Host intrusion detection method, device, equipment and storage medium

Abstract

The present application discloses a host intrusion detection method, apparatus, device and storage medium, wherein the method comprises: obtaining data to be detected, wherein the data to be detected comprises business category information; based on the business category information, determining target detection item information corresponding to the data to be detected; detecting the data to be detected based on the detection items corresponding to the target detection item information, and obtaining detection information. The technical solution provided in the present application can fully utilize the business category information corresponding to the data to be detected, quickly perform host intrusion detection, and thus significantly improve the detection accuracy and efficiency.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a host intrusion detection method, device, equipment and storage medium. Background Art

[0002] In order to ensure the information security of computer networks, it is necessary to carry out security protection of computer networks. The sources of intrusion data to computer networks are mainly divided into two categories: on the one hand, data from the host, and on the other hand, data from the network. Among them, firewalls, switches, and intrusion protection sensors can be used to achieve intrusion detection and protection of the network. At present, network intrusion detection is relatively mature and standardized, with unified rules.

[0003] In the prior art, host intrusion detection and protection methods can be divided into the following four detection methods according to the detection method, namely: 1) feature-based detection, comparing the observed events with known threat features to identify events, mainly used to detect known threats; 2) anomaly-based detection, comparing the observed events with determined normal activities to identify deviations from normal activities. This method mainly detects unknown threats; 3) stateful protocol-based detection, comparing the observed events with pre-set configuration files to identify deviations from the configuration files. The difference between this method and anomaly-based detection is that the general configuration files provided by the supplier are used to detect attacks that cannot be detected by other methods; 4) detection based on mathematical models such as artificial intelligence, pre-building attack detection models, and detecting intrusion events by training the detection models.

[0004] At present, technical personnel in this field often use a combination of the above four methods to perform host intrusion detection. However, host intrusion detection based on the combination of the above four detection methods has problems such as high CPU resource usage of concurrent tasks, numerous and non-uniform detection configurations, poor interpretability, difficulty in fully utilizing intrusion features, and difficulty in migrating detection models of different architecture systems.

[0005] Therefore, an improved host intrusion detection technology solution is needed to solve the problems existing in the above-mentioned prior art. Summary of the invention

[0006] In order to solve the problems of the prior art, the embodiments of the present application provide a host intrusion detection method, device, equipment and storage medium technical solution, the technical solution of which is as follows:

[0007] In one aspect, a host intrusion detection method is provided, the method comprising:

[0008] Acquire data to be detected, where the data to be detected includes service category information;

[0009] Based on the service category information, determining target detection item information corresponding to the data to be detected;

[0010] The data to be detected is detected based on the detection item corresponding to the target detection item information to obtain detection information.

[0011] Furthermore, before the step of determining the target detection item information corresponding to the to-be-detected data based on the service category information, the method further includes:

[0012] Analyze the data to be detected to obtain service category information and detection content information corresponding to the data to be detected;

[0013] According to the service category information and the detection content information, target format data corresponding to the data to be detected is obtained.

[0014] Furthermore, before the step of determining the target detection item information corresponding to the to-be-detected data based on the service category information, the method further includes:

[0015] Determining detection priority information corresponding to the data to be detected according to the target format data;

[0016] According to the detection priority information, obtaining the sorting information of the target format data in the detection data queue;

[0017] The target format data is inserted into the detection data queue according to the sorting information.

[0018] Furthermore, before the step of determining the target detection item information corresponding to the to-be-detected data based on the service category information, the method further includes:

[0019] Sending the target format data to the detection data queue;

[0020] Based on the detection priority information corresponding to the target format data, the detection arrangement information corresponding to the target format data in the detection data queue is obtained.

[0021] Furthermore, it also includes:

[0022] Acquire information of a plurality of detection items;

[0023] Based on the plurality of detection item information, determining the detection necklace table information corresponding to the service category information;

[0024] Based on the detection necklace table information, corresponding detection processing is performed on the data to be detected.

[0025] Further, the service category information includes first service category information and second service category information; and determining the target detection item information corresponding to the to-be-detected data based on the service category information includes:

[0026] Based on the first service category information, determining first detection item information corresponding to the data to be detected;

[0027] Determining second detection item information corresponding to the data to be detected based on the second service category information;

[0028] The target detection item information is determined based on the first detection item information and the second detection item information.

[0029] Furthermore, the first service category information includes at least any one of host detection data, log audit detection data, malicious file detection data, vulnerability detection data and malicious behavior association analysis detection data.

[0030] On the other hand, a host intrusion detection device is provided, the device comprising:

[0031] Data acquisition module: used to acquire the data to be detected, wherein the data to be detected includes business category information;

[0032] A target detection item information determination module is used to determine the target detection item information corresponding to the data to be detected based on the service category information;

[0033] Detection module: used to detect the data to be detected based on the detection items corresponding to the target detection item information to obtain detection information.

[0034] On the other hand, a host intrusion detection device is provided, which includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set are loaded and executed by the processor to implement the host intrusion detection method as described above.

[0035] On the other hand, a computer-readable storage medium is provided, in which at least one instruction, at least one program, a code set or an instruction set is stored, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by a processor to implement the host intrusion detection method as described above.

[0036] The present application provides a host intrusion detection method, device, equipment and storage medium, which have the following technical effects:

[0037] The embodiment of the present application obtains data to be detected including business category information, so as to determine target detection item information corresponding to the data to be detected based on the business category information corresponding to the data to be detected, and detects the data to be detected based on the detection items corresponding to the target detection item information to obtain detection information. The technical solution provided by the present application can fully utilize the business category information corresponding to the data to be detected, quickly perform host intrusion detection, and thus significantly improve the detection accuracy and detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0039] Figure 1 A schematic diagram of a process flow of a host intrusion detection method provided in an embodiment of the present application;

[0040] Figure 2 A schematic diagram of a flow chart of a method for determining target detection item information provided in an embodiment of the present application;

[0041] Figure 3 A flowchart of a method for determining necklace table information provided in an embodiment of the present application;

[0042] Figure 4 A schematic diagram of the structure of the detection necklace table information corresponding to the host detection configuration file provided in the embodiment of the present application;

[0043] Figure 5 A schematic diagram of the structure of the detection necklace table information corresponding to the log audit detection configuration file provided in the embodiment of the present application;

[0044] Figure 6 A schematic diagram of the structure of the detection necklace table information corresponding to the malicious file detection configuration file provided in the embodiment of the present application;

[0045] Figure 7 A schematic diagram of the structure of the detection necklace table information corresponding to the vulnerability detection configuration file provided in the embodiment of the present application;

[0046] Figure 8 A schematic diagram of the structure of the detection necklace table information corresponding to the malicious behavior association analysis detection configuration file provided in the embodiment of the present application;

[0047] Fig. 9 A schematic diagram of a flow chart of a method for determining target format data provided in an embodiment of the present application;

[0048] Fig.10 A schematic diagram of a flow chart of a method for determining a detection data queue provided in an embodiment of the present application;

[0049] Fig.11 A flowchart of another method for determining a detection data queue provided in an embodiment of the present application;

[0050] Fig.12 A schematic diagram of the structure of a host intrusion detection device provided in an embodiment of the present application;

[0051] Fig.13 A schematic diagram of the structure of another host intrusion detection device provided in an embodiment of the present application;

[0052] Fig.14 A schematic diagram of the structure of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0054] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein.

[0055] See also Figure 1 , which is a flow chart of a host intrusion detection method provided by an embodiment of the present application, and the following is combined with Figure 1 The technical solution of the present application is described in detail. It should be noted that this specification provides method operation steps as described in the embodiments or flow charts, but more or fewer operation steps may be included based on conventional or non-creative work. The order of steps listed in the embodiments is only one way of executing the steps among many, and does not represent the only execution order. The method specifically includes the following steps:

[0056] S101: Acquire data to be detected, where the data to be detected includes service category information.

[0057] In an embodiment of the present application, the data to be detected may include system abnormality data, suspicious process data, malicious file data, etc. The business category information is used to indicate the business category of the data to be detected, so as to determine the detection item type corresponding to the data to be detected according to the business category of the data to be detected, thereby realizing host intrusion detection of the data to be detected. Specifically, the business category information may include first business category information and second business category information, wherein the second business category information is sub-business category information corresponding to the first business category information. Exemplarily, the first business category information may include vulnerability detection data, and the second business category information may be Linux system application vulnerability detection data, Android application vulnerability detection data or hardware vulnerability detection data, etc., thereby making full use of the characteristic information carried by the data to be detected itself to realize accurate detection of host-type intrusions, thereby solving the problem that the intrusion features in the prior art cannot be reasonably utilized.

[0058] S102: Determine target detection item information corresponding to the data to be detected based on the service category information.

[0059] S103: Detect the data to be detected based on the detection item corresponding to the target detection item information to obtain detection information.

[0060] In an embodiment of the present application, the target detection item information is the detection item information that matches the business category information, and the detection item is the detection configuration item corresponding to the detection item information. The target detection item information is gradually matched and detected with the data to be detected according to the business category information, and then the detection result corresponding to the host intrusion detection is obtained, so as to perform corresponding alarms and defense operations, so as to avoid irreversible losses due to the inability or delay in determining the type of host intrusion, and then make full use of the business category information corresponding to the data to be detected, and quickly perform host intrusion detection, thereby significantly improving the detection accuracy and detection efficiency.

[0061] In another specific implementation, step S103 also includes, based on the detection information, determining the detection results of the data to be detected. Specifically, if the detection result is that the data to be detected matches the detection item corresponding to the target detection item information, then a corresponding alarm information and an operation instruction corresponding to the alarm information are generated. Exemplarily, the processing method for the detection result may include alarm reporting, terminating a process, isolating files, discarding files, or recording logs.

[0062] In an optional embodiment, if Figure 2As shown, it is a flow chart of a method for determining target detection item information provided by an embodiment of the present application, the business category information includes first business category information and second business category information, wherein the first business category information includes at least any one of host detection data, log audit detection data, malicious file detection data and vulnerability detection data, then step S102 may include:

[0063] S1021: Determine first detection item information corresponding to the data to be detected based on the first service category information.

[0064] S1022: Determine second detection item information corresponding to the data to be detected based on the second service category information.

[0065] S1023: Determine target detection item information based on the first detection item information and the second detection item information.

[0066] In an embodiment of the present application, the first detection item information is the detection item information corresponding to the first business category information, which is used to detect the data to be detected including the first business category. Exemplarily, the first business category information may include but is not limited to host detection data, log audit detection data, malicious file detection data, vulnerability detection data and malicious behavior association analysis detection data, then the first detection item information may include but is not limited to host detection configuration file, log audit detection configuration file, malicious file detection configuration file, vulnerability detection configuration file and malicious behavior association analysis detection configuration file, so as to perform host intrusion detection on the data to be detected including the first business category information; the second detection item information is the detection item information corresponding to the second business category information, which is used to detect the data to be detected including the second business category. Exemplarily, the second business category information may include but is not limited to open port detection data, suspicious process detection data, data integrity detection data, system resource occupancy detection data, Linux system application vulnerability data, Android application vulnerability data and hardware vulnerability data, then the second detection item information may include but is not limited to open port detection configuration file, suspicious process detection configuration file, data integrity detection configuration file, system resource occupancy detection configuration file, Linux system application vulnerability detection configuration file, Android application vulnerability detection configuration file and hardware vulnerability detection configuration file, so as to perform host intrusion detection on the data to be detected including the second business category information.

[0067] In actual applications, the second detection item information is the sub-detection item information corresponding to the first detection item information. Therefore, when determining the first detection item information corresponding to the data to be detected, it is only necessary to determine the sub-detection item information corresponding to the first detection item information, so as to realize the detection of host intrusion, thereby improving the detection efficiency.

[0068] In an optional embodiment, if Figure 3 As shown, it is a flow chart of a method for determining necklace table information provided in an embodiment of the present application, and the method further includes:

[0069] S301: Acquire information of multiple detection items.

[0070] S302: Based on the multiple detection item information, determine the detection necklace table information corresponding to the service category information.

[0071] S303: Perform corresponding detection processing on the data to be detected based on the detection necklace table information.

[0072] In an embodiment of the present application, the detection necklace table information represents a detection necklace table that classifies detection items corresponding to business category information. By detecting the data to be detected through the detection necklace table information, the detection efficiency of the data to be detected can be improved, and the detection necklace table information can be easily expanded, thereby realizing a comprehensive and accurate detection mechanism.

[0073] In a specific embodiment, if Figure 4-Figure 8 As shown, Figure 4 A schematic diagram of the structure of the detection necklace table information corresponding to the host detection configuration file provided in the embodiment of the present application, Figure 5 A schematic diagram of the structure of the detection necklace table information corresponding to the log audit detection configuration file provided in the embodiment of the present application, Figure 6 A schematic diagram of the structure of the detection necklace table information corresponding to the malicious file detection configuration file provided in the embodiment of the present application, Figure 7 A schematic diagram of the structure of the detection necklace table information corresponding to the vulnerability detection configuration file provided in the embodiment of the present application, Figure 8 A schematic diagram of the structure of the detection necklace table information corresponding to the malicious behavior association analysis detection configuration file provided in the embodiment of the present application, from Figure 4-Figure 8 It can be seen that the detection necklace table information includes the first detection item information, the second detection item information and the detection configuration body corresponding to the second detection item information. The detection configuration body is used to detect the detection content information corresponding to the business category information of the data to be detected. There can be multiple detection content information in the detection configuration body, so as to make full use of the characteristic information of the data to be detected, quickly determine the host intrusion type corresponding to the data to be detected, and then generate corresponding protection measures to improve the detection efficiency of the data to be detected.

[0074] It should be noted that the detection configuration bodies corresponding to the second detection item information can be arranged in ascending or descending order according to the corresponding identification numbers to improve the traversal efficiency of the detection.

[0075] In a specific embodiment, a suspicious process detection configuration file may include a processing method, a user group name, a user name, a service category information, a detection direction and a detection configuration body. Exemplarily, the suspicious process detection configuration file is alerthost any1 2->any2 any3(msg:"unknown suspicious process detected"; content:"error unknown proc"; sid:1200013;), wherein alert indicates that the processing result is an alarm report; host indicates that the first service category information is host detection data; any1 indicates detection of all user groups; 2 indicates that the second service category information is suspicious process detection data; -> indicates detection of newly added data to be detected; any2 indicates detection of all users in all user groups; any3 indicates the detection item corresponding to the second service category information, (msg:"unknown suspicious process detected"; content:"error unknown proc"; sid:1200013;) indicates that if the "error unknown proc" string exists in the data to be detected, an alarm message of "unknown suspicious process detected" is reported; sid is used for configuration file indexing for easy separate updating.

[0076] In an optional embodiment, detection item update information corresponding to the detection item information sent by the cloud service end is received, and the detection necklace table is updated based on the detection item update information.

[0077] In an optional embodiment, if Fig. 9 As shown, it is a flow chart of the target format data determination method provided in an embodiment of the present application. Before step S102, the method may further include:

[0078] S801: Analyze and process the data to be detected to obtain service category information and detection content information corresponding to the data to be detected.

[0079] S802: Obtain target format data corresponding to the data to be detected according to the service category information and the detection content information.

[0080] In an embodiment of the present application, the target format data is used to store the business category information and the detection content information, so as to perform host intrusion detection on the data to be detected according to the business category information and the detection content information in the target format data. Specifically, before the data to be detected is detected, the present embodiment parses the data to be detected, so as to parse out the business category information and the detection content information in the data to be detected, and fills the business category information and the detection content information into the corresponding area in the preset data format according to the mapping relationship between the detection data and the preset data format, and obtains the target format data corresponding to the data to be detected, and then can directly match the detection item information according to the business category information and the detection content information in the target format data, which can greatly improve the detection efficiency.

[0081] Exemplarily, the service category information includes first service category information and second service category information, and the detection content information may include user group name, detection direction, user name, detection item category, detection priority information and detection content. Specifically, the target format data and the number of bytes corresponding to each data are shown in Table 1:

[0082] Table 1

[0083]

[0084] It should be noted that the number of variable bytes in Table 1 is less than 65535.

[0085] In another optional embodiment, Fig.10 As shown, it is a flow chart of the detection data queue determination method provided in an embodiment of the present application. Before step S102, the method may further include:

[0086] S901: Determine detection priority information corresponding to the data to be detected according to the target format data.

[0087] S902: Obtaining the sorting information of the target format data in the detection data queue according to the detection priority information.

[0088] S903: Insert the target format data into the detection data queue according to the sorting information.

[0089] In an embodiment of the present application, the detection data queue is used to cache target format data and arrange the target format data in a detection priority order corresponding to the detection priority information to realize host intrusion detection with asynchronous data collection and data detection, thereby facilitating the optimization of system resource occupancy.

[0090] Specifically, according to the detection priority information, the sorting information of the target format data in the detection data queue is determined, and then the target format data is inserted into the detection data queue according to the sorting information, so that when the target format data is uploaded to the detection data queue, the target format data is directly cached in the detection priority order corresponding to the detection priority information, so that detection can be performed in the order of priority in the detection data queue, thereby improving detection efficiency.

[0091] In another optional embodiment, Fig.11 As shown, it is a flow chart of another detection data queue determination method provided in an embodiment of the present application. Before step S102, the method may further include:

[0092] S1001: Send target format data to the detection data queue.

[0093] S1002: Based on the detection priority information corresponding to the target format data, obtain the detection arrangement information corresponding to the target format data in the detection data queue.

[0094] In an embodiment of the present application, the target format data to be detected can be sent to a detection data queue, and based on the detection priority information corresponding to the target format data, the target format data cached in the detection data queue can be uniformly sorted to determine the detection arrangement information corresponding to the target format data in the detection data queue, so as to perform detection in a detection arrangement order corresponding to the detection arrangement information in the detection data queue, so as to realize host intrusion detection with asynchronous data collection and data detection, thereby facilitating the optimization of system resource occupancy.

[0095] In a specific embodiment, before sending the target format data to the detection data queue, the target format data needs to be encapsulated to obtain encapsulated target format data, and the encapsulated target format data is transmitted to the detection data queue to avoid data loss during the transmission process and ensure data integrity.

[0096] It can be seen from the above technical solutions of the embodiments of the present application that the following technical effects are achieved:

[0097] The embodiment of the present application obtains data to be detected including business category information, so as to determine target detection item information corresponding to the data to be detected based on the business category information corresponding to the data to be detected, and detects the data to be detected based on the detection items corresponding to the target detection item information to obtain detection information. The technical solution provided by the present application can fully utilize the business category information corresponding to the data to be detected, quickly perform host intrusion detection, and thus significantly improve the detection accuracy and detection efficiency.

[0098] The present application also provides a host intrusion detection device, such as Fig.12As shown, it is a structural schematic diagram of a host intrusion detection device provided in an embodiment of the present application, and the device specifically includes:

[0099] Data acquisition module 10: used to acquire the data to be detected, where the data to be detected includes business category information.

[0100] The target detection item information determination module 20 is used to determine the target detection item information corresponding to the data to be detected based on the service category information.

[0101] The detection module 30 is used to detect the data to be detected based on the detection items corresponding to the target detection item information to obtain detection information.

[0102] Preferably, the device further comprises:

[0103] The parsing module 101 is used to parse the data to be detected to obtain the service category information and detection content information corresponding to the data to be detected.

[0104] The target format data determination module 102 is used to obtain the target format data corresponding to the data to be detected according to the service category information and the detection content information.

[0105] Preferably, the device further comprises:

[0106] The detection priority information determination module 201 is used to determine the detection priority information corresponding to the data to be detected according to the target format data.

[0107] The sorting information determining module 202 is used to obtain the sorting information of the target format data in the detection data queue according to the detection priority information.

[0108] The detection data queue determination module 203 is used to insert the target format data into the detection data queue according to the sorting information.

[0109] Preferably, the device further comprises:

[0110] The sending module 304 is used to send the target format data to the detection data queue.

[0111] The detection arrangement information determination module 305 is used to obtain the detection arrangement information corresponding to the target format data in the detection data queue based on the detection priority information corresponding to the target format data.

[0112] Preferably, Fig.13 As shown, it is a schematic diagram of the structure of another host intrusion detection device provided in an embodiment of the present application, and the device also includes:

[0113] The detection item information acquisition module 401 is used to acquire multiple detection item information.

[0114] The detection necklace table information determination module 402 is used to determine the detection necklace table information corresponding to the service category information based on multiple detection item information.

[0115] The detection processing module 403 is used to perform corresponding detection processing on the data to be detected based on the detection necklace table information.

[0116] Preferably, the business category is based on the business category information, and the target detection item information corresponding to the to-be-detected data is determined to include the first business category information and the second business category information. Then, the target detection item information determination module 20 may include:

[0117] The first detection item information determination submodule 201 is used to determine the first detection item information corresponding to the to-be-detected data based on the first service category information.

[0118] The second detection item information determination submodule 202 is used to determine the second detection item information corresponding to the to-be-detected data based on the second service category information.

[0119] The target detection item information determination submodule 203 is used to determine the target detection item information based on the first detection item information and the second detection item information.

[0120] Preferably, the first service category information includes at least any one of host detection data, log audit detection data, malicious file detection data, vulnerability detection data and malicious behavior association analysis detection data.

[0121] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0122] An embodiment of the present application provides a host intrusion detection device, which includes a processor and a memory, in which at least one instruction, at least one program, a code set or an instruction set is stored, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the host intrusion detection method provided in the above method embodiment.

[0123] The memory can be used to store software programs and modules. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, application programs required for functions, etc.; the data storage area can store data created according to the use of the device, etc. In addition, the memory can include a high-speed random access memory and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices. Accordingly, the memory can also include a memory controller to provide the processor with access to the memory.

[0124] The host intrusion detection device may be an embedded terminal, such as a vehicle host, a roadside terminal, and a network device, or a server. The present application embodiment also provides a structural diagram of a server, see Fig.14 , the server 1400 is used to implement the data processing method provided in the above embodiment. The server 1400 may have relatively large differences due to different configurations or performances, and may include one or more processors 1410 (for example, one or more processors) and storage 1430, one or more storage media 1420 (for example, one or more mass storage devices) storing application programs 1423 or data 1422. Among them, the memory 1430 and the storage medium 1420 can be short-term storage or persistent storage. The program stored in the storage medium 1420 may include one or more modules, each of which may include a series of instruction operations on the server. Furthermore, the processor 1410 can be configured to communicate with the storage medium 1420 to execute a series of instruction operations in the storage medium 1420 on the server 1300. The server 1400 may also include one or more power supplies 1460, one or more wired or wireless network interfaces 1450, one or more input and output interfaces 1440, and / or, one or more operating systems 1421, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, Android, Linux, QNX, etc.

[0125] An embodiment of the present application also provides a computer-readable storage medium. The storage medium can be set in a server to store at least one instruction, at least one program, a code set or an instruction set related to a host intrusion detection method in an implementation method embodiment. The at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the host intrusion detection method provided by the above-mentioned method embodiment.

[0126] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system and server embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0127] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A host intrusion detection method, characterized in that: The method comprises: Acquire data to be detected, where the data to be detected includes service category information; Based on the service category information, determining target detection item information corresponding to the data to be detected; Detecting the data to be detected based on the detection item corresponding to the target detection item information to obtain detection information; The method also includes: acquiring multiple detection item information; based on the multiple detection item information, determining the detection necklace table information corresponding to the business category information, the detection necklace table information includes first detection item information, second detection item information and a detection configuration body corresponding to the second detection item information, the detection configuration body is used to detect the detection content information corresponding to the business category information, the second detection item information is the sub-detection item information corresponding to the first detection item information; based on the detection necklace table information, the data to be detected is subjected to corresponding detection processing.

2. The method according to claim 1, characterized in that: Before the step of determining the target detection item information corresponding to the to-be-detected data based on the service category information, the method further includes: Analyze the data to be detected to obtain service category information and detection content information corresponding to the data to be detected; According to the service category information and the detection content information, target format data corresponding to the data to be detected is obtained.

3. The method according to claim 2, characterized in that Before the step of determining the target detection item information corresponding to the to-be-detected data based on the service category information, the method further includes: Determining detection priority information corresponding to the data to be detected according to the target format data; According to the detection priority information, obtaining the sorting information of the target format data in the detection data queue; The target format data is inserted into the detection data queue according to the sorting information.

4. The method according to claim 2, characterized in that: Before the step of determining the target detection item information corresponding to the to-be-detected data based on the service category information, the method further includes: Sending the target format data to the detection data queue; Based on the detection priority information corresponding to the target format data, the detection arrangement information corresponding to the target format data in the detection data queue is obtained.

5. The method according to claim 1, characterized in that The service category information includes first service category information and second service category information; and determining the target detection item information corresponding to the to-be-detected data based on the service category information includes: Based on the first service category information, determining first detection item information corresponding to the data to be detected; Determining second detection item information corresponding to the data to be detected based on the second service category information; The target detection item information is determined based on the first detection item information and the second detection item information.

6. The method according to claim 5, characterized in that The first service category information includes at least any one of host detection data, log audit detection data, malicious file detection data, vulnerability detection data and malicious behavior association analysis detection data.

7. A host intrusion detection device, characterized in that: The device comprises: Data acquisition module: used to acquire the data to be detected, wherein the data to be detected includes business category information; A target detection item information determination module is used to determine the target detection item information corresponding to the data to be detected based on the service category information; Detection module: used to detect the data to be detected based on the detection item corresponding to the target detection item information to obtain detection information; The device also includes: acquiring multiple detection item information; based on the multiple detection item information, determining the detection necklace table information corresponding to the business category information, the detection necklace table information includes first detection item information, second detection item information and a detection configuration body corresponding to the second detection item information, the detection configuration body is used to detect the detection content information corresponding to the business category information, the second detection item information is the sub-detection item information corresponding to the first detection item information; based on the detection necklace table information, the data to be detected is subjected to corresponding detection processing.

8. A host intrusion detection device, characterized in that: The host intrusion detection device includes a processor and a memory, wherein the memory stores at least one instruction, at least one program, a code set or an instruction set, and the at least one instruction, the at least one program, the code set or the instruction set is loaded and executed by the processor to implement the host intrusion detection method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction or at least one program, and the at least one instruction or the at least one program is loaded and executed by the processor to implement the host intrusion detection method according to any one of claims 1 to 6.

Images