to determine abnormal process information, wherein the feature comparison reference value includes a command relationship reference feature value and a user relationship reference feature value; The anomaly detection module is further used to obtain historical process data and generate a sample process data set according to the historical process data; the sample process data set includes execution information of multiple sample processes; the execution information includes sample process basic information, sample process command information and sample process user information; Constructing a sample process set according to the basic information of the sample process; the sample process set includes a sample process hierarchical relationship between multiple sample processes; Adjusting the structure of the sample process set according to the sample process command information and the sample process hierarchical relationship to obtain a sample process command set, and determining a command relationship reference feature value corresponding to the sample process command set; The sample process set is structurally adjusted according to the sample process user information and the sample process hierarchical relationship to obtain a sample process user set, and a user relationship reference feature value corresponding to the sample process user set is determined.

8. An electronic device, characterized in that: include: processor; as well as A memory having computer-readable instructions stored thereon, wherein the computer-readable instructions, when executed by the processor, implement the abnormal process detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the abnormal process detection method according to any one of claims 1 to 6 is implemented.

Images