A behavior detection method, device, equipment and readable storage medium

Abstract

The present application discloses a behavior detection method, device, equipment and readable storage medium. The present application can perform indirect control relationship association, indirect data flow association and / or cross-restart association for different processes to obtain process association rules, so it can be found whether different processes have indirect control relationships, indirect data flow relationships and / or cross-restart relationships, and use the execution subject and object in the process behavior information as nodes, and the relationship between the execution subject and the object as edges to construct a behavior graph structure; when multiple behavior graph structures embody the process association rules, the multiple behavior graph structures are associated and constructed into a unified behavior graph structure, thereby marking the deeper relationship between different processes, and then attack behavior detection is performed based on the unified behavior graph structure, which can discover hidden attack behaviors and improve the accuracy of attack detection. The behavior detection device, equipment and readable storage medium provided by the present application also have the above-mentioned technical effects.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a behavior detection method, device, equipment and readable storage medium. Background Art

[0002] At present, when performing behavioral detection on processes on the terminal side, we only focus on the relationship between the main process and the child process, which have a direct control relationship. We do not explore and associate the deeper relationships between different processes. As a result, the scope of process behavior detection is broken, and it is not easy to discover hidden attack behaviors. The accuracy of the detection results is also low, and the false alarm rate is high.

[0003] Therefore, how to discover hidden attack behaviors between processes and improve the accuracy of attack detection is a problem that technical personnel in this field need to solve. Summary of the invention

[0004] In view of this, the purpose of this application is to provide a behavior detection method, device, equipment and readable storage medium to discover hidden attack behaviors between processes and improve the accuracy of attack detection. The specific scheme is as follows:

[0005] In a first aspect, the present application provides a behavior detection method, applied to a target terminal, comprising:

[0006] Acquiring process behavior information in the target terminal;

[0007] Constructing a behavior graph structure by taking the execution subject and the object in the process behavior information as nodes and the relationship between the execution subject and the object as edges;

[0008] When multiple behavior graph structures embody process association rules, the multiple behavior graph structures are associated to form a unified behavior graph structure;

[0009] The process association rule is: performing indirect control relationship association, indirect data flow association and / or cross-restart association for different processes;

[0010] Attack behavior detection is performed based on the unified behavior graph structure.

[0011] Optionally, the process association rule further associates direct control relationships between different processes.

[0012] Optionally, the performing attack behavior detection based on the unified behavior graph structure includes:

[0013] Using a single behavior association rule and a multi-behavior association rule to perform rule matching on the unified behavior graph structure;

[0014] The single behavior association rule performs logical association, or logical association, and / or non-logical association on different attributes of a single behavior in a single process;

[0015] The multi-behavior association rules are used to perform logical association, or logical association, and / or non-logical association on the attributes of different behaviors.

[0016] Optionally, after performing attack behavior detection based on the unified behavior graph structure, the method further includes:

[0017] Nodes and / or edges having attack behaviors are marked in the unified behavior graph structure.

[0018] Optionally, after marking the nodes and / or edges with attack behaviors in the unified behavior graph structure, the method further includes:

[0019] Deleting the edge not marked with the attack behavior and the end leaf of the edge from the unified behavior graph structure, while retaining the nodes connected by the edge, so as to prune the unified behavior graph structure;

[0020] Send the deleted unified behavior graph structure to the server;

[0021] or

[0022] Send the marked unified behavior graph structure to the server.

[0023] In a second aspect, the present application provides a behavior detection method, which is applied to a server, wherein the server is connected to a plurality of target terminals as described in any one of the above items, and the method comprises:

[0024] Associating the behavior graph structures sent by different target terminals to construct a global behavior graph structure;

[0025] Using multiple behavior association rules to perform rule matching on the global behavior graph structure to perform attack behavior detection on the global behavior graph structure;

[0026] The multi-behavior association rules perform logical association, or logical association, and / or non-logical association on the attributes of different behaviors across terminals.

[0027] In a third aspect, the present application provides a behavior detection device, applied to a target terminal, comprising:

[0028] An acquisition module, used to acquire process behavior information in the target terminal;

[0029] A construction module, used to construct a behavior graph structure using the execution subject and the object in the process behavior information as nodes and the relationship between the execution subject and the object as edges;

[0030] A first association module is used to associate the multiple behavior graph structures to form a unified behavior graph structure when the multiple behavior graph structures reflect the process association rule;

[0031] The process association rule is: performing indirect control relationship association, indirect data flow association and / or cross-restart association for different processes;

[0032] A detection module is used to perform attack behavior detection based on the unified behavior graph structure.

[0033] In a fourth aspect, the present application provides a behavior detection device, which is applied to a server, wherein the server is connected to a plurality of target terminals as described in any one of the above items, and the method includes:

[0034] A second association module is used to associate the behavior graph structures sent by different target terminals to construct a global behavior graph structure;

[0035] A matching module, used for performing rule matching on the global behavior graph structure by using multiple behavior association rules, so as to perform attack behavior detection on the global behavior graph structure;

[0036] The multi-behavior association rules perform logical association, or logical association, and / or non-logical association on the attributes of different behaviors across terminals.

[0037] In a fifth aspect, the present application provides an electronic device, including:

[0038] Memory for storing computer programs;

[0039] The processor is used to execute the computer program to implement the aforementioned disclosed behavior detection method.

[0040] In a sixth aspect, the present application provides a readable storage medium for storing a computer program, wherein the computer program implements the aforementioned disclosed behavior detection method when executed by a processor.

[0041] It can be seen from the above scheme that the present application provides a behavior detection method, which is applied to a target terminal, including: obtaining process behavior information in the target terminal; constructing a behavior graph structure with the execution subject and object in the process behavior information as nodes and the relationship between the execution subject and the object as edges; when multiple behavior graph structures embody process association rules, the multiple behavior graph structures are associated to construct a unified behavior graph structure; wherein the process association rules are: performing indirect control relationship association, indirect data flow association and / or cross-restart association for different processes; and performing attack behavior detection based on the unified behavior graph structure.

[0042] It can be seen that the present application can perform indirect control relationship association, indirect data flow association and / or cross-restart association for different processes to obtain corresponding process association rules. Therefore, it can be discovered whether different processes have indirect control relationships, indirect data flow relationships and / or cross-restart relationships, and construct a behavior graph structure with the execution subject and object in the process behavior information as nodes and the relationship between the execution subject and the object as edges; when multiple behavior graph structures embody the process association rules, the multiple behavior graph structures are associated to construct a unified behavior graph structure, thereby marking the deeper relationship between different processes, expanding the scope of process behavior detection, and reducing the probability of breaks in the detection range. After that, attack behavior detection is performed based on the unified behavior graph structure, which can discover hidden attack behaviors, improve the accuracy of attack detection results, and reduce the false alarm rate.

[0043] Correspondingly, a behavior detection device, equipment and readable storage medium provided by the present application also have the above-mentioned technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0045] Figure 1 A flow chart of a behavior detection method disclosed in this application;

[0046] Figure 2 A behavior graph structure disclosed in this application;

[0047] Figure 3 A schematic diagram of association between behavior graph structures disclosed in this application;

[0048] Figure 4 A schematic diagram of a behavior detection device disclosed in this application;

[0049] Figure 5 This is a schematic diagram of another behavior detection device disclosed in this application;

[0050] Figure 6 A schematic diagram of an electronic device disclosed in this application;

[0051] Figure 7 This is a schematic diagram of another electronic device disclosed in this application. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0053] At present, when the terminal performs behavior detection on the process, only the relationship between the main process and the sub-process, which has a direct control relationship, is focused on, and the deeper relationship between different processes is not explored and associated, resulting in a break in the scope of process behavior detection, making it difficult to detect hidden attack behaviors, and the accuracy of the detection results is also low, with a high false alarm rate. To this end, the present application provides a behavior detection solution that can detect hidden attack behaviors between processes and improve the accuracy of attack detection.

[0054] See also Figure 1 As shown, the embodiment of the present application discloses a behavior detection method, which is applied to a target terminal, including:

[0055] S101. Obtain process behavior information in a target terminal.

[0056] In this embodiment, the process behavior information may be process creation, process destruction, thread creation, thread destruction, file creation, file creation time modification, file renaming, file moving, file reading, file modification, file deletion, registry creation, registry deletion, registry modification, network connection or DNS query. These behavior information may be generated by local operation or remote operation.

[0057] Specifically, one process behavior information corresponds to one process behavior, and the attributes of a single process behavior include at least one of the following: process ID, process path, path of operated data, and type of operated data. The operated data can be: documents, images, videos, data tables, scripts, registries, threads, and other types of files.

[0058] The target terminal can be any terminal device, such as a personal PC, tablet, mobile phone, etc.

[0059] S102: Construct a behavior graph structure by taking the execution subject and the object in the process behavior information as nodes and the relationship between the execution subject and the object as edges.

[0060] Based on the above, the execution subject and object in the process behavior information can be processes and files. For example: for the process behavior information "Process 1 modifies file A", the subject is: process 1, and the object is: file A; for another example: for the process behavior information "Process 1 calls process 2", the subject is: process 1, and the object is: process 2. It can be seen that the execution subject is the active executor of the action, and the object is the passive recipient of the action, and a process behavior information can draw at least two nodes and edges between two nodes to obtain a behavior graph structure. If multiple behavior graph structures are connected, the following can be obtained: Figure 2 ,like Figure 3 The unified behavior graph structure shown.

[0061] like Figure 2 As shown, any process behavior information can be drawn in the graph structure. In a specific implementation, the single behavior information of a single process is obtained from the process behavior information. If different attributes in the single behavior information have AND logic, OR logic, and / or non-logic relationships, the process ID in the single behavior information is used as a node, and "AND logic, OR logic or non-logic" is used as an edge to draw a graph. For example: the modified file is stored in the C drive and has the suffix .EXE. If process 1 modifies file F with the suffix .EXE in the C drive, it is considered that the behavior of process 1 with respect to file F can be marked in the graph structure, so process 1 is used as a node, and an edge is drawn to file F.

[0062] Of course, not all behaviors executed by a process need to be drawn in the behavior graph structure. In a specific implementation, the behaviors that need to be drawn in the graph can be screened. For example: if the attributes of different process behavior information have AND logic, OR logic, and / or non-logic, then the process ID can be used as the node, and the "AND logic, OR logic, and / or non-logic between different process behavior information" can be used as the edge to draw a graph. For example: a single process changes both file F and registry R. Specifically, if process 1 modifies file F and then modifies registry R, ​​then it is considered that these two behaviors of process 1 can be marked in the graph structure. Therefore, with process 1 as the node, draw an edge pointing to file F, and draw another edge pointing to registry R.

[0063] Of course, the filtering conditions for constructing the graph structure can be set more carefully. For example, if a single process modifies both file F and registry R, ​​and the path of file F is equal to the value written in registry R, ​​it will be drawn in the graph structure. If process 1 modifies file F and then modifies registry R, ​​it will not be drawn in the graph structure. Only on this basis, it is further determined that the path of file F is equal to the value written in registry R, ​​and it is considered to meet the conditions for constructing the graph structure.

[0064] S103. When multiple behavior graph structures embody process association rules, the multiple behavior graph structures are associated to construct a unified behavior graph structure; wherein the process association rules are: performing indirect control relationship association, indirect data flow association and / or cross-restart association for different processes.

[0065] In this embodiment, the indirect control relationship between different processes includes: process injection relationship, COM call relationship, WMI call relationship, etc.

[0066] The indirect data flow association between different processes is as follows: if both process 1 and process 2 operate on file A, then there is an indirect data flow association between process 1 and process 2; for another example: if process 1 operates on file A and process 2 operates on file B at the same time, resulting in an attack, then there is also an indirect data flow association between process 1 and process 2.

[0067] Cross-restart associations between different processes include scheduled tasks, auto-start items, etc. For example, if process 1 starts the auto-start item when the terminal is turned on, then after the terminal restarts, the auto-start item calls process 2. At this time, it is considered that there is a cross-restart association between process 1 and process 2.

[0068] In a specific implementation, the process association rule further associates direct control relationships between different processes, such as the creation, calling, and destruction of a subprocess by a main process.

[0069] In a specific implementation, the unified behavior graph structure can be as follows Figure 2 As shown. Figure 2 In the diagram, circles are nodes and arrows are edges between nodes. A circle represents a process, represented by the letter P. The edges between nodes represent the relationship between different processes, including: direct control relationship (such as process creation); indirect control relationship (such as injection, COM call, WMI call, etc.); indirect data flow relationship (such as decompression, executable file is started, script is started, etc.).

[0070] Figure 2 The rectangular nodes in the figure represent files, which are represented by the letter F. The parent node of the file is the process node. The operation behaviors of the process node on the file can be subdivided into file creation, file modification, file deletion, etc. Figure 2 The diamond node in represents the registry, represented by the letter R. The parent node of the registry is the process node. The operation behavior of the process node on the registry can be subdivided into registry creation, registry deletion, registry modification, etc. Figure 2 The triangle node in the figure represents a URL resource, which is represented by the letter U. The parent node of the URL resource is the process node. Of course, the process node can also perform other operations on other types of data, which can also be marked with the process node as the parent node. Figure 2 It can be seen that the modified files, registry, URL resources and other data are all the end leaf nodes of the graph structure. Various operation behaviors of the process on the terminal can be abstracted into a graph structure.

[0071] S104. Perform attack behavior detection based on a unified behavior graph structure.

[0072] After constructing the graph structure with the above-mentioned drawing idea, the graph structure can continue to be matched with rules with the above-mentioned drawing idea to detect whether the various associations illustrated in the graph structure are offensive. In a specific implementation, attack behavior detection based on a unified behavior graph structure includes: using a single behavior association rule and multiple behavior association rules to match the unified behavior graph structure; wherein the single behavior association rule performs logical association, or logical association, and / or non-logical association on different attributes of a single behavior within a single process; wherein the multiple behavior association rules perform logical association, or logical association, and / or non-logical association on the attributes of different behaviors.

[0073] It should be noted that the association of multiple behaviors is not limited to one process. In other words, the association of these multiple behaviors can cross processes. For example, process 1 changes file F, process 2 changes registry R, ​​and the path of file F is equal to the value written in registry R. Then the two behaviors of "process 1 changes file F" and "process 2 changes registry R" are associated, and based on this, we can further detect whether these two behaviors and their association are aggressive.

[0074] In this embodiment, after attack behavior detection is performed based on the unified behavior graph structure, it also includes: marking nodes and / or edges with attack behaviors in the unified behavior graph structure. Marking nodes and / or edges with attack behaviors in the unified behavior graph structure includes: (1) considering all behaviors that meet the single behavior association rule and the multi-behavior association rule as abnormal behaviors, circling related attack behaviors, and distinguishing unrelated attack behaviors. (2) Using existing attack detection rules to detect one by one Figure 2 Each behavior in .

[0075] like Figure 2 As shown, the behavior in the dashed box Figure 1 and behavior Figure 2 It is considered to be the part with attack behavior detected, which is of course a local graph of the entire unified behavior graph structure.

[0076] It should be noted that if after detecting the entire unified behavior graph structure, it is found that some of the nodes and edges are not marked with attack behaviors, then the behaviors corresponding to these nodes and edges can be temporarily considered to be normal behaviors. In order to reduce the amount of data in the unified behavior graph structure, the edges corresponding to the process behaviors that are not marked with attack behaviors can be deleted (such as Figure 2 The edge a in the ellipse area and the end leaf node of the edge (such as Figure 2 File F) in the ellipse area.

[0077] It can be seen that this embodiment can perform indirect control relationship association, indirect data flow association and / or cross-restart association for different processes to obtain corresponding process association rules. Therefore, it can be discovered whether different processes have indirect control relationships, indirect data flow relationships and / or cross-restart relationships, and construct a behavior graph structure with the execution subject and object in the process behavior information as nodes and the relationship between the execution subject and the object as edges; when multiple behavior graph structures embody the process association rules, the multiple behavior graph structures are associated to construct a unified behavior graph structure, thereby marking the deeper relationship between different processes, expanding the scope of process behavior detection, and reducing the probability of breaks in the detection range. After that, attack behavior detection is performed based on the unified behavior graph structure, which can discover hidden attack behaviors, improve the accuracy of attack detection results, and reduce the false alarm rate.

[0078] Based on the above embodiments, it should be noted that after marking the nodes and / or edges with attack behaviors in the unified behavior graph structure, it also includes: deleting the edges corresponding to the process behaviors that are not marked with attack behaviors and the terminal leaves of the edges from the unified behavior graph structure, while retaining the nodes connected by the edges to delete the unified behavior graph structure; sending the deleted unified behavior graph structure to the server; or sending the marked unified behavior graph structure to the server.

[0079] If the server is connected to multiple target terminals, the server can receive multiple unified behavior graph structures, and the server can associate and alert the behavior graph structures sent by different target terminals. Each terminal can update its own behavior graph structure in real time and periodically send its own current behavior graph structure to the server.

[0080] like Figure 3 As shown in the figure, the behavior graph structures constructed by terminals 1 and 2 both have P1 processes and attack behaviors. Based on this P1 process, the two behavior graph structures can be associated to achieve cross-terminal alarms. Of course, different behavior graph structures can also be associated based on other common information (such as file names, etc.).

[0081] Another behavior detection method provided in an embodiment of the present application is introduced below. The another behavior detection method described below and the one behavior detection method described above can be referenced to each other.

[0082] The present embodiment provides a behavior detection method, which is applied to a server side, and the server side is connected to multiple target terminals described in the above embodiments. The method includes: associating the behavior graph structures sent by different target terminals to construct a global behavior graph structure; using multiple behavior association rules to match the global behavior graph structure to perform attack behavior detection on the global behavior graph structure; wherein the multiple behavior association rules perform logical association, or logical association, and / or non-logical association on the attributes of different behaviors across terminals.

[0083] Among them, it is assumed that a unified behavior graph structure can be constructed for each process in a target terminal, so a target terminal sends a unified behavior graph structure to the server, and the unified behavior graph structure is constructed according to the relevant steps described in the above embodiment. Then the server can obtain multiple unified behavior graph structures, and the server can associate the graph structures sent by different target terminals, and then use multi-behavior association rules to match the global behavior graph structure obtained by association, so as to detect attack behaviors on the associated global behavior graph structure.

[0084] It can be seen that the server in this embodiment can associate and warn the unified behavior graph structures sent by different target terminals, thereby realizing cross-terminal alarms. In one implementation, different unified behavior graph structures can be associated to obtain a global alarm graph to facilitate viewing of attack distribution areas, ranges, etc.

[0085] As mentioned above, all operation behaviors on the terminal can be abstracted into a graph structure. The operation behaviors on the terminal include but are not limited to process creation, process destruction, thread creation, thread destruction, remote thread creation, file creation, file creation time modification, file renaming, file moving, file reading, file modification, file deletion, registry creation, registry deletion, registry modification, network connection, DNS query, etc.

[0086] In this embodiment, these operation behaviors are referred to as original behaviors. If these original behaviors are the behaviors we want to record, then a terminal global graph can be constructed for a terminal based on these original behaviors, such as Figure 2 A single process can perform multiple types of primitive behaviors. For example: Figure 2 The behavior shown in Figure 2 ", in which process P1 creates child process P2, creates file F1, and accesses external URL U1.

[0087] The association rules set in this embodiment can directly find abnormal behaviors. In other words, behaviors that conform to the rules of this embodiment are considered abnormal behaviors. In order to filter out the abnormal behaviors that we want to record, multiple layers of rules can be set: (1) Simple rules for a single behavior: perform AND or NOT operations on the attributes within a single original behavior. For example: perform AND operations on the file path and file type in the original behavior of file creation. (2) Complex rules for multiple behaviors: perform AND or NOT operations on the attributes between multiple original behaviors. For example: perform AND operations on the file path in the original behavior of file creation and the registry value in the original behavior of writing to the registry.

[0088] Among them, the AND, OR, and NOT operations of the attributes between different original behaviors can cross processes and restarts. For example: Process 1 changes file F, process 2 changes registry R, ​​and the path of file F is equal to the value written in registry R. Then the two behaviors of "Process 1 changes file F" and "Process 2 changes registry R" are related and need to be drawn in the diagram at the same time to realize cross-process recording of different original behaviors. For example: Process 1 starts the auto-start item when the terminal is turned on. Then after the terminal is restarted, the auto-start item calls process 2. At this time, it is considered that these two original behaviors cross restarts.

[0089] Based on this principle, the following rules can be set:

[0090] (1) Behavior association and detection within a single process: used to perform association detection on the original behavior rules within a single process. Each original behavior is constrained within the same process scope through its main process ID attribute. Figure 2 "Behavior Figure 2 " Taking the P1 process as an example, its three original behaviors: creating a child process P2, creating a file F1, and accessing an external URL U1 are detected as malicious.

[0091] (2) Correlation and detection of different behaviors across processes: used to detect the correlation of original behaviors within two or more processes. The relationship between processes includes direct control correlation, indirect control correlation, and indirect data flow correlation. Figure 2 "Behavior" in Figure 1 "For example, process P3 has an original behavior of creating file F1, and process P4 has an original behavior of creating registry R1. These two original behaviors hit malicious behaviors. When matching such rules, it is not necessary to specify the attribute constraints of the subject process ID. The entire "behavior Figure 1 " is considered as a whole, and all primitive behaviors on it are implicitly related to each other, and the whole "behavior Figure 1 ” Specific internal correlation.

[0092] (3) Correlation and detection of indirect data flows. Taking the example of an executable file being started, suppose Figure 2 "Behavior" in Figure 1 "Process P2 creates the executable file F2, which is then started as a mirror by other processes. Figure 2 "Behavior Figure 2 " is the root node of Figure 1 ” and “behavior Figure 2 ” is associated.

[0093] (4) Correlate and detect cross-restart behaviors. Some malicious attacks may have persistent behaviors such as self-starting items and scheduled tasks, which will cause the malicious attacks before and after the restart to be divided into two unrelated parts. Cross-restart correlation is mainly to solve such similar problems and make the boundaries of malicious attack behaviors more accurate.

[0094] By using the multiple rules set above, we can record all the abnormal behaviors that occur on the terminal and that we want to record into the graph, and get the following: Figure 2 Afterwards, the attack behaviors in the graph can be marked.

[0095] Of course, aggressive behavior and normal behavior are essentially composed of primitive behaviors, but aggressive behavior has boundaries, such as Figure 2 "Behavior" in Figure 1 ” and “behavior Figure 2 " are two independent attack behavior graphs, and the other parts are normal original behaviors. Therefore, the attack behavior graph can be regarded as a subgraph of the terminal global graph. By matching the behaviors in the terminal global graph with malicious behavior rules, the attack behavior graph can be detected. Figure 2 "Behavior" in Figure 1 ” and “behavior Figure 2 ”, so that the attack range can be framed.

[0096] It can be seen that this embodiment can record and mark attack behaviors within a single process, within different processes, and across restarts, and contextualizes the graph structure to achieve the purpose of layered detection. This accurately defines the attack scope, improves the accuracy of attack detection, and reduces the false alarm rate.

[0097] Since malicious attacks usually occur on more than one terminal, they may move laterally to other terminals in the intranet to continue the attack. In order to achieve cross-terminal detection, the associated behavior graphs obtained on each terminal side (including behavior graph descriptions, matching rule descriptions, and corresponding original behaviors) can be sent to the server (such as a physical server or cloud), and the graphs can be associated across terminals on the server. If different associations meet the alarm rules, an alarm is output. Cross-terminal association can obtain a global detection graph for the intranet, such as Figure 3 shown.

[0098] It can be seen that this embodiment can record attack behaviors within a single process, different processes, and across restarts in a terminal. At the same time, it can also associate malicious behaviors on different terminals in the cloud to accurately define the boundaries of attack behaviors and effectively improve detection accuracy.

[0099] A behavior detection device provided in an embodiment of the present application is introduced below. The behavior detection device described below and the behavior detection method described above can be referenced to each other.

[0100] See also Figure 4 As shown, the embodiment of the present application discloses a behavior detection device, which is applied to a target terminal, including:

[0101] The acquisition module 401 is used to acquire the process behavior information in the target terminal;

[0102] A construction module 402 is used to construct a behavior graph structure using the execution subject and the object in the process behavior information as nodes and the relationship between the execution subject and the object as edges;

[0103] A first association module 403 is used to associate the multiple behavior graph structures to form a unified behavior graph structure when the multiple behavior graph structures reflect the process association rule;

[0104] The process association rules are: performing indirect control relationship association, indirect data flow association and / or cross-restart association for different processes;

[0105] The detection module 404 is used to perform attack behavior detection based on the unified behavior graph structure.

[0106] In a specific implementation, the process association rule further associates direct control relationships between different processes.

[0107] In a specific embodiment, the detection module is specifically used for:

[0108] Use single behavior association rules and multi-behavior association rules to match the unified behavior graph structure;

[0109] Among them, the single behavior association rule performs logical association, or logical association, and / or non-logical association on different attributes of a single behavior within a single process;

[0110] The multi-behavior association rules are used to perform logical association, or logical association, and / or non-logical association on the attributes of different behaviors.

[0111] In a specific embodiment, it also includes:

[0112] The marking module is used to mark nodes and / or edges with attack behaviors in the unified behavior graph structure.

[0113] In a specific embodiment, it also includes:

[0114] A deletion module is used to delete the edge corresponding to the process behavior that is not marked with an attack behavior and the terminal leaf of the edge from the unified behavior graph structure, while retaining the nodes connected by the edge, so as to delete the unified behavior graph structure;

[0115] A sending module, used to send the deleted unified behavior graph structure to the server;

[0116] or

[0117] Another sending module is used to send the marked unified behavior graph structure to the server.

[0118] Among them, for more specific working processes of each module and unit in this embodiment, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0119] It can be seen that this embodiment provides a behavior detection device, which marks the deeper relationship between different processes, expands the scope of process behavior detection, and then marks the nodes and / or edges with attack behaviors in the behavior graph structure, which can discover hidden attack behaviors and improve the accuracy of attack detection results.

[0120] Another behavior detection device provided in an embodiment of the present application is introduced below. The another behavior detection device described below and the another behavior detection method described above can be referenced to each other.

[0121] See also Figure 5 As shown, an embodiment of the present application discloses a behavior detection device, which is applied to a server, and the server is connected to a plurality of target terminals of any one of the above items, and the method includes:

[0122] The second association module 501 is used to associate the behavior graph structures sent by different target terminals to construct a global behavior graph structure;

[0123] A matching module 502 is used to perform rule matching on the global behavior graph structure using multiple behavior association rules to perform attack behavior detection on the global behavior graph structure;

[0124] The multi-behavior association rules perform logical association, or logical association, and / or non-logical association on the attributes of different behaviors across terminals.

[0125] Among them, for more specific working processes of each module and unit in this embodiment, reference can be made to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0126] It can be seen that this embodiment provides a behavior detection device, which can associate the behavior graph structures sent by different target terminals and issue an alarm, thereby realizing cross-terminal alarm.

[0127] An electronic device provided in an embodiment of the present application is introduced below. The electronic device described below and the behavior detection method and device described above can be referenced to each other.

[0128] See also Figure 6 As shown, the embodiment of the present application discloses an electronic device, including:

[0129] Memory 601, used for storing computer programs;

[0130] The processor 602 is used to execute the computer program to implement the method disclosed in any of the above embodiments.

[0131] Please refer to Figure 7 , Figure 7 Another electronic device schematic diagram provided for this embodiment, the electronic device may have relatively large differences due to different configurations or performances, and may include one or more processors (central processing units, CPU) 322 (for example, one or more processors) and memory 332, one or more storage media 330 (for example, one or more mass storage devices) storing application programs 342 or data 344. Among them, the memory 332 and the storage medium 330 can be short-term storage or permanent storage. The program stored in the storage medium 330 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations in the data processing device. Furthermore, the central processor 322 can be configured to communicate with the storage medium 330 to execute a series of instruction operations in the storage medium 330 on the electronic device 301.

[0132] The electronic device 301 may further include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input / output interfaces 358, and / or one or more operating systems 341. For example, Windows Server™, Mac OS X™, Unix™, Linux™, FreeBSD™, etc.

[0133] exist Figure 7 In the embodiment, application 342 may be a program for executing the behavior detection method, and data 344 may be data required or generated for executing the behavior detection method.

[0134] The steps in the behavior detection method described above can be implemented by the structure of an electronic device.

[0135] A readable storage medium provided in an embodiment of the present application is introduced below. The readable storage medium described below and the behavior detection method, device and apparatus described above can be referenced to each other.

[0136] A readable storage medium is used to store a computer program, wherein the computer program, when executed by a processor, implements the behavior detection method disclosed in the above embodiment. For the specific steps of the method, reference can be made to the corresponding contents disclosed in the above embodiment, and no further description will be given here.

[0137] The "first", "second", "third", "fourth", etc. (if any) referred to in this application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods or devices.

[0138] It should be noted that the descriptions involving "first", "second", etc. in this application are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In addition, the technical solutions between the various embodiments can be combined with each other, but they must be based on the ability of ordinary technicians in this field to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be deemed that such combination of technical solutions does not exist and is not within the scope of protection required by this application.

[0139] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0140] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of readable storage medium known in the art.

[0141] Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A behavior detection method, characterized in that: Applied to target terminals, including: Acquiring process behavior information in the target terminal; Constructing a behavior graph structure by taking the execution subject and the object in the process behavior information as nodes and the relationship between the execution subject and the object as edges; When multiple behavior graph structures embody process association rules, the multiple behavior graph structures are associated to form a unified behavior graph structure; The process association rule is: performing indirect control relationship association, indirect data flow association and / or cross-restart association for different processes; Attack behavior detection is performed based on the unified behavior graph structure.

2. The behavior detection method according to claim 1, characterized in that: The process association rule also associates direct control relationships between different processes.

3. The behavior detection method according to claim 1, characterized in that: The attack behavior detection based on the unified behavior graph structure includes: Using a single behavior association rule and a multi-behavior association rule to perform rule matching on the unified behavior graph structure; The single behavior association rule performs logical association, or logical association, and / or non-logical association on different attributes of a single behavior in a single process; The multi-behavior association rules are used to perform logical association, or logical association, and / or non-logical association on the attributes of different behaviors.

4. The behavior detection method according to claim 1, characterized in that: After the attack behavior detection is performed based on the unified behavior graph structure, the method further includes: Nodes and / or edges having attack behaviors are marked in the unified behavior graph structure.

5. The behavior detection method according to claim 4, characterized in that: After marking the nodes and / or edges with attack behaviors in the unified behavior graph structure, the method further includes: Deleting the edge not marked with the attack behavior and the terminal leaf of the edge from the unified behavior graph structure, while retaining the nodes connected by the edge, so as to prune the unified behavior graph structure; Send the deleted unified behavior graph structure to the server; or Send the marked unified behavior graph structure to the server.

6. A behavior detection method, characterized in that: Applied to a server, the server being connected to a plurality of target terminals according to any one of claims 1 to 5, the method comprising: Associating the behavior graph structures sent by different target terminals to construct a global behavior graph structure; Using multiple behavior association rules to perform rule matching on the global behavior graph structure to perform attack behavior detection on the global behavior graph structure; The multi-behavior association rules perform logical association, or logical association, and / or non-logical association on the attributes of different behaviors across terminals.

7. A behavior detection device, characterized in that: Applied to target terminals, including: An acquisition module, used to acquire process behavior information in the target terminal; A construction module, used to construct a behavior graph structure using the execution subject and the object in the process behavior information as nodes and the relationship between the execution subject and the object as edges; A first association module is used to associate the multiple behavior graph structures to form a unified behavior graph structure when the multiple behavior graph structures reflect the process association rule; The process association rule is: performing indirect control relationship association, indirect data flow association and / or cross-restart association for different processes; A detection module is used to perform attack behavior detection based on the unified behavior graph structure.

8. A behavior detection device, characterized in that: Applied to a server, the server being connected to a plurality of target terminals according to any one of claims 1 to 5, the method comprising: A second association module is used to associate the behavior graph structures sent by different target terminals to construct a global behavior graph structure; A matching module, used for performing rule matching on the global behavior graph structure by using multiple behavior association rules, so as to perform attack behavior detection on the global behavior graph structure; The multi-behavior association rules perform logical association, or logical association, and / or non-logical association on the attributes of different behaviors across terminals.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to execute the computer program to implement the behavior detection method as claimed in any one of claims 1 to 6.

10. A readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the behavior detection method according to any one of claims 1 to 6 is implemented.

Images