Behavioral safety baseline rule compilation method, device, equipment and storage medium

Abstract

The embodiments of the present invention provide a rule compilation method, device, equipment and storage medium for a behavioral security baseline. The method includes: parsing the rules of at least one behavioral security baseline to obtain the data structure of each rule; the data structure includes at least one of the following: rule name, rule identification ID, operation parameters, processing node; generating a rule subgraph corresponding to each rule according to the data structure of each rule; fusing each rule subgraph to obtain a target execution graph; generating executable code based on the target execution graph. The above scheme improves the efficiency of rule use.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a rule compilation method, device, equipment and storage medium for a behavioral security baseline. Background Art

[0002] With the development of technology and the spread of knowledge, the methods and number of network attacks have also increased significantly. Various new attack methods have emerged one after another, bringing great challenges and pressure to security analysts and products.

[0003] Traditional security analysis and detection methods are based on prior knowledge and use features to perform security detection on network data and logs. This method can deal with known attack methods well, but cannot effectively detect unknown and new attack methods and cannot adapt to the current severe network security situation.

[0004] In recent years, with the development of machine learning and the rise of real-time computing frameworks, the user's behavioral security baseline can be obtained by learning network data and logs. The learned behavioral security baseline can then be used as benchmark data for abnormal behavior analysis and detection to analyze and detect abnormal behavior. Summary of the invention

[0005] The embodiment of the present invention provides a rule compilation method, apparatus, device and storage medium of a behavior security baseline to implement the rule compilation method of the behavior security baseline.

[0006] Specifically, the embodiment of the present invention provides the following technical solutions:

[0007] In a first aspect, an embodiment of the present invention provides a method for compiling rules of a behavioral security baseline, comprising:

[0008] Parse the rules of at least one behavioral security baseline to obtain a data structure of each rule; the data structure includes at least one of the following: a rule name, a rule ID, an operating parameter, and a processing node;

[0009] Generate a rule subgraph corresponding to each rule according to the data structure of each rule;

[0010] The rule subgraphs are fused to obtain a target execution graph;

[0011] Executable code is generated based on the target execution graph.

[0012] Optionally, parsing the rules of at least one behavioral security baseline to obtain a data structure of each rule includes:

[0013] Each of the rules is parsed according to the semantic format and / or parameter format of the rule to obtain the data structure of each of the rules.

[0014] Optionally, generating a rule subgraph corresponding to each rule according to the data structure of each rule includes:

[0015] A rule subgraph corresponding to each of the rules is generated according to the operation parameters and the configuration information of the predecessor node and the successor node of the processing node, wherein each of the processing nodes corresponds to a node in the rule subgraph.

[0016] Optionally, generating executable code based on the target execution graph includes:

[0017] Generate executable code corresponding to all nodes in the target execution graph; and / or

[0018] Generate executable code corresponding to the data flow of the target execution graph; and / or

[0019] Generate executable code corresponding to the message flow according to the running parameter information of the message node related to the target execution graph; the message node includes at least one of the following: a message publishing node, a message processing node, a message feedback node; and / or

[0020] According to the semantics of the target execution graph, executable code is generated that maps the target execution graph to an underlying computing framework.

[0021] Optionally, the processing node parameter includes at least one of the following: node ID, node name, node operation parameter, node processing mode;

[0022] The generating executable codes corresponding to all nodes in the target execution graph includes:

[0023] According to the parameters of the processing node, executable codes corresponding to all nodes in the target execution graph are generated, and the executable codes include: node attribute codes, and / or node processing logic codes.

[0024] Optionally, the generating of the executable code corresponding to the data flow of the target execution graph includes:

[0025] The executable code corresponding to the data flow is generated according to the connection information between the nodes in the target execution graph, and the executable code corresponding to the data flow is used to send input data from the current node to the successor node; the connection information is determined according to the configuration information of the predecessor node and the successor node of the processing node.

[0026] Optionally, generating executable code corresponding to the message flow according to the message configuration information related to the target execution graph includes:

[0027] A message data flow pipeline is constructed from a message publishing node, a message processing node to a message feedback node in sequence, and an executable code corresponding to the message flow is generated. The executable code is used to process the message flow in the data flow pipeline.

[0028] Optionally, after generating the executable codes corresponding to all nodes in the target execution graph, the method further includes:

[0029] The executable code corresponding to the node in the target execution graph is optimized, including at least one of the following: constant statement preprocessing, equivalent statement logical merging, and common statement merging.

[0030] Optionally, the fusing of the rule subgraphs to obtain a target execution graph includes:

[0031] The rule subgraphs are merged, and the entry nodes are merged to obtain an execution graph;

[0032] Optimizing the execution graph to obtain a target execution graph, wherein the optimization includes at least one of the following:

[0033] According to the characteristics of the data flow, the execution graph is optimized for data flow;

[0034] Performing field optimization processing on the data fields in the execution graph, wherein the field optimization processing includes at least one of the following: field calculation, field clipping or field merging;

[0035] Resource optimization processing is performed on the resources referenced by the execution graph.

[0036] Optionally, the data flow optimization processing includes at least one of the following: semantically equivalent node fusion, network throughput balancing, intermediate node merging, or egress node merging;

[0037] The resource optimization process includes at least one of the following:

[0038] When the referenced resource is a table, performing index optimization processing;

[0039] Reference to a semantically equivalent union of said resource; or,

[0040] References to equivalent instances of the resource are merged.

[0041] In a second aspect, an embodiment of the present invention provides a rule compilation device for a behavior security baseline, including:

[0042] An acquisition module, used to parse the rules of at least one behavioral security baseline to obtain a data structure of each rule; the data structure includes at least one of the following: a rule name, a rule ID, an operation parameter, and a processing node;

[0043] A processing module, used for generating a rule subgraph corresponding to each rule according to the data structure of each rule;

[0044] The processing module is further used to fuse the rule subgraphs to obtain a target execution graph;

[0045] Executable code is generated based on the target execution graph.

[0046] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the browser access authorization method described in the first aspect are implemented.

[0047] In a fourth aspect, an embodiment of the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of the browser access authorization method described in the first aspect are implemented.

[0048] In a fifth aspect, an embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the browser access authorization method as described in the first aspect.

[0049] The rule compilation method, apparatus, device and storage medium of the behavioral security baseline provided in the embodiments of the present invention parse the rules of at least one behavioral security baseline to obtain the data structure of each rule; generate a rule subgraph corresponding to each rule according to the data structure of each rule; fuse each rule subgraph to obtain a target execution graph; generate executable code based on the target execution graph, and generate executable code based on the execution graph, so as to improve the accuracy and efficiency of rule compilation, and because the rules are converted into executable code, the efficiency and convenience of rule application are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0051] Figure 1This is one of the flow charts of the rule compilation method of the behavior security baseline provided by the embodiment of the present invention;

[0052] Figure 2 It is an implementation framework diagram of a rule compilation method for a behavioral security baseline provided by an embodiment of the present invention;

[0053] Figure 3 This is the second flow chart of the rule compilation method of the behavior security baseline provided by the embodiment of the present invention;

[0054] Figure 4 is an example diagram of a rule parsing process provided by an embodiment of the present invention;

[0055] Figure 5 It is a schematic diagram of a regular subgraph conversion process provided by an embodiment of the present invention;

[0056] Figure 6 It is a structural schematic diagram of a rule compilation device for a behavior safety baseline provided by the present invention;

[0057] Figure 7 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0059] In the embodiment of the present invention, the behavioral security baseline refers to the one obtained based on the user's behavioral data. The user's behavioral data may include the time, quantity, user behavior, traffic usage, etc. The behavioral security baseline is usually obtained in time periods. The behavioral security baseline may represent the behavioral data of each user behavior in at least one user behavior occurring in at least one time period within a preset time range for one or more users.

[0060] In the process of studying the rules of the behavioral security baseline, the inventors found that: in order to adapt to different security analysis scenarios, the rules of the behavioral security baseline for various scenarios can be flexibly configured, and then the input behavior data can be processed based on the rules corresponding to the input behavior data, so that the application scenarios of the behavioral security baseline are wider. In order to further improve the efficiency of using the rules of the behavioral security baseline, the following scheme is proposed in an embodiment of the present invention: the rules of the behavioral security baseline are compiled and processed. First, the rules of the behavioral security baseline are parsed to obtain the data structure of the rules, and then the data structure of the rules is converted into a graph, and executable code is generated according to the graph.

[0061] Combine the following Figure 1-Figure 5 The technical solution of the embodiment of the present invention is described in detail with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0062] Figure 1 This is one of the flow charts of the rule compilation method of the behavior security baseline provided by the embodiment of the present invention. Figure 1 As shown, the method provided in this embodiment includes:

[0063] Step 101: parse at least one rule of a behavioral security baseline to obtain a data structure of each rule; the data structure includes at least one of the following: a rule name, a rule ID, an operating parameter, and a processing node;

[0064] Specifically, the rules of the behavioral security baseline are composed of a rule header and a rule body. Optionally, the rules are described and defined in JSON language. The rules of the behavioral security baseline can configure the parameter configuration information of each node in the data processing process and the relationship between each node.

[0065] Table 1 Rule Header

[0066] Parameter name Parameter Description id Rule ID, define the rule ID value

[0067] Table 2 Rule body

[0068]

[0069] The next node refers to the node to which the current node outputs the processed data, and the next node can be one or more.

[0070] The processing node includes, for example, at least one of the following: a data input node, a time configuration node, a filtering node, a time window node, a grouping node, a noise reduction node, a baseline generation node, a baseline detection node, and a data output node.

[0071] Table 3 Node definition

[0072]

[0073]

[0074] Optionally, the above processing node may also include multiple instances.

[0075] The rules of at least one behavioral security baseline are parsed to obtain a data structure of each rule; the data structure includes at least one of the following: a rule name, a rule identification ID, an operating parameter, and a processing node.

[0076] The operation parameters include, for example, at least one of the following: input and output parameters and processing methods of each node;

[0077] Optionally, the data in the above data processing process includes behavioral data, editing data of the behavioral safety baseline, etc. For example, in the process of abnormal behavior analysis and detection, some operations are usually performed on the behavioral safety baseline. The data of these operations can be called editing data of the behavioral safety baseline, such as updating, deleting and other operation data of the behavioral safety baseline.

[0078] Step 102: Generate a rule subgraph corresponding to each rule according to the data structure of each rule;

[0079] Specifically, based on the data structure of each rule obtained by parsing, a rule subgraph corresponding to the parsed rule is generated. The rule subgraph includes nodes and connection relationships between nodes. The parameters of the node include at least one of the following: node ID, node name, node operation parameters, and node processing method.

[0080] Step 103: fuse each rule subgraph to obtain a target execution graph;

[0081] Specifically, each rule subgraph is fused to obtain a target execution graph. For example, multiple rule subgraphs are fused, and repeated nodes are merged, especially entry nodes are merged to obtain a target execution graph.

[0082] Step 104: Generate executable code based on the target execution graph.

[0083] Specifically, executable codes may be generated based on the target execution graph, for example, the target execution graph may be divided into different parts, and executable codes may be generated for different parts respectively. For example, nodes in the target execution graph may be divided into one category, data flows may be divided into one category, and so on.

[0084] Optionally, the executable code may be Java code.

[0085] The method of this embodiment parses the rules of at least one behavioral security baseline to obtain the data structure of each rule; generates a rule subgraph corresponding to each rule based on the data structure of each rule; fuses each rule subgraph to obtain a target execution graph; generates executable code based on the target execution graph, and generates executable code based on the execution graph, which improves the accuracy and efficiency of rule compilation, and because the rules are converted into executable codes, the efficiency and convenience of rule application are improved.

[0086] Optionally, the method of the embodiment of the present invention can be Figure 2 The framework implementation in Figure 3 As shown, the method includes:

[0087] Get <behavioral safety baseline rule set>;

[0088] The rule loader loads all rules in the <Behavioral Security Baseline Rule Set> and parses them;

[0089] The graph generator converts the parsed rules into rule subgraphs;

[0090] The graph optimizer converts the rule subgraph into a target execution graph, and the optimization process can be executed during the conversion process;

[0091] The code generator generates executable code from the target execution graph.

[0092] In one embodiment, step 101 may be implemented in the following manner:

[0093] Each of the rules is parsed according to the semantic format and / or parameter format of the rule to obtain the data structure of each of the rules.

[0094] Specifically, each rule is parsed according to the semantic format and / or parameter format of the rule to obtain the data structure of each rule.

[0095] For example, Figure 4 As shown, the method comprises the following steps:

[0096] Get <behavioral safety baseline rule set>;

[0097] Traverse the <Behavioral Security Baseline Rule Set> and perform loading operations for each rule: parse the configuration information corresponding to the rules of the behavioral security baseline, including the semantic format and / or parameter format. If the semantic format and parameter format of the rule are incorrect, an error is reported and the rule loading is stopped. Otherwise, the data structure of the loaded rule is saved. The rule data structure can also be called the rule context.

[0098] Output <rule data structure set>.

[0099] In one embodiment, step 102 may be implemented as follows:

[0100] A rule subgraph corresponding to each rule is generated according to the operation parameters and the configuration information of the predecessor node and the successor node of the processing node, wherein each processing node corresponds to a node in the rule subgraph.

[0101] Specifically, each processing node in the rule corresponds to a node in the rule subgraph, and the nodes in the rule subgraph are connected through a data flow pipeline according to the configuration information of the predecessor and successor nodes of the processing node.

[0102] Among them, the operating parameters and configuration information can be stored through the rule description file.

[0103] Alternatively, if Figure 5 As shown, the method includes:

[0104] Get <rule data structure set>;

[0105] Traverse the <rule data structure set> and perform operations on the data structure of each rule: according to the data structure of the rule, convert the rule data structure into a rule subgraph. If the rule subgraph semantics and graph node parameters are incorrect, an error is reported and the rule subgraph generation is stopped. Save the converted rule subgraph to the <rule subgraph set>;

[0106] Output <rule subgraph>.

[0107] In one embodiment, step 103 may be implemented by the following steps:

[0108] The rule subgraphs are merged and the entry nodes are merged to obtain the execution graph;

[0109] The execution graph is optimized to obtain a target execution graph, where the optimization includes at least one of the following:

[0110] According to the characteristics of data flow, the execution graph is optimized for data flow;

[0111] Performing field optimization processing on the data fields in the execution graph, where the field optimization processing includes at least one of the following: field calculation, field clipping, or field merging;

[0112] Perform resource optimization on resources referenced by the execution graph.

[0113] Optionally, the data flow optimization processing includes at least one of the following: semantically equivalent node fusion, network throughput balancing, intermediate node merging, or egress node merging;

[0114] Specifically, after generating the rule subgraphs corresponding to the respective rules, the rule subgraphs may be merged to obtain a graph, and multiple repeated entry nodes in the graph may be merged to obtain an execution graph.

[0115] Furthermore, data flow optimization processing can be performed according to the characteristics of the data flow. For data flows in different application scenarios, their characteristics are analyzed and different optimization processing methods are adopted. Among them, intermediate node merging, for example, refers to merging multiple intermediate nodes with the same function into one, and the exit node merging is similar.

[0116] Optionally, the resource optimization process includes at least one of the following:

[0117] When the referenced resource is a table, performing index optimization processing;

[0118] Reference to a semantically equivalent union of said resource; or,

[0119] References to equivalent instances of the resource are merged.

[0120] Specifically, for example, if the referenced resource is a plurality of tables, the indexes of the plurality of tables are optimized, for example, the association relationship between the indexes of the respective tables is optimized.

[0121] In one embodiment, obtain <rule subgraph set>;

[0122] All rule subgraphs are fused into an execution graph through the graph fusion optimizer, specifically performing at least one of the following: rule subgraph fusion; graph entry node merging;

[0123] The data flow of the execution graph is optimized by the graph data flow optimizer, specifically performing at least one of the following: semantically equivalent graph node fusion; network throughput balancing; graph intermediate node merging; graph exit node merging;

[0124] Optimize data fields through the graph data field optimizer, specifically perform at least one of the following: field calculation, field pruning, and field merging;

[0125] The graph node code is optimized by the graph node code optimizer, specifically performing at least one of the following: constant statement pre-calculation; equivalent statement logical merging; common statement merging;

[0126] The resources referenced by the graph are optimized through the graph resource optimizer, specifically performing at least one of the following: table index optimization processing; equivalent semantic merging of referenced external resources; equivalent instance merging of referenced external resources;

[0127] Finally, the target execution graph is obtained.

[0128] In the above implementation, multiple rule subgraphs are fused and optimized so that the target execution graph can accurately represent the rules, and the optimized target execution graph has a simple structure and is easy to generate executable code.

[0129] In one embodiment, step 104 may be implemented as follows:

[0130] Generate executable code corresponding to all nodes in the target execution graph; and / or

[0131] Generate executable code corresponding to the data flow of the target execution graph; and / or

[0132] Generate executable code corresponding to the message flow according to the running parameter information of the message node related to the target execution graph; the message node includes at least one of the following: a message publishing node, a message processing node, a message feedback node; and / or

[0133] According to the semantics of the target execution graph, the executable code mapping the target execution graph to the underlying computing framework is generated.

[0134] Specifically, obtain the target execution graph;

[0135] Traverse all nodes in the target execution graph through the code generator and generate executable code corresponding to the nodes;

[0136] The code generator generates executable code corresponding to the data flow according to the target execution graph data flow;

[0137] The code generator generates executable code corresponding to the message flow according to the running parameters of the message nodes of the relevant behavioral security baseline of the execution graph;

[0138] The code generator generates executable code that maps the execution graph to the underlying computing framework based on the semantics of the target execution graph.

[0139] Optionally, you can use the Java project packaging tool Maven to package all the generated codes into a Java jar compressed package.

[0140] Optionally, the executable code corresponding to the generated node includes:

[0141] The executable code corresponding to the data flow is generated according to the connection information between the nodes in the target execution graph. The executable code corresponding to the data flow is used to send the input data from the current node to the successor node; the connection information is determined according to the configuration information of the predecessor node and the successor node of the processing node.

[0142] For example, the current node is processing node A, the predecessor node of processing node A is processing node B, and the successor node of processing node A is processing node C, that is, the data flow direction is processing node B-processing node A-processing node C, that is, processing node A receives the data flow sent by processing node B, and processing node A sends the data flow to processing node C.

[0143] Optionally, after generating the executable code corresponding to the node, you can also perform the following operations:

[0144] Optimize the executable code corresponding to the node in the target execution graph, including at least one of the following: constant statement preprocessing, equivalent statement logical merging, and common statement merging.

[0145] Optionally, the executable code corresponding to the generated message includes:

[0146] A message data flow pipeline is constructed from a message publishing node, a message processing node to a message feedback node in sequence, and an executable code corresponding to the message flow is generated. The executable code is used to process the message flow in the data flow pipeline.

[0147] In the above implementation, executable codes corresponding to all nodes in the target execution graph, executable codes corresponding to data flows, executable codes corresponding to message flows, and executable codes mapping the target execution graph to the underlying computing framework are generated respectively, that is, executable codes are generated for components in different types of execution graphs respectively, thereby improving the accuracy and efficiency of compilation.

[0148] The following is a description of a rule compilation device for a behavioral security baseline provided by the present invention. The rule compilation device for the behavioral security baseline described below and the rule compilation method for the behavioral security baseline described above can be referenced to each other.

[0149] Figure 6 : is a schematic diagram of the structure of the rule compilation device of the behavior safety baseline provided by the present invention. The rule compilation device of the behavior safety baseline provided by this embodiment includes:

[0150] The acquisition module 210 is used to parse the rules of at least one behavioral security baseline to obtain a data structure of each rule; the data structure includes at least one of the following: rule name, rule ID, operation parameter, and processing node;

[0151] A processing module 220, configured to generate a rule subgraph corresponding to each rule according to the data structure of each rule;

[0152] The processing module 220 is further used to fuse the rule subgraphs to obtain a target execution graph;

[0153] Executable code is generated based on the target execution graph.

[0154] Optionally, the acquisition module 210 is specifically used for:

[0155] Each of the rules is parsed according to the semantic format and / or parameter format of the rule to obtain the data structure of each of the rules.

[0156] Optionally, the processing module 220 is specifically configured to:

[0157] A rule subgraph corresponding to each of the rules is generated according to the operation parameters and the configuration information of the predecessor node and the successor node of the processing node, wherein each of the processing nodes corresponds to a node in the rule subgraph.

[0158] Optionally, the processing module 220 is specifically configured to:

[0159] Generate executable code corresponding to all nodes in the target execution graph; and / or

[0160] Generate executable code corresponding to the data flow of the target execution graph; and / or

[0161] Generate executable code corresponding to the message flow according to the running parameter information of the message node related to the target execution graph; the message node includes at least one of the following: a message publishing node, a message processing node, a message feedback node; and / or

[0162] According to the semantics of the target execution graph, executable code is generated that maps the target execution graph to an underlying computing framework.

[0163] Optionally, the processing node parameter includes at least one of the following: node ID, node name, node operation parameter, node processing mode;

[0164] The generating executable codes corresponding to all nodes in the target execution graph includes:

[0165] According to the parameters of the processing node, executable codes corresponding to all nodes in the target execution graph are generated, and the executable codes include: node attribute codes, and / or node processing logic codes.

[0166] Optionally, the processing module 220 is specifically configured to:

[0167] The executable code corresponding to the data flow is generated according to the connection information between the nodes in the target execution graph, and the executable code corresponding to the data flow is used to send input data from the current node to the successor node; the connection information is determined according to the configuration information of the predecessor node and the successor node of the processing node.

[0168] Optionally, the processing module 220 is specifically configured to:

[0169] A message data flow pipeline is constructed from a message publishing node, a message processing node to a message feedback node in sequence, and an executable code corresponding to the message flow is generated. The executable code is used to process the message flow in the data flow pipeline.

[0170] Optionally, the processing module 220 is further configured to:

[0171] The executable code corresponding to the node in the target execution graph is optimized, including at least one of the following: constant statement preprocessing, equivalent statement logical merging, and common statement merging.

[0172] Optionally, the processing module 220 is specifically configured to:

[0173] The rule subgraphs are merged, and the entry nodes are merged to obtain an execution graph;

[0174] Optimizing the execution graph to obtain a target execution graph, wherein the optimization includes at least one of the following:

[0175] According to the characteristics of the data flow, the execution graph is optimized for data flow;

[0176] Performing field optimization processing on the data fields in the execution graph, wherein the field optimization processing includes at least one of the following: field calculation, field clipping or field merging;

[0177] Resource optimization processing is performed on the resources referenced by the execution graph.

[0178] Optionally, the data flow optimization processing includes at least one of the following: semantically equivalent node fusion, network throughput balancing, intermediate node merging, or egress node merging;

[0179] The resource optimization process includes at least one of the following:

[0180] When the referenced resource is a table, performing index optimization processing;

[0181] Reference to a semantically equivalent union of said resource; or,

[0182] References to equivalent instances of the resource are merged.

[0183] The device of the embodiment of the present invention is used to execute the method in any of the aforementioned method embodiments. Its implementation principle and technical effects are similar and will not be repeated here.

[0184] Figure 7 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 7As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute the rule compilation method of the behavioral security baseline, the method comprising: parsing the rules of at least one behavioral security baseline to obtain the data structure of each of the rules; the data structure comprises at least one of the following: rule name, rule identification ID, operation parameter, processing node; generating the rule subgraph corresponding to each of the rules according to the data structure of each of the rules; fusing each of the rule subgraphs to obtain the target execution graph; generating executable code based on the target execution graph.

[0185] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0186] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the rule compilation method of the behavioral security baseline provided by the above-mentioned methods, and the method includes: parsing the rules of at least one behavioral security baseline to obtain the data structure of each of the rules; the data structure includes at least one of the following: rule name, rule identification ID, operating parameters, processing nodes; according to the data structure of each of the rules, generating a rule subgraph corresponding to each of the rules; fusing each of the rule subgraphs to obtain a target execution graph; and generating executable code based on the target execution graph.

[0187] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a rule compilation method for executing the above-mentioned behavioral security baselines, the method comprising: parsing the rules of at least one behavioral security baseline to obtain a data structure of each of the rules; the data structure comprising at least one of the following: rule name, rule identification ID, operating parameters, processing nodes; generating a rule subgraph corresponding to each of the rules according to the data structure of each of the rules; fusing each of the rule subgraphs to obtain a target execution graph; and generating executable code based on the target execution graph.

[0188] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0189] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0190] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A rule compilation method for a behavioral security baseline, characterized in that: include: Parse the rules of at least one behavioral security baseline to obtain a data structure of each rule; the data structure includes at least one of the following: a rule name, a rule ID, an operating parameter, and a processing node; The behavior safety baseline is obtained based on the user's behavior data; the behavior safety baseline represents the behavior data of each user behavior in at least one user behavior occurring within at least one time period within a preset time range for one or more users; The behavioral security baseline is used as a benchmark data for abnormal behavior analysis and detection to perform abnormal behavior analysis and detection; The parsing of the rules of at least one behavioral security baseline to obtain the data structure of each rule includes: Parsing each of the rules according to the semantic format and / or parameter format of the rules to obtain the data structure of each of the rules; Generate a rule subgraph corresponding to each rule according to the data structure of each rule; The rule subgraphs are fused to obtain a target execution graph; The step of fusing the rule subgraphs to obtain a target execution graph includes: The rule subgraphs are merged, and the entry nodes are merged to obtain an execution graph; Optimizing the execution graph to obtain a target execution graph, wherein the optimization includes at least one of the following: According to the characteristics of the data flow, the execution graph is optimized for data flow; Performing field optimization processing on the data fields in the execution graph, wherein the field optimization processing includes at least one of the following: field calculation, field clipping or field merging; Performing resource optimization processing on resources referenced by the execution graph; Executable code is generated based on the target execution graph.

2. The rule compilation method of the behavioral security baseline according to claim 1 is characterized in that: Generating a rule subgraph corresponding to each rule according to the data structure of each rule includes: A rule subgraph corresponding to each of the rules is generated according to the operation parameters and the configuration information of the predecessor node and the successor node of the processing node, wherein each of the processing nodes corresponds to a node in the rule subgraph.

3. The rule compilation method of the behavioral security baseline according to claim 1 is characterized in that: The generating executable code based on the target execution graph includes: Generate executable code corresponding to all nodes in the target execution graph; and / or Generate executable code corresponding to the data flow of the target execution graph; and / or Generate executable code corresponding to the message flow according to the running parameter information of the message node related to the target execution graph; the message node includes at least one of the following: a message publishing node, a message processing node, a message feedback node; and / or According to the semantics of the target execution graph, executable code is generated that maps the target execution graph to an underlying computing framework.

4. The rule compilation method of the behavioral security baseline according to claim 3 is characterized in that: The processing node parameters include at least one of the following: node ID, node name, node operation parameters, node processing mode; The generating executable codes corresponding to all nodes in the target execution graph includes: According to the parameters of the processing node, executable codes corresponding to all nodes in the target execution graph are generated, and the executable codes include: node attribute codes, and / or node processing logic codes.

5. The rule compilation method of the behavioral security baseline according to claim 3 is characterized in that: The generating of the executable code corresponding to the data flow of the target execution graph includes: The executable code corresponding to the data flow is generated according to the connection information between the nodes in the target execution graph, and the executable code corresponding to the data flow is used to send input data from the current node to the successor node; the connection information is determined according to the configuration information of the predecessor node and the successor node of the processing node.

6. The rule compilation method of the behavioral security baseline according to claim 3 is characterized in that: The step of generating executable code corresponding to the message flow according to the message configuration information related to the target execution graph includes: A message data flow pipeline is constructed from a message publishing node, a message processing node to a message feedback node in sequence, and an executable code corresponding to the message flow is generated. The executable code is used to process the message flow in the data flow pipeline.

7. The rule compilation method of the behavioral security baseline according to claim 4 is characterized in that: After generating the executable codes corresponding to all nodes in the target execution graph, the method further includes: The executable code corresponding to the node in the target execution graph is optimized, including at least one of the following: constant statement preprocessing, equivalent statement logical merging, and common statement merging.

8. The rule compilation method of the behavioral security baseline according to claim 1 is characterized in that: The data flow optimization process includes at least one of the following: semantically equivalent node fusion, network throughput balancing, intermediate node merging or egress node merging; The resource optimization process includes at least one of the following: When the referenced resource is a table, performing index optimization processing; Reference to a semantically equivalent union of said resource; or, References to equivalent instances of the resource are merged.

9. A rule compilation device for a behavioral security baseline, characterized in that: include: An acquisition module, used to parse the rules of at least one behavioral security baseline to obtain a data structure of each rule; the data structure includes at least one of the following: a rule name, a rule ID, an operation parameter, and a processing node; The behavior safety baseline is obtained based on the behavior data of the user; the behavior safety baseline represents the behavior data of each user behavior in at least one user behavior occurring within at least one time period within a preset time range for one or more users; The behavioral security baseline is used as a benchmark data for abnormal behavior analysis and detection to perform abnormal behavior analysis and detection; The step of parsing the rules of at least one behavioral security baseline to obtain the data structure of each rule includes: parsing each rule according to a semantic format and / or a parameter format of the rule to obtain the data structure of each rule; A processing module, used for generating a rule subgraph corresponding to each rule according to the data structure of each rule; The processing module is further used to fuse each of the rule subgraphs to obtain a target execution graph; the fusing of each of the rule subgraphs to obtain a target execution graph includes: fusing the rule subgraphs and merging the entry nodes to obtain an execution graph; optimizing the execution graph to obtain a target execution graph, wherein the optimization includes at least one of the following: performing data flow optimization on the execution graph according to the characteristics of the data flow; performing field optimization on the data fields in the execution graph, wherein the field optimization includes at least one of the following: field calculation, field clipping or field merging; performing resource optimization on the resources referenced by the execution graph; Executable code is generated based on the target execution graph.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 8 are implemented.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product having executable instructions stored thereon, characterized in that: When the instruction is executed by a processor, the processor implements the steps of the method as claimed in any one of claims 1 to 8.

Images