Behavioral portrait construction method and apparatus, electronic device, and storage medium

Abstract

The application discloses a behavior portrait construction method and device, electronic equipment and a storage medium, wherein the method comprises the following steps: a server receives behavior data reported by each terminal in at least two terminals in a cluster; for each process, the behavior data of the process on each terminal is analyzed, and each behavior data used for learning the behavior baseline of the process is adjusted; based on the adjusted behavior data, the behavior baseline of each process is learned; and the learned behavior baseline of each process is encapsulated to obtain a terminal behavior portrait model applicable to the cluster.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, electronic device and storage medium for constructing behavioral profiles. Background Technology

[0002] In virtual network scenarios, multiple physical servers typically operate in a cluster. In related technologies, electronic devices filter behavior logs using learned behavioral profiles and identify suspicious behaviors based on the filtering results; however, behavior recognition detection is costly. Summary of the Invention

[0003] In view of this, embodiments of this application provide a method, apparatus, electronic device, and storage medium for constructing behavioral profiles, so as to at least solve the problem of high detection costs in related technologies during behavior recognition.

[0004] The technical solution of this application embodiment is implemented as follows:

[0005] This application provides a method for constructing a behavioral profile, applied to a server, the method comprising:

[0006] Receive behavioral data reported by each of at least two terminals within the cluster;

[0007] For each process, the behavioral data of that process on each terminal is correlated and analyzed, and the various behavioral data used to learn the baseline behavior of that process are adjusted.

[0008] Based on the adjusted behavioral data, a behavioral baseline for each process is learned;

[0009] The learned behavioral baselines of each process are encapsulated to obtain a terminal behavior profile model suitable for the cluster.

[0010] In the above scheme, the step of encapsulating the learned behavioral baselines of each process into a terminal behavior profile model suitable for the cluster includes:

[0011] Determine the process type;

[0012] Based on different process types, the corresponding behavioral baselines are stored in the terminal behavior profile model for the corresponding process type; among them,

[0013] Process types include one of the following:

[0014] System processes;

[0015] Key business processes;

[0016] Other business processes;

[0017] Terminal behavior profiling models include one of the following:

[0018] System process behavior profiling model;

[0019] Key business process behavior profiling model;

[0020] Other business process behavior profiling model.

[0021] The method in the above scheme further includes:

[0022] The terminal behavior profile model is distributed to each terminal in the cluster so that each terminal can perform behavior anomaly detection based on the locally distributed terminal behavior profile model.

[0023] The method in the above scheme further includes:

[0024] Under the condition that the set conditions are met, the current terminal behavior profile model will continue to be updated; among which,

[0025] The set conditions indicate that the false negative rate of abnormal behavior corresponding to the current terminal behavior profile model is greater than the first set threshold, and / or the false positive rate of normal behavior corresponding to the current terminal behavior profile model is greater than the second set threshold.

[0026] This application embodiment also provides a behavior profile construction method, applied to terminals within a cluster, the method comprising:

[0027] Report local behavior data to the server; instruct the server to perform correlation analysis on the behavior data of each received terminal to obtain the process behavior data required for process behavior baseline learning, and finally obtain a terminal behavior profile model suitable for the cluster.

[0028] Based on the terminal behavior profiling model, abnormal behavior of the terminal is detected locally.

[0029] In the above scheme, the step of detecting abnormal behavior on the terminal's local side based on the terminal behavior profiling model includes:

[0030] Receive the terminal behavior profile model sent by the server;

[0031] Anomaly detection is performed on local abnormal behavior based on the received terminal behavior profile model.

[0032] This application embodiment also provides a behavior recognition profile construction device, including:

[0033] The receiving unit is used to receive behavioral data reported by each of at least two terminals in the cluster.

[0034] The adjustment unit is used to analyze the behavioral data of each process on various terminals and adjust the behavioral data used to learn the baseline behavior of the process.

[0035] The learning unit is used to learn the behavioral baseline of each process based on the adjusted behavioral data;

[0036] The encapsulation unit is used to encapsulate the learned behavioral baselines of each process into a terminal behavior profile model suitable for the cluster.

[0037] This application embodiment also provides a behavior profile construction device, including:

[0038] The reporting unit is used to report local behavior data to the server; in order to instruct the server to perform correlation analysis on the behavior data of each terminal received, to obtain the process behavior data required for process baseline learning, and finally to obtain a terminal behavior profile model suitable for the cluster.

[0039] The detection unit is used to detect abnormal behaviors of the terminal based on the terminal behavior profile model.

[0040] This application also provides an electronic device, including: a processor and a memory for storing a computer program capable of running on the processor.

[0041] When the processor runs the computer program, it executes the steps of the behavior recognition profile construction method described above.

[0042] This application embodiment also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the above-described behavior profile construction method.

[0043] The solution provided in this application embodiment involves a server receiving behavioral data reported by each of at least two terminals within a cluster. For each process, the server performs correlation analysis on the behavioral data of that process across various terminals, adjusting the behavioral data used to learn the behavioral baseline of that process. Based on the adjusted behavioral data, a behavioral baseline for each process is learned. The learned behavioral baselines of each process are then encapsulated to obtain a terminal behavior profile model suitable for the cluster. Terminals within the cluster report local behavioral data to the server, instructing the server to perform correlation analysis on the received behavioral data from each terminal to obtain the process behavioral data required for learning the process baseline, and ultimately obtain a terminal behavior profile model suitable for the cluster. Based on the terminal behavior profile model, anomaly detection is performed on the abnormal behavior of the terminal's local behavior. Based on the solution provided in this application embodiment, the server adjusts the behavioral data reported by each terminal for learning the behavioral baseline of each process to obtain a terminal behavior profile model suitable for the cluster. The terminal then performs anomaly detection on its local abnormal behavior based on the terminal behavior profile model. This eliminates the need for terminals within the cluster to learn the terminal behavior profile model, reducing the detection cost during behavior recognition. Attached Figure Description

[0044] Figure 1 This is a schematic diagram illustrating the implementation process of the behavior profile construction method provided in the embodiments of this application;

[0045] Figure 2 This is a schematic diagram illustrating the implementation process of a behavior profile construction method provided in another embodiment of this application;

[0046] Figure 3 A schematic diagram of the detection framework provided for an application embodiment of this application;

[0047] Figure 4 A schematic diagram illustrating the implementation process of the cloud-based behavioral profile construction method provided in the application embodiments of this application;

[0048] Figure 5 This is a schematic diagram of the behavioral profiling construction device provided in the embodiments of this application;

[0049] Figure 6 This is a schematic diagram of the structure of a behavior profiling device provided in another embodiment of this application;

[0050] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0051] In virtual network scenarios, multiple physical servers typically operate in a cluster. In related technologies, electronic devices filter behavior logs using learned behavioral profiles and identify suspicious behaviors based on the filtering results; however, behavior recognition detection is costly.

[0052] Based on this, in various embodiments of this application, the server receives behavioral data reported by each of at least two terminals within the cluster; for each process, it performs correlation analysis on the behavioral data of that process across various terminals, adjusting the behavioral data used to learn the behavioral baseline of that process; based on the adjusted behavioral data, it learns the behavioral baseline of each process; and encapsulates the learned behavioral baselines of each process into a terminal behavior profile model suitable for the cluster. Terminals within the cluster report local behavioral data to the server, instructing the server to perform correlation analysis on the received behavioral data of each terminal to obtain the process behavioral data required for learning the process behavioral baseline, and ultimately obtain a terminal behavior profile model suitable for the cluster; based on the terminal behavior profile model, it performs anomaly detection on the abnormal behavior of the terminal's local behavior. Based on the solution provided in this application, the server adjusts the behavioral data reported by each terminal for learning the baseline behavior of each process to obtain a terminal behavior profile model suitable for the cluster. The terminal performs anomaly detection on its local abnormal behavior based on the terminal behavior profile model. In this way, the terminal behavior profile model learned by the server is more comprehensive and accurate, reducing the false alarm rate for normal behavior and the false negative rate for abnormal behavior. Moreover, the terminals in the cluster do not need to learn the terminal behavior profile model, which reduces the detection cost during behavior recognition.

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] Figure 1 This is a schematic diagram illustrating the implementation flow of the behavior profile construction method provided in this application embodiment. This application embodiment provides a behavior profile construction method applied to a server, the method including:

[0055] Step 101: Receive behavioral data reported by each of at least two terminals in the cluster.

[0056] In a virtual network scenario, a cluster typically includes two or more endpoints, which may include, but are not limited to, servers, mobile terminals, and other electronic devices. Servers can be located within the cluster or outside of it; this is not a limitation.

[0057] In this embodiment, the terminal runs processes that can generate behavioral data. The terminal reports the behavioral data corresponding to each process to the server. The behavioral data of the processes can be in the form of executable file paths or behavioral logs, etc.

[0058] Step 102: For each process, perform correlation analysis on the process's behavior data across various terminals, and adjust the various behavior data used to learn the baseline behavior of the process.

[0059] Here, taking a single process as an example, each terminal running this process in the cluster reports the behavior data of this process on each terminal to the server respectively. However, the behavior data of this process reported by each terminal may be abnormal, and these behavior data cannot be directly used to learn the behavior baseline of this process. Therefore, it is necessary to analyze these behavior data to filter out the behavior data required for learning the behavior baseline of this process.

[0060] Specifically, the server extracts the features that can determine whether the behavior data of this process is normal behavior data from the behavior data of this process received on each terminal, and sets the feature baselines corresponding to the features. Based on the features corresponding to this process and the corresponding feature baselines, the server filters out the behavior data required for learning the behavior baseline of this process from the behavior data of this process received on each terminal.

[0061] Among them, the types of features include but are not limited to: process activity, owner of the file, issuer of the file signature, threat intelligence information of the file, and behavior information of the process. The feature baseline can be set according to the empirical values of developers, or roughly selected according to the received behavior data, or calculated according to a certain formula based on the received behavior data, etc. The feature baseline can be understood as a threshold. Specifically, the feature baseline can be a single value such as x, and when the feature value is greater than x or less than x, the value-taking condition is satisfied; the feature baseline can also be two values such as x and y (x < y), and when the feature value is greater than x and less than y or less than x or greater than y, the value-taking condition is satisfied.

[0062] In practical applications, the activity of a process can be obtained according to the number of occurrences of certain operations in the behavior data of the process. Suppose software A is installed on a terminal. When software A is clicked once, software A will run, and at this time, 1 executable file path of software A is obtained. When software A is clicked 10 times, 10 executable file paths of software A will be obtained. At this time, the activity of the process of software A can be extracted from the behavior data of software A as 10.

[0063] The method of filtering behavior data according to the feature baseline can be: removing the maximum and minimum values in the received feature values, and judging each remaining feature value. All the behavior data corresponding to the feature values that meet the value-taking conditions are the behavior data required for learning the behavior baseline of this process.

[0064] In practical applications, after receiving the behavior data, the behavior data can be converted into a data format that the server can recognize and process.

[0065] Step 103: Based on the adjusted behavior data, learn the behavior baseline of each process.

[0066] Here, based on the behavioral data required to learn the behavioral baseline of the corresponding process, the behavioral baseline of the corresponding process is learned respectively.

[0067] Step 104: Encapsulate the learned behavioral baselines of each process to obtain a terminal behavior profile model suitable for the cluster.

[0068] Based on the solution provided in this application, the server adjusts the behavioral data reported by each terminal for learning the behavioral baseline of each process, learns the behavioral baseline of each process, and finally encapsulates it to obtain a terminal behavior profile model suitable for the cluster. In this way, the terminal behavior profile model learned by the server is more comprehensive and accurate, reducing the false alarm rate for normal behavior and the false negative rate for abnormal behavior.

[0069] In one embodiment, encapsulating the learned behavioral baselines of each process into a terminal behavior profile model suitable for the cluster includes:

[0070] Determine the process type;

[0071] Based on different process types, the corresponding behavioral baselines are stored in the terminal behavior profile model for the corresponding process type; among them,

[0072] Process types include one of the following:

[0073] System processes;

[0074] Key business processes;

[0075] Other business processes;

[0076] Terminal behavior profiling models include one of the following:

[0077] System process behavior profiling model;

[0078] Key business process behavior profiling model;

[0079] Other business process behavior profiling model.

[0080] The behavioral baselines corresponding to system processes are stored in the system process behavior profile model. Corresponding to this model, the server can analyze the behavioral data of system processes to identify the terminal's business type and can also distribute a whitelist of default software behaviors to the terminal. The terminal then uses this whitelist to classify behaviors as legitimate, reducing the time spent filtering behavioral data and lowering the false positive rate for normal behaviors. In practical applications, when the default behavior profile of a system process on a terminal does not converge, the server distributes the behavior profile of that process, reducing the learning difficulty for the terminal.

[0081] The behavioral baselines corresponding to key business processes are stored in the key business process behavior profile model. Corresponding to this model, the server analyzes the key business processes of terminals (usually servers, such as web servers) to determine the security boundaries of the business. This can be used to filter and detect unknown behaviors, and can also be distributed to terminals as a public whitelist, enabling terminals unable to learn business behaviors to obtain behavioral profiles. The server-distributed behavioral profiles are used to filter abnormal behavior data, improving the phenomenon of false positives where normal behavior is mistaken for abnormal behavior, thus reducing the false positive rate. Some characteristics of abnormal behavior events differ from those of normal behavior events; corresponding alarm rules are set for these characteristics, so abnormal behavior events will trigger alarms and generate alarm logs.

[0082] The behavioral baselines corresponding to other business processes are stored in the behavioral profile model of other business processes. Here, other business processes can be understood as application processes. Corresponding to the behavioral profile model of other business processes, the server can identify the normal behaviors generated by the application during runtime by analyzing the behavioral data corresponding to the white behaviors of the application processes. By constructing and distributing whitelists at the application level, the terminal determines the behavioral data generated by the applications in the whitelist as white behaviors, which shortens the time consumed by behavioral data filtering and reduces the false alarm rate of normal behaviors. In this embodiment, the behavioral baselines corresponding to processes are classified according to process type, and the behavioral baselines corresponding to processes of the same type are stored in the same terminal behavioral profile model, which facilitates the subsequent targeted distribution of terminal behavioral profile models to terminals in the cluster.

[0083] In one embodiment, the method further includes:

[0084] The terminal behavior profile model is distributed to each terminal in the cluster so that each terminal can perform behavior anomaly detection based on the locally distributed terminal behavior profile model.

[0085] Here, the server can distribute the terminal behavior profile model through software interfaces, hardware interfaces, or other methods. It should be noted that the server's generation and distribution of the terminal behavior profile model can be two discontinuous actions. That is, the server's distribution action can be either broadcasting the terminal behavior profile model to the terminals in the cluster immediately after receiving it, or storing the terminal behavior profile model and then distributing it to the terminals only when triggering conditions are met (such as receiving a request from a terminal or a terminal joining the cluster). This is not limited here. Furthermore, the terminal receiving the terminal behavior profile model can be the terminal that reported the behavior data, or it can be something else entirely.

[0086] The server can determine the process running on the terminal based on the behavioral data reported by the terminal, and send the terminal behavior profile model corresponding to the running process to the terminal.

[0087] Alternatively, the server can obtain the processes supported by the terminal's runtime environment and / or newly installed processes through the management plane of the first cluster, and send the terminal behavior profile model corresponding to the processes supported by the terminal and / or the newly installed processes to the terminal.

[0088] Alternatively, the server can send the corresponding terminal behavior profile model to the terminal based on the request issued by the terminal (such as a request to obtain a system process behavior profile model).

[0089] In this embodiment, the server performs correlation analysis on the behavioral data reported by the terminals within the cluster to obtain a terminal behavior profile model suitable for the cluster. This allows the terminals within the cluster to directly use the terminal behavior profile model issued by the server to perform abnormal behavior detection on their local behavioral data without having to learn the terminal behavior profile model. Abnormal behavior data is filtered out from the local behavioral data, reducing the detection cost during behavior recognition.

[0090] In one embodiment, the method further includes:

[0091] Under the condition that the set conditions are met, the current terminal behavior profile model will continue to be updated; among which,

[0092] The set conditions indicate that the false negative rate of abnormal behavior corresponding to the current terminal behavior profile model is greater than the first set threshold, and / or the false positive rate of normal behavior corresponding to the current terminal behavior profile model is greater than the second set threshold.

[0093] After obtaining the terminal behavior profile model, the server determines whether the current terminal behavior profile model meets the set conditions. If the current terminal behavior profile model meets the set conditions, it determines that the current terminal behavior profile model needs to be updated, and updates the current terminal behavior profile model based on the filtering results of the obtained behavior data. The filtering and processing of behavior data can be performed by operations and maintenance personnel, or by the server or other electronic devices.

[0094] Here, we can continue to determine whether the updated terminal behavior profile model meets the set conditions. If the set conditions are met, we can update the terminal behavior profile model again until the updated terminal behavior profile model no longer meets the set conditions.

[0095] Terminal behavior profiling models that meet certain criteria have a high false negative rate for abnormal behavior and / or a high false positive rate for normal behavior. In the above solution, the server updates these terminal behavior profiling models using filtered behavior data. This can exclude some or all behavior data related to abnormal behavior events, improving the learning rate of abnormal behaviors into the terminal behavior profiling models and thus reducing the false negative rate for abnormal behavior. Furthermore, by excluding behavior data that may cause false positives for normal behavior, the false positive rate for normal behavior in the terminal behavior profiling models can be reduced.

[0096] Figure 2 This is a schematic diagram illustrating the implementation flow of the behavior profile construction method provided in this application embodiment. This application embodiment provides a behavior profile construction method applied to terminals within a cluster, wherein the terminals include, but are not limited to, electronic devices such as servers and mobile terminals. The method includes:

[0097] Step 201: Report local behavior data to the server.

[0098] The server is instructed to perform correlation analysis on the received behavioral data of each terminal to obtain the process behavior data required for process behavior baseline learning, and finally obtain a terminal behavior profile model suitable for the cluster.

[0099] Step 202: Based on the terminal behavior profile model, perform anomaly detection on the abnormal behavior of the terminal locally.

[0100] In one embodiment, the step of detecting abnormal behavior on the terminal's local side based on the terminal behavior profiling model includes:

[0101] Receive the terminal behavior profile model sent by the server;

[0102] Anomaly detection is performed on local abnormal behavior based on the received terminal behavior profile model.

[0103] In a virtual network scenario, a cluster typically consists of two or more endpoints, each running processes that can generate behavioral data. Servers can be located within or outside the cluster; this is not a limitation here.

[0104] The server performs correlation analysis on the behavioral data reported by the terminals in the cluster to obtain a terminal behavior profile model applicable to the cluster, and distributes the terminal behavior profile model to the terminals in the cluster. The terminals receive and use the terminal behavior profile model distributed by the server to perform behavior anomaly detection on the local behavior data of the terminals and filter out abnormal behavior data from the local behavior data.

[0105] The terminal receiving the terminal behavior profile model can be either the terminal that reports the behavior data or not. The behavior data can be in the form of executable file paths or behavior logs, etc. Here, the terminal behavior profile model can be used by one or more terminals within the cluster, and the terminal can receive the terminal behavior profile model sent by the server through software interfaces, hardware interfaces, etc.

[0106] In this embodiment, the terminals within the cluster do not need to learn the terminal behavior profile model, which reduces the detection cost during behavior recognition. Furthermore, the terminal behavior profile model learned by the server is more comprehensive and accurate, reducing the false alarm rate for normal behavior and the false negative rate for abnormal behavior.

[0107] Abnormal behavior data has characteristics that differ from normal behavior data. In one embodiment, corresponding alarm rules are set for these characteristics. When the terminal detects abnormal behavior data from the local behavior data, an alarm is triggered and an alarm log is generated to facilitate operators to promptly discover abnormal behavior on the local terminal.

[0108] Terminals can output alarm logs via external devices such as displays. Before outputting alarm logs, similar alarm logs can be merged using aggregation and reduction methods such as character aggregation, semantic aggregation, and / or statistical reduction, thereby reducing the number of alarm logs. When outputting alarm logs, alarm events corresponding to the alarm logs can be sorted according to the risk level of the alarms, placing high-risk alarm events first to facilitate analysis by operations personnel. Furthermore, alarm logs and corresponding behavioral events can be analyzed based on the correlations between raw data (such as behavior logs), alarm log correlations, and cross-host correlations, and the analysis results can be output.

[0109] In one embodiment, the terminal has a set reputation database that records behavioral data corresponding to abnormal behavior and / or normal behavior. When the terminal filters local behavioral data, it can also filter the local behavioral data based on the set reputation database to filter out abnormal behavior data. Here, the set reputation database can be sent to the terminal by the server, or it can be generated by the terminal during operation based on behavioral data and corresponding judgment results. This can improve the false alarm phenomenon of identifying normal behavior data as abnormal behavior data and reduce the number of false alarm alarm logs.

[0110] The present application will be further described in detail below with reference to application examples.

[0111] Currently, filtering of behavior on servers is achieved by defining expert rules. Experts use their expertise in specific domains to design rules that computers can recognize and use for detection; these rules are called expert rules. Expert rules are divided into two types: white rules and black rules.

[0112] Blacklisting involves analyzing known attack behaviors to identify distinguishing features from normal behavior, combining these features to form a rule. During the detection phase, this rule is used to filter all behaviors; if a rule is matched, the behavior is considered an attack. Rule generation relies heavily on expert experience; poor design can lead to false positives, where normal logs are mistakenly identified as suspicious logs.

[0113] White rules are rules developed by experts based on the business logic executed by the server. These rules abstract the executable behaviors into corresponding rules, and behaviors outside the scope of these rules are prohibited. If the rules for normal behavior are designed too strictly, many legitimate files will fail to execute; conversely, if the rules are designed too leniently, malicious behaviors will be able to bypass the expert rules.

[0114] The effectiveness depends on the quality of the rules extracted by security experts. Actual testing on the client side shows a high false positive rate, and its detection effectiveness against zero-day attacks is also limited. A zero-day attack refers to an attack by a hacker exploiting a non-public vulnerability or tool to attack a client's server. Here, the server can be understood as a computer that provides various high-performance services to users, such as a supercomputer used for scientific computing tasks.

[0115] Based on this, this application embodiment proposes a distributed anomaly detection method and system. Based on a defined detection framework, it can filter behavior logs generated by the host, identify suspicious behaviors, and promptly detect unknown attacks. Specifically, by combining the capabilities of terminal behavior profiling, alarm reduction, and cloud profiling, it can automatically detect suspicious behaviors while ensuring that false alarms are controllable. Furthermore, the entire anomaly detection process is fully automated, enabling the detection of both known and unknown attacks without the intervention of security experts.

[0116] like Figure 3 As shown, the detection framework is mainly divided into three modules:

[0117] The terminal behavior profiling module is used to learn the behavior of the host. The learned behavior profile is used to filter behavior logs, which can solve the problem of unstable results when relying on expert rules.

[0118] The cloud-based profile correction module optimizes the user-reported behavioral profile model. Through cluster profiles, host profiles, application profiles, system background profiles, and / or business profiles, it continuously optimizes and adjusts the terminal's host profile to maintain optimal detection performance. This application example reduces the number of false alarm logs, ensuring both high false alarm and high detection rates while enabling automatic detection of host behavior.

[0119] The alarm reduction module compresses alarm logs generated by terminal behavior profiling, reducing the number of false alarm logs and playing a role in false alarm control. After alarm reduction, false alarm logs can be reduced by more than 90%, greatly improving the efficiency of security operations.

[0120] right Figure 3 The detection framework shown is explained below:

[0121] Terminal behavior logs: Logs generated on the host and collected.

[0122] The terminal behavior profiling module includes sub-modules for application whitelisting, behavior baseline, and model contamination analysis.

[0123] Application whitelist: For some common applications that are not exploited by attackers, an application whitelist can be used for quick filtering.

[0124] Behavioral baseline: The set of relevant behaviors learned from the host machine, also known as the behavioral model.

[0125] Model contamination analysis: Model contamination analysis can be performed through rule detection, contamination analysis, etc., mainly to solve the problem of attack behaviors being learned into the model, resulting in the failure to detect abnormal behaviors.

[0126] The alarm reduction module includes sub-modules for alarm aggregation, alarm correlation analysis, and scoring algorithms.

[0127] Alarm aggregation: This feature merges similar alarm logs to reduce the number of alarms.

[0128] Alarm correlation analysis: Alarm correlation analysis makes it easier for security operations and maintenance personnel to analyze alarm logs.

[0129] Scoring Algorithm: The scoring algorithm sorts alarms according to their risk level, which can prioritize urgent alarm events and allow operations personnel to focus their main efforts on critical alarm logs.

[0130] The cloud-based profile correction module includes sub-modules for a profile library and a behavioral reputation library.

[0131] Profile Library: By building a cloud-based profile library from different perspectives, a general basic behavior library can be constructed, which can serve as input for the behavior reputation library.

[0132] Behavioral reputation database: The behavioral reputation database can be distributed to the terminal to filter some common normal or abnormal behaviors.

[0133] Compared to centralized detection frameworks that send all logs to a server for processing, this application example's solution rationally utilizes various computing and storage resources on the terminal, allowing each terminal to filter its own generated behavior logs, thus reducing the amount of logs uploaded and significantly lowering detection costs. With false positives under control, this helps customers promptly detect unknown attacks and avoid losses. Simultaneously, the alarm logs generated after filtering the behavior logs are compressed, reducing the number of false positives and keeping them under control.

[0134] Figure 4 This illustration shows a schematic diagram of the implementation process of the cloud-based behavioral profile construction method provided in an application embodiment of this application, which includes at least:

[0135] Terminal behavior data reporting: Used to report the behavior data generated by processes on the terminal to the cloud.

[0136] Information parsing: The reported behavioral data is parsed into features required by the feature extraction module.

[0137] Feature extraction module: This module primarily extracts features that can be used for identification, such as process activity, file owner, file signature issuer, file threat intelligence, and process behavior information. Here, any file executed in the operating system can be referred to as a process.

[0138] Process white behavior identification and filtering module: Based on the above characteristics, the behavior of the process is judged and filtered, and only process-related white behaviors can enter the process type identification module.

[0139] Process type identification module: Based on the process type, we categorize the process's behavior into system background profile, business profile, and application profile, which facilitates targeted data distribution in the future.

[0140] Manual identification and maintenance module: Security experts can optimize the cloud-based endpoint cluster behavior profile database to solve the problem of infiltrating attacks during the learning period, as well as the problem of high false positives.

[0141] Update and distribution module: The cloud-based terminal cluster behavior profile library distributes corresponding behavior profiles in a targeted manner based on the terminal's problems and needs.

[0142] Any method or architecture similar to that of the present invention, but which uses a similar detection module to detect and process behavior, is within the scope of protection of this application.

[0143] To implement the method of the embodiments of this application, the embodiments of this application also provide a behavior profile construction apparatus, such as... Figure 5 As shown, the device includes:

[0144] The receiving unit 501 receives behavioral data reported by each of at least two terminals in the cluster.

[0145] The adjustment unit 502 is used to analyze the behavior data of each process on each terminal and adjust the behavior data used to learn the behavior baseline of the process for each process.

[0146] Learning unit 503 is used to learn the behavioral baseline of each process based on the adjusted behavioral data;

[0147] The encapsulation unit 504 is used to encapsulate the learned behavioral baselines of each process into a terminal behavior profile model suitable for the cluster.

[0148] In one embodiment, the packaging unit 504 is used for:

[0149] Determine the process type;

[0150] Based on different process types, the corresponding behavioral baselines are stored in the terminal behavior profile model for the corresponding process type; among them,

[0151] Process types include one of the following:

[0152] System processes;

[0153] Key business processes;

[0154] Other business processes;

[0155] Terminal behavior profiling models include one of the following:

[0156] System process behavior profiling model;

[0157] Key business process behavior profiling model;

[0158] Other business process behavior profiling model.

[0159] In one embodiment, the apparatus further includes:

[0160] The distribution unit is used to distribute the terminal behavior profile model to each terminal in the cluster, so that each terminal can perform behavior anomaly detection based on the locally distributed terminal behavior profile model.

[0161] In one embodiment, the apparatus further includes:

[0162] The update unit is used to continue updating the current terminal behavior profile model when preset conditions are met; wherein,

[0163] The set conditions indicate that the false negative rate of abnormal behavior corresponding to the current terminal behavior profile model is greater than the first set threshold, and / or the false positive rate of normal behavior corresponding to the current terminal behavior profile model is greater than the second set threshold.

[0164] In practical applications, the receiving unit 501 can be implemented by the communication interface in the behavior profile building device, the adjustment unit 502, the learning unit 503, the encapsulation unit 504, and the update unit can be implemented by the processor in the behavior profile building device, and the distribution unit can be implemented by the processor in the behavior profile building device in combination with the communication interface.

[0165] It should be noted that the behavior profiling device provided in the above embodiments is only illustrated by the division of the above-described program modules when constructing behavior profiles. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the behavior profiling device and the behavior profiling method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0166] To implement the method of the embodiments of this application, the embodiments of this application also provide a behavior profile construction apparatus, such as... Figure 6 As shown, the device includes:

[0167] The reporting unit 601 is used to report local behavior data to the server; to instruct the server to perform correlation analysis on the behavior data of each terminal received, to obtain the process behavior data required for process behavior baseline learning, and finally to obtain a terminal behavior profile model suitable for the cluster.

[0168] The detection unit 602 is used to detect abnormal behavior of the terminal based on the terminal behavior profile model.

[0169] In one embodiment, the detection unit 602 is used for:

[0170] Receive the terminal behavior profile model sent by the server;

[0171] Anomaly detection is performed on local abnormal behavior based on the received terminal behavior profile model.

[0172] In practical applications, the reporting unit 601 can be implemented by the communication interface in the behavior profile building device, and the detection unit 602 can be implemented by the processor in the behavior profile building device.

[0173] It should be noted that the behavior profiling device provided in the above embodiments is only illustrated by the division of the above-described program modules when constructing behavior profiles. In actual applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the device can be divided into different program modules to complete all or part of the processing described above. In addition, the behavior profiling device and the behavior profiling method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0174] Based on the hardware implementation of the above program modules, and in order to implement the behavior profile construction method of the embodiments of this application, the embodiments of this application also provide an electronic device. Figure 7 This is a schematic diagram of the hardware structure of the electronic device according to an embodiment of this application, as shown below. Figure 7 As shown, the electronic device includes:

[0175] Communication interface 1 enables information exchange with other devices, such as network devices;

[0176] Processor 2 is connected to communication interface 1 to enable information interaction with other devices and to execute the methods provided by one or more of the above-mentioned technical solutions when running computer programs. The computer program is stored in memory 3.

[0177] Of course, in practical applications, the various components in an electronic device are coupled together through bus system 4. It can be understood that bus system 4 is used to achieve communication and connection between these components. In addition to the data bus, bus system 4 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 7 The general will label all buses as Bus System 4.

[0178] The memory 3 in this embodiment is used to store various types of data to support the operation of the electronic device. Examples of such data include any computer program used to operate on the electronic device.

[0179] It is understood that memory 3 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 2 described in the embodiments of this application is intended to include, but is not limited to, these and any other suitable types of memory.

[0180] The methods disclosed in the embodiments of this application can be applied to processor 2, or implemented by processor 2. Processor 2 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 2 or by instructions in the form of software. The processor 2 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 2 can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or being executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, which is located in memory 3. Processor 2 reads the program in memory 3 and completes the steps of the aforementioned method in combination with its hardware.

[0181] When processor 2 executes the program, it implements the corresponding processes in the various methods of the embodiments of this application. For the sake of brevity, these will not be described in detail here.

[0182] In an exemplary embodiment, this application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, such as a memory 3 that stores a computer program, which can be executed by a processor 2 to complete the steps described in the aforementioned method. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disc, or CD-ROM.

[0183] In the several embodiments provided in this application, it should be understood that the disclosed apparatus, electronic devices, and methods can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components may be combined, or integrated into another system, or some features may be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed may be through some interfaces, and the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0184] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0185] In addition, each functional unit in the various embodiments of this application can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0186] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0187] Alternatively, if the integrated units described above are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0188] It is understood that user information is involved in the embodiments of this application. When the embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0189] It should be noted that the technical solutions described in the embodiments of this application can be combined arbitrarily without conflict. Unless otherwise stated and limited, the term "connection" should be interpreted broadly. For example, it can refer to an electrical connection, or the internal connection between two components. It can be a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can understand the specific meaning of the above term according to the specific circumstances.

[0190] Furthermore, in the examples of this application, "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the objects distinguished by "first," "second," and "third" can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in a sequence other than those illustrated or described herein.

[0191] In this document, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent three cases: A alone, A and B simultaneously, and B alone. Additionally, the term "at least one" in this document means any combination of at least two of any one or more of a plurality of elements. For example, including at least one of A, B, and C can mean including any one or more elements selected from the set consisting of A, B, and C.

[0192] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0193] The specific technical features described in the various embodiments in the detailed implementation can be combined in various ways without contradiction. For example, different implementation methods can be formed by combining different specific technical features. In order to avoid unnecessary repetition, the various possible combinations of the specific technical features in this application will not be described separately.

Claims

1. A behavior profile construction method characterized by, Applied to a server, the method comprises: Receiving behavior data reported by each of at least two terminals in a cluster; For each process, correlating the behavior data of the process on each terminal, and adjusting each behavior data used to learn the behavior baseline of the process; wherein, from the behavior data of the process on each terminal, a feature capable of determining whether the behavior data of the process is normal behavior data is extracted, and a feature baseline corresponding to the feature is set; based on the feature corresponding to the process and the corresponding feature baseline, behavior data required to learn the behavior baseline of the process is screened out from the behavior data of the process on each terminal; Learning the behavior baseline of each process based on the adjusted behavior data; Packaging the learned behavior baseline of each process to obtain a terminal behavior portrait model applicable to the cluster; wherein, according to different process types, the corresponding behavior baseline is stored in the terminal behavior portrait model of the corresponding process type; Distributing the terminal behavior portrait model corresponding to each terminal in the cluster to each terminal in the cluster, so that each terminal performs behavior anomaly detection on local abnormal behavior based on the locally distributed terminal behavior portrait model.

2. The method of claim 1, wherein, The packaging of the learned behavior baseline of each process to obtain a terminal behavior portrait model applicable to the cluster comprises: Determining the process type; According to different process types, the corresponding behavior baseline is stored in the terminal behavior portrait model of the corresponding process type; wherein, The process type comprises one of the following: System process; Key business process; Other business process; The terminal behavior portrait model comprises one of the following: System process behavior portrait model; Key business process behavior portrait model; Other business process behavior portrait model.

3. The method of claim 1, wherein, The method further comprises: In the case of meeting the set condition, the current terminal behavior portrait model is continuously updated; wherein, The set condition represents that the false negative rate of the abnormal behavior corresponding to the current terminal behavior portrait model is greater than a first set threshold, and / or the false positive rate of the normal behavior corresponding to the current terminal behavior portrait model is greater than a second set threshold.

4. A behavior profile construction method characterized by, Applied to a terminal in a cluster, the method comprises: Reporting local behavior data to a server; to instruct the server to correlate the received behavior data of each terminal, obtain process behavior data required for process behavior baseline learning, and store the corresponding behavior baseline in the terminal behavior portrait model of the corresponding process type according to different process types, and finally obtain a terminal behavior portrait model applicable to the cluster; wherein, for each process, the server correlating the received behavior data of each terminal comprises: the server extracts a feature capable of determining whether the behavior data of the process is normal behavior data from the behavior data of the process on each terminal, and sets a feature baseline corresponding to the feature; based on the feature corresponding to the process and the corresponding feature baseline, behavior data required to learn the behavior baseline of the process is screened out from the behavior data of the process on each terminal; Based on the terminal behavior profile model, anomaly detection is performed on the abnormal behavior of the terminal locally; wherein, the terminal behavior profile model corresponding to the terminal is received from the server; and the abnormal behavior of the local terminal is detected based on the received terminal behavior profile model.

5. A behavior profile construction apparatus characterized by comprising: include: The receiving unit is used to receive behavioral data reported by each of at least two terminals in the cluster. An adjustment unit is used to perform correlation analysis on the behavioral data of each process across various terminals for each process, and adjust the behavioral data used to learn the behavioral baseline of the process. Specifically, the adjustment unit is used to extract features from the behavioral data of the process across various terminals that can determine whether the process's behavioral data is normal, and set the feature baseline corresponding to the features. Based on the features and the corresponding feature baseline of the process, the unit filters out the behavioral data required to learn the behavioral baseline of the process from the behavioral data of the process across various terminals. The learning unit is used to learn the behavioral baseline of each process based on the adjusted behavioral data; The encapsulation unit is used to encapsulate the learned behavioral baselines of each process into a terminal behavior profile model suitable for the cluster; wherein, according to different process types, the corresponding behavioral baselines are stored in the terminal behavior profile model of the corresponding process type. The distribution unit is used to distribute the terminal behavior profile model corresponding to each terminal to each terminal in the cluster, so that each terminal can perform behavior anomaly detection on its local abnormal behavior based on the locally distributed terminal behavior profile model.

6. A behavior profile construction apparatus characterized by comprising: include: The reporting unit is used to report local behavior data to the server. The system instructs the server to perform correlation analysis on the received behavioral data from each terminal to obtain the process behavioral data required for learning the process behavioral baseline. Based on different process types, the corresponding behavioral baselines are stored in the corresponding process type's terminal behavioral profile model, ultimately resulting in a terminal behavioral profile model suitable for the cluster. Specifically, for each process, the server's correlation analysis on the received behavioral data from each terminal includes: extracting features from the process's behavioral data across terminals that determine whether the process's behavioral data is normal, and setting the corresponding feature baseline; and based on the process's features and the corresponding feature baseline, filtering out the behavioral data required for learning the process's behavioral baseline from the process's behavioral data across terminals. The detection unit is used to perform anomaly detection on abnormal behavior of the terminal based on the terminal behavior profile model; wherein, it receives the terminal behavior profile model corresponding to the terminal sent by the server; and performs anomaly detection on abnormal behavior of the local terminal based on the received terminal behavior profile model.

7. An electronic device, comprising: include: The processor and the memory used to store computer programs that can run on the processor. When the processor is used to run the computer program, it performs the steps of the method according to any one of claims 1 to 3, or performs the steps of the method according to claim 4.

8. A storage medium having stored thereon a computer program, characterized in that When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 3, or the steps of the method according to claim 4.

Images