Method and apparatus for detecting phishing behavior

Abstract

The embodiment of the present application provides a kind of phishing behavior detection method and device, it is related to network security technical field, wherein method includes: when receiving current log data, current log data is converted into current graph data;Current graph data is stored in graph database;When determining that current log data is the log data of including IP access behavior, at least one graph included in graph database is matched with the graph to be detected based on graph query statement rule, and matching result is obtained;The graph to be detected is composed of the graph data corresponding to each log data between the last log data of including IP access behavior and current log data and current graph data;When matching result is matching success, it is determined that the log data corresponding to the graph to be detected is network fishing behavior data.The present application realizes the detection of network fishing behavior based on the real-time triggering of graph query statement rule to external IP behavior, improves the accuracy of network fishing behavior detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the network security technical field, and particularly relates to a network phishing behavior detection method and device. BACKGROUND

[0002] Phishing mainly refers to that an attacker induces a victim to access a malicious connection or open a malicious file through an email, a fake World Wide Web (Web) site, an Instant Messenger (IM) or the like, so as to control a terminal of the victim or steal private data of the victim. Among them, the phishing attack through the email is one of main manners, but with the improvement of the detection product capability of the phishing email, the success rate of the phishing email is also lower and lower, and the attackers turn to use the IM manner more and more commonly. Therefore, it is crucial to effectively detect the IM phishing behavior.

[0003] In the prior art, a file from the IM is first marked, and then a static scanning is performed on the content of the marked file by using a malicious code feature library, if the malicious code feature library is hit, it is determined that the network phishing behavior is suspicious, and if the malicious code feature library is not hit, a system interface called when the marked file is executed or opened is monitored, and when the system interface called when the marked file is executed or opened conforms to an abnormal calling rule, it is determined that the network phishing behavior is suspicious.

[0004] However, in the prior art, the file from the IM is detected by using a conventional malicious file detection idea through the marking manner, the phishing file hit the malicious code feature library or the abnormal calling rule of the system interface can be detected to a certain extent, but the attacker can bypass the detection by means of code obfuscation of the file from the IM, changing of the system interface calling sequence or injection of a system normal process, so that the malicious code feature library or the abnormal calling rule cannot be matched, and thus the accuracy of the network phishing behavior detection is reduced. SUMMARY

[0005] In view of the problems in the prior art, the present application provides a network phishing behavior detection method and device.

[0006] Specifically, the present application provides the following technical scheme:

[0007] In a first aspect, the present application provides a network phishing behavior detection method, comprising:

[0008] When the current log data is received, the current log data is converted into current graph data; the current graph data comprises node data and edge data;

[0009] store the current graph data in a graph database;

[0010] In a case where the current log data is determined as the log data including the IP access behavior, a to-be-detected graph is matched with at least one graph included in the graph database based on a graph query statement rule to obtain a matching result; the to-be-detected graph is composed of graph data corresponding to each log data between previous log data including the IP access behavior and the current log data and the current graph data; the graph query statement rule is a rule determined based on a phishing behavior;

[0011] In a case where the matching result is a matching success, it is determined that log data corresponding to the to-be-detected graph is phishing behavior data.

[0012] Further, the matching of the to-be-detected graph with the at least one graph included in the graph database based on the graph query statement rule to obtain the matching result comprises:

[0013] obtaining first node information of a first node and second node information of a last node of the to-be-detected graph;

[0014] determining whether the graph database contains a target graph in which node information of the first node is the first node information and node information of the last node is the second node information;

[0015] In a case where it is determined that the graph database contains the target graph, it is determined that the matching result is a matching success;

[0016] In a case where it is determined that the graph database does not contain the target graph, it is determined that the matching result is a matching failure.

[0017] Further, the determination of the matching result as the matching success comprises:

[0018] obtaining edge information of a to-be-detected edge connected with the first node in the to-be-detected graph, and obtaining edge information of a first target edge connected with the first node in the target graph;

[0019] In a case where it is determined that the edge information of the to-be-detected edge matches the edge information of the first target edge, it is determined that the matching result is a matching success.

[0020] Further, the determination of the matching result as the matching success comprises:

[0021] obtaining a second node connected with the first target edge in the target graph; the first target edge points to the second node;

[0022] When it is determined that the second target edge between the second node and the last node in the target graph includes a preset number of second target edges, it is determined that the matching result is a matching success.

[0023] Further, the target graph query statement rule is matched with at least one graph in the graph database based on the rule to obtain a matching result, comprising:

[0024] Determine the current application scenario type corresponding to the current log data;

[0025] Obtain the target graph query statement rule corresponding to the current application scenario type; the target graph query statement rule is a rule determined based on the current application scenario type of the phishing behavior;

[0026] The target graph query statement rule is matched with at least one graph in the graph database based on the rule to obtain a matching result.

[0027] Further, the current log data is converted into current graph data, comprising:

[0028] Determine the log behavior type of the current log data; the log behavior type includes one of the following: process operation type, file operation type, IP access type, domain name resolution type and registry operation type; the process operation type includes one of the following: process creation type, process injection type and process closing type; the file operation type includes one of the following: file transmission type, file creation type, file writing type, file decompression type and file deletion type; the registry operation type includes one of the following: registry creation type, registry modification type and registry deletion type;

[0029] The current log data is converted into the current graph data based on the log behavior type.

[0030] Further, the current log data is converted into the current graph data based on the log behavior type, comprising:

[0031] When the log behavior type is the process creation type, the hash value of the parent process of the target process in the current log data is determined as the identification information of the first node of the process creation behavior edge, the hash value of the target process in the current log data is determined as the identification information of the second node of the process creation behavior edge, the hash value of the source file of the target process in the current log data is determined as the identification information of the first node of the process file source edge, and the hash value of the target process in the current log data is determined as the identification information of the second node of the process file source edge; the process creation behavior edge points to the second node of the process creation behavior edge.

[0032] when the log behavior type is a process injection type, determining a hash value of a source process of a target process in the current log data as identification information of a first node of a process injection behavior edge, and determining a hash value of the target process in the current log data as identification information of a second node of the process injection behavior edge; the process injection behavior edge points to the second node of the process injection behavior edge;

[0033] when the log behavior type is a process injection type, determining a hash value of a source process of a target process in the current log data as identification information of a first node of a process injection behavior edge, and determining a hash value of the target process in the current log data as identification information of a second node of the process injection behavior edge; the process injection behavior edge points to the second node of the process injection behavior edge;

[0034] when the log behavior type is a file transmission type, determining a hash value of a target process in the current log data as identification information of a first node of a file transmission behavior edge, and determining a hash value of a transmitted file in the current log data as identification information of a second node of the file transmission behavior edge; the file transmission behavior edge points to the second node of the file transmission behavior edge;

[0035] when the log behavior type is a file transmission type, determining a hash value of a target process in the current log data as identification information of a first node of a file transmission behavior edge, and determining a hash value of a transmitted file in the current log data as identification information of a second node of the file transmission behavior edge; the file transmission behavior edge points to the second node of the file transmission behavior edge;

[0036] when the log behavior type is a file transmission type, determining a hash value of a target process in the current log data as identification information of a first node of a file transmission behavior edge, and determining a hash value of a transmitted file in the current log data as identification information of a second node of the file transmission behavior edge; the file transmission behavior edge points to the second node of the file transmission behavior edge;

[0037] when the log behavior type is a file transmission type, determining a hash value of a target process in the current log data as identification information of a first node of a file transmission behavior edge, and determining a hash value of a transmitted file in the current log data as identification information of a second node of the file transmission behavior edge; the file transmission behavior edge points to the second node of the file transmission behavior edge;

[0038] when the log behavior type is a file deletion type, determining the hash value of the target process in the current log data as identification information of a first node of a file deletion behavior edge, and determining the hash value of the deleted file as identification information of a second node of the file deletion behavior edge; the file deletion behavior edge points to the second node of the file deletion behavior edge;

[0039] when the log behavior type is an IP access type, determining the hash value of the target process in the current log data as identification information of a first node of an IP access behavior edge, and determining the IP value of the access device in the current log data as identification information of a second node of the IP access behavior edge; the IP access behavior edge points to the second node of the IP access behavior edge;

[0040] when the log behavior type is a domain name resolution type, determining the hash value of the target process in the current log data as identification information of a first node of a domain name resolution behavior edge, and determining the resolved domain name in the current log data as identification information of a second node of the domain name resolution behavior edge; the domain name resolution behavior edge points to the second node of the domain name resolution behavior edge;

[0041] when the log behavior type is a registry creation type, determining the hash value of the target process in the current log data as identification information of a first node of a registry creation behavior edge, and determining the key value of the created registry in the current log data as identification information of a second node of the registry creation behavior edge; the registry creation behavior edge points to the second node of the registry creation behavior edge;

[0042] when the log behavior type is a registry modification type, determining the hash value of the target process in the current log data as identification information of a first node of a registry modification behavior edge, and determining the key value of the created registry in the current log data as identification information of a second node of the registry modification behavior edge; the registry modification behavior edge points to the second node of the registry modification behavior edge;

[0043] when the log behavior type is a registry deletion type, determining the hash value of the target process in the current log data as identification information of a first node of a registry deletion behavior edge, and determining the key value of the created registry in the current log data as identification information of a second node of the registry deletion behavior edge; the registry deletion behavior edge points to the second node of the registry deletion behavior edge.

[0044] Further, the method further comprises:

[0045] determining first information in the current log data as attribute information of a first node of a behavior edge, determining second information in the current log data as attribute information of a second node of the behavior edge, and determining third information in the current log data as attribute information of the behavior edge;

[0046] when the log behavior type is a process creation type, the behavior edge comprises a process creation behavior edge; the first information comprises at least one of a process name of the parent process, a file path of the parent process, and an IP value of a device performing process creation; the second information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of an electronic device; and the third information comprises a process creation time;

[0047] when the log behavior type is a process injection type, the behavior edge comprises a process injection behavior edge; the first information comprises at least one of a process name of the source process, a file path of the source process, and an IP value of a device performing process injection; the second information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing process injection; and the third information comprises a process injection time;

[0048] when the log behavior type is a process closing type, the behavior edge comprises a process closing behavior edge; the first information comprises at least one of a process name of the parent process, a file path of the parent process, and an IP value of a device performing process closing; the second information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing process closing; and the third information comprises a process deletion time;

[0049] when the log behavior type is a file transmission type, the behavior edge comprises a file transmission behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file transmission; the second information comprises at least one of a file name of a transmitted file, a file path, a file type, a file size, a file writing time, and an IP value of a device performing file transmission; and the third information comprises a file transmission time;

[0050] When the log behavior type is a file write type, the behavior edge includes a file write behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file write; the second information includes at least one of a file name of a file performing write, a file path, a file type, a file size, a file write time, and an IP value of a device performing file write; and the third information includes a time of performing write in the file.

[0051] When the log behavior type is a file decompression type, the behavior edge includes a file decompression behavior edge; the first information includes at least one of a file name, a file path, a file type, a file size, a file write time, and an IP value of a device performing file decompression of a compressed file; the second information includes at least one of a file name, a file path, a file type, a file size, a file write time, and an IP value of a device performing file decompression of a decompressed file; and the third information includes a file decompression time.

[0052] When the log behavior type is a file creation type, the behavior edge includes a file creation behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file creation; the second information includes at least one of a file name, a file path, a file type, a file size, a file write time, and an IP value of a device performing file creation of a created file; and the third information includes a file creation time.

[0053] When the log behavior type is a file deletion type, the behavior edge includes a file deletion behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file creation; the second information includes at least one of a file name, a file path, a file type, a file size, a file write time, and an IP value of a device performing file deletion of a deleted file; and the third information includes a file deletion time.

[0054] When the log behavior type is an IP access type, the behavior edge includes an IP access behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file creation; the second information includes IP intranet popularity; and the third information includes an IP access time.

[0055] When the log behavior type is a domain name resolution type, the behavior edge comprises a domain name resolution behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device on which an execution file is created; the second information comprises a resolved domain name; and the third information comprises a domain name resolution time.

[0056] When the log behavior type is a registry creation type, the behavior edge comprises a registry creation behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device on which an execution file is created; the second information comprises at least one of a path of a created registry, a registry value, and a registry type; and the third information comprises a registry creation time.

[0057] When the log behavior type is a registry modification type, the behavior edge comprises a registry modification behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device on which an execution file is created; the second information comprises at least one of a path of a created registry, a registry value, and a registry type; and the third information comprises a registry modification time.

[0058] When the log behavior type is a registry deletion type, the behavior edge comprises a registry deletion behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device on which an execution file is created; the second information comprises at least one of a path of a created registry, a registry value, and a registry type; and the third information comprises a registry deletion time.

[0059] Further, after determining that the log data corresponding to the to-be-detected graph is phishing behavior data, the method further comprises:

[0060] generating alarm information based on the log data corresponding to the to-be-detected graph.

[0061] In a second aspect, an embodiment of the present application further provides a phishing behavior detection device, comprising:

[0062] a conversion unit configured to convert current log data into current graph data when the current log data is received; the current graph data comprises node data and edge data;

[0063] a storage unit configured to store the current graph data in a graph database;

[0064] The matching unit is configured to, when it is determined that the current log data is log data including IP access behavior, match a to-be-detected graph with at least one graph included in the graph database based on a graph query statement rule to obtain a matching result, wherein the to-be-detected graph is composed of graph data corresponding to each log data between previous log data including IP access behavior and the current log data and the current graph data, and the graph query statement rule is a rule determined based on phishing behavior.

[0065] The determining unit is configured to, when the matching result is matching success, determine that log data corresponding to the to-be-detected graph is phishing behavior data.

[0066] In a third aspect, an electronic device is provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the phishing behavior detection method according to the first aspect when executing the program.

[0067] In a fourth aspect, a non-transitory computer-readable storage medium is provided, which stores a computer program executable by a processor, and the computer program implements the steps of the phishing behavior detection method according to the first aspect when executed by the processor.

[0068] In a fifth aspect, a computer program product is provided, which stores executable instructions, and the instructions make the processor implement the steps of the phishing behavior detection method according to the first aspect when executed by the processor.

[0069] The phishing behavior detection method and device provided by the embodiments of the present application convert the received current log data into current graph data, and when it is determined that the current log data is log data including IP access behavior, match a to-be-detected graph with at least one graph in the graph database based on a graph query statement rule determined based on phishing behavior, and when the matching is successful, determine that log data corresponding to the to-be-detected graph is phishing behavior data. It can be seen that the embodiments of the present application convert each log data into corresponding graph data, and implement the detection of phishing behavior based on a graph query statement rule specified based on phishing behavior. Even if an attacker bypasses the detection through illegal means, the IP of the malicious device accessed finally can be detected based on the graph query statement rule, the detection of phishing behavior based on the real-time triggering of the graph query statement rule based on the external IP behavior is implemented, and the accuracy of the detection of phishing behavior is improved. BRIEF DESCRIPTION OF DRAWINGS

[0070] In order to make the technical solutions of the embodiments of the present application or the prior art clearer, the accompanying drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0071] Figure 1 is one of flow diagrams of the network phishing behavior detection method provided by the embodiments of the present application;

[0072] Figure 2 is a structural diagram of the network phishing behavior detection system provided by the embodiments of the present application;

[0073] Figure 3 is another flow diagram of the network phishing behavior detection method provided by the embodiments of the present application;

[0074] Figure 4 is a third flow diagram of the network phishing behavior detection method provided by the embodiments of the present application;

[0075] Figure 5 is one of structural diagrams of the graph provided by the embodiments of the present application;

[0076] Figure 6 is a fourth flow diagram of the network phishing behavior detection method provided by the embodiments of the present application;

[0077] Figure 7 is a second structural diagram of the graph provided by the embodiments of the present application;

[0078] Figure 8 is a third structural diagram of the graph provided by the embodiments of the present application;

[0079] Figure 9 is a structural diagram of the graph data provided by the embodiments of the present application;

[0080] Figure 10 is a fifth flow diagram of the network phishing behavior detection method provided by the embodiments of the present application;

[0081] Figure 11 is a structural diagram of the network phishing behavior detection device provided by the embodiments of the present application;

[0082] Figure 12 is a structural diagram of the electronic device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0083] In order to make the purposes, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0084] Figure 1 is one of the flowcharts of the phishing behavior detection method provided by the embodiments of the present application, as shown in the figure, Figure 1 The phishing behavior detection method comprises the following steps:

[0085] Step 101, when receiving current log data, converting the current log data into current graph data; the current graph data comprises node data and edge data.

[0086] The format of the log data can be JSON format, etc., and the graph data obtained by conversion is directed graph data. Preferably, the log data is data for instant messaging software, and the instant messaging software refers to communication software that realizes online chatting and communication through instant messaging technology. The graph refers to a graph composed of a plurality of given points and edges connecting two points, which can well describe a certain specific relationship between certain things, with points representing things and edges connecting two points representing that the two things have a certain relationship.

[0087] For example, a security protection product is installed on the electronic device, and each log data generated on the electronic device can be collected through the security protection product. When receiving current log data, the current log data is converted into current graph data comprising node data and edge data based on graph model construction logic. That is, when receiving a log data, the log data needs to be converted into corresponding graph data.

[0088] Step 102, storing the current graph data in a graph database.

[0089] The graph database can be any type of graph database such as Nebula Graph, Neo4j, HugeGraph, JanusGraph, TigerGraph, etc.

[0090] For example, when the current graph data is obtained, the current graph data is stored in the graph database, so that the graph database associates the current graph data with the previous graph data, effectively utilizes the multi-behavior association capability of the graph database, and the associated multiple graph data forms a graph atlas. Therefore, multiple graph atlases are stored in the graph database.

[0091] Step 103, when it is determined that the current log data is log data including Internet Protocol (IP) access behavior, matching a to-be-detected graph with at least one graph included in the graph database based on a graph query statement rule to obtain a matching result; the to-be-detected graph is composed of graph data corresponding to each log data between previous log data including IP access behavior and the current log data and the current graph data.

[0092] The graph query statement rule is a rule determined based on phishing behavior, which is summarized by a security operation expert based on behaviors of existing phishing samples and patterns of unknown sample behaviors, and given in combination with a path pattern matching function provided by the graph database.

[0093] For example, when the current log data is received, the behavior field value of the current log data needs to be extracted, and when the behavior field value is a field value of IP access behavior, it is determined that the current log data is log data including IP access behavior, and at this time, the graph data corresponding to each log data between the previous log data including IP access behavior and the current log data and the current graph data are composed to form a to-be-detected graph; for example, 7 log data are sequentially received based on time sequence, which are log data 1, log data 2, log data 3, log data 4, log data 5, log data 6 and log data 7, wherein the log data 4 and the log data 7 are both log data including IP access behavior, and when the current log data is the log data 7, the graph data corresponding to the log data 5, the graph data corresponding to the log data 6 and the graph data corresponding to the log data 7 are composed to form a to-be-detected graph, and when the to-be-detected graph is obtained, the to-be-detected graph is matched with all graphs stored in the graph database through the graph query statement rule to determine whether the log data corresponding to the to-be-detected graph is phishing behavior data.

[0094] Step 104, when the matching result is matching success, it is determined that the log data corresponding to the to-be-detected graph is phishing behavior data.

[0095] For example, when the matching result is matching success, it is determined that the log data corresponding to the to-be-detected graph is phishing behavior data; when the matching result is matching failure, it is determined that the log data corresponding to the to-be-detected graph is not phishing behavior data.

[0096] Figure 2 is a structural schematic diagram of a phishing behavior detection system provided by an embodiment of the application, as Figure 2As shown, the network phishing behavior detection system includes a log collection module 201, a graph data conversion module 202, a graph database 203, a real-time rule detection module 204, and an alarm module 205; wherein the log collection module 201 is configured to receive current log data, and send the received current log data to the graph data conversion module 202, the graph data conversion module 202 is configured to convert the current log data into current graph data, and store the current graph data in the graph database 203; when it is determined that the current log data is log data including IP access behavior, the detection graph including the current log data is sent to the real-time rule detection module 204, the real-time rule detection module 204 is configured to match the detection graph and all graphs in the graph database based on a pre-defined graph query statement rule, when the matching is successful, an alarm event is generated based on the log data corresponding to the detection graph, and the alarm event is sent to the alarm module 205, the alarm module 205 is configured to perform alarm notification.

[0097] The network phishing behavior detection method provided by the embodiment of the application converts the received current log data into current graph data, and when it is determined that the current log data is log data including IP access behavior, the detection graph is matched with at least one graph in the graph database based on a graph query statement rule determined according to network phishing behavior, when the matching is successful, it is determined that the log data corresponding to the detection graph is network phishing behavior data. It can be known that the present application converts each log data into corresponding graph data, and realizes the detection of network phishing behavior based on a graph query statement rule defined according to network phishing behavior, so that even if an attacker bypasses the detection through illegal means, the IP of the malicious device finally accessed can be detected based on the graph query statement rule, the detection of network phishing behavior based on the real-time triggering of the graph query statement rule according to external IP behavior is realized, and the accuracy of network phishing behavior detection is improved.

[0098] Optionally, Figure 3 is a flowchart of the network phishing behavior detection method provided by the embodiment of the application, as shown in Figure 3 When it is determined that the current log data is log data including IP access behavior, the above step 103 can be implemented by the following steps.

[0099] Step 1031, when it is determined that the current log data is log data including IP access behavior, the first node information of the first node and the second node information of the last node of the detection graph are acquired.

[0100] For example, when it is determined that the current log data is log data including IP access behavior, first node information of a first node and second node information of a last node are acquired from the graph to be detected, the first node information includes identification information of the first node, or identification information of the first node and attribute information of the first node, and the second node information includes identification information of the last node, or identification information of the last node and attribute information of the last node.

[0101] In step 1032, it is determined whether the graph database contains a target graph in which node information of the first node is the first node information and node information of the last node is the second node information.

[0102] In this embodiment, the graph query statement rule is that node information of a first node in a graph is first node information, and after passing through at least one behavior edge, node information of a last node is second node information.

[0103] For example, when the first node information of the first node and the second node information of the last node of the graph to be detected are acquired, each graph in the graph database is traversed to determine whether the graph database contains a target graph in which node information of the first node is the first node information and node information of the last node is the second node information, so as to realize traversal of the graph database based on the graph query statement rule.

[0104] In step 1033, when it is determined that the graph database contains the target graph, it is determined that the matching result is a matching success.

[0105] For example, when it is determined that the graph database contains a target graph in which node information of the first node is the first node information and node information of the last node is the second node information, it is indicated that the matching is successful.

[0106] In step 1034, when it is determined that the graph database does not contain the target graph, it is determined that the matching result is a matching failure.

[0107] For example, when it is determined that the graph database does not contain a target graph in which node information of the first node is the first node information and node information of the last node is the second node information, it is indicated that the matching is failed, and the network phishing behavior detection is ended.

[0108] The network phishing behavior detection method provided in the embodiment of the application can determine that log data corresponding to the graph to be detected is network phishing behavior data when a target graph in which node information of a first node is first node information and node information of a last node is second node information is matched, and the detection mode based on stored log behavior and external IP triggering can be realized, so that detection of network phishing behavior with a large time span can be realized.

[0109] Optionally, Figure 4 is a third flowchart of the network phishing behavior detection method provided by the embodiments of the present application, as shown in the figure, Figure 4 When it is determined that the target graph is not contained in the graph database, the step 1033 specifically includes the following steps:

[0110] Step 10331, when it is determined that the target graph is not contained in the graph database, the edge information of the to-be-detected edge connected with the first node in the to-be-detected graph is acquired, and the edge information of the first target edge connected with the first node in the target graph is acquired.

[0111] For example, when it is determined that the node information of the first node in the graph database is the first node information, and the node information of the last node in the target graph is the second node information, the edge information of the to-be-detected edge connected with the first node in the to-be-detected graph is further acquired, and the edge information of the first target edge connected with the first node in the target graph is further acquired.

[0112] Step 10332, when it is determined that the edge information of the to-be-detected edge matches the edge information of the first target edge, it is determined that the matching result is a matching success.

[0113] For example, the edge information of the to-be-detected edge and the edge information of the first target edge are compared, when it is determined that the edge information of the to-be-detected edge and the edge information of the first target edge are the same, it is determined that the edge information of the to-be-detected edge matches the edge information of the first target edge, and the matching result is a matching success; when it is determined that the edge information of the to-be-detected edge and the edge information of the first target edge are different, it is determined that the edge information of the to-be-detected edge does not match the edge information of the first target edge, and the matching result is a matching failure. For example, Figure 5 is one of the structure diagrams of the graph provided by the embodiments of the present application, as shown in the figure, Figure 5As shown, the graph includes five nodes and five edges, wherein the first node (node 1) is a desktop process node of an operating system, the second node (node 2) is a process node of instant messaging software started in the desktop process of the operating system, the edge between the second node and the first node is a process creation behavior edge, the process creation behavior edge points to the second node, the third node is a file node of a phishing file received in the instant messaging software process, the edge between the third node (node 3) and the second node is a file transmission behavior edge, the file transmission behavior edge points to the third node, the fourth node (node 4) is a process node of a malicious process started after the victim clicks the phishing file, the edge between the fourth node and the third node is a process file source edge, the process file source edge points to the fourth node, the edge between the fourth node and the first node is a process creation behavior edge, the process creation behavior edge points to the fourth node, the fifth node (node 5) is an IP node of a device of an external attacker, and the edge between the fifth node and the fourth node is an IP access behavior edge; the desktop process node of the operating system is not involved in the matching process, so Figure 5 The starting node of the graph for the log data is the second node, and the graph query statement rule for this scenario can use the following graph statement to match the phishing behavior:

[0114] MATCH p=(v1:Process)-[e:IMFileTransfer]-[e*n]->(v2:InternetIP)

[0115] WHERE id(v2)==‘123.156.21.10’

[0116] RETURN p

[0117] The matching path expressed by the graph query statement rule is: the starting node is a process (Process) node, the first behavior edge is a file transmission behavior edge (IMFileTransfer) of instant messaging software, then it is associated through multiple steps of behavior edges (e*n) of any log behavior type, and finally reaches an IP node (InternetIP) with an identifier of ‘123.156.21.10’. Figure 5 As shown in the graph, the starting node is a process node of instant messaging software, the first behavior edge is a file transmission behavior edge, and after passing through a process file source edge and an IP access behavior edge, the last node is an IP node, which matches the graph query statement rule, so it is determined that the matching result is a matching success.

[0118] The network phishing behavior detection method provided by the embodiment of the present application further needs to match the edge information of the to-be-detected edge connected with the first node in the to-be-detected graph with the edge information of the first target edge connected with the first node in the target graph when the node information of the first node is the first node information and the node information of the last node is the second node information, and the log data corresponding to the to-be-detected graph is determined as the network phishing behavior data when the matching is successful, thereby further improving the accuracy of network phishing behavior detection.

[0119] Optionally, Figure 6 is a fourth flowchart of the network phishing behavior detection method provided by the embodiment of the present application, as shown in Figure 6 When it is determined that the edge information of the to-be-detected edge matches the edge information of the first target edge, the step 10332 can be specifically implemented in the following manner:

[0120] Step 103321, acquiring a second node connected with the first target edge in the target graph; the first target edge points to the second node.

[0121] For example, when it is determined that the edge information of the to-be-detected edge matches the edge information of the first target edge, a second node connected with the first target edge in the target graph is further acquired.

[0122] Step 103322, when it is determined that a preset number of second target edges are included between the second node and the last node in the target graph, it is determined that the matching result is matching success.

[0123] For example, the number of second target edges between the second node connected with the first target edge in the target graph and the last node in the target graph is acquired, and when the number of second target edges is the preset number, it is determined that the matching result is matching success; when the number of second target edges is not the preset number, it is determined that the matching result is matching failure. Figure 7 is a second structure diagram of the graph provided by the embodiment of the present application, as shown in Figure 7As shown, the first node (node 1) is a desktop process node of an operating system, the second node (node 2) is a process node of instant messaging software started in the desktop process of the operating system, the edge between the second node and the first node is a process creation behavior edge, the process creation behavior edge points to the second node, the third node (node 3) is a file node of a phishing file received in the instant messaging software process, the edge between the third node and the second node is a file transfer behavior edge of the instant messaging software, the file transfer behavior edge points to the third node, and then the IP node of the device of the attacker is connected through an unknown behavior path, and the edge between the IP node and the unknown behavior path is an IP access behavior edge; the desktop process node of the operating system is not involved in the matching process of the present application, so Figure 7 The starting node of the graph for the log data is the second node, and the graph query statement rule for this scene can use the following graph statement to match the phishing behavior:

[0124] MATCH p=(v1:Process)-[e:IMFilesfer]-[e:2..5]->(v2:InternetIP)

[0125] WHERE id(v2)==’123.156.21.10’

[0126] RETURN p

[0127] The matching path expressed by this graph query statement rule is: the starting node is a process (Process) node, the first behavior edge is a file transfer behavior edge (IMFileTransfer) of instant messaging software, then it is associated through two to five steps of behavior edges (e:2..5) of any log behavior type, and finally reaches the IP node (InternetIP) with the identification information of ‘123.156.21.10’. Figure 7 As shown in the graph, the starting node is a process node of instant messaging software, the first behavior edge is a file transfer behavior edge of instant messaging software, and after passing through three unknown behavior edges or four unknown behavior edges, the last node is an IP node, which is matched with the graph query statement rule, so it is determined that the matching result is a matching success.

[0128] The network phishing behavior detection method provided by the embodiment of the application determines that the log data corresponding to the to-be-detected graph is network phishing behavior data when the edge information of the to-be-detected edge connected with the first node in the to-be-detected graph matches the edge information of the first target edge connected with the first node in the target graph, and when it is determined that the second node connected with the first target edge in the target graph and the last node in the target graph include a preset number of second target edges. The behavior mode of the unknown network phishing sample can be combined with the variable-length path matching capability of the graph sentence query to implement rule coverage. The variable-length path matching capability is reflected by the preset number of unknown behavior edges, and is not limited to the number of unknown behavior edges, thereby further improving the accuracy of network phishing behavior detection.

[0129] Optionally, the step 103 can be specifically implemented by the following method:

[0130] determining a current application scenario type corresponding to the current log data;

[0131] obtaining a target graph query statement rule corresponding to the current application scenario type; the target graph query statement rule is a rule determined based on a network phishing behavior of the current application scenario type;

[0132] matching the to-be-detected graph with at least one graph included in the graph database based on the target graph query statement rule to obtain a matching result.

[0133] For example, when the current log data is received, the current log data is analyzed to determine a current application scenario type corresponding to the current log data, and then based on a pre-stored corresponding relationship between a scenario type and a graph query statement rule, a target graph query statement rule corresponding to the current application scenario type is determined, and then based on the target graph query statement rule, the to-be-detected graph is matched with all graphs included in the graph database to obtain a matching result. Figure 8 is a third structure diagram of a graph provided by the embodiment of the application, as Figure 8As shown, the application scenario of the graph is receiving a phishing compressed file in an instant messaging software process, and after the phishing compressed file is decompressed, the victim is induced to click the decompressed file to start the process node of the malicious process, and finally the device of the attacker is connected; the graph includes six nodes and six edges, wherein the first node (node 1) is the process node of the desktop of the operating system, the second node (node 2) is the process node of the instant messaging software started in the desktop process of the operating system, the edge between the second node and the first node is the process creation behavior edge, the process creation behavior edge points to the second node, the third node (node 3) is the file node of the phishing compressed file received in the instant messaging software process, the edge between the third node and the second node is the file transmission behavior edge of the instant messaging software, the file transmission behavior edge points to the third node, the fourth node (node 4) is the file node of the decompressed file after the phishing compressed file is decompressed, the edge between the fourth node and the third node is the file decompression behavior edge, the fifth node (node 5) is the process node of the malicious process started by the victim after being induced to click the decompressed file, the edge between the fifth node and the fourth node is the process file source edge, the process file source edge points to the fifth node, the edge between the fifth node and the first node is the process creation behavior edge, and the process creation behavior edge points to the fifth node, the sixth node (node 6) is the IP node of the connected device of the attacker, and the edge between the sixth node and the fifth node is the IP access behavior edge; the application does not involve the desktop process node of the operating system in the matching process, so Figure 8 The starting node of the graph for the log data is the second node, and the graph query statement rule for this scenario can use the following graph statement to match the phishing behavior:

[0134] MATCH p=(v1:Process)-[e:IMFileTransfer]-[e:FileUnzip]-

[0135] [e*2]->(v2:InternetIP)

[0136] WHERE id(v2)==’123.156.21.10’

[0137] RETURN p

[0138] The matching path expressed by the graph query statement rule is: the starting node is a process node, the first behavior edge is a file transfer behavior edge of the instant messaging software (IMFileTransfer), the second behavior edge is a file unzip behavior edge (FileUnzip), then two behavior edges of an arbitrary log behavior type (e*2) are associated, and finally the IP node (InternetIP) with the identification information of '123.156.21.10' is reached. Figure 8 As shown in the graph, the starting node is a process node of the instant messaging software, the first behavior edge is a file transfer behavior edge of the instant messaging software, the second behavior edge is a file unzip behavior edge, after the process file source edge and the IP access behavior edge, the last node is an IP node, and the graph query statement rule is matched, so it is determined that the matching result is a matching success.

[0139] The network phishing behavior detection method provided by the embodiment of the application obtains the target graph query statement rule corresponding to the current application scene type based on the current log data, and then matches the to-be-detected graph and all graphs included in the graph database based on the target graph query statement rule, so that the same target graph query statement rule is used for network phishing behavior detection of the same application scene, the target graph query statement rule is more accurate, and the accuracy of network phishing behavior detection is improved.

[0140] Optionally, the step 101 can be implemented by the following method.

[0141] The log behavior type of the current log data is determined, and the log behavior type includes one of the following: a process operation type, a file operation type, an IP access type, a domain name resolution type, and a registry operation type; the process operation type includes one of the following: a process creation type, a process injection type, and a process closing type; the file operation type includes one of the following: a file transfer type, a file creation type, a file write type, a file unzip type, and a file deletion type; and the registry operation type includes one of the following: a registry creation type, a registry modification type, and a registry deletion type.

[0142] The current log data is converted into the current graph data based on the log behavior type.

[0143] The network phishing behavior detection method provided by the embodiment of the application converts the current log data into the current graph data based on the log behavior type, and provides efficient data support for subsequent traceability analysis of network phishing behavior.

[0144] Further, the conversion of the current log data into the current graph data based on the log behavior type can be implemented by the following method.

[0145] when the log behavior type is the process creation type, determining a hash value of a parent process of a target process in the current log data as identification information of a first node of a process creation behavior edge, determining a hash value of the target process in the current log data as identification information of a second node of the process creation behavior edge, determining a hash value of a source file of the target process in the current log data as identification information of a first node of a process file source edge, and determining the hash value of the target process in the current log data as identification information of a second node of the process file source edge; the process creation behavior edge points to the second node of the process creation behavior edge;

[0146] when the log behavior type is the process injection type, determining a hash value of a source process of a target process in the current log data as identification information of a first node of a process injection behavior edge, and determining a hash value of the target process in the current log data as identification information of a second node of the process injection behavior edge; the process injection behavior edge points to the second node of the process injection behavior edge;

[0147] when the log behavior type is the process closing type, determining a hash value of a parent process of a target process in the current log data as identification information of a first node of a process closing behavior edge, and determining a hash value of the target process as identification information of a second node of the process closing behavior edge; the process closing behavior edge points to the second node of the process closing behavior edge;

[0148] when the log behavior type is the file transmission type, determining a hash value of a target process in the current log data as identification information of a first node of a file transmission behavior edge, and determining a hash value of a transmitted file in the current log data as identification information of a second node of the file transmission behavior edge; the file transmission behavior edge points to the second node of the file transmission behavior edge;

[0149] when the log behavior type is the file writing type, determining a hash value of a target process in the current log data as identification information of a first node of a file writing behavior edge, and determining a hash value of a file on which writing is performed in the current log data as identification information of a second node of the file writing behavior edge; the file writing behavior edge points to the second node of the file writing behavior edge;

[0150] when the log behavior type is the file decompression type, determining a hash value of a compressed file in the current log data as identification information of a first node of a file decompression behavior edge, and determining a hash value of a decompressed file obtained after the compressed file is decompressed as identification information of a second node of the file decompression behavior edge; the file decompression behavior edge points to the second node of the file decompression behavior edge;

[0151] When the log behavior type is a file creation type, a hash value of the target process in the current log data is determined as identification information of a first node of a file creation behavior edge, and a hash value of a created file is determined as identification information of a second node of the file creation behavior edge; the file creation behavior edge points to the second node of the file creation behavior edge;

[0152] When the log behavior type is a file deletion type, a hash value of the target process in the current log data is determined as identification information of a first node of a file deletion behavior edge, and a hash value of a deleted file is determined as identification information of a second node of the file deletion behavior edge; the file deletion behavior edge points to the second node of the file deletion behavior edge;

[0153] When the log behavior type is an IP access type, a hash value of the target process in the current log data is determined as identification information of a first node of an IP access behavior edge, and an IP value of an accessed device in the current log data is determined as identification information of a second node of the IP access behavior edge; the IP access behavior edge points to the second node of the IP access behavior edge;

[0154] When the log behavior type is a domain name resolution type, a hash value of the target process in the current log data is determined as identification information of a first node of a domain name resolution behavior edge, and a resolved domain name in the current log data is determined as identification information of a second node of the domain name resolution behavior edge; the domain name resolution behavior edge points to the second node of the domain name resolution behavior edge;

[0155] When the log behavior type is a registry creation type, a hash value of the target process in the current log data is determined as identification information of a first node of a registry creation behavior edge, and a key value of a created registry in the current log data is determined as identification information of a second node of the registry creation behavior edge; the registry creation behavior edge points to the second node of the registry creation behavior edge;

[0156] When the log behavior type is a registry modification type, a hash value of the target process in the current log data is determined as identification information of a first node of a registry modification behavior edge, and a key value of a created registry in the current log data is determined as identification information of a second node of the registry modification behavior edge; the registry modification behavior edge points to the second node of the registry modification behavior edge;

[0157] When the log behavior type is the registry deletion type, the hash value of the target process in the current log data is determined as the identification information of the first node of the registry deletion behavior edge, and the key value of the created registry in the current log data is determined as the identification information of the second node of the registry deletion behavior edge; the registry deletion behavior edge points to the second node of the registry deletion behavior edge.

[0158] Preferably, the file transfer behavior edge is a file transfer behavior edge of instant messaging software, the file write behavior edge is a file write behavior edge of instant messaging software, the file decompression behavior edge is a file decompression behavior edge of instant messaging software, the file creation behavior edge is a file creation behavior edge of instant messaging software, and the file deletion behavior edge is a file deletion behavior edge of instant messaging software.

[0159] For example, taking the log behavior type of the current log data as a process creation type as an example, the received current log data is as follows:

[0160] {

[0161] “eventClassId”:”edr:process_creation”,

[0162] “processMd5”:”bbe80313cf12098d3fc4d8a42e9dbb33”,

[0163] “processName”:”test.exe”,

[0164] “processPath”:”D:\\test\\test.exe”,

[0165] “fileMd5”:”55cd438153cd16c3c4886518d9b2c7ff”,

[0166] “sourceProcessMd5”:”d41fde47374c24c13a4f232fdf6b5778”,

[0167] “sourceProcessName”:”explorer.exe”,

[0168] “sourceProcessPath”:”C:\\Windows\\explorer.exe”,

[0169] “behaviorTime”:”2022-08-07 00:00:00.000”,

[0170] "devicAddress": "192.168.2.19",

[0171] ………

[0172] }

[0173] According to the graph information conversion logic, the current log data is converted into a process node, a process creation behavior edge and a process file source edge, and the format of the converted graph data is as follows:

[0174] Node information of the first node:

[0175] (“bbe80313cf12098d3fc4d8a42e9dbb33”, {“processName”: “test.exe”, “processPath”: “D:\\test\\test.exe”, “devicAddress”: “192.168.2.19”})

[0176] Among them, “bbe80313cf12098d3fc4d8a42e9dbb33” represents the hash value of the target process, which is the identification information of the first node;

[0177] “processName”: “test.exe”, “processPath”: “D:\\test\\test.exe”, “devicAddress”: “192.168.2.19” represents the attribute information of the first node, “processName”: “test.exe” represents the name of the target process as “test.exe”; “processPath”: “D:\\test\\test.exe” represents the file path of the target process as “D:\\test\\test.exe”; “devicAddress”: “192.168.2.19” represents the IP address of the device running the target process.

[0178] Edge information of the process creation behavior edge:

[0179] (“d41fde47374c24c13a4f232fdf6b5778”, “bbe80313cf12098d3fc4d8a42e9dbb33”, {“behaviorTime”: “2022-08-07 00:00:00.000”})

[0180] Wherein, "d41fde47374c24c13a4f232fdf6b5778" represents the hash value of the parent process of the target process, and is the identification information of the first node of the process creation behavior edge; "bbe80313cf12098d3fc4d8a42e9dbb33" represents the hash value of the target process, and is the identification information of the second node of the process creation behavior edge; "behaviorTime": "2022-08-07 00:00:00.000" represents that the attribute information of the process creation behavior edge is the process creation time 2022-08-07 00:00:00.000, wherein 2022-08-07 00:00:00.000 represents 00:00:00.000 milliseconds on August 7, 2002.

[0181] Edge information of the process file source edge:

[0182] ("55cd438153cd16c3c4886518d9b2c7ff", "bbe80313cf12098d3fc4d8a42e9dbb33", { "behaviorTime": "2022-08-07 00:00:00.000"})

[0183] Wherein, "55cd438153cd16c3c4886518d9b2c7ff" represents the hash value of the source file of the target process, and is the identification information of the first node of the process file source edge; "bbe80313cf12098d3fc4d8a42e9dbb33" represents the hash value of the target process, and is the identification information of the second node of the process file source edge; "behaviorTime": "2022-08-07 00:00:00.000" represents that the attribute information of the process creation behavior edge is the process creation time 2022-08-07 00:00:00.000.

[0184] The network phishing behavior detection method provided by the embodiment of the application converts the log data of each log behavior type into corresponding nodes and behavior edges, and the graph data is composed of the corresponding nodes and behavior edges, thereby providing efficient data support for subsequent network phishing behavior trace analysis.

[0185] Further, the network phishing behavior detection method further includes the following steps:

[0186] The first information in the current log data is determined as the attribute information of the first node of the behavior edge, the second information in the current log data is determined as the attribute information of the second node of the behavior edge, and the third information in the current log data is determined as the attribute information of the behavior edge.

[0187] In a case where the log behavior type is a process creation type, the behavior edge includes the process creation behavior edge; the first information includes at least one of a process name of the parent process, a file path of the parent process, and an IP value of a device performing process creation; the second information includes at least one of a process name of the target process, a file path of the target process, and an IP value of the electronic device; and the third information includes a process creation time.

[0188] In a case where the log behavior type is a process injection type, the behavior edge includes the process injection behavior edge; the first information includes at least one of a process name of the source process, a file path of the source process, and an IP value of a device performing process injection; the second information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing process injection; and the third information includes a process injection time.

[0189] In a case where the log behavior type is a process closing type, the behavior edge includes the process closing behavior edge; the first information includes at least one of a process name of the parent process, a file path of the parent process, and an IP value of a device performing process closing; the second information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing process closing; and the third information includes a process deletion time.

[0190] In a case where the log behavior type is a file transfer type, the behavior edge includes the file transfer behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file transfer; the second information includes at least one of a file name of a transferred file, a file path, a file type, a file size, a file writing time, and an IP value of a device performing file transfer; and the third information includes a file transfer time.

[0191] In a case where the log behavior type is a file writing type, the behavior edge includes the file writing behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file writing; the second information includes at least one of a file name of a file performing writing, a file path, a file type, a file size, a file writing time, and an IP value of a device performing file writing; and the third information includes a time of performing writing in the file.

[0192] when the log behavior type is a file decompression type, the behavior edge comprises a file decompression behavior edge; the first information comprises at least one of a file name, a file path, a file type, a file size, a file write time of the compressed file and an IP value of a device performing file decompression; the second information comprises at least one of a file name, a file path, a file type, a file size, a file write time of the decompressed file and an IP value of a device performing file decompression; and the third information comprises a file decompression time;

[0193] when the log behavior type is a file creation type, the behavior edge comprises a file creation behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process and an IP value of a device performing file creation; the second information comprises at least one of a file name, a file path, a file type, a file size, a file write time of the created file and an IP value of a device performing file creation; and the third information comprises a file creation time;

[0194] when the log behavior type is a file deletion type, the behavior edge comprises a file deletion behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process and an IP value of a device performing file creation; the second information comprises at least one of a file name, a file path, a file type, a file size, a file write time of the deleted file and an IP value of a device performing file deletion; and the third information comprises a file deletion time;

[0195] when the log behavior type is an IP access type, the behavior edge comprises an IP access behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process and an IP value of a device performing file creation; the second information comprises IP intranet popularity; and the third information comprises an IP access time;

[0196] when the log behavior type is a domain name resolution type, the behavior edge comprises a domain name resolution behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process and an IP value of a device performing file creation; the second information comprises a resolved domain name; and the third information comprises a domain name resolution time;

[0197] when the log behavior type is a registry creation type, the behavior edge comprises a registry creation behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process and an IP value of a device performing file creation; the second information comprises at least one of a path, a registry value and a registry type of the created registry; and the third information comprises a registry creation time;

[0198] In the log behavior type is the registry modification type, the behavior edge includes the registry modification behavior edge; the first information includes at least one of the following: process name of the target process, file path of the target process and IP value of the device for creating the execution file; the second information includes at least one of the following: path of the created registry, registry value and registry type; the third information includes the registry modification time;

[0199] In the log behavior type is the registry deletion type, the behavior edge includes the registry deletion behavior edge; the first information includes at least one of the following: process name of the target process, file path of the target process and IP value of the device for creating the execution file; the second information includes at least one of the following: path of the created registry, registry value and registry type; the third information includes the registry deletion time.

[0200] Figure 9 is the structure schematic view of the graph data provided by the embodiment of the application, as Figure 9 As shown in the figure, after the current log data is converted into graph data, the information contained in the current log data can be viewed by the visualization tool: the desktop process node (node A) of the operating system, the "test.exe" process node (node B) and the source process node (node C) of the "test.exe" process node, the edge between the desktop process node and the "test.exe" process node is the process creation behavior edge, and the edge between the "test.exe" process node and the source process node is the process file source edge; the desktop process "explorer.exe" of the operating system starts the "test.exe" process, and the source file of the "test.exe" process is from the source process "D:\\test\\test.exe". According to the same method, the current log data of other log behavior types is converted into graph data composed of nodes and edges, and the application does not repeat here.

[0201] The network phishing behavior detection method provided by the embodiment of the application stores the attribute information of each node and the attribute information of each behavior edge in the graph data, when matching the network phishing behavior, the identification information and the attribute information of the node are matched at the same time, the identification information and the attribute information of the behavior edge are matched at the same time, when the identification information and the attribute information are matched, it is determined that the matching result is matching success, and the accuracy of the network phishing behavior detection is further improved.

[0202] Optionally, Figure 10 is the fifth flow schematic view of the network phishing behavior detection method provided by the embodiment of the application, as Figure 10As shown in the above step 103, the network phishing behavior detection method further includes the following steps:

[0203] Step 105, generating alarm information based on the log data corresponding to the to-be-detected graph.

[0204] For example, based on the pre-specified graph query statement rule, the to-be-detected graph and all graphs in the graph database are matched, when the matching is successful, the alarm event is generated based on the log data corresponding to the to-be-detected graph, and the alarm event is sent to the alarm module for alarm notification, so that the user can take relevant measures in time to avoid losses.

[0205] Figure 11 The network phishing behavior detection device provided by the embodiment of the application is shown in the structure diagram of the network phishing behavior detection device. Figure 11 As shown, the network phishing behavior detection device includes a conversion unit 1101, a storage unit 1102, a matching unit 1103, and a determination unit 1104; wherein:

[0206] The conversion unit 1101 is configured to convert the current log data into current graph data when the current log data is received; the current graph data includes node data and edge data;

[0207] The storage unit 1102 is configured to store the current graph data in the graph database;

[0208] The matching unit 1103 is configured to, when it is determined that the current log data is log data including IP access behavior, match the to-be-detected graph with at least one graph included in the graph database based on a graph query statement rule to obtain a matching result; the to-be-detected graph is composed of graph data corresponding to each log data between the previous log data including IP access behavior and the current log data and the current graph data; the graph query statement rule is a rule determined based on network phishing behavior;

[0209] The determination unit 1104 is configured to, when the matching result is matching success, determine that the log data corresponding to the to-be-detected graph is network phishing behavior data.

[0210] The network phishing behavior detection device provided by the embodiment of the present application converts the received current log data into current graph data, and when it is determined that the current log data is log data including IP access behavior, the to-be-detected graph is matched with at least one graph in the graph database based on the graph query statement rule determined according to the network phishing behavior, and when the matching is successful, it is determined that the log data corresponding to the to-be-detected graph is network phishing behavior data. It can be known that the present application converts each log data into corresponding graph data, and realizes the detection of network phishing behavior based on the graph query statement rule specified according to the network phishing behavior. In this way, even if the attacker bypasses the detection through illegal means, the IP of the malicious device finally accessed can be detected based on the graph query statement rule, the detection of network phishing behavior based on the real-time triggering of the graph query statement rule according to the external IP behavior is realized, and the accuracy of network phishing behavior detection is improved.

[0211] According to any one of the above embodiments, the matching unit 1103 is specifically configured to:

[0212] obtain first node information of a first node and second node information of a last node of the to-be-detected graph;

[0213] determine whether the graph database contains a target graph in which the node information of the first node is the first node information and the node information of the last node is the second node information;

[0214] when it is determined that the graph database contains the target graph, determine that the matching result is matching success;

[0215] when it is determined that the graph database does not contain the target graph, determine that the matching result is matching failure.

[0216] According to any one of the above embodiments, the matching unit 1103 is specifically configured to:

[0217] obtain edge information of a to-be-detected edge connected to the first node in the to-be-detected graph, and obtain edge information of a first target edge connected to the first node in the target graph;

[0218] when it is determined that the edge information of the to-be-detected edge matches the edge information of the first target edge, determine that the matching result is matching success.

[0219] According to any one of the above embodiments, the matching unit 1103 is specifically configured to:

[0220] obtain a second node connected to the first target edge in the target graph; the first target edge points to the second node;

[0221] When it is determined that the second target edge includes a preset number of edges between the second node and the last node in the target graph, it is determined that the matching result is a matching success.

[0222] According to any one of the above embodiments, the matching unit 1103 is further specifically configured to:

[0223] determine a current application scenario type corresponding to the current log data;

[0224] obtain a target graph query statement rule corresponding to the current application scenario type; the target graph query statement rule is a rule determined based on a phishing behavior of the current application scenario type;

[0225] match the to-be-detected graph and at least one graph included in the graph database based on the target graph query statement rule to obtain a matching result.

[0226] According to any one of the above embodiments, the conversion unit 1101 is specifically configured to:

[0227] determine a log behavior type of the current log data; the log behavior type includes one of the following: a process operation type, a file operation type, an IP access type, a domain name resolution type, and a registry operation type; the process operation type includes one of the following: a process creation type, a process injection type, and a process closing type; the file operation type includes one of the following: a file transmission type, a file creation type, a file writing type, a file decompression type, and a file deletion type; the registry operation type includes one of the following: a registry creation type, a registry modification type, and a registry deletion type;

[0228] convert the current log data into the current graph data based on the log behavior type.

[0229] According to any one of the above embodiments, the conversion unit 1101 is further specifically configured to:

[0230] when the log behavior type is the process creation type, determine a hash value of a parent process of a target process in the current log data as identification information of a first node of a process creation behavior edge, determine a hash value of the target process in the current log data as identification information of a second node of the process creation behavior edge, determine a hash value of a source file of the target process in the current log data as identification information of a first node of a process file source edge, and determine a hash value of the target process in the current log data as identification information of a second node of the process file source edge; the process creation behavior edge points to the second node of the process creation behavior edge.

[0231] when the log behavior type is a process injection type, determining a hash value of a source process of a target process in the current log data as identification information of a first node of a process injection behavior edge, and determining a hash value of the target process in the current log data as identification information of a second node of the process injection behavior edge; the process injection behavior edge points to the second node of the process injection behavior edge;

[0232] when the log behavior type is a process closing type, determining a hash value of a parent process of a target process in the current log data as identification information of a first node of a process closing behavior edge, and determining a hash value of the target process as identification information of a second node of the process closing behavior edge; the process closing behavior edge points to the second node of the process closing behavior edge;

[0233] when the log behavior type is a file transmission type, determining a hash value of a target process in the current log data as identification information of a first node of a file transmission behavior edge, and determining a hash value of a transmitted file in the current log data as identification information of a second node of the file transmission behavior edge; the file transmission behavior edge points to the second node of the file transmission behavior edge;

[0234] when the log behavior type is a file writing type, determining a hash value of a target process in the current log data as identification information of a first node of a file writing behavior edge, and determining a hash value of a file on which writing is performed in the current log data as identification information of a second node of the file writing behavior edge; the file writing behavior edge points to the second node of the file writing behavior edge;

[0235] when the log behavior type is a file decompression type, determining a hash value of a compressed file in the current log data as identification information of a first node of a file decompression behavior edge, and determining a hash value of a decompressed file obtained after the compressed file is decompressed as identification information of a second node of the file decompression behavior edge; the file decompression behavior edge points to the second node of the file decompression behavior edge;

[0236] when the log behavior type is a file creation type, determining a hash value of a target process in the current log data as identification information of a first node of a file creation behavior edge, and determining a hash value of a created file as identification information of a second node of the file creation behavior edge; the file creation behavior edge points to the second node of the file creation behavior edge;

[0237] when the log behavior type is a file deletion type, determining the hash value of the target process in the current log data as identification information of a first node of a file deletion behavior edge, and determining the hash value of the deleted file as identification information of a second node of the file deletion behavior edge; the file deletion behavior edge points to the second node of the file deletion behavior edge;

[0238] when the log behavior type is an IP access type, determining the hash value of the target process in the current log data as identification information of a first node of an IP access behavior edge, and determining the IP value of the access device in the current log data as identification information of a second node of the IP access behavior edge; the IP access behavior edge points to the second node of the IP access behavior edge;

[0239] when the log behavior type is a domain name resolution type, determining the hash value of the target process in the current log data as identification information of a first node of a domain name resolution behavior edge, and determining the resolved domain name in the current log data as identification information of a second node of the domain name resolution behavior edge; the domain name resolution behavior edge points to the second node of the domain name resolution behavior edge;

[0240] when the log behavior type is a registry creation type, determining the hash value of the target process in the current log data as identification information of a first node of a registry creation behavior edge, and determining the key value of the created registry in the current log data as identification information of a second node of the registry creation behavior edge; the registry creation behavior edge points to the second node of the registry creation behavior edge;

[0241] when the log behavior type is a registry modification type, determining the hash value of the target process in the current log data as identification information of a first node of a registry modification behavior edge, and determining the key value of the created registry in the current log data as identification information of a second node of the registry modification behavior edge; the registry modification behavior edge points to the second node of the registry modification behavior edge;

[0242] when the log behavior type is a registry deletion type, determining the hash value of the target process in the current log data as identification information of a first node of a registry deletion behavior edge, and determining the key value of the created registry in the current log data as identification information of a second node of the registry deletion behavior edge; the registry deletion behavior edge points to the second node of the registry deletion behavior edge.

[0243] Based on any of the above embodiments, the conversion unit 1101 is further configured to:

[0244] determining first information in the current log data as attribute information of a first node of a behavior edge, determining second information in the current log data as attribute information of a second node of the behavior edge, and determining third information in the current log data as attribute information of the behavior edge;

[0245] when the log behavior type is a process creation type, the behavior edge comprises a process creation behavior edge; the first information comprises at least one of a process name of the parent process, a file path of the parent process, and an IP value of a device performing process creation; the second information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of the electronic device; and the third information comprises a process creation time;

[0246] when the log behavior type is a process injection type, the behavior edge comprises a process injection behavior edge; the first information comprises at least one of a process name of the source process, a file path of the source process, and an IP value of a device performing process injection; the second information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing process injection; and the third information comprises a process injection time;

[0247] when the log behavior type is a process closing type, the behavior edge comprises a process closing behavior edge; the first information comprises at least one of a process name of the parent process, a file path of the parent process, and an IP value of a device performing process closing; the second information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing process closing; and the third information comprises a process deletion time;

[0248] when the log behavior type is a file transmission type, the behavior edge comprises a file transmission behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file transmission; the second information comprises at least one of a file name of a transmitted file, a file path, a file type, a file size, a file writing time, and an IP value of a device performing file transmission; and the third information comprises a file transmission time;

[0249] When the log behavior type is a file write type, the behavior edge includes a file write behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file write; the second information includes at least one of a file name of a file performing write, a file path, a file type, a file size, a file write time, and an IP value of a device performing file write; and the third information includes a time of performing write in the file.

[0250] When the log behavior type is a file decompression type, the behavior edge includes a file decompression behavior edge; the first information includes at least one of a file name, a file path, a file type, a file size, a file write time, and an IP value of a device performing file decompression of a compressed file; the second information includes at least one of a file name, a file path, a file type, a file size, a file write time, and an IP value of a device performing file decompression of a decompressed file; and the third information includes a file decompression time.

[0251] When the log behavior type is a file creation type, the behavior edge includes a file creation behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file creation; the second information includes at least one of a file name, a file path, a file type, a file size, a file write time, and an IP value of a device performing file creation of a created file; and the third information includes a file creation time.

[0252] When the log behavior type is a file deletion type, the behavior edge includes a file deletion behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file creation; the second information includes at least one of a file name, a file path, a file type, a file size, a file write time, and an IP value of a device performing file deletion of a deleted file; and the third information includes a file deletion time.

[0253] When the log behavior type is an IP access type, the behavior edge includes an IP access behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file creation; the second information includes IP intranet popularity; and the third information includes an IP access time.

[0254] When the log behavior type is domain name resolution, the behavior edge includes a domain name resolution behavior edge; the first information includes at least one of the following: the process name of the target process, the file path of the target process, and the IP value of the device that created the executable file; the second information includes the resolved domain name; the third information includes the domain name resolution time;

[0255] When the log behavior type is registry creation type, the behavior edge includes registry creation behavior edge; the first information includes at least one of the following: the process name of the target process, the file path of the target process, and the IP value of the device executing file creation; the second information includes at least one of the following: the path of the created registry, the registry value, and the registry type; the third information includes the registry creation time;

[0256] When the log behavior type is registry modification type, the behavior edge includes registry modification behavior edge; the first information includes at least one of the following: the process name of the target process, the file path of the target process, and the IP value of the device that created the executable file; the second information includes at least one of the following: the path of the created registry, the registry value, and the registry type; the third information includes the registry modification time;

[0257] When the log behavior type is registry deletion, the behavior edge includes a registry deletion behavior edge; the first information includes at least one of the following: the process name of the target process, the file path of the target process, and the IP value of the device that created the executable file; the second information includes at least one of the following: the path of the created registry, the registry value, and the registry type; the third information includes the registry deletion time.

[0258] Based on any of the above embodiments, the device further includes:

[0259] The generation unit is used to generate alarm information based on the log data corresponding to the map to be detected.

[0260] Figure 12 This is a schematic diagram of the physical structure of the electronic device provided in the embodiments of the present invention, such as... Figure 12 As shown, the electronic device may include a processor 1210, a communications interface 1220, a memory 1230, and a communication bus 1240, wherein the processor 1210, the communications interface 1220, and the memory 1230 communicate with each other via the communication bus 1240. The processor 1210 can call logical instructions in the memory 1230 to execute the following methods:

[0261] convert the current log data into current graph data when the current log data is received; the current graph data comprises node data and edge data;

[0262] store the current graph data in a graph database;

[0263] when it is determined that the current log data is log data comprising IP access behavior, match a to-be-detected graph atlas with at least one graph atlas comprised in the graph database based on a graph query statement rule to obtain a matching result; the to-be-detected graph atlas is composed of graph data corresponding to each log data between previous log data comprising IP access behavior and the current log data and the current graph data; the graph query statement rule is a rule determined based on phishing behavior;

[0264] when the matching result is a matching success, determine that log data corresponding to the to-be-detected graph atlas is phishing behavior data.

[0265] In addition, the logical instructions in the memory 1230 described above can be implemented in the form of a software function unit and sold or used as an independent product, which can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various program code storage media.

[0266] On the other hand, the embodiments of the present application also provide a non-transitory computer readable storage medium having a computer program stored thereon, which is executed by a processor to implement the phishing behavior detection method provided by the above-mentioned embodiments, comprising:

[0267] convert the current log data into current graph data when the current log data is received; the current graph data comprises node data and edge data;

[0268] store the current graph data in a graph database;

[0269] When the current log data is determined to be log data including IP access behavior, the graph to be detected is matched with at least one graph included in the graph database based on graph query statement rules to obtain a matching result; the graph to be detected consists of graph data corresponding to each log data between the previous log data including IP access behavior and the current log data and the current graph data; the graph query statement rules are rules determined based on phishing behavior;

[0270] When the matching result is successful, the log data corresponding to the target graph is determined to be phishing behavior data.

[0271] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to perform the phishing behavior detection method provided by the methods described above, the method comprising:

[0272] Upon receiving current log data, the current log data is converted into current graph data; the current graph data includes node data and edge data.

[0273] Store the current graph data in the graph database;

[0274] When the current log data is determined to be log data including IP access behavior, the graph to be detected is matched with at least one graph included in the graph database based on graph query statement rules to obtain a matching result; the graph to be detected consists of graph data corresponding to each log data between the previous log data including IP access behavior and the current log data and the current graph data; the graph query statement rules are rules determined based on phishing behavior;

[0275] When the matching result is successful, the log data corresponding to the target graph is determined to be phishing behavior data.

[0276] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0277] Those skilled in the art can clearly understand the technical solutions of the various embodiments from the above description of the embodiments, and the various embodiments can be implemented by means of software with the necessary general hardware platforms, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions, essentially or in other words, the part of the prior art that makes a contribution, can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a ROM / RAM, a magnetic disk, an optical disk, and the like, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0278] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement for some technical features therein; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of detecting a phishing behavior, the method comprising: The method comprises: converting the current log data into current graph data when the current log data is received; the current graph data comprises node data and edge data; storing the current graph data in a graph database; when it is determined that the current log data is log data comprising IP access behavior, matching a to-be-detected graph with at least one graph included in the graph database based on a graph query statement rule to obtain a matching result; the to-be-detected graph is composed of graph data corresponding to each log data between previous log data comprising IP access behavior and the current log data and the current graph data; the graph query statement rule is a rule determined based on phishing behavior; when the matching result is a matching success, determining that log data corresponding to the to-be-detected graph is phishing behavior data; the matching of the to-be-detected graph with at least one graph included in the graph database based on the graph query statement rule to obtain a matching result comprises: obtaining first node information of a first node and second node information of a last node of the to-be-detected graph; determining whether the graph database contains a target graph in which node information of the first node is the first node information and node information of the last node is the second node information; when it is determined that the graph database contains the target graph, determining that the matching result is a matching success; when it is determined that the graph database does not contain the target graph, determining that the matching result is a matching failure.

2. The method of phishing behavior detection according to claim 1, wherein, the determination that the matching result is a matching success comprises: obtaining edge information of a to-be-detected edge connected with the first node in the to-be-detected graph, and obtaining edge information of a first target edge connected with the first node in the target graph; when it is determined that the edge information of the to-be-detected edge matches the edge information of the first target edge, determining that the matching result is a matching success.

3. The method of phishing behavior detection according to claim 2, wherein, the determination that the matching result is a matching success comprises: obtaining a second node connected with the first target edge in the target graph; the first target edge points to the second node; when it is determined that a preset number of second target edges are included between the second node and a last node in the target graph, determining that the matching result is a matching success.

4. The method of phishing behavior detection of claim 1, wherein, the matching of the to-be-detected graph with at least one graph included in the graph database based on the graph query statement rule to obtain a matching result comprises: determining a current application scenario type corresponding to the current log data; obtaining a target graph query statement rule corresponding to the current application scenario type; the target graph query statement rule is a rule determined based on phishing behavior of the current application scenario type; matching the to-be-detected graph with at least one graph included in the graph database based on the target graph query statement rule to obtain a matching result.

5. The method of phishing behavior detection according to claim 1, wherein, the conversion of the current log data into current graph data comprises: determining a log behavior type of the current log data; the log behavior type comprises one of the following: a process operation type, a file operation type, an IP access type, a domain name resolution type, and a registry operation type; the process operation type comprises one of the following: a process creation type, a process injection type, and a process closing type; the file operation type comprises one of the following: a file transmission type, a file creation type, a file writing type, a file decompression type, and a file deletion type; the registry operation type comprises one of the following: a registry creation type, a registry modification type, and a registry deletion type; converting the current log data into the current graph data based on the log behavior type.

6. The method of phishing behavior detection according to claim 5, wherein, The converting the current log data into the current graph data based on the log behavior type comprises: when the log behavior type is the process creation type, determining a hash value of a parent process of a target process in the current log data as identification information of a first node of a process creation behavior edge, determining a hash value of the target process in the current log data as identification information of a second node of the process creation behavior edge, determining a hash value of a source file of the target process in the current log data as identification information of a first node of a process file source edge, and determining the hash value of the target process in the current log data as identification information of a second node of the process file source edge; the process creation behavior edge points to the second node of the process creation behavior edge; when the log behavior type is the process injection type, determining a hash value of a source process of a target process in the current log data as identification information of a first node of a process injection behavior edge, and determining a hash value of the target process in the current log data as identification information of a second node of the process injection behavior edge; the process injection behavior edge points to the second node of the process injection behavior edge; when the log behavior type is the process closing type, determining a hash value of a parent process of a target process in the current log data as identification information of a first node of a process closing behavior edge, and determining a hash value of the target process as identification information of a second node of the process closing behavior edge; the process closing behavior edge points to the second node of the process closing behavior edge; when the log behavior type is the file transmission type, determining a hash value of a target process in the current log data as identification information of a first node of a file transmission behavior edge, and determining a hash value of a transmitted file in the current log data as identification information of a second node of the file transmission behavior edge; the file transmission behavior edge points to the second node of the file transmission behavior edge; when the log behavior type is the file writing type, determining a hash value of a target process in the current log data as identification information of a first node of a file writing behavior edge, and determining a hash value of a file on which writing is performed in the current log data as identification information of a second node of the file writing behavior edge; the file writing behavior edge points to the second node of the file writing behavior edge; When the log behavior type is a file decompression type, a hash value of a compressed file in the current log data is determined as identification information of a first node of a file decompression behavior edge, and a hash value of a decompressed file obtained after the compressed file is decompressed is determined as identification information of a second node of the file decompression behavior edge; the file decompression behavior edge points to the second node of the file decompression behavior edge; When the log behavior type is a file creation type, a hash value of a target process in the current log data is determined as identification information of a first node of a file creation behavior edge, and a hash value of a created file is determined as identification information of a second node of the file creation behavior edge; the file creation behavior edge points to the second node of the file creation behavior edge; When the log behavior type is a file deletion type, a hash value of a target process in the current log data is determined as identification information of a first node of a file deletion behavior edge, and a hash value of a deleted file is determined as identification information of a second node of the file deletion behavior edge; the file deletion behavior edge points to the second node of the file deletion behavior edge; When the log behavior type is an IP access type, a hash value of a target process in the current log data is determined as identification information of a first node of an IP access behavior edge, and an IP value of an access device in the current log data is determined as identification information of a second node of the IP access behavior edge; the IP access behavior edge points to the second node of the IP access behavior edge; When the log behavior type is a domain name resolution type, a hash value of a target process in the current log data is determined as identification information of a first node of a domain name resolution behavior edge, and a resolved domain name in the current log data is determined as identification information of a second node of the domain name resolution behavior edge; the domain name resolution behavior edge points to the second node of the domain name resolution behavior edge; When the log behavior type is a registry creation type, a hash value of a target process in the current log data is determined as identification information of a first node of a registry creation behavior edge, and a key value of a created registry in the current log data is determined as identification information of a second node of the registry creation behavior edge; the registry creation behavior edge points to the second node of the registry creation behavior edge; When the log behavior type is a registry modification type, a hash value of a target process in the current log data is determined as identification information of a first node of a registry modification behavior edge, and a key value of a created registry in the current log data is determined as identification information of a second node of the registry modification behavior edge; the registry modification behavior edge points to the second node of the registry modification behavior edge; When the log behavior type is a registry deletion type, a hash value of a target process in the current log data is determined as identification information of a first node of a registry deletion behavior edge, and a key value of a created registry in the current log data is determined as identification information of a second node of the registry deletion behavior edge; the registry deletion behavior edge points to the second node of the registry deletion behavior edge.

7. The method of phishing behavior detection according to claim 6, wherein, The method further comprises: determining first information in the current log data as attribute information of a first node of a behavior edge, determining second information in the current log data as attribute information of a second node of the behavior edge, and determining third information in the current log data as attribute information of the behavior edge; when the log behavior type is a process creation type, the behavior edge comprises the process creation behavior edge; the first information comprises at least one of a process name of the parent process, a file path of the parent process, and an IP value of a device performing process creation; the second information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of an electronic device; and the third information comprises a process creation time; when the log behavior type is a process injection type, the behavior edge comprises the process injection behavior edge; the first information comprises at least one of a process name of the source process, a file path of the source process, and an IP value of a device performing process injection; the second information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing process injection; and the third information comprises a process injection time; when the log behavior type is a process closing type, the behavior edge comprises a process closing behavior edge; the first information comprises at least one of a process name of the parent process, a file path of the parent process, and an IP value of a device performing process closing; the second information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing process closing; and the third information comprises a process deletion time; when the log behavior type is a file transmission type, the behavior edge comprises a file transmission behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file transmission; the second information comprises at least one of a file name of a transmitted file, a file path, a file type, a file size, a file writing time, and an IP value of a device performing file transmission; and the third information comprises a file transmission time; when the log behavior type is a file writing type, the behavior edge comprises a file writing behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file writing; the second information comprises at least one of a file name of a file performing writing, a file path, a file type, a file size, a file writing time, and an IP value of a device performing file writing; and the third information comprises a time of performing writing in a file; When the log behavior type is a file decompression type, the behavior edge includes a file decompression behavior edge; the first information includes at least one of a file name of a compressed file, a file path, a file type, a file size, a file write time, and an IP value of a device performing file decompression; the second information includes at least one of a file name of a decompressed file, a file path, a file type, a file size, a file write time, and an IP value of a device performing file decompression; and the third information includes a file decompression time; When the log behavior type is a file creation type, the behavior edge includes a file creation behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file creation; the second information includes at least one of a file name of a created file, a file path, a file type, a file size, a file write time, and an IP value of a device performing file creation; and the third information includes a file creation time; When the log behavior type is a file deletion type, the behavior edge includes a file deletion behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file creation; the second information includes at least one of a file name of a deleted file, a file path, a file type, a file size, a file write time, and an IP value of a device performing file deletion; and the third information includes a file deletion time; When the log behavior type is an IP access type, the behavior edge includes an IP access behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file creation; the second information includes IP intranet popularity; and the third information includes an IP access time; When the log behavior type is a domain name resolution type, the behavior edge includes a domain name resolution behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file creation; the second information includes a resolved domain name; and the third information includes a domain name resolution time; When the log behavior type is a registry creation type, the behavior edge includes a registry creation behavior edge; the first information includes at least one of a process name of the target process, a file path of the target process, and an IP value of a device performing file creation; the second information includes at least one of a path of a created registry, a registry value, and a registry type; and the third information includes a registry creation time; In a case where the log behavior type is a registry modification type, the behavior edge comprises a registry modification behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device on which an execution file is created; the second information comprises at least one of a path of the created registry, a registry value, and a registry type; and the third information comprises a registry modification time. In a case where the log behavior type is a registry deletion type, the behavior edge comprises a registry deletion behavior edge; the first information comprises at least one of a process name of the target process, a file path of the target process, and an IP value of a device on which an execution file is created; the second information comprises at least one of a path of the created registry, a registry value, and a registry type; and the third information comprises a registry deletion time.

8. The method of detecting phishing behavior according to any one of claims 1-7, wherein, After determining that the log data corresponding to the to-be-detected graph is phishing behavior data, the method further comprises: generating an alarm information based on the log data corresponding to the to-be-detected graph.

9. A phishing behavior detection apparatus, characterized by, comprises: a conversion unit, configured to convert current log data into current graph data when the current log data is received; the current graph data comprises node data and edge data; a storage unit, configured to store the current graph data in a graph database; a matching unit, configured to, when it is determined that the current log data is log data comprising IP access behavior, match a to-be-detected graph with at least one graph included in the graph database based on a graph query statement rule to obtain a matching result; the to-be-detected graph is composed of graph data corresponding to each log data between previous log data comprising IP access behavior and the current log data and the current graph data; and the graph query statement rule is a rule determined based on phishing behavior; a determination unit, configured to, when the matching result is matching success, determine that the log data corresponding to the to-be-detected graph is phishing behavior data; the matching unit is specifically configured to: obtain first node information of a first node of the to-be-detected graph and second node information of a last node of the to-be-detected graph; determine whether the graph database contains a target graph in which node information of the first node is the first node information and node information of the last node is the second node information; when it is determined that the graph database contains the target graph, determine that the matching result is matching success; when it is determined that the graph database does not contain the target graph, determine that the matching result is matching failure.

10. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the phishing behavior detection method of any one of claims 1 to 8 when executing the program. 11.A non-transitory computer-readable storage medium having stored thereon a computer program. The computer program implements the phishing behavior detection method of any one of claims 1 to 8 when executed by the processor.

12. A computer program product having executable instructions stored thereon, characterized in that, The instruction causes the processor to implement the phishing behavior detection method of any one of claims 1 to 8 when executed by the processor.

Images