Data collection method, device and electronic equipment

Abstract

The present application provides a data collection method, device and electronic device, the method comprising: obtaining first collected data of a terminal, the first collected data being collected by the terminal based on a first collection strategy; obtaining operation information of the terminal at a current moment, the operation information comprising at least one of the following: performance information, business information and process information; updating the first collection strategy based on the operation information to obtain an updated first collection strategy; performing data collection based on the updated first collection strategy to obtain second collected data, updating the collection strategy through the real-time operation information of the terminal, so that the collected second collected data takes into account both the data volume and the actual operation information of the terminal, avoiding the problem of data underreporting while reducing the amount of collected data, effectively improving the efficiency of data input and output, and reducing the possibility of underreporting of threat events.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and relates to but is not limited to a data collection method, device and electronic equipment. Background Art

[0002] Currently, the Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) detection platforms are deployed in a network-provided Software-as-a-Service (SaaS) model, collecting and reporting multi-source security telemetry data to a cloud database for unified storage. The cloud data analysis system conducts continuous correlation analysis, threat detection, threat hunting, and automated response to the telemetry data to cope with the increasingly serious advanced threat attack incidents.

[0003] There are two main schemes for collecting terminal telemetry data in related technologies: one is that the terminal collects all telemetry data and reports it to the cloud, which has disadvantages: the amount of terminal telemetry data is huge, which poses great challenges to network bandwidth, database storage and massive data analysis systems, and the cost of the entire platform is high and cannot be effectively controlled. The other is that the terminal telemetry data is filtered before reporting it to the cloud, which has disadvantages: the current filtering method adopts a one-size-fits-all approach of first collecting all data and then filtering. The impact of full collection on performance and business always exists, and one-size-fits-all filtering may lead to underreporting of threat events. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a data collection method, device, equipment and computer-readable storage medium to solve the problems existing in the prior art.

[0005] The technical solution of the embodiment of the present application is implemented as follows:

[0006] The present application provides a data collection method, including:

[0007] Acquire first collected data, where the first collected data is collected by the terminal based on a first collection strategy;

[0008] Acquire operation information of the terminal at the current moment, the operation information including at least one of the following: performance information, service information and process information;

[0009] Based on the operation information, the first acquisition strategy is updated to obtain an updated first acquisition strategy;

[0010] Data collection is performed based on the updated first collection strategy to obtain second collected data.

[0011] In some embodiments, the updating of the first acquisition strategy based on the operation information to obtain an updated first acquisition strategy includes:

[0012] According to the first collected data and the performance information, adjusting the first sub-strategy included in the first collection strategy to obtain an adjusted first sub-strategy; and / or,

[0013] adjusting the second sub-strategy included in the first collection strategy according to the first collection data and the business information to obtain an adjusted second sub-strategy; and / or,

[0014] According to the first collected data and the process information, adjusting the third sub-strategy included in the first collection strategy to obtain an adjusted third sub-strategy;

[0015] An updated first acquisition strategy is determined according to the adjusted first sub-strategy and / or the adjusted second sub-strategy and / or the adjusted third sub-strategy.

[0016] In some embodiments, adjusting the first sub-strategy included in the first acquisition strategy according to the first acquisition data and the performance information to obtain the adjusted first sub-strategy includes:

[0017] Acquire reference performance information and a first reference sub-strategy corresponding to the reference performance information; the reference performance information includes at least one of the following: processor operation information, storage operation information, and network operation information; the first reference sub-strategy includes a first reference collection type and / or a first reference collection amount; the first sub-strategy includes a first collection type and / or a first collection amount;

[0018] determining, according to the performance information and the reference performance information, an adjustment value of the first acquisition type and / or an adjustment value of the first acquisition amount;

[0019] Based on the adjustment value of the first collection type and / or the adjustment value of the first collection amount, the first collection type and / or the first collection amount are adjusted to obtain an adjusted first sub-strategy.

[0020] In some embodiments, adjusting the second sub-strategy included in the first collection strategy according to the first collection data and the business information to obtain the adjusted second sub-strategy includes:

[0021] Acquire critical performance information corresponding to the service information; the critical performance information is the minimum performance information occupied when ensuring the normal operation of the service information; the second sub-strategy includes a second collection type and / or a second collection amount;

[0022] determining, according to the critical performance information and the performance information, an adjustment value of the second acquisition type and / or an adjustment value of the second acquisition amount;

[0023] Based on the adjustment value of the second collection type and / or the adjustment value of the second collection amount, the second collection type and / or the second collection amount are adjusted to obtain an adjusted second sub-strategy.

[0024] In some embodiments, adjusting the third sub-strategy included in the first acquisition strategy according to the first acquisition data and the process information to obtain the adjusted third sub-strategy includes:

[0025] Performing risk assessment on the process information to obtain a risk assessment result; the third sub-strategy includes a third collection type and / or a third collection amount;

[0026] Determining an adjustment value of the third collection type and / or an adjustment value of the third collection amount according to the risk assessment result;

[0027] Based on the adjustment value of the third collection type and / or the adjustment value of the third collection amount, the third collection type and / or the third collection amount are adjusted to obtain an adjusted third sub-strategy.

[0028] In some embodiments, performing risk assessment on the process information to obtain a risk assessment result includes:

[0029] Obtain a preset evaluation engine, wherein the preset evaluation engine includes at least an artificial intelligence AI engine, an anomaly detection engine, and a behavior rule engine;

[0030] Determine, according to the process information, a process behavior graph context corresponding to the process information;

[0031] According to the AI ​​engine, the anomaly detection engine and the behavior rule engine, a risk assessment is performed on the process behavior graph context to obtain a risk assessment result.

[0032] In some embodiments, the method further comprises:

[0033] The first collected data and the second collected data are sent to a server, so that the server determines a threat attack event against the terminal according to the first collected data and the second collected data.

[0034] The present application provides a data acquisition device, including:

[0035] A first acquisition module, used to acquire first collected data, where the first collected data is collected by the terminal based on a first collection strategy;

[0036] A second acquisition module is used to acquire the operation information of the terminal at the current moment, wherein the operation information includes at least one of the following: performance information, service information and process information;

[0037] An updating module, configured to update the first acquisition strategy based on the operation information to obtain an updated first acquisition strategy;

[0038] The acquisition module is used to perform data acquisition based on the updated first acquisition strategy to obtain second acquired data.

[0039] An embodiment of the present application provides an electronic device, including:

[0040] A monitoring collection module, used for collecting first collection data, where the first collection data is collected by the electronic device based on a first collection strategy;

[0041] A scheduling module, used for sending the first collected data to a decision module;

[0042] A decision module, configured to update the first collection strategy based on the operation information of the electronic device at the current moment to obtain an updated first collection strategy; the operation information includes at least one of the following: performance information, service information, and process information;

[0043] The scheduling module is further used to send the updated first collection strategy to the monitoring collection module, so that the monitoring collection module performs data collection based on the updated first collection strategy to obtain second collection data.

[0044] In some embodiments, the electronic device further comprises:

[0045] The reporting module is used to send the first collected data and the second collected data collected by the monitoring collection module to the server, so that the server determines the threat attack event against the electronic device according to the first collected data and the second collected data.

[0046] An embodiment of the present application provides another electronic device, including:

[0047] A memory for storing executable instructions;

[0048] The processor is used to implement the data collection method provided in the embodiment of the present application when executing the executable instructions stored in the memory.

[0049] An embodiment of the present application provides a computer-readable storage medium storing executable instructions for causing a processor to execute and implement the data collection method provided in the embodiment of the present application.

[0050] In the data collection method provided in the embodiment of the present application, firstly, the first collection data is obtained, and the first collection data is collected by the terminal based on the first collection strategy; the operation information of the terminal at the current moment is obtained, and the operation information includes at least one of the following: performance information, business information and process information; based on the operation information, the first collection strategy is updated to obtain the updated first collection strategy; data is collected based on the updated first collection strategy to obtain the second collection data. The embodiment of the present application updates the collection strategy through the real-time operation information of the terminal, so that the collected second collection data takes into account the data volume and the actual operation information of the terminal, avoids the problem of data omission while reducing the amount of collected data, effectively improves the efficiency of data input and output, and reduces the possibility of omission of threat events. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 A schematic diagram of an implementation flow of the data collection method provided in an embodiment of the present application;

[0052] Figure 2 A schematic diagram of another implementation flow of the data collection method provided in an embodiment of the present application;

[0053] Figure 3a A schematic diagram of an implementation flow of adjusting a first sub-strategy included in a first acquisition strategy in a data acquisition method provided in an embodiment of the present application;

[0054] Figure 3b A schematic diagram of an implementation flow of adjusting the second sub-strategy included in the first acquisition strategy in the data acquisition method provided in an embodiment of the present application;

[0055] Figure 3c A schematic diagram of an implementation flow of adjusting the third sub-strategy included in the first acquisition strategy in the data acquisition method provided in an embodiment of the present application;

[0056] Figure 4 A schematic diagram of another implementation flow of the data collection method provided in the embodiment of the present application;

[0057] Figure 5 A schematic diagram of the overall design of the terminal telemetry data intelligent collection solution provided in the embodiment of the present application;

[0058] Figure 6 A schematic diagram of the structure of a data acquisition device provided in an embodiment of the present application;

[0059] Figure 7 A schematic diagram of a structure of an electronic device provided in an embodiment of the present application;

[0060] Figure 8A schematic diagram of another composition structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The described embodiments should not be regarded as limiting the present application. All other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of this application.

[0062] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0063] In the following description, the terms "first\second\third" involved are merely used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged with a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0064] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0065] Before further describing the embodiments of the present application in detail, the nouns and terms involved in the embodiments of the present application are explained. The nouns and terms involved in the embodiments of the present application are subject to the following interpretations.

[0066] 1) The terminal detection and response (EDR) platform is a terminal security solution consisting of cloud-based, lightweight endpoint security software (Agent) and management platform software (MGR). The cloud is mainly responsible for platform upgrades, virus database upgrades, and cloud detection. MGR is responsible for managing and maintaining all Agent terminals. It supports unified terminal asset management, terminal virus detection, and terminal compliance checks, as well as one-click isolation and disposal of security incidents and full-network threat positioning for hot event control reversal. Agent endpoint software supports anti-virus functions, intrusion prevention functions, firewall isolation functions, data information collection and reporting, one-click disposal, etc.

[0067] 2) Extended Detection and Response (XDR) Platform, a unified security incident detection and response platform that automatically collects and correlates data from multiple proprietary security components.

[0068] 3) Event Tracing for Windows (ETW), ETW provides a tracking and recording mechanism for event objects created by user-level applications and kernel-level drivers, providing developers with a set of fast, reliable and versatile event tracing features.

[0069] The technical solution of the present application is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0070] Figure 1 A schematic diagram of an implementation flow of the data acquisition method provided in the embodiment of the present application is applied to a data acquisition device, such as Figure 1 As shown, the data collection method includes the following steps:

[0071] Step S101, obtaining first collected data.

[0072] Here, the first collected data is collected by the terminal based on the first collection strategy. This step can be performed by a data collection device in the terminal. The terminal collects the first collected data based on the first collection strategy and can transmit it to the server, so that the server determines whether the terminal is threatened by the threat attack event based on the first collected data and the data collected multiple times before.

[0073] Step S102, obtaining the operation information of the terminal at the current moment.

[0074] The operation information here includes at least one of the following: performance information, business information and process information.

[0075] The performance information may include at least one of the following: processor operation information, storage operation information, and network operation information. Service information is information related to the service currently executed by the terminal. Process information is information about all processes currently running on the terminal.

[0076] Step S103: Based on the operation information, the first acquisition strategy is updated to obtain an updated first acquisition strategy.

[0077] The terminal determines whether the first collection strategy used when collecting the first collection data matches the real-time state of the terminal based on the data type and / or data volume of the first collection data and the current operating information of the terminal. If not, the first collection strategy is updated based on the operating information to obtain an updated first collection strategy.

[0078] Step S104: performing data collection based on the updated first collection strategy to obtain second collected data.

[0079] After obtaining the updated first collection strategy, the control terminal performs data collection based on the updated first collection strategy to obtain the second collection data. Since the second collection data is data collected by considering the real-time operation information of the terminal, the second collection data takes into account both the data volume and the actual operation information of the terminal, and avoids the problem of data omission while reducing the amount of collected data, effectively improves the efficiency of data input and output, and reduces the possibility of omission of threat events.

[0080] In some embodiments, after the terminal collects the second collected data, it transmits it to the server, so that the server determines whether the terminal is under threat attack by the threat attack event based on the first collected data collected last time, the second collected data collected this time, and the data collected multiple times before.

[0081] In some embodiments, after step S104 is executed, when it is necessary to continue the collection, the second collected data is used as the new first collection data, and the updated first collection strategy is used as the new first collection strategy, and the above steps S102 to S104 are repeated to achieve continuous collection, thereby achieving continuous monitoring of the terminal by the server.

[0082] The data collection method provided in the embodiment of the present application first obtains the first collected data, which is collected by the terminal based on the first collection strategy; obtains the operation information of the terminal at the current moment, and the operation information includes at least one of the following: performance information, business information and process information; based on the operation information, the first collection strategy is updated to obtain the updated first collection strategy; data is collected based on the updated first collection strategy to obtain the second collected data. The collection strategy is updated through the real-time operation information of the terminal, so that the collected second collection data takes into account the data volume and the actual operation information of the terminal, avoids the problem of data omission while reducing the amount of collected data, effectively improves the efficiency of data input and output, and reduces the possibility of omission of threat events.

[0083] exist Figure 1 On the basis of the illustrated embodiment, the embodiment of the present application further provides a data collection method. Figure 2 Another implementation flow diagram of the data collection method provided in the embodiment of the present application is as follows: Figure 2 As shown, the method comprises the following steps:

[0084] Step S201, obtaining first collected data.

[0085] The first collected data is collected by the terminal based on the first collection strategy. This step can be performed by a data collection device in the terminal. After the terminal collects the first collected data based on the first collection strategy, it can transmit it to the server, so that the server determines whether the terminal is threatened by the threat attack event based on the first collected data and the data collected multiple times before.

[0086] Step S202, obtaining the operation information of the terminal at the current moment.

[0087] The operation information here includes at least one of the following: performance information, business information and process information.

[0088] The performance information may include at least one of the following: processor operation information, storage operation information, and network operation information. Service information is information related to the service currently executed by the terminal. Process information is information about all processes currently running on the terminal.

[0089] The following steps S203 to S206 are Figure 1 An implementation of step S103 in the illustrated embodiment. From step S203 to step S205, only one of them may be executed, any two of them may be executed simultaneously, or all three steps may be executed simultaneously, and step S203, step S204 and step S205 may be executed in any order.

[0090] Step S203: adjusting the first sub-strategy included in the first collection strategy according to the first collection data and the performance information to obtain an adjusted first sub-strategy.

[0091] In the embodiment of the present application, the first acquisition strategy is adjusted in consideration of one or more influencing factors, and the specific adjustment method is shown in the following embodiment.

[0092] Step S204: adjusting the second sub-strategy included in the first collection strategy according to the first collection data and the business information to obtain an adjusted second sub-strategy.

[0093] Step S205: adjusting the third sub-strategy included in the first collection strategy according to the first collection data and the process information to obtain an adjusted third sub-strategy.

[0094] Step S206: Determine an updated first acquisition strategy according to the adjusted first sub-strategy and / or the adjusted second sub-strategy and / or the adjusted third sub-strategy.

[0095] When step S204 and step S205 are not performed, step S206 is to determine the updated first acquisition strategy according to the adjusted first sub-strategy. When step S203 and step S205 are not performed, step S206 is to determine the updated first acquisition strategy according to the adjusted second sub-strategy. When step S203 and step S204 are not performed, step S206 is to determine the updated first acquisition strategy according to the adjusted third sub-strategy. When step S205 is not performed, step S206 is to determine the updated first acquisition strategy according to the adjusted first sub-strategy and the adjusted second sub-strategy. When step S204 is not performed, step S206 is to determine the updated first acquisition strategy according to the adjusted first sub-strategy and the adjusted third sub-strategy. When step S203 is not performed, step S206 is to determine the updated first acquisition strategy according to the adjusted second sub-strategy and the adjusted third sub-strategy. When steps S203 to S205 are all executed, step S206 is to determine an updated first acquisition strategy according to the adjusted first sub-strategy, the adjusted second sub-strategy and the adjusted third sub-strategy.

[0096] Step S207: performing data collection based on the updated first collection strategy to obtain second collected data.

[0097] After obtaining the updated first collection strategy, the control terminal performs data collection based on the updated first collection strategy to obtain the second collection data. Since the second collection data is data collected by considering the real-time operation information of the terminal, the second collection data takes into account both the data volume and the actual operation information of the terminal, and avoids the problem of data omission while reducing the amount of collected data, effectively improves the efficiency of data input and output, and reduces the possibility of omission of threat events.

[0098] The data collection method provided in the embodiment of the present application updates the collection strategy through at least one influencing factor among the real-time performance information, business information and process information of the terminal, so that the collected second collection data takes into account both the data volume and the actual operation information of the terminal, avoids the problem of data underreporting while reducing the amount of collected data, effectively improves the efficiency of data input and output, and reduces the possibility of underreporting of threat events.

[0099] In some embodiments, when the first sub-strategy includes a first acquisition type, Figure 2 In the embodiment shown, step S203 of "adjusting the first sub-strategy included in the first acquisition strategy according to the first acquisition data and the performance information to obtain an adjusted first sub-strategy" can be performed by Figure 3a The steps shown are to achieve this:

[0100] Step S30a1, obtaining reference performance information and a first reference sub-strategy corresponding to the reference performance information.

[0101] Here, the reference performance information includes at least one of the following: processor operation information, storage operation information, and network operation information. The first reference sub-strategy includes a first reference acquisition type.

[0102] Step S30a2: determining an adjustment value of the first acquisition type according to the performance information and the reference performance information.

[0103] Step S30a3: adjusting the first acquisition type based on the adjustment value of the first acquisition type to obtain an adjusted first sub-strategy.

[0104] In actual operation, when the terminal performance occupancy rate is higher, it means that there are more processes currently running on the terminal. At this time, the collection of unnecessary data types can be reduced or canceled, such as keyboard input and other behavioral data, to reduce the amount of transmitted data. At the same time, the collection of security-related data types can be increased, such as registry behavior data, gateway behavior data, etc., to avoid data underreporting.

[0105] Correspondingly, in some embodiments, when the second sub-strategy includes the second acquisition type, Figure 2 Step S204 in the illustrated embodiment, "adjusting the second sub-strategy included in the first collection strategy according to the first collection data and the business information to obtain an adjusted second sub-strategy", can be implemented as follows: obtaining critical performance information corresponding to the business information; the critical performance information is the minimum performance information occupied to ensure that the business information can run normally; determining an adjustment value of the second collection type according to the critical performance information and the performance information; adjusting the second collection type based on the adjustment value of the second collection type to obtain an adjusted second sub-strategy.

[0106] In actual operation, the more complex the business running on the terminal or the more business running, the higher the performance occupancy rate, which indicates that the terminal currently has more running processes. At this time, the collection of unnecessary data types can be reduced or canceled, such as keyboard input and other behavioral data, to reduce the amount of transmitted data. At the same time, the collection of security-related data types can be increased, such as registry behavior data, gateway behavior data, etc., to avoid data omissions.

[0107] Correspondingly, in some embodiments, when the third sub-strategy includes the third acquisition type, Figure 2Step S205 in the illustrated embodiment, "adjusting the third sub-strategy included in the first acquisition strategy according to the first acquisition data and the process information to obtain an adjusted third sub-strategy", can be implemented as: performing a risk assessment on the process information to obtain a risk assessment result; determining an adjustment value of the third acquisition type according to the risk assessment result; and adjusting the third acquisition type based on the adjustment value of the third acquisition type to obtain an adjusted third sub-strategy.

[0108] In actual operation, when the terminal perceives that a process may have risks based on the context of the running process behavior graph, it increases the collection of type data related to the process to avoid data omissions.

[0109] In some embodiments, when the first sub-strategy includes a first acquisition amount, Figure 2 In the embodiment shown, step S203 of "adjusting the first sub-strategy included in the first acquisition strategy according to the first acquisition data and the performance information to obtain an adjusted first sub-strategy" can be performed by Figure 3b The steps shown are to achieve this:

[0110] Step S30b1, obtaining reference performance information and a first reference sub-strategy corresponding to the reference performance information.

[0111] Here, the reference performance information includes at least one of the following: processor operation information, storage operation information and network operation information. The first reference sub-strategy includes a first reference collection amount.

[0112] Step S30b2: determining an adjustment value of the first collected amount according to the performance information and the reference performance information.

[0113] Step S30b3: adjusting the first collection amount based on the adjustment value of the first collection amount to obtain an adjusted first sub-strategy.

[0114] In actual operation, when the terminal performance occupancy rate is higher, it means that the terminal currently has more running processes. At this time, the collection of unnecessary data can be reduced or canceled, such as the amount of data of behavioral data such as keyboard input, to reduce the amount of transmitted data. At the same time, the amount of data collected about security-related behavioral data can be increased, such as the amount of data of registry behavior data, the amount of data of gateway behavior data, etc., to avoid data underreporting.

[0115] Correspondingly, in some embodiments, when the second sub-strategy includes the second collection amount, Figure 2Step S204 in the illustrated embodiment, "adjusting the second sub-strategy included in the first collection strategy according to the first collection data and the business information to obtain an adjusted second sub-strategy", can be implemented as follows: obtaining critical performance information corresponding to the business information; the critical performance information is the minimum performance information occupied to ensure that the business information can operate normally; determining an adjustment value of the second collection amount according to the critical performance information and the performance information; and adjusting the second collection amount based on the adjustment value of the second collection amount to obtain an adjusted second sub-strategy.

[0116] In actual operation, the more complex the business running on the terminal or the more business running, the higher the performance occupancy rate, which indicates that the terminal currently has more running processes. At this time, the collection of unnecessary data can be reduced or canceled, such as the amount of data of behavioral data such as keyboard input, to reduce the amount of transmitted data. At the same time, the amount of data collected about security-related behavioral data can be increased, such as the amount of data of registry behavior data, the amount of data of gateway behavior data, etc., to avoid data omissions.

[0117] Correspondingly, in some embodiments, when the third sub-strategy includes the third collection amount, Figure 2 Step S205 in the illustrated embodiment, "adjusting the third sub-strategy included in the first collection strategy according to the first collection data and the process information to obtain an adjusted third sub-strategy", can be implemented as follows: performing a risk assessment on the process information to obtain a risk assessment result; determining an adjustment value of the third collection quantity according to the risk assessment result; and adjusting the third collection quantity based on the adjustment value of the third collection quantity to obtain an adjusted third sub-strategy.

[0118] In actual operation, when the terminal perceives that a process may have risks based on the context of the running process behavior graph, the amount of collected behavior data related to the process is increased to avoid data omissions.

[0119] In some embodiments, when the first sub-strategy includes a first acquisition type and a first acquisition amount, Figure 2 In the embodiment shown, step S203 of "adjusting the first sub-strategy included in the first acquisition strategy according to the first acquisition data and the performance information to obtain an adjusted first sub-strategy" can be performed by Figure 3c The steps shown are to achieve this:

[0120] Step S30c1, obtaining reference performance information and a first reference sub-strategy corresponding to the reference performance information.

[0121] Here, the reference performance information includes at least one of the following: processor operation information, storage operation information, and network operation information. The first reference sub-strategy includes a first reference collection type and a first reference collection amount.

[0122] Step S30c2: determining an adjustment value of the first acquisition type and an adjustment value of the first acquisition amount according to the performance information and the reference performance information.

[0123] Step S30c3: adjusting the first collection type based on the adjustment value of the first collection type, and adjusting the first collection amount based on the adjustment value of the first collection amount, to obtain an adjusted first sub-strategy.

[0124] In actual operation, when the terminal performance occupancy rate is higher, it means that the terminal currently has more processes running. At this time, the collection of unnecessary data types and data volumes can be reduced or canceled, such as the data volume of behavioral data such as keyboard input, to reduce the amount of transmitted data. At the same time, the collection of security-related type data and its data volume can be increased, such as the data volume of registry behavior data, the data volume of gateway behavior data, etc., to avoid data underreporting.

[0125] Correspondingly, in some embodiments, when the second sub-strategy includes the second collection type and the second collection amount, Figure 2 Step S204 in the illustrated embodiment, "adjusting the second sub-strategy included in the first collection strategy according to the first collection data and the business information to obtain an adjusted second sub-strategy", can be implemented as follows: obtaining critical performance information corresponding to the business information; the critical performance information is the minimum performance information occupied to ensure that the business information can operate normally; determining an adjustment value of the second collection type and an adjustment value of the second collection amount according to the critical performance information and the performance information; adjusting the second collection type based on the adjustment value of the second collection type, and adjusting the second collection amount according to the adjustment value of the second collection amount to obtain an adjusted second sub-strategy.

[0126] In actual operation, the more complex the business running on the terminal is or the more business running, the higher the performance occupancy rate is, which indicates that the terminal currently has more running processes. At this time, the collection of unnecessary data types and data volumes can be reduced or canceled, such as the data volume of behavioral data such as keyboard input, to reduce the amount of transmitted data. At the same time, the collection of security-related type data and its data volume can be increased, such as the data volume of registry behavior data, the data volume of gateway behavior data, etc., to avoid data omissions.

[0127] Correspondingly, in some embodiments, when the third sub-strategy includes a third collection type and a third collection amount, Figure 2Step S205 in the illustrated embodiment, "adjusting the third sub-strategy included in the first collection strategy according to the first collection data and the process information to obtain an adjusted third sub-strategy", can be implemented as follows: performing a risk assessment on the process information to obtain a risk assessment result; determining an adjustment value of the third collection type and an adjustment value of the third collection amount according to the risk assessment result; adjusting the third collection type based on the adjustment value of the third collection type, and adjusting the third collection amount according to the adjustment value of the third collection amount to obtain an adjusted third sub-strategy.

[0128] In actual operation, when the terminal perceives that a process may have risks based on the context of the running process behavior graph, it increases the type and amount of data related to the process to avoid data omissions.

[0129] In some embodiments, when the data acquisition device performs risk assessment, "perform risk assessment on the process information to obtain risk assessment results" can be achieved through the following steps: obtain a preset assessment engine, the preset assessment engine includes at least an artificial intelligence AI engine, an anomaly detection engine and a behavior rule engine; determine the process behavior graph context corresponding to the process information based on the process information; perform risk assessment on the process behavior graph context based on the AI ​​engine, the anomaly detection engine and the behavior rule engine to obtain a risk assessment result.

[0130] For example, the terminal will collect API behavior data of the process and identify behaviors such as screen capture, keyboard logging, remote desktop, etc., but the overall data volume is too large, and most of the behaviors are irrelevant to the attack and are invalid data; therefore, the intelligent collection decision module will intelligently identify high-risk process trees, such as when an unknown signature process is started or a legitimate process is exploited by a vulnerability or memory attack (injection, etc.), before in-depth monitoring and collection will be performed.

[0131] Based on the above embodiments, the embodiments of the present application further provide a data collection method. Figure 4 A schematic diagram of another implementation flow of the data collection method provided in the embodiment of the present application is shown as follows: Figure 4 As shown, the method comprises the following steps:

[0132] Step S401, obtaining first collected data.

[0133] The first collected data is collected by the terminal based on a first collection strategy.

[0134] Step S402, obtaining the operation information of the terminal at the current moment.

[0135] The operation information here includes at least one of the following: performance information, business information and process information.

[0136] The performance information may include at least one of the following: processor operation information, storage operation information, and network operation information. Service information is information related to the service currently executed by the terminal. Process information is information about all processes currently running on the terminal.

[0137] Step S403: Based on the operation information, the first acquisition strategy is updated to obtain an updated first acquisition strategy.

[0138] The terminal determines whether the first collection strategy used when collecting the first collection data matches the real-time state of the terminal based on the data type and / or data volume of the first collection data and the current operating information of the terminal. If not, the first collection strategy is updated based on the operating information to obtain an updated first collection strategy.

[0139] Step S404: perform data collection based on the updated first collection strategy to obtain second collected data.

[0140] After obtaining the updated first collection strategy, the control terminal performs data collection based on the updated first collection strategy to obtain the second collection data. Since the second collection data is data collected by considering the real-time operation information of the terminal, the second collection data takes into account both the data volume and the actual operation information of the terminal, and avoids the problem of data omission while reducing the amount of collected data, effectively improves the efficiency of data input and output, and reduces the possibility of omission of threat events.

[0141] Step S405: Send the first collected data and the second collected data to a server, so that the server determines a threat attack event against the terminal according to the first collected data and the second collected data.

[0142] In some embodiments, after the collected data is sent to the server, if the server detects a threat attack event on the terminal, the server generates a defense strategy and sends it to the terminal. At this time, the terminal can continue to perform the following steps:

[0143] Step S406: receiving the defense strategy sent by the server.

[0144] The defense strategy is determined by the server according to the threat attack event.

[0145] Step S407: executing the defense strategy.

[0146] The data collection method provided in the embodiment of the present application updates the collection strategy through at least one influencing factor such as the real-time performance information, business information and process information of the terminal, so that the collected second collection data takes into account both the data volume and the actual operation information of the terminal, and avoids the problem of data underreporting under the premise of reducing the amount of collected data, effectively improves the efficiency of data input and output, and reduces the possibility of underreporting of threat events. When the server detects that the terminal may have a threat attack based on the reported collection data, it generates a corresponding defense strategy for the reported data and sends it to the terminal so that the terminal can perform security defense based on the defense strategy, thereby improving the security of the terminal.

[0147] The following is an explanation of an exemplary application of the embodiments of the present application in a practical application scenario.

[0148] Currently, the Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) detection platforms are deployed in a network-provided Software-as-a-Service (SaaS) model, collecting and reporting multi-source security telemetry data to the cloud data lake for unified storage. The cloud data analysis system conducts continuous correlation analysis, threat detection, threat hunting, and automated response to the telemetry data to cope with the increasingly serious advanced threat attack incidents.

[0149] At present, there are two main schemes for collecting terminal telemetry data: one is that the terminal collects all telemetry data and reports it to the cloud. The advantage of this scheme is that the terminal telemetry data will not be missed, and there will be no underreporting of threat events due to the omission of telemetry data; the disadvantage is that the amount of terminal telemetry data is huge, which poses great challenges to network bandwidth, data lake storage and massive data analysis systems, and the cost of the entire platform is high and cannot be effectively controlled. Another collection scheme is to filter the terminal telemetry data before reporting it to the cloud. The advantage of this scheme is that the terminal will first filter the fully collected telemetry data before reporting it to the cloud, reducing the amount of telemetry data reported; the disadvantage is that the current filtering method adopts a one-size-fits-all scheme of first collecting the full amount and then filtering. The impact of full collection on performance and business always exists, and it may also cause underreporting of threat events. It is difficult to find a perfect balance between the amount of telemetry data and the problem of underreporting.

[0150] The embodiment of the present application aims to propose a terminal telemetry data intelligent collection solution, which uses intelligent collection and intelligent filtering to provide feedback and collaborate with each other from the dimensions of operating system real-time performance, business status, and threat context perception. The original behavior collected promotes intelligent filtering to make correct decisions. The decisions can enhance the adaptive ability of intelligent collection, achieve high-fidelity and low-data-volume intelligent collection capabilities for telemetry data, and solve the problems of huge amounts of terminal telemetry data and underreporting of telemetry data.

[0151] Figure 5 The overall design diagram of the terminal telemetry data intelligent collection solution provided in the embodiment of the present application is as follows: Figure 5 As shown, the overall solution is divided into an intelligent collection decision module 51, an intelligent collection scheduling module 52, a monitoring collection module 53 and a reporting module 54.

[0152] Among them, the monitoring and collection module 53 is responsible for various types of telemetry data monitoring and collection work, including but not limited to process / thread behavior collection unit 531, module behavior collection unit 532, file behavior collection unit 533, registry behavior collection unit 534, network behavior collection unit 535, Windows event tracing (ET W, Event Tracing for Windows) collection unit 536, application programming interface (API,) Application Programming Interface call collection unit 537, etc.

[0153] Each acquisition unit may include multiple acquisition modes, including but not limited to light, medium, deep, etc., and the acquisition mode may change in real time according to the decision result of the intelligent acquisition decision module 51. In different processes at the same time, the acquisition modes of different acquisition units may be different.

[0154] The intelligent collection decision module 51 includes an operating system (OS) real-time performance perception part 511, a business state perception part 512, and a threat context perception part 513. Different terminal devices have different hardware configurations. The OS real-time performance perception part 511 will adaptively adjust the type and amount of telemetry data collected in real time according to the operating system performance; the business state perception part 512 will perceive the business state. For example, for a PC machine, if the user is using the machine heavily, the collection strategy will be appropriately adjusted to ensure that it does not affect the normal use of the user; the threat context perception part 513 dynamically, in real time, and continuously evaluates the risk level of the terminal process behavior graph context through an AI engine, anomaly detection engine, and behavior rule engine.

[0155] The three perception parts, namely, OS real-time performance perception part 511, business status perception part 512 and threat context perception part 513, make a decision on a certain instantaneous collection strategy through comprehensive evaluation, and notify each monitoring collection module to complete the real-time collection strategy update through the intelligent collection scheduling module.

[0156] For example, the terminal will collect API behavior data of the process and identify behaviors such as screen capture, keyboard logging, remote desktop, etc., but the overall data volume is too large, and most of the behaviors are irrelevant to the attack and are invalid data; therefore, the intelligent collection decision module will intelligently identify high-risk process trees, such as when an unknown signature process is started or a legitimate process is exploited by a vulnerability or memory attack (injection, etc.), before in-depth monitoring and collection will be performed.

[0157] Terminal telemetry data differentiation can be divided into four levels: L1: Differentiated telemetry data of different terminals; L2: Differentiated telemetry data of different processes of the same terminal; L3: Differentiated telemetry data of the same process of the same terminal at different times; L4: Differentiated telemetry data of the same process of the same terminal at the same time. The intelligent telemetry data collection solution continuously promotes the evolution of telemetry data differentiation to achieve a balance between security effects and data volume.

[0158] The terminal telemetry data intelligent collection solution provided in the embodiment of the present application is based on the dimensions of operating system real-time performance, business status and threat context perception, through mutual feedback and coordination between intelligent collection and intelligent filtering. The original collected behavior promotes intelligent filtering to make correct decisions. The decisions can enhance the adaptive ability of intelligent collection, achieve high-fidelity and low-data-volume intelligent collection capabilities of telemetry data, and solve the problems of huge amount of terminal telemetry data and underreporting of telemetry data.

[0159] Based on the embodiments of the aforementioned methods, the embodiments of the present application provide a data acquisition device, wherein the modules included in the device and the units included in the modules can be implemented by a processor in a computer device; of course, they can also be implemented by a specific logic circuit; in the implementation process, the processor can be a central processing unit (CPU, Central Processing Unit), a microprocessor (MPU, Microprocessor Unit), a digital signal processor (DSP, Digital Signal Processing) or a field programmable gate array (FPGA, Field Programmable Gate Array), etc.

[0160] Figure 6 A schematic diagram of a data acquisition device provided in an embodiment of the present application is shown in FIG. 600 . The data acquisition device 600 is applied to a server. Figure 6 As shown, the data acquisition device 600 includes:

[0161] A first acquisition module 601 is used to acquire first collected data, where the first collected data is collected by the terminal based on a first collection strategy;

[0162] The second acquisition module 602 is used to acquire the operation information of the terminal at the current moment, where the operation information includes at least one of the following: performance information, service information, and process information;

[0163] An updating module 603, configured to update the first acquisition strategy based on the operation information to obtain an updated first acquisition strategy;

[0164] The collection module 604 is used to collect data based on the updated first collection strategy to obtain second collected data.

[0165] In some embodiments, the updating module 603 includes a determining unit and at least one of: a first adjusting unit, a second adjusting unit, and a third adjusting unit;

[0166] A first adjustment unit, configured to adjust a first sub-strategy included in the first acquisition strategy according to the first acquisition data and the performance information to obtain an adjusted first sub-strategy;

[0167] A second adjustment unit, configured to adjust a second sub-strategy included in the first collection strategy according to the first collection data and the business information to obtain an adjusted second sub-strategy;

[0168] A third adjustment unit, configured to adjust a third sub-strategy included in the first collection strategy according to the first collection data and the process information to obtain an adjusted third sub-strategy;

[0169] A determining unit is used to determine an updated first acquisition strategy according to the adjusted first sub-strategy and / or the adjusted second sub-strategy and / or the adjusted third sub-strategy.

[0170] In some embodiments, the first adjustment unit is further configured to:

[0171] Acquire reference performance information and a first reference sub-strategy corresponding to the reference performance information; the reference performance information includes at least one of the following: processor operation information, storage operation information, and network operation information; the first reference sub-strategy includes a first reference collection type and / or a first reference collection amount; the first sub-strategy includes a first collection type and / or a first collection amount;

[0172] determining, according to the performance information and the reference performance information, an adjustment value of the first acquisition type and / or an adjustment value of the first acquisition amount;

[0173] Based on the adjustment value of the first collection type and / or the adjustment value of the first collection amount, the first collection type and / or the first collection amount are adjusted to obtain an adjusted first sub-strategy.

[0174] In some embodiments, the second adjustment unit is further configured to:

[0175] Acquire critical performance information corresponding to the service information; the critical performance information is the minimum performance information occupied when ensuring the normal operation of the service information; the second sub-strategy includes a second collection type and / or a second collection amount;

[0176] determining, according to the critical performance information and the performance information, an adjustment value of the second acquisition type and / or an adjustment value of the second acquisition amount;

[0177] Based on the adjustment value of the second collection type and / or the adjustment value of the second collection amount, the second collection type and / or the second collection amount are adjusted to obtain an adjusted second sub-strategy.

[0178] In some embodiments, the third adjustment unit is further configured to:

[0179] Performing risk assessment on the process information to obtain a risk assessment result; the third sub-strategy includes a third collection type and / or a third collection amount;

[0180] Determining an adjustment value of the third collection type and / or an adjustment value of the third collection amount according to the risk assessment result;

[0181] Based on the adjustment value of the third collection type and / or the adjustment value of the third collection amount, the third collection type and / or the third collection amount are adjusted to obtain an adjusted third sub-strategy.

[0182] In some embodiments, the third adjustment unit is further configured to:

[0183] Obtain a preset evaluation engine, wherein the preset evaluation engine includes at least an artificial intelligence AI engine, an anomaly detection engine, and a behavior rule engine;

[0184] Determine, according to the process information, a process behavior graph context corresponding to the process information;

[0185] According to the AI ​​engine, the anomaly detection engine and the behavior rule engine, a risk assessment is performed on the process behavior graph context to obtain a risk assessment result.

[0186] In some embodiments, the data acquisition device 600 may further include:

[0187] The sending module is used to send the first collected data and the second collected data to the server, so that the server determines the threat attack event against the terminal according to the first collected data and the second collected data.

[0188] In some embodiments, the data acquisition device 600 may further include:

[0189] A receiving module, used to receive a defense strategy sent by the server, wherein the defense strategy is determined by the server according to the threat attack event;

[0190] The running module is used to run the defense strategy.

[0191] It should be noted that the description of the above data acquisition device embodiment is similar to the above method description and has the same beneficial effects as the method embodiment. For technical details not disclosed in the data acquisition device embodiment of this application, those skilled in the art should refer to the description of the method embodiment of this application for understanding.

[0192] It should be noted that in the embodiment of the present application, if the above-mentioned data acquisition method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the embodiment of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM, ReadOnly Memory), a disk or an optical disk. In this way, the embodiment of the present application is not limited to any specific combination of hardware and software.

[0193] Accordingly, an embodiment of the present application provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps in the data acquisition method provided in the above embodiment are implemented.

[0194] An embodiment of the present application provides an electronic device, Figure 7 A schematic diagram of a structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 7 As shown, the electronic device 700 includes: a monitoring and acquisition module 701, a scheduling module 702 and a decision module 703.

[0195] The monitoring collection module 701 is used to collect first collection data, where the first collection data is collected by the electronic device based on a first collection strategy;

[0196] A scheduling module 702, configured to send the first collected data to a decision module;

[0197] The decision module 703 is used to update the first collection strategy based on the operation information of the electronic device at the current moment to obtain an updated first collection strategy; the operation information includes at least one of the following: performance information, service information and process information;

[0198] The scheduling module 702 is further configured to send the updated first collection strategy to the monitoring collection module, so that the monitoring collection module collects data based on the updated first collection strategy to obtain second collected data.

[0199] In some embodiments, the electronic device 700 may further include:

[0200] The reporting module 704 is used to send the first collected data and the second collected data collected by the monitoring collection module to the server, so that the server determines the threat attack event against the electronic device according to the first collected data and the second collected data.

[0201] The present application embodiment further provides an electronic device, Figure 8 Another schematic diagram of the structure of the electronic device provided in the embodiment of the present application is as follows: Figure 8 As shown, the electronic device 800 includes: a processor 801, at least one communication bus 802, a user interface 803, at least one external communication interface 804 and a memory 805. The communication bus 802 is configured to realize the connection and communication between these components. The user interface 803 may include a display screen, and the external communication interface 804 may include a standard wired interface and a wireless interface. The processor 801 is configured to execute the program of the data acquisition method stored in the memory to implement the steps in the data acquisition method provided in the above embodiment.

[0202] The description of the above display device, electronic device and storage medium embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the display device, electronic device and storage medium embodiments of the present application, please refer to the description of the method embodiments of the present application for understanding.

[0203] It should be understood that "one embodiment" or "an embodiment" mentioned throughout the specification means that specific features, structures or characteristics related to the embodiment are included in at least one embodiment of the present application. Therefore, "in one embodiment" or "in an embodiment" appearing throughout the specification does not necessarily refer to the same embodiment. In addition, these specific features, structures or characteristics can be combined in one or more embodiments in any suitable manner. It should be understood that in various embodiments of the present application, the size of the sequence number of the above-mentioned processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application. The above-mentioned sequence numbers of the embodiments of the present application are only for description and do not represent the advantages and disadvantages of the embodiments.

[0204] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0205] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0206] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0207] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0208] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, read-only memories, magnetic disks or optical disks.

[0209] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can essentially or in other words, the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a device to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks or optical disks.

[0210] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A data collection method, characterized in that: The method comprises: Acquire first collected data, where the first collected data is collected by the terminal based on a first collection strategy; Acquire operation information of the terminal at the current moment, the operation information including at least one of the following: performance information, service information and process information; Based on the operation information, the first acquisition strategy is updated to obtain an updated first acquisition strategy; Perform data collection based on the updated first collection strategy to obtain second collected data; The updating of the first acquisition strategy based on the operation information to obtain an updated first acquisition strategy includes: Adjusting a first sub-strategy included in the first acquisition strategy according to the first acquisition data and the performance information to obtain an adjusted first sub-strategy; According to the first collected data and the business information, adjusting the second sub-strategy included in the first collection strategy to obtain an adjusted second sub-strategy; According to the first collected data and the process information, adjusting the third sub-strategy included in the first collection strategy to obtain an adjusted third sub-strategy; Determine an updated first acquisition strategy according to at least one of the adjusted first sub-strategy, the adjusted second sub-strategy, and the adjusted third sub-strategy; wherein the at least one sub-strategy includes at least the adjusted third sub-strategy; The adjusting, according to the first collected data and the process information, the third sub-strategy included in the first collection strategy to obtain the adjusted third sub-strategy includes: Performing risk assessment on the process information to obtain a risk assessment result; the third sub-strategy includes a third collection type and / or a third collection amount; Determining an adjustment value of the third collection type and / or an adjustment value of the third collection amount according to the risk assessment result; Based on the adjustment value of the third collection type and / or the adjustment value of the third collection amount, the third collection type and / or the third collection amount are adjusted to obtain an adjusted third sub-strategy.

2. The method according to claim 1, characterized in that The step of adjusting the first sub-strategy included in the first acquisition strategy according to the first acquisition data and the performance information to obtain the adjusted first sub-strategy includes: Acquire reference performance information and a first reference sub-strategy corresponding to the reference performance information; the reference performance information includes at least one of the following: processor operation information, storage operation information, and network operation information; the first reference sub-strategy includes a first reference collection type and / or a first reference collection amount; the first sub-strategy includes a first collection type and / or a first collection amount; determining, according to the performance information and the reference performance information, an adjustment value of the first acquisition type and / or an adjustment value of the first acquisition amount; Based on the adjustment value of the first collection type and / or the adjustment value of the first collection amount, the first collection type and / or the first collection amount are adjusted to obtain an adjusted first sub-strategy.

3. The method according to claim 1, characterized in that The adjusting, according to the first collected data and the business information, the second sub-strategy included in the first collection strategy to obtain the adjusted second sub-strategy includes: Acquire critical performance information corresponding to the service information; the critical performance information is the minimum performance information occupied when ensuring the normal operation of the service information; the second sub-strategy includes a second collection type and / or a second collection amount; determining, according to the critical performance information and the performance information, an adjustment value of the second acquisition type and / or an adjustment value of the second acquisition amount; Based on the adjustment value of the second collection type and / or the adjustment value of the second collection amount, the second collection type and / or the second collection amount are adjusted to obtain an adjusted second sub-strategy.

4. The method according to claim 1, characterized in that: The performing risk assessment on the process information to obtain a risk assessment result includes: Obtain a preset evaluation engine, wherein the preset evaluation engine includes at least an artificial intelligence AI engine, an anomaly detection engine, and a behavior rule engine; Determine, according to the process information, a process behavior graph context corresponding to the process information; According to the AI ​​engine, the anomaly detection engine and the behavior rule engine, a risk assessment is performed on the process behavior graph context to obtain a risk assessment result.

5. The method according to claim 1, characterized in that The method further comprises: The first collected data and the second collected data are sent to a server, so that the server determines a threat attack event against the terminal according to the first collected data and the second collected data.

6. A data acquisition device, characterized in that: The device comprises: A first acquisition module, used to acquire first collected data, where the first collected data is collected by the terminal based on a first collection strategy; A second acquisition module is used to acquire the operation information of the terminal at the current moment, wherein the operation information includes at least one of the following: performance information, service information and process information; An updating module, configured to update the first acquisition strategy based on the operation information to obtain an updated first acquisition strategy; A collection module, used for collecting data based on the updated first collection strategy to obtain second collected data; The updating module comprises a determining unit and a first adjusting unit, a second adjusting unit and a third adjusting unit; The first adjustment unit is configured to adjust a first sub-strategy included in the first collection strategy according to the first collection data and the performance information to obtain an adjusted first sub-strategy; The second adjustment unit is used to adjust the second sub-strategy included in the first collection strategy according to the first collection data and the business information to obtain an adjusted second sub-strategy; The third adjustment unit is used to adjust the third sub-strategy included in the first collection strategy according to the first collection data and the process information to obtain an adjusted third sub-strategy; The determining unit is used to determine the updated first acquisition strategy according to the adjusted first sub-strategy, the adjusted second sub-strategy, and at least one of the adjusted third sub-strategy; wherein the at least one sub-strategy at least includes the adjusted third sub-strategy; The third adjustment unit is further used to perform risk assessment on the process information to obtain a risk assessment result; the third sub-strategy includes a third collection type and / or a third collection amount; an adjustment value of the third collection type and / or an adjustment value of the third collection amount is determined according to the risk assessment result; based on the adjustment value of the third collection type and / or the adjustment value of the third collection amount, the third collection type and / or the third collection amount is adjusted to obtain an adjusted third sub-strategy.

7. An electronic device, characterized in that: include: A monitoring collection module, used for collecting first collection data, where the first collection data is collected by the electronic device based on a first collection strategy; A scheduling module, used for sending the first collected data to a decision module; A decision module, configured to update the first acquisition strategy based on the operation information of the electronic device at a current moment to obtain an updated first acquisition strategy; The operation information includes at least one of the following: performance information, business information and process information; used to adjust the first sub-strategy included in the first collection strategy according to the first collection data and the performance information to obtain the adjusted first sub-strategy; adjust the second sub-strategy included in the first collection strategy according to the first collection data and the business information to obtain the adjusted second sub-strategy; adjust the third sub-strategy included in the first collection strategy according to the first collection data and the process information to obtain the adjusted third sub-strategy; determine the updated first collection strategy according to at least one of the adjusted first sub-strategy, the adjusted second sub-strategy and the adjusted third sub-strategy; wherein the at least one sub-strategy at least includes the adjusted third sub-strategy; and also used to perform risk assessment on the process information to obtain a risk assessment result; the third sub-strategy includes a third collection type and / or a third collection amount; determine the adjustment value of the third collection type and / or the adjustment value of the third collection amount according to the risk assessment result; adjust the third collection type and / or the third collection amount based on the adjustment value of the third collection type and / or the adjustment value of the third collection amount to obtain the adjusted third sub-strategy; The scheduling module is further used to send the updated first collection strategy to the monitoring collection module, so that the monitoring collection module performs data collection based on the updated first collection strategy to obtain second collection data.

8. The electronic device according to claim 7, characterized in that: Also includes: The reporting module is used to send the first collected data and the second collected data collected by the monitoring collection module to the server, so that the server determines the threat attack event against the electronic device according to the first collected data and the second collected data.

Images