Methods, devices, electronic equipment, and readable media for detecting abnormal host states

Abstract

This disclosure provides a method, apparatus, electronic device, and readable medium for detecting abnormal host states. The method includes: determining a process tree set and a process family set based on process characteristic data of the host; determining a process family relationship matrix based on the distances between multiple process families in the process family set; determining the distance between any relationship matrix in the process family relationship matrix and any process family in the process family set; determining a process family within the process family set to which a process tree in the process tree set belongs based on the distance; and determining the abnormal host state based on the tree structure characteristic data and traffic characteristic data of the process trees in the process family set. Through the embodiments of this disclosure, the accuracy, reliability, and timeliness of abnormal process detection are improved.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to a method, apparatus, electronic device, and readable medium for detecting abnormal states of a host computer. Background Technology

[0002] Currently, host abnormal behavior detection and analysis solutions mainly include two categories: network-side intrusion detection and host-side intrusion detection.

[0003] In related technologies, the detection of abnormal processes on a host is usually based on statistical or rule matching techniques, or through protocol analysis and behavioral analysis to detect the behavior of an intruding host.

[0004] However, existing abnormal process detection methods are all based on single-process implementation. Therefore, they cannot detect and analyze encrypted traffic and rely heavily on abnormal process rule bases, making it difficult to detect and alert on unknown threat behaviors.

[0005] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this disclosure is to provide a method, apparatus, electronic device, and readable medium for detecting abnormal host states, which at least to some extent overcomes the problem of low reliability in host abnormality detection due to limitations and defects in related technologies.

[0007] According to a first aspect of the present disclosure, a method for detecting abnormal host states is provided, comprising: determining a process tree set and a process family set based on process characteristic data of the host; determining a process family relationship matrix based on the distance between multiple process families in the process family set; determining the distance between any relationship matrix in the process family relationship matrix and any process family in the process family set; determining a process family in the process family set to which a process tree in the process tree set belongs based on the distance; and determining the abnormal host state based on the tree structure characteristic data and traffic characteristic data of the process tree in the process family.

[0008] In one exemplary embodiment of this disclosure, determining the process tree set and the process family set based on the host's process feature data includes: parsing the process name, process identifier, and parent process identifier contained in the process feature data; determining the parent-child relationship between processes based on the process identifier and the parent process identifier; constructing a process tree with the process name as a node and the parent-child relationship as an edge; summarizing the process trees to generate a process tree set; dividing the process trees in the process tree set into process families according to preset conditions, and summarizing the process families into a process family set.

[0009] In an exemplary embodiment of this disclosure, dividing process trees in a process tree set into process families according to preset conditions and summarizing process families into a process family set includes: determining one process tree in the process tree set as a first process tree; determining another process tree in the process tree set as a second process tree; determining whether the first process tree and the second process tree satisfy a preset condition; if it is determined that the first process tree and the second process tree satisfy a preset condition, then determining that the first process tree and the second process tree belong to the same process tree family, wherein the first preset condition is that the structure of the first process tree includes the structure of the second process tree, the second preset condition is that the structure of the second process tree includes the structure of the first process tree, the third preset condition is that the structure of the first process tree includes the subtree structure of the second process tree after subtracting the last leaf node, and the fourth preset condition is that the structure of the second process tree includes the subtree structure of the first process tree after subtracting the last leaf node.

[0010] In one exemplary embodiment of this disclosure, determining the process family relationship matrix based on the distance between multiple process families in the process family set includes: selecting one process family from the process family set; determining the probability that any process in the process family is the parent process of another process; constructing a process relationship matrix according to the process order and probability in the process family; and traversing the process relationship matrices of all process families in the process family set to determine the process family relationship matrix.

[0011] In an exemplary embodiment of this disclosure, determining the distance between any relation matrix in the process family relation matrix and any process family in the process family set includes: determining a vector component of a relation matrix, denoted as a first vector component; determining a vector component of a process family, denoted as a second vector component; determining the Euclidean distance between the first vector component and the second vector component; and determining the Euclidean distance as the distance between the relation matrix and the process family.

[0012] In one exemplary embodiment of this disclosure, determining a process family in the process family set to which a process tree belongs based on distance includes: determining the minimum value among all Euclidean distances; and determining the process family corresponding to the minimum value as the process family to which the process tree belongs.

[0013] In one exemplary embodiment of this disclosure, determining the abnormal state of a host based on the tree structure feature data and traffic feature data of the process tree in the process family includes: determining the average value of the tree structure feature vector and the distance of the tree structure feature vector from the base value based on the tree structure feature data of the process tree in the process family; determining the average value of the traffic feature vector and the distance of the traffic feature vector from the base value based on the traffic feature data of the process tree in the process family; determining the absolute difference between the tree structure feature data of the process tree and the average value of the tree structure feature vector, denoted as a first difference; determining the absolute difference between the traffic feature data of the process tree and the average value of the traffic feature vector, denoted as a second difference; determining a first magnitude relationship between the first difference and the distance of the tree structure feature vector from the base value, and determining a second magnitude relationship between the second difference and the distance of the traffic feature vector from the base value; and determining the abnormal state of the host based on the determination results of the first magnitude relationship and the second magnitude relationship.

[0014] In an exemplary embodiment of this disclosure, determining the abnormal state of the host based on the judgment results of the first size relationship and the second size relationship includes: if the first difference is determined to be greater than the distance from the tree structure feature vector to the base value, and the second difference is determined to be less than the distance from the traffic feature vector to the base value, then the host is determined to be in an abnormal process startup state; if the first difference is determined to be less than the distance from the tree structure feature vector to the base value, and the second difference is determined to be greater than the distance from the traffic feature vector to the base value, then the host is determined to be in an abnormal network connection state; if the first difference is determined to be greater than the distance from the tree structure feature vector to the base value, and the second difference is determined to be greater than the distance from the traffic feature vector to the base value, then the host is determined to be in an abnormal unknown process state.

[0015] In one exemplary embodiment of this disclosure, determining the average value of the tree structure feature vector and the basic value of the distance between the tree structure feature vectors based on the tree structure feature data of the process trees in the process family includes: normalizing the tree structure feature data of the process trees in the process family; determining the average value of the normalized tree structure feature data and determining the average value of the tree structure feature data as the average value of the tree structure feature vector; determining the Euclidean distance between any two process trees in the process family; and determining the basic value of the distance between the tree structure feature vectors based on the Euclidean distance between the process trees, a first preset baseline adjustment factor, and the number of process trees.

[0016] In one exemplary embodiment of this disclosure, determining the average value of the traffic feature vector and the base value of the distance between the traffic feature vectors based on the traffic feature data of the process trees in the process family includes: determining the traffic feature vectors of the process trees in the process family; normalizing the traffic feature data corresponding to the traffic feature vectors; determining the average value of the normalized traffic feature data and using the average value of the traffic feature data as the average value of the traffic feature vectors; determining the Euclidean distance between the traffic feature vectors of any two process trees in the process family; and determining the base value of the distance between the traffic feature vectors based on the Euclidean distance between the traffic feature vectors, a second preset baseline adjustment factor, and the number of process trees.

[0017] In one exemplary embodiment of this disclosure, determining the traffic feature vector of the process tree in the process family includes: acquiring network traffic data and network connection status data of the host; associating the network traffic data and network connection status data according to local communication attribute information to obtain the host's network connection information, wherein the communication attribute information includes at least one of local IP, local port, external IP, external port and protocol; dividing the network connection information into inbound connection information and outbound connection information according to the connection method; determining the public IP connection information in the network connection information; and determining the traffic feature vector based on the network connection information.

[0018] In one exemplary embodiment of this disclosure, determining the traffic feature vector based on network connection information includes: determining the number of open unknown ports in the process tree based on the network connection information, wherein the unknown ports are not in a preset port whitelist; determining the ratio of outbound to inbound packets and the ratio of outbound to inbound bytes based on inbound connection information and outbound connection information; determining the average network connection duration, average number of packets, packet variance, average number of bytes, and byte variance based on the network connection information; determining the proportion of public IP connections for any port based on the network connection information; and determining the number of open unknown ports, the ratio of outbound to inbound packets, the ratio of outbound to inbound bytes, the average network connection duration, the average number of packets, the packet variance, the average number of bytes, the byte variance, and the proportion of public IP connections as the traffic feature vector.

[0019] According to a second aspect of the present disclosure, a device for detecting abnormal host states is provided, comprising: a determining module, configured to determine a process tree set and a process family set based on process characteristic data of the host; the determining module is further configured to determine a process family relationship matrix based on the distance between multiple process families in the process family set; the determining module is further configured to determine the distance between any relationship matrix in the process family relationship matrix and any process family in the process family set; the determining module is further configured to determine a process family in the process family set to which a process tree in the process tree set belongs based on the distance; and the determining module is further configured to determine the abnormal state of the host based on the tree structure characteristic data and traffic characteristic data of the process tree in the process family.

[0020] According to a third aspect of this disclosure, an electronic device is provided, comprising: a memory; and a processor coupled to the memory, the processor being configured to perform the method as described in any of the foregoing methods based on instructions stored in the memory.

[0021] According to a fourth aspect of this disclosure, a computer-readable storage medium is provided having a program stored thereon that, when executed by a processor, implements a method for detecting a host abnormal state as described in any of the preceding claims.

[0022] In this embodiment of the disclosure, a process family is constructed through the parent-child relationship of processes, and the host running state characteristics are analyzed from the perspective of the process family, which improves the reliability, accuracy and timeliness of the analysis and detection of abnormal host states.

[0023] Furthermore, process families are constructed by analyzing process tree relationships, and the relationships between processes within a family are described using a directed graph. A relationship matrix is ​​used to describe the process family, and the similarity of process families is analyzed based on the relationship matrix. In other words, the anomaly type of the host is determined by multiple process trees and network traffic characteristics in the process family, which improves the accuracy of host anomaly detection.

[0024] Furthermore, by extracting tree structure features such as the total number of nodes, number of process categories, depth and width of the process family relationship tree, as well as network traffic features such as the inbound / outbound traffic ratio, average number of packets and average number of bytes, a process family feature matrix can be constructed. By adding or modifying feature dimensions, the differences in security features in different host environments can be taken into account, enabling adaptation to different host environments and exhibiting strong scalability and adaptability.

[0025] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0026] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0027] Figure 1 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0028] Figure 2 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0029] Figure 3A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0030] Figure 4 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0031] Figure 5 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0032] Figure 6 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0033] Figure 7 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0034] Figure 8 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0035] Figure 9 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0036] Figure 10 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0037] Figure 11 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0038] Figure 12 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0039] Figure 13 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0040] Figure 14 A flowchart illustrating a method for detecting abnormal host states in an exemplary embodiment of this disclosure is shown;

[0041] Figure 15 This is a block diagram of a host abnormal state detection device according to an exemplary embodiment of the present disclosure;

[0042] Figure 16 This is a block diagram of an electronic device according to an exemplary embodiment of the present disclosure. Detailed Implementation

[0043] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided to make this disclosure more comprehensive and complete, and to fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a full understanding of embodiments of this disclosure. However, those skilled in the art will recognize that the technical solutions of this disclosure can be practiced with one or more specific details omitted, or other methods, components, apparatus, steps, etc., can be employed. In other instances, well-known technical solutions are not shown or described in detail to avoid obscuring various aspects of this disclosure.

[0044] Furthermore, the accompanying drawings are merely illustrative of this disclosure, and the same reference numerals in the drawings denote the same or similar parts, thus repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0045] The exemplary embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0046] Figure 1 This is a flowchart of a method for detecting abnormal host states in an exemplary embodiment of this disclosure.

[0047] refer to Figure 1 Methods for detecting abnormal host states may include:

[0048] Step S102: Determine the process tree set and process family set based on the host's process characteristic data.

[0049] In one exemplary embodiment of this disclosure, when performing anomaly detection on a host, the host's netstat records, process records, netflow data, port whitelist, and process whitelist are obtained, but not limited to these. Process characteristic data are determined through several types of data in the above-mentioned operating parameters, and a process tree is constructed based on the parent-child relationship between processes.

[0050] In one exemplary embodiment of this disclosure, a process tree set is obtained by summarizing the process trees, and the process trees in the process tree set are classified and divided into various categories of process families. Then, the host's processes are judged to be abnormal based on the records of the process families. The specific type of abnormal process, the handling strategy, the correlation between abnormal processes, etc. can also be determined by the process families.

[0051] Step S104: Determine the process family relationship matrix based on the distance between multiple process families in the process family set.

[0052] In one exemplary embodiment of this disclosure, the process family relationship matrix is ​​determined by the distance between multiple process families in the process family set, thereby determining the correlation between process families. The process family relationship matrix also determines the probability that multiple processes in the process tree are in a parent-child relationship, that is, it more accurately defines the correlation between processes from a probabilistic perspective.

[0053] Step S106: Determine the distance between any relation matrix in the process family relation matrix and any process family in the process family set.

[0054] In one exemplary embodiment of this disclosure, the distance between any relation matrix in the process family relation matrix and any process family in the process family set is the Euclidean distance. The Euclidean distance is a commonly used distance definition, which refers to the true distance between two points in m-dimensional space, or the natural length of a vector (i.e., the distance from the point to the origin). The Euclidean distance can not only reflect the correlation between process families, but also determine the relevant process families when multiple process families have abnormal processes. Then, the abnormal state and abnormal type of the host process can be determined based on the historical records of the process families.

[0055] Step S108: Determine a process family in the process family set to which the process tree in the process tree set belongs based on the distance.

[0056] Step S110: Determine the abnormal state of the host based on the tree structure feature data and traffic feature data of the process tree in the process family.

[0057] In one exemplary embodiment of this disclosure, a process family is constructed through the parent-child relationship of processes, and the host running state characteristics are analyzed from the perspective of the process family, which improves the reliability, accuracy and timeliness of the analysis and detection of abnormal host states.

[0058] Specifically, process families are constructed by analyzing process tree relationships, and the relationships between processes within a family are described using a directed graph. A relationship matrix is ​​used to describe the process family, and the similarity of process families is analyzed based on the relationship matrix. In other words, the anomaly type of the host is determined by multiple process trees and network traffic characteristics in the process family, which improves the accuracy of host anomaly detection.

[0059] The following is combined with Figures 1 to 14 This document provides a detailed explanation of each step in the method for detecting abnormal host states.

[0060] like Figure 2 As shown, the process tree set and process family set are determined based on the host's process characteristic data, including:

[0061] Step S202: Parse the process name, process identifier, and parent process identifier contained in the process feature data.

[0062] Step S204: Determine the parent-child relationship between processes based on the process identifier and the parent process identifier.

[0063] Step S206: Construct a process tree using process names as nodes and parent-child relationships as edges.

[0064] Step S208: Summarize the process trees to generate a process tree set.

[0065] Step S210: Divide the process trees in the process tree set into process families according to preset conditions, and summarize the process families into a process family set.

[0066] In one exemplary embodiment of this disclosure, the process names of all hosts in the historical samples are obtained, and after deduplication of the process names, a process set P{p1, p2, ... p} is constructed. x} and construct the process tree, specifically including the following steps:

[0067] (1) Enter the process whitelist;

[0068] (2) Input the host process information of the historical samples: name / PID / PPID information, and filter out the processes that appear in the process whitelist;

[0069] (3) Based on PID (process ID) information and PPID (parent process ID) information, construct a process tree with process name as node and process parent-child relationship as edge;

[0070] (4) Traverse the host process data for each day to form a historical process tree set PT_all{pt1, pt2, ... pt n}

[0071] like Figure 3 As shown, the process trees in the process tree set are divided into process families according to preset conditions, and the process families are aggregated into a process family set, including:

[0072] Step S302: Determine one process tree from the process tree set as the first process tree.

[0073] Step S304: Determine another process tree in the process tree set as the second process tree.

[0074] Step S306: Determine whether the first process tree and the second process tree meet a preset condition. If yes, proceed to step S308; otherwise, proceed to step S310.

[0075] Step S308: If it is determined that the first process tree and the second process tree meet a preset condition, then it is determined that the first process tree and the second process tree belong to the same process tree family.

[0076] Step S310: If it is determined that the first process tree and the second process tree meet a preset condition, then it is determined that the first process tree and the second process tree belong to the same process tree family.

[0077] Among them, the first preset condition is that the structure of the first process tree includes the structure of the second process tree; the second preset condition is that the structure of the second process tree includes the structure of the first process tree; the third preset condition is that the structure of the first process tree includes the subtree structure of the second process tree after removing the last leaf node; and the fourth preset condition is that the structure of the second process tree includes the subtree structure of the first process tree after removing the last leaf node.

[0078] In one exemplary embodiment of this disclosure, constructing a process family set specifically includes the following steps:

[0079] (1) Input process tree set PT_all{pt1, pt2, ... pt n};

[0080] (2) Remove duplicates from the process tree structures that are completely identical in PT_all;

[0081] (3) Divide the process families, traverse the process tree set PT_all, and select any two process trees pt that satisfy one of the following conditions. i and pt j Classified into the same process family:

[0082] (3.1)pt i The process tree structure contains pt j Process tree structure;

[0083] (3.1)ptj The process tree structure contains pt i Process tree structure;

[0084] (3.1)pt i The process tree structure contains pt j The subtree obtained by subtracting the last leaf node from the process tree;

[0085] (3.1)pt j The process tree structure contains pt i The subtree obtained by subtracting the last leaf node from the process tree.

[0086] Based on the above steps, we obtain the process family set PF{PF1, PF2, ..., PF}. m Each process family contains several process trees, such as PF1{pt1, pt2, ... pt2}. x}

[0087] like Figure 4 As shown, determining the process family relationship matrix based on the distances between multiple process families in the process family set includes:

[0088] Step S402: Select one process family from the process family set.

[0089] Step S404: Determine the probability that any process in the process family is the parent process of another process.

[0090] Step S406: Construct a process relationship matrix according to the process order and probability in the process family.

[0091] Step S408: Traverse the process relationship matrix of all process families in the process family set to determine the process family relationship matrix.

[0092] In one exemplary embodiment of this disclosure, the specific steps for constructing the process family relationship matrix include:

[0093] (1) Input process family set PF{PF1, PF2, ..., PF m};

[0094] (2) Extract all process trees within the family, such as extracting PF1{pt1, pt2, pt3} from the PF1 family. k , ...pt x};

[0095] (3) Calculate PF k The probability that each process within a family is a parent-child process of other processes, such as in a process tree (pt). k Calculate according to the formula (p i p j∈pt k Construct a relation matrix according to the order of process set P to obtain process family PF. k Relationship matrix E k as follows:

[0096]

[0097] (4) Traverse the process family set PF and calculate the relation matrix set E{E1, E2, ..., E} for each process family. m}

[0098] like Figure 5 As shown, determining the distance between any relation matrix in the process family relation matrix and any process family in the process family set includes:

[0099] Step S502: Determine a vector component of a relation matrix, denoted as the first vector component.

[0100] Step S504: Determine the vector component of a process family, denoted as the second vector component.

[0101] Step S506: Determine the Euclidean distance between the first vector component and the second vector component.

[0102] Step S508: Determine the Euclidean distance as the distance between the relation matrix and the process family.

[0103] In one exemplary embodiment of this disclosure, each relation matrix in relation matrix E′ is sequentially calculated to be related to PF{PF1, PF2, ..., PF}. m The Euclidean distance, E, of each family relation matrix in} k 'and The expression for the Euclidean distance between them is as follows:

[0104]

[0105] Among them, E k ′ ij and Representing relation matrix E respectively k 'and Each vector component.

[0106] like Figure 6 As shown, a process family in the set of process families to which a process tree belongs, determined by distance, includes:

[0107] Step S602: Determine the minimum value among all Euclidean distances.

[0108] Step S604: Determine the process family corresponding to the minimum value as the process family to which the process tree belongs.

[0109] In one exemplary embodiment of this disclosure, The process family PF corresponding to the smallest value k That is, the process tree pt k The process family to which the process tree belongs is determined by Euclidean distance. Then, the host's process anomalies and anomaly types are determined by the characteristic data of the process tree and the security baseline data of the process family.

[0110] like Figure 7 As shown, the abnormal states of a host are determined based on the tree structure characteristics and traffic characteristics of the process tree within a process family, including:

[0111] Step S702: Determine the average value of the tree structure feature vector and the distance base value of the tree structure feature vector based on the tree structure feature data of the process tree in the process family.

[0112] Step S704: Determine the average value of the traffic feature vector and the distance from the traffic feature vector to the base value based on the traffic feature data of the process tree in the process family.

[0113] Step S706: Determine the absolute difference between the tree structure feature data of the process tree and the average value of the tree structure feature vector, and denot it as the first difference.

[0114] Step S708: Determine the absolute difference between the flow characteristic data of the process tree and the average value of the flow characteristic vector, and denot it as the second difference.

[0115] Step S710: Determine the first size relationship between the first difference and the distance of the tree structure feature vector from the base value, and determine the second size relationship between the second difference and the distance of the flow feature vector from the base value.

[0116] Step S712: Determine the abnormal state of the host based on the judgment results of the first size relationship and the second size relationship.

[0117] In one exemplary embodiment of this disclosure, the process family PF is found by determining the process family to which the process tree belongs. k average value of structural feature vectors Tree structure feature vector distance from baseline ΔT, average value of flow feature vector The average distance ΔN of the traffic feature vector is used to determine the abnormal state of the host based on the judgment results of the first and second size relationships.

[0118] like Figure 8 As shown, based on the judgment results of the first and second size relationships, the abnormal states of the host are determined to include:

[0119] Step S802: If the first difference is greater than the distance between the tree structure feature vector and the base value, and the second difference is less than the distance between the traffic feature vector and the base value, then the host is determined to be in an abnormal process startup state.

[0120] Step S804: If the first difference is determined to be less than the distance between the tree structure feature vector and the base value, and the second difference is determined to be greater than the distance between the traffic feature vector and the base value, then the host is determined to be in an abnormal network connection state.

[0121] Step S806: If the first difference is determined to be greater than the distance between the tree structure feature vector and the base value, and the second difference is determined to be greater than the distance between the traffic feature vector and the base value, then the host is determined to be in an abnormal unknown process state.

[0122] In one exemplary embodiment of this disclosure, the process family PF is found by determining the process family to which the process tree belongs. k average value of structural feature vectors Tree structure feature vector distance from baseline ΔT, average value of flow feature vector Average distance ΔN between traffic feature vectors The expression for the first difference. The expression for the second difference, and thus the result of the host anomaly judgment, can be expressed as follows:

[0123] (1) If and This indicates a risk of abnormal process startup on the host, triggering a Level A alarm event.

[0124] (2) If and The host is at risk of a network connection failure, and a level B alarm event is output.

[0125] (3) If and If an unknown process exists on the host, output a level C alarm event.

[0126] Among them, alarm levels A, B and C can be defined by the user according to the application scenario.

[0127] like Figure 9 As shown, the mean value of the tree structure feature vector and the basic value of the distance between the tree structure feature vector and the process tree in the process family are determined based on the tree structure feature data.

[0128] Step S902: Normalize the tree structure feature data of the process tree in the process family.

[0129] In one exemplary embodiment of this disclosure, firstly, the process tree pt is calculated. k The tree structure feature values ​​include:

[0130] (1) The size of the process tree is T_S, and pt is calculated. k The total number of processes included;

[0131] (2) The process tree involves process types T_P, and pt is calculated. k The total number of different process names included;

[0132] (3) Number of process tree levels T_D, number of computation tree levels pt k The number of floors;

[0133] (4) Process tree degree T_W, computation tree pt k In this context, the maximum number of subtrees a node can have is considered the maximum number of subtrees a node possesses.

[0134] Secondly, normalizing the tree structure feature values ​​includes the following steps:

[0135] (1) The size of the process tree T_S = T_S / T_S_MAX, where T_S_MAX = the maximum size of the process tree in the historical process tree set PT_all × 1.1;

[0136] (2) The process tree involves process types T_P = T_P / T_P_MAX, where T_P_MAX = the maximum number of process types involved in the process tree in the historical process tree set PT_all × 1.1;

[0137] (3) The number of process tree levels T_D = T_D / T_D_MAX, where T_D_MAX = the maximum number of process tree levels in the historical process tree set PT_all × 1.1;

[0138] (4) Process tree degree T_W = T_W / T_W_MAX, where T_W_MAX = the maximum process tree degree in the historical process tree set PT_all × 1.1;

[0139] Finally, the tree structure feature values ​​are normalized to form the tree structure feature vector, denoted as T[T_S, T_P, T_D, T_W].

[0140] Step S904: Determine the average value of the normalized tree structure feature data, and set the average value of the tree structure feature data as the average value of the tree structure feature vector.

[0141] In one exemplary embodiment of this disclosure, the average value of the features is calculated:

[0142]

[0143] Step S906: Determine the Euclidean distance between any two process trees in the process family.

[0144] In one exemplary embodiment of this disclosure, the Euclidean distance between each relation tree according to the tree structure feature vector is calculated as follows:

[0145]

[0146] Among them, T1 k and T2 k These represent the vector components of eigenvectors T1 and T2, respectively.

[0147] Step S908: Determine the basic value of the distance between the tree structure feature vectors based on the Euclidean distance between the process trees, the first preset baseline adjustment factor, and the number of process trees.

[0148] In one exemplary embodiment of this disclosure, determining the basic value of the distance between the tree structure feature vectors includes the following steps:

[0149] (3) Calculate the distance of process family PF1 from the baseline. as follows:

[0150]

[0151] (4) The first preset baseline adjustment factor α can be set to 1.1 and can be adjusted according to the application environment;

[0152] (5) Traverse process families (PF) and calculate the distance to the baseline for each process family. That is, the distance between the feature vectors of the tree structure and the basic value.

[0153] like Figure 10 As shown, the average value of the traffic feature vector and the base value of the distance between the traffic feature vector and the process tree in the process family are determined based on the traffic feature data, including:

[0154] Step S1002: Determine the traffic feature vector of the process tree in the process family.

[0155] In one exemplary embodiment of this disclosure, obtaining the process tree traffic characteristics of a host includes:

[0156] (1) Calculate the number of unknown open ports N_U, and calculate the number of open ports of all processes contained in the process tree that are not in the port whitelist;

[0157] (2) Calculate the inbound and outbound traffic ratio of the process port, including the ratio of outbound to inbound packet count N_X1 and the ratio of outbound to inbound byte count N_X2;

[0158] (3) Calculate connection traffic characteristics, including average network connection duration N_C1, average number of packets N_C2, packet number variance N_C3, average number of bytes N_C4 and byte number variance N_C5;

[0159] (4) Calculate the proportion of public IP connections among the IPs connected to the corresponding port, i.e., the public IP connection ratio N_P.

[0160] Step S1004: Normalize the traffic feature data corresponding to the traffic feature vector.

[0161] In one exemplary embodiment of this disclosure, the specific steps of normalization are as follows:

[0162] (1) The number of unknown open ports N_U = N_U / N_U_MAX, where N_U_MAX = the maximum number of unknown open ports in the process tree set PT_all × 1.1;

[0163] (2) The ratio of inbound and outbound packet counts N_X1 = N_X1 / N_X1_MAX, and the ratio of inbound and outbound byte counts N_X2 = N_X2 / N_X2_MAX, where N_X1_MAX = the maximum value of the ratio of inbound and outbound packet counts in the historical process tree set PT_all × 1.1, and N_X2_MAX = the maximum value of the ratio of inbound and outbound byte counts in the historical process tree set PT_all × 1.1;

[0164] (3) The characteristics of connection traffic are calculated as follows:

[0165] (3.1) N_C1 = N_C1 / N_C1_MAX;

[0166] (3.2) N_C2 = N_C2 / N_C2_MAX;

[0167] (3.3) N_C3 = N_C3 / N_C3_MAX;

[0168] (3.4) N_C4 = N_C4 / N_C4_MAX;

[0169] (3.5) N_C5 = N_C5 / N_C5_MAX,

[0170] Where N_C1 / N_C2 / N_C3 / N_C4 / N_C5 = the maximum value of process trees N_C1 / N_C2 / N_C3 / N_C4 / N_C5 in the historical process tree set PT_all × 1.1;

[0171] (4) After normalizing the process family traffic feature values, a traffic feature vector N[N_U, N_X1, N_X2, N_C1, N_C2, N_C3, N_C4, N_C5, N_P] is formed.

[0172] Step S1006: Determine the average value of the normalized flow characteristic data, and set the average value of the flow characteristic data as the average value of the flow characteristic vector.

[0173] In one exemplary embodiment of this disclosure, the average value of the process family traffic feature vector is calculated. The steps include:

[0174] (1) Input the normalized process family process tree PF1{pt1, pt2, ... pt m The corresponding flow feature vector is as follows:

[0175]

[0176] (2) Calculate the characteristic average:

[0177]

[0178] (3) Traverse the historical process family set PF and calculate the average value of the traffic feature vector of each process family according to the above formula;

[0179] (4) Calculate the average distance ΔN of the process family flow feature vector.

[0180] Step S1008: Determine the Euclidean distance between the flow feature vectors of any two process trees in the process family.

[0181] In one exemplary embodiment of this disclosure, the process tree PF1{pt1, pt2, ... pt1} of the input process family PF1 is... m The corresponding flow feature vectors, such as flow feature vector N1 and flow feature vector N2 for any two process trees, are used to calculate their Euclidean distance according to the following formula:

[0182]

[0183] Among them, N1 k N2 k These represent the vector components of eigenvectors N1 and N2.

[0184] Step S1010: Determine the basic value of the distance between the traffic feature vectors based on the Euclidean distance between the traffic feature vectors, the second preset baseline adjustment factor, and the number of process trees.

[0185] In one exemplary embodiment of this disclosure, the computation process family PF1 is distance from the baseline. as follows:

[0186]

[0187] Where β is the baseline adjustment factor, which is set to 1.1 by default and can be adjusted according to the application environment;

[0188] (7) Traverse the distance baselines of process families PF to determine the distance baseline for each family. That is, the distance between the traffic feature vector and the base value.

[0189] like Figure 11 As shown, the traffic feature vector for determining the process tree within a process family includes:

[0190] Step S1102: Obtain network traffic data and network connection status data of the host.

[0191] Step S1104: Associate network traffic data and network connection status data according to local communication attribute information to obtain the host's network connection information. The communication attribute information includes at least one of local IP, local port, external IP, external port, and protocol.

[0192] Step S1106: Divide the network connection information into inbound connection information and outbound connection information according to the connection method.

[0193] Step S1108: Determine the public IP connection information in the network connection information.

[0194] Step S1110: Determine the traffic feature vector based on the network connection information.

[0195] like Figure 12 As shown, determining the traffic feature vector based on network connectivity information includes:

[0196] Step S1202: Determine the number of open unknown ports in the process tree based on network connection information, and ensure that the unknown ports are not in the preset port whitelist.

[0197] Step S1204: Determine the ratio of outbound to inbound packets and the ratio of outbound to inbound bytes based on the inbound connection information and the outbound connection information.

[0198] Step S1206: Determine the average network connection duration, average number of packets, packet number variance, average number of bytes, and byte number variance based on the network connection information.

[0199] Step S1208: Determine the percentage of public IP connections for any port based on network connection information.

[0200] Step S1210: The number of open unknown ports, the ratio of outbound to inbound packets, the ratio of outbound to inbound bytes, the average network connection duration, the average number of packets, the packet variance, the average number of bytes, the byte variance, and the proportion of public IP connections are determined as traffic feature vectors.

[0201] like Figure 13 As shown, this disclosure also provides a method for detecting abnormal host states, which further includes:

[0202] Step S1302: Input sample data.

[0203] In one exemplary embodiment of this disclosure, the process data of the host to be analyzed on that day includes:

[0204] (1) Input the host netstat (connection status) record and extract the local IP / local port / external IP / external port / connection status / PID;

[0205] (2) Input the host process record and extract the host process name / PID / PPID;

[0206] (3) Input network Netflow (connection traffic) data and extract local IP / local port / external IP / external port / protocol / packet count / byte count, etc.

[0207] Step S1304, Feature extraction.

[0208] In one exemplary embodiment of this disclosure, a process tree set PT of the host to be analyzed is constructed. all ′{pt1,pt2,…pt n}

[0209] In one exemplary embodiment of this disclosure, the computation process tree set PT all The process family PF to which each process tree belongs. all '{PF1, PF2, ... PF n}

[0210] In one exemplary embodiment of this disclosure, the computation process tree set PT all The tree structure feature vector T′ and the flow feature vector N′ of each process tree in the process tree are given.

[0211] Step S1306: Calculate the process family security baseline.

[0212] In one exemplary embodiment of this disclosure, the computation process tree set PT all ′{pt1,pt2,…pt n The relation matrix E′{E′1, E′2, ..., E′} for each process tree in} n ′}.

[0213] In one exemplary embodiment of this disclosure, each relation matrix in E′ is sequentially calculated to be related to PF{PF1, PF2, ..., PF}. m The Euclidean distance of each family relationship matrix support in} will be E k 'and The distance between them is denoted as:

[0214]

[0215] Among them, E k′ ij , Represents the relation matrix E k 'and The vector components.

[0216] Step S1308: Output the model results, that is, determine the process family of the host's process tree.

[0217] like Figure 14 As shown, this disclosure also provides a method for detecting abnormal host states, which further includes:

[0218] Step S1402: Input the host process data to be analyzed.

[0219] Step S1404: Perform feature calculation.

[0220] Step S1406: Perform abnormal host identification.

[0221] In one exemplary embodiment of this disclosure, The process family corresponding to the minimum value is the process family to which the host's process tree belongs, denoted as the target process family.

[0222] In one exemplary embodiment of this disclosure, a target process family PF is determined. k average value of structural feature vectors Tree structure feature vector distance from baseline ΔT, average value of flow feature vector Average distance ΔN of traffic feature vectors.

[0223] In one exemplary embodiment of this disclosure, the host abnormality judgment result includes, but is not limited to, the following:

[0224] if and This indicates a risk of abnormal process startup on the host, triggering a Level A alarm event.

[0225] if and The host is at risk of a network connection failure, and a level B alarm event is output.

[0226] if and If an unknown process exists on the host, output a level C alarm event;

[0227] Alarm levels A, B, and C can be defined according to the application scenario.

[0228] Corresponding to the above method embodiments, this disclosure also provides a host abnormal state detection device, which can be used to execute the above method embodiments.

[0229] Figure 15 This is a block diagram of a host abnormal state detection device according to an exemplary embodiment of the present disclosure.

[0230] refer to Figure 15 The host abnormal state detection device 1500 may include:

[0231] The determination module 1502 is used to determine the process tree set and the process family set based on the process characteristic data of the host.

[0232] The determination module 1502 is also used to determine the process family relationship matrix based on the distance between multiple process families in the process family set.

[0233] The determination module 1502 is also used to determine the distance between any relation matrix in the process family relation matrix and any process family in the process family set.

[0234] The determination module 1502 is also used to determine, based on distance, a process family in the process family set to which the process tree in the process tree set belongs.

[0235] The determination module 1502 is also used to determine the abnormal state of the host based on the tree structure feature data and traffic feature data of the process tree in the process family.

[0236] In one exemplary embodiment of this disclosure, the determining module 1502 is further configured to: parse the process name, process identifier, and parent process identifier contained in the process feature data; determine the parent-child relationship between processes based on the process identifier and the parent process identifier; construct a process tree with the process name as a node and the parent-child relationship as an edge; summarize the process trees to generate a process tree set; divide the process trees in the process tree set into process families according to preset conditions, and summarize the process families into a process family set.

[0237] In an exemplary embodiment of this disclosure, the determining module 1502 is further configured to: determine one process tree in the process tree set as a first process tree; determine another process tree in the process tree set as a second process tree; determine whether the first process tree and the second process tree satisfy a preset condition; if it is determined that the first process tree and the second process tree satisfy a preset condition, then determine that the first process tree and the second process tree belong to the same process tree family, wherein the first preset condition in the preset condition is that the structure of the first process tree includes the structure of the second process tree, the second preset condition in the preset condition is that the structure of the second process tree includes the structure of the first process tree, the third preset condition in the preset condition is that the structure of the first process tree includes the subtree structure of the second process tree after subtracting the last leaf node, and the fourth preset condition in the preset condition is that the structure of the second process tree includes the subtree structure of the first process tree after subtracting the last leaf node.

[0238] In one exemplary embodiment of this disclosure, the determining module 1502 is further configured to: select a process family from the process family set; determine the probability that any process in the process family is the parent process of another process; construct a process relationship matrix according to the process order and probability in the process family; and traverse the process relationship matrices of all process families in the process family set to determine the process family relationship matrix.

[0239] In an exemplary embodiment of this disclosure, the determining module 1502 is further configured to: determine a vector component of a relation matrix, denoted as a first vector component; determine a vector component of a process family, denoted as a second vector component; determine the Euclidean distance between the first vector component and the second vector component; and determine the Euclidean distance as the distance between the relation matrix and the process family.

[0240] In one exemplary embodiment of this disclosure, the determining module 1502 is further configured to: determine the minimum value among all Euclidean distances; and determine the process family corresponding to the minimum value as the process family to which the process tree belongs.

[0241] In an exemplary embodiment of this disclosure, the determining module 1502 is further configured to: determine the average value of the tree structure feature vector and the distance from the tree structure feature vector to the base value based on the tree structure feature data of the process tree in the process family; determine the average value of the traffic feature vector and the distance from the traffic feature vector to the base value based on the traffic feature data of the process tree in the process family; determine the absolute difference between the tree structure feature data of the process tree and the average value of the tree structure feature vector, denoted as a first difference; determine the absolute difference between the traffic feature data of the process tree and the average value of the traffic feature vector, denoted as a second difference; determine a first magnitude relationship between the first difference and the distance from the tree structure feature vector to the base value, and determine a second magnitude relationship between the second difference and the distance from the traffic feature vector to the base value; and determine the abnormal state of the host based on the determination results of the first magnitude relationship and the second magnitude relationship.

[0242] In an exemplary embodiment of this disclosure, the determining module 1502 is further configured to: determine that the host is in an abnormal process startup state if the first difference is determined to be greater than the distance from the tree structure feature vector to the base value and the second difference is determined to be greater than the distance from the traffic feature vector to the base value; determine that the host is in an abnormal network connection state if the first difference is determined to be greater than the distance from the tree structure feature vector to the base value and the second difference is determined to be greater than the distance from the traffic feature vector to the base value; and determine that the host is in an abnormal unknown process state if the first difference is determined to be greater than the distance from the tree structure feature vector to the base value and the second difference is determined to be greater than the distance from the traffic feature vector to the base value.

[0243] In an exemplary embodiment of this disclosure, the determining module 1502 is further configured to: normalize the tree structure feature data of the process trees in the process family; determine the average value of the normalized tree structure feature data, and determine the average value of the tree structure feature data as the average value of the tree structure feature vector; determine the Euclidean distance between any two process trees in the process family; and determine the basic value of the tree structure feature vector distance based on the Euclidean distance between the process trees, the first preset baseline adjustment factor, and the number of process trees.

[0244] In an exemplary embodiment of this disclosure, the determining module 1502 is further configured to: determine the traffic feature vector of the process tree in the process family; normalize the traffic feature data corresponding to the traffic feature vector; determine the average value of the normalized traffic feature data, and determine the average value of the traffic feature data as the average value of the traffic feature vector; determine the Euclidean distance between the traffic feature vectors of any two process trees in the process family; and determine the basic value of the distance between the traffic feature vectors based on the Euclidean distance between the traffic feature vectors, the second preset baseline adjustment factor, and the number of process trees.

[0245] In one exemplary embodiment of this disclosure, the determining module 1502 is further configured to: acquire network traffic data and network connection status data of the host; associate the network traffic data and network connection status data according to local communication attribute information to obtain the host's network connection information, wherein the communication attribute information includes at least one of local IP, local port, external IP, external port and protocol; divide the network connection information into inbound connection information and outbound connection information according to the connection method; determine the public IP connection information in the network connection information; and determine the traffic feature vector based on the network connection information.

[0246] In an exemplary embodiment of this disclosure, the determining module 1502 is further configured to: determine the number of open unknown ports in the process tree based on network connection information, wherein the unknown ports are not in a preset port whitelist; determine the ratio of outbound to inbound packets and the ratio of outbound to inbound bytes based on inbound connection information and outbound connection information; determine the average network connection duration, average number of packets, packet variance, average number of bytes, and byte variance based on network connection information; determine the proportion of public IP connections for any port based on network connection information; and determine the number of open unknown ports, the ratio of outbound to inbound packets, the ratio of outbound to inbound bytes, the average network connection duration, the average number of packets, the packet variance, the average number of bytes, the byte variance, and the proportion of public IP connections as a traffic feature vector.

[0247] Since the functions of the apparatus 1500 have been described in detail in their respective method embodiments, they will not be repeated here.

[0248] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0249] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0250] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely hardware implementations, entirely software implementations (including firmware, microcode, etc.), or implementations combining hardware and software aspects, collectively referred to herein as “circuits,” “modules,” or “systems.”

[0251] The following reference Figure 16 To describe an electronic device 1600 according to this embodiment of the present invention. Figure 16 The electronic device 1600 shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0252] like Figure 16 As shown, the electronic device 1600 is manifested in the form of a general-purpose computing device. The components of the electronic device 1600 may include, but are not limited to: at least one processing unit 1610, at least one storage unit 1620, and a bus 1630 connecting different system components (including storage unit 1620 and processing unit 1610).

[0253] The storage unit stores program code that can be executed by the processing unit 1610, causing the processing unit 1610 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present invention. For example, the processing unit 1610 can perform the method shown in the embodiments of this disclosure.

[0254] Storage unit 1620 may include readable media in the form of volatile storage units, such as random access memory (RAM) 16201 and / or cache memory 16202, and may further include read-only memory (ROM) 16203.

[0255] Storage unit 1620 may also include a program / utility 16204 having a set (at least one) program module 16205, such program module 16205 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0256] Bus 1630 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0257] Electronic device 1600 can also communicate with one or more external devices 1640 (e.g., keyboard, pointing device, Bluetooth device, etc.), one or more devices that enable a user to interact with electronic device 1600, and / or any device that enables electronic device 1600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 1650. Furthermore, electronic device 1600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1660. As shown, network adapter 1660 communicates with other modules of electronic device 1600 via bus 1630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0258] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0259] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section of this specification.

[0260] The program product for implementing the above-described method according to embodiments of the present invention may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, the readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0261] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0262] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0263] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0264] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0265] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0266] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and concept of this disclosure are indicated by the claims.

Claims

1. A method of detecting a host abnormal state, characterized by, The method comprises: determining a process tree set and a process family set according to process feature data of a host; determining a process family relationship matrix according to distances between multiple process families in the process family set, comprising: determining a process family in the process family set; determining a probability that any process in the process family is a parent process of another process; constructing a process relationship matrix according to process orders and probabilities in the process family; traversing process relationship matrices of all process families in the process family set to determine the process family relationship matrix; determining a distance between any relationship matrix in the process family relationship matrix and any process family in the process family set, comprising: determining a vector component of one of the relationship matrices, denoted as a first vector component; determining a vector component of one of the process families, denoted as a second vector component; determining an Euclidean distance between the first vector component and the second vector component; determining the Euclidean distance as the distance between the relationship matrix and the process family; determining a process family in the process family set to which a process tree in the process tree set belongs according to the distance; determining an abnormal state of the host according to tree structure feature data and traffic feature data of process trees in the process family, comprising: determining a tree structure feature vector average value and a tree structure feature vector distance base value according to the tree structure feature data of the process trees in the process family; determining a traffic feature vector average value and a traffic feature vector distance base value according to the traffic feature data of the process trees in the process family; determining an absolute difference value between the tree structure feature data of the process tree and the tree structure feature vector average value, denoted as a first difference value; determining an absolute difference value between the traffic feature data of the process tree and the traffic feature vector average value, denoted as a second difference value; judging a first size relationship between the first difference value and the tree structure feature vector distance base value, and judging a second size relationship between the second difference value and the traffic feature vector distance base value; determining the abnormal state of the host according to a judgment result of the first size relationship and the second size relationship.

2. The method of claim 1, wherein the host exception state is detected by: Determining a process tree set and the process family set according to process feature data of a host comprises: parsing process names, process identifiers, and parent process identifiers contained in the process feature data; determining parent-child relationships between processes according to the process identifiers and the parent process identifiers; constructing a process tree with the process names as nodes and the parent-child relationships as edges; summarizing the process tree to generate a process tree set; dividing process trees in the process tree set into process families according to preset conditions, and summarizing the process families into the process family set.

3. The method of claim 2, wherein the host exception state is detected by: Dividing process trees in the process tree set into process families according to preset conditions, and summarizing the process families into the process family set comprises: determining one of the process trees in the process tree set as a first process tree; determining another of the process trees in the process tree set as a second process tree; judging whether the first process tree and the second process tree satisfy one of the preset conditions; If it is determined that the first process tree and the second process tree satisfy a preset condition, it is determined that the first process tree and the second process tree belong to a same process tree family, wherein a first preset condition in the preset condition is that a structure of the first process tree comprises a structure of the second process tree, a second preset condition in the preset condition is that the structure of the second process tree comprises the structure of the first process tree, a third preset condition in the preset condition is that the structure of the first process tree comprises a sub-tree structure of the second process tree excluding a last leaf node, and a fourth preset condition in the preset condition is that the structure of the second process tree comprises a sub-tree structure of the first process tree excluding the last leaf node.

4. The method of claim 1, wherein the host exception state is detected by: Determining the process family to which the process tree belongs from the process family set according to the distance comprises: determining a minimum value in all the Euclidean distances; determining the process family corresponding to the minimum value as the process family to which the process tree belongs.

5. The method of claim 1, wherein the host exception state is detected by: Determining the abnormal state of the host according to the determination results of the first size relationship and the second size relationship comprises: if it is determined that the first difference value is greater than the tree structure feature vector distance base value and it is determined that the second difference value is less than the traffic feature vector distance base value, it is determined that the host is in an abnormal process start state; if it is determined that the first difference value is less than the tree structure feature vector distance base value and it is determined that the second difference value is greater than the traffic feature vector distance base value, it is determined that the host is in an abnormal network connection state; if it is determined that the first difference value is greater than the tree structure feature vector distance base value and it is determined that the second difference value is greater than the traffic feature vector distance base value, it is determined that the host is in an abnormal unknown process state.

6. The method of claim 1, wherein the host exception state is detected by: Determining a tree structure feature vector average value and a tree structure feature vector distance base value according to the tree structure feature data of the process trees in the process family comprises: normalizing the tree structure feature data of the process trees in the process family; determining an average value of the normalized tree structure feature data, and determining the average value of the tree structure feature data as the tree structure feature vector average value; determining the Euclidean distance between any two process trees in the process family; determining the tree structure feature vector distance base value according to the Euclidean distance between the process trees, a first preset baseline adjustment factor, and the number of process trees.

7. The method of claim 1, wherein the host exception state is detected by: Determining a traffic feature vector average value and a traffic feature vector distance base value according to the traffic feature data of the process trees in the process family comprises: determining the traffic feature vector of the process trees in the process family; normalizing the traffic feature data corresponding to the traffic feature vector; determining an average value of the normalized traffic feature data, and determining the average value of the traffic feature data as the traffic feature vector average value; determining the Euclidean distance between the traffic feature vectors of any two process trees in the process family; determining the traffic feature vector distance base value according to the Euclidean distance between the traffic feature vectors, a second preset baseline adjustment factor, and the number of process trees.

8. The method of detecting a host exception state according to claim 7, wherein, Determining a traffic feature vector of a process tree in the process family comprises: Obtaining network traffic data and network connection state data of the host; Associating the network traffic data and the network connection state data according to local communication attribute information to obtain network connection information of the host, the communication attribute information comprising at least one of local IP, local port, external IP, external port and protocol; Dividing the network connection information into inbound connection information and outbound connection information according to connection modes; Determining public network IP connection information in the network connection information; Determining the traffic feature vector according to the network connection information.

9. The method of claim 8, wherein the host exception state is detected by: Determining the traffic feature vector according to the network connection information comprises: Determining the number of open unknown ports in the process tree according to the network connection information, the unknown ports not belonging to a preset port whitelist; Determining an outbound / inbound packet number ratio and an outbound / inbound byte ratio according to the inbound connection information and the outbound connection information; Determining an average network connection duration, an average packet number, a packet number variance, an average byte number and a byte number variance according to the network connection information; Determining a public network IP connection proportion of any port according to the network connection information; Determining the number of open unknown ports, the outbound / inbound packet number ratio, the outbound / inbound byte ratio, the average network connection duration, the average packet number, the packet number variance, the average byte number, the byte number variance and the public network IP connection proportion as the traffic feature vector.

10. A device for detecting abnormal states of a host computer, characterized in that, Comprise: A determining module configured to determine a process tree set and a process family set according to process feature data of a host; The determining module is further configured to determine a process family relationship matrix according to distances between a plurality of process families in the process family set, comprising: Determining a process family in the process family set; Determining a probability that any process in the process family is a parent process of another process; Constructing a process relationship matrix according to process orders and probabilities in the process family; Traversing process relationship matrices of all process families in the process family set to determine the process family relationship matrix; The determining module is further configured to determine a distance between any relationship matrix in the process family relationship matrix and any process family in the process family set; The determining module is further configured to determine a process family in the process family set to which a process tree in the process tree set belongs according to the distance, comprising: Determining a vector component of a relationship matrix, denoted as a first vector component; Determining a vector component of a process family, denoted as a second vector component; Determining an Euclidean distance between the first vector component and the second vector component; Determining the Euclidean distance as the distance between the relationship matrix and the process family; The determining module is further configured to determine an abnormal state of the host according to tree structure feature data and traffic feature data of a process tree in the process family, comprising: determining a tree structure feature vector mean value and a tree structure feature vector distance base value according to the tree structure feature data of the process trees in the process family; determining a flow feature vector mean value and a flow feature vector distance base value according to the flow feature data of the process trees in the process family; determining an absolute difference value between the tree structure feature data of the process tree and the tree structure feature vector mean value, denoted as a first difference value; determining an absolute difference value between the flow feature data of the process tree and the flow feature vector mean value, denoted as a second difference value; judging a first size relationship between the first difference value and the tree structure feature vector distance base value, and judging a second size relationship between the second difference value and the flow feature vector distance base value; determining an abnormal state of the host according to the judging results of the first size relationship and the second size relationship.

11. An electronic device, comprising: comprise: a memory; and a processor coupled to the memory, the processor configured to execute a method for detecting an abnormal state of a host based on instructions stored in the memory, as claimed in any one of claims 1-9.

12. A computer readable storage medium having stored thereon a program which, when executed by a processor, implements a method for detecting an abnormal state of a host, as claimed in any one of claims 1-9.

Images