Abnormal process detection method, device, equipment and medium

Abstract

The present application relates to an abnormal process detection method, device, equipment and medium, the method comprising: obtaining a target process tree constructed based on a generation relationship between multiple processes; the target process tree includes process nodes; there is a generation relationship between two process nodes on the same edge in the target process tree; each process node in the target process tree is matched with a process node in a pre-built abnormal process tree library to obtain a matched abnormal process node; preliminary abnormality detection of the target process tree based on the connectivity between the abnormal process nodes; in the case of preliminary detection of abnormality in the target process tree, mapping the process behavior characteristics corresponding to the abnormal process node to obtain the attack stage corresponding to the abnormal process node; according to the attack stage corresponding to each abnormal process node in the target process tree, advanced abnormality detection is performed on the target process tree to obtain an abnormality detection result for the target process tree. The method can improve the accuracy of abnormal process detection.

Description

Technical Field

[0001] The present application relates to computer technology, and more particularly to the field of data security, and in particular to an abnormal process detection method, device, equipment and medium. Background Art

[0002] With the development of computer technology, abnormal process detection technology has emerged. Abnormal process detection refers to the technology of abnormal detection of processes received by computer devices. For example, there are many important data stored on the cloud host. We need to perform abnormal detection on the processes received by the cloud host and intervene in the detected abnormal processes to prevent the occurrence of security risk events such as virus propagation, vulnerability exploitation and data leakage, so as to ensure the security of data on the cloud host.

[0003] In traditional technology, single-point detection is usually used, that is, based on the process data of a single process, whether the process is abnormal is detected, which is easy to cause false alarms or omissions in detection, resulting in low detection accuracy. Summary of the invention

[0004] Based on this, it is necessary to provide an abnormal process detection method, device, equipment and medium that can improve the accuracy of abnormal process detection in response to the above technical problems.

[0005] In a first aspect, the present application provides a method for detecting an abnormal process, the method comprising:

[0006] Obtain a target process tree constructed based on a generation relationship between multiple processes; the target process tree includes at least one process node; and there is a generation relationship between two process nodes on the same edge in the target process tree;

[0007] Matching each process node in the target process tree with a process node in a pre-built abnormal process tree library to obtain a matched abnormal process node;

[0008] Performing preliminary anomaly detection on the target process tree based on the connectivity between the abnormal process nodes;

[0009] In the case of preliminary detection of an abnormality in the target process tree, mapping the process behavior characteristics corresponding to the abnormal process node to obtain the attack stage corresponding to the abnormal process node;

[0010] According to the attack stages respectively corresponding to the abnormal process nodes in the target process tree, advanced abnormality detection is performed on the target process tree to obtain an abnormality detection result for the target process tree.

[0011] In a second aspect, the present application provides an abnormal process detection device, the device comprising:

[0012] An acquisition module, used for acquiring a target process tree constructed based on a generation relationship between multiple processes; the target process tree includes at least one process node; there is a generation relationship between two process nodes on the same edge in the target process tree;

[0013] A matching module, used to match each process node in the target process tree with a process node in a pre-built abnormal process tree library to obtain a matched abnormal process node;

[0014] A detection module, configured to perform preliminary anomaly detection on the target process tree based on the connectivity between the abnormal process nodes;

[0015] A mapping module, for mapping the process behavior characteristics corresponding to the abnormal process node when the target process tree is initially detected to be abnormal, to obtain the attack stage corresponding to the abnormal process node;

[0016] The detection module is also used to perform advanced anomaly detection on the target process tree according to the attack stages respectively corresponding to the abnormal process nodes in the target process tree, so as to obtain an anomaly detection result for the target process tree.

[0017] In one embodiment, the mapping module is also used to determine the mapping relationship between preset process behavior characteristics and attack stages; for each abnormal process node, based on the mapping relationship, the attack stage mapped to the process behavior characteristics corresponding to the abnormal process node is determined to obtain the attack stage corresponding to the abnormal process node.

[0018] In one embodiment, the detection module is further used to determine that the target process tree is abnormal if there is at least one execution type stage in the attack stages respectively corresponding to the abnormal process nodes in the target process tree.

[0019] In one embodiment, the target process tree includes at least one process chain; each process chain includes at least one process node; the device further includes:

[0020] A merging module is used to generate corresponding single-point alarm information for each abnormal process node in the target process tree; after the advanced detection of the abnormality of the target process tree, for each process chain in the target process tree, the single-point alarm information corresponding to each abnormal process node on the process chain is connected in series to obtain the alarm information corresponding to the process chain; the alarm information corresponding to each process chain in the target process tree is merged to obtain the target alarm information and output it.

[0021] In one embodiment, the apparatus further comprises:

[0022] The first construction module is used to obtain at least one historical alarm information; the historical alarm information is alarm information obtained by performing abnormal detection on each process node in at least one historical process tree; for each historical alarm information, determine the process node targeted by the historical alarm information, obtain the alarm process node corresponding to the historical alarm information, and extract the process subtree with the alarm process node as the new root node from the process tree where the alarm process node is located, to obtain the process subtree corresponding to the historical alarm information; construct an abnormal process tree library according to the process subtrees corresponding to each of the historical alarm information.

[0023] In one embodiment, the detection module is also used to determine the connected abnormal process nodes from the matched abnormal process nodes to obtain the target abnormal process nodes; if the number of the target abnormal process nodes is greater than a preset number threshold, the target process tree is preliminarily determined to be abnormal.

[0024] In one embodiment, the detection module is also used to determine the connected abnormal process nodes from the matched abnormal process nodes to obtain multiple candidate abnormal process nodes; determine the abnormal process nodes with the same process behavior characteristics from the multiple candidate abnormal process nodes; and deduplicate the abnormal process nodes with the same process behavior characteristics to obtain the target abnormal process node.

[0025] In one embodiment, the matching module is also used to compare, for each process node in the target process tree, the process behavior characteristics corresponding to the process node with the process behavior characteristics corresponding to each process node in the abnormal process tree library, and to use the process nodes in the target process tree with consistent characteristics as abnormal process nodes.

[0026] In one embodiment, a process node of the target process tree stores a process behavior feature; the stored process behavior feature is extracted based on a process command corresponding to the process node; the device further includes:

[0027] The second construction module is used to obtain an initial process tree constructed based on a generation relationship between multiple processes; the initial process tree includes at least one process node storing the process command; there is a generation relationship between two process nodes on the same edge in the initial process tree; homogenize the process commands with different forms but the same functions stored in the process nodes in the initial process tree so that the process commands with the same function have the same form to obtain a homogenized process tree; extract features of the process commands in the process nodes of the homogenized process tree to obtain process behavior features, and construct a target process tree based on the process behavior features.

[0028] In one embodiment, the process node of the target process tree also stores command parameters corresponding to the process command; the stored process behavior features are extracted based on the process command corresponding to the process node and the command parameters corresponding to the process command; the second construction module is also used to extract features of the command parameters of the process nodes in the homogenized process tree to obtain command parameter features; extract features of the process command and the command parameter features in the process node to obtain process behavior features, and construct the target process tree based on the process behavior features.

[0029] In one embodiment, the apparatus further comprises:

[0030] An updating module is used to determine the process node in the abnormal process tree library that causes a false alarm of the target process tree abnormality when the abnormal detection result indicates that the target process tree is abnormal, but the target process tree is not really abnormal, and delete the process node that causes the false alarm to update the abnormal process tree library.

[0031] In one embodiment, the acquisition module is also used to obtain a target process tree of the host; the target process tree is constructed based on a generation relationship between multiple processes running on the host; the detection module is also used to determine whether there is a process attacking the host among the multiple processes if an abnormality detection result for the target process tree indicates that the target process tree is abnormal.

[0032] In a third aspect, the present application provides a computer device including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps in the method embodiments of the present application are implemented.

[0033] In a fourth aspect, the present application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in the method embodiments of the present application.

[0034] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the steps in the method embodiments of the present application when the computer program is executed by a processor.

[0035] The above abnormal process detection method, device, equipment, medium and computer program product obtain a target process tree constructed based on a generative relationship between multiple processes; the target process tree includes at least one process node; there is a generative relationship between two process nodes on the same side in the target process tree, and each process node in the target process tree is matched with a process node in a pre-constructed abnormal process tree library. Since each process node in the abnormal process tree library is abnormal, the abnormal process node in the target process tree can be determined more accurately. Then, based on the connectivity between the abnormal process nodes, the target process tree is preliminarily detected for abnormality, and whether the target process tree is abnormal can be preliminarily detected more accurately. In the case of preliminary detection of the abnormality of the target process tree, the process behavior characteristics corresponding to the abnormal process node are mapped to obtain the attack stage corresponding to the abnormal process node. Since there is a generative relationship between two process nodes on the same side in the target process tree, the target process tree is subjected to advanced abnormality detection through the attack stages corresponding to each abnormal process node in the target process tree. In this way, the information of the attack process corresponding to each abnormal process node in the target process tree is comprehensively considered, and the abnormal detection result for the target process tree can be accurately obtained, thereby improving the detection accuracy of the abnormal process. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 is an application environment diagram of an abnormal process detection method in an embodiment;

[0037] Figure 2 1 is a flow chart of an abnormal process detection method in one embodiment;

[0038] Figure 3 A schematic diagram of a target process tree structure in one embodiment;

[0039] Figure 4 Schematic diagram of the mapping relationship between process behavior characteristics and attack stages in one embodiment;

[0040] Figure 5 A schematic diagram showing alarm information of a traditional single-point detection in an embodiment;

[0041] Figure 6 This is a schematic diagram showing the alarm information of the present application in an embodiment;

[0042] Figure 7 A schematic diagram of connected process nodes in one embodiment;

[0043] Figure 8 A schematic diagram of command parameter feature extraction levels in one embodiment;

[0044] Fig. 9 A schematic diagram of an overall framework of abnormal process detection in one embodiment;

[0045] Fig.10 is a flowchart of an abnormal process detection method in another embodiment;

[0046] Fig.11 is a structural block diagram of an abnormal process detection device in one embodiment;

[0047] Fig.12 is an internal structure diagram of a computer device in one embodiment;

[0048] Fig.13 FIG. 4 is a diagram showing the internal structure of a computer device in another embodiment. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0050] The abnormal process detection method provided in this application can be applied to Figure 1 In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other servers. Among them, the terminal 102 can be, but is not limited to, various desktop computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The server 104 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, cloud security, host security and other network security services, CDN, and basic cloud computing services such as big data and artificial intelligence platforms. The terminal 102 and the server 104 can be directly or indirectly connected by wired or wireless communication, and this application is not limited here.

[0051] The server 104 can obtain a target process tree constructed based on a generation relationship between multiple processes; the target process tree includes at least one process node; there is a generation relationship between two process nodes on the same side of the target process tree. The server 104 can match each process node in the target process tree with a process node in a pre-built abnormal process tree library to obtain a matched abnormal process node, and perform preliminary abnormality detection on the target process tree based on the connectivity between the abnormal process nodes. In the case of preliminary detection of abnormalities in the target process tree, the server 104 can map the process behavior features corresponding to the abnormal process nodes to obtain the attack stage corresponding to the abnormal process nodes; according to the attack stages corresponding to the abnormal process nodes in the target process tree, the target process tree is subjected to advanced abnormality detection to obtain abnormality detection results for the target process tree.

[0052] It is understood that the server 104 may send the abnormality detection result for the target process tree to the terminal 102 for display. This embodiment does not limit this. It is understood that Figure 1 The application scenarios are only for illustration and are not limited to this.

[0053] It should be noted that the abnormal process detection method in some embodiments of the present application uses artificial intelligence technology. For example, the command parameter features of the command parameters of the present application are obtained by extracting features of the command parameters of the process nodes in the homogenized process tree using artificial intelligence technology.

[0054] In one embodiment, Figure 2 As shown, a method for detecting abnormal processes is provided. The method can be applied to a computer device, which can be a terminal or a server. The method can be executed by the terminal or the server itself alone, or can be implemented through interaction between the terminal and the server, and includes the following steps:

[0055] Step 202, obtaining a target process tree constructed based on a generation relationship between multiple processes; the target process tree includes at least one process node; there is a generation relationship between two process nodes on the same edge in the target process tree.

[0056] Among them, a process is a running activity of a program in a computer device on a specific data set, and is the basic unit for resource allocation and scheduling of the system. A process node is a node obtained by abstracting a process. A process tree is a tree structure composed of at least one process node, and a process tree is used to intuitively represent the relationship between processes. A target process tree is a process tree to be detected for anomalies. There is a generative relationship between two process nodes on the same edge in the target process tree. It can be understood that the two process nodes are connected unidirectionally through an edge, and the two process nodes connected unidirectionally through the edge are respectively a parent process node and a child process node. It can be understood that the parent process node and the child process node are directly connected through an edge, and the edge connecting the parent process node and the child process node can represent the generative relationship between the parent process node and the child process node. The generative relationship can be understood as that the existence of a child process node is premised on the existence of the corresponding parent process node. If the corresponding parent process node does not exist, the corresponding child process node will not be generated. The target process tree includes at least one process chain, and each process chain includes at least one process node. Each process node in each process chain corresponds to each operation step. It can be understood that the penetration attack process on a computer device may include multiple operation steps. The process attack chain formed by the multiple operation steps can realize the penetration attack on the computer device. It can be understood that the penetration attack is a systematic and progressive comprehensive attack method.

[0057] In one embodiment, Figure 3 As shown, the target process tree includes 10 process nodes. There is a generation relationship between two process nodes on the same edge in the target process tree, for example, there is a generation relationship between process node 1 and process node 2, and there is a generation relationship between process node 2 and process node 8. The target process tree includes six process chains, wherein the first process chain includes process node 1, process node 2, and process node 8. The second process chain includes process node 1 and process node 3. The third process chain includes process node 1, process node 4, and process node 9. The fourth process chain includes process node 1 and process node 5. The fifth process chain includes process node 1 and process node 6. The sixth process chain includes process node 1, process node 7, and process node 10. It can be understood that each process node in each process chain corresponds to each operation step.

[0058] In one embodiment, a computer device may run multiple processes, and the computer device may obtain multiple processes running locally and determine the generation relationship between the multiple processes, and then the computer device may build a target process tree based on the generation relationship between the multiple processes. It can be understood that the multiple processes running on the computer device may specifically be multiple processes that have run on the computer device within a preset time period, that is, the multiple processes running on the computer device may be processes running on the computer device at different time points.

[0059] In one embodiment, the computer device may also directly obtain the target process tree constructed based on the generation relationship between multiple processes from a third-party device. It is understandable that the construction process of the target process tree may not be completed on the computer device, but on the third-party device. Specifically, multiple processes may be run on the computer device, and the third-party device may obtain multiple processes from the computer device and determine the generation relationship between the multiple processes, and then the third-party device may construct the target process tree based on the generation relationship between the multiple processes.

[0060] Step 204: Match each process node in the target process tree with the process nodes in the pre-built abnormal process tree library to obtain matched abnormal process nodes.

[0061] The abnormal process tree library is a database composed of abnormal process trees. It can be understood that the abnormal process tree library includes at least one abnormal process tree, and the process corresponding to the process node in the abnormal process tree is an abnormal process. The abnormal process node is a process node in the target process tree that matches the process node in the abnormal process tree library. It can be understood that the process corresponding to the abnormal process node in the target process tree is considered abnormal.

[0062] In one embodiment, the process nodes of the target process tree and the process nodes in the abnormal process tree library both store corresponding process behavior features. It can be understood that the process behavior features are extracted based on the process data corresponding to the corresponding process nodes. The computer device can match each process node in the target process tree with the process nodes in the pre-built abnormal process tree library based on the process behavior features stored in the process nodes of the target process tree and the process behavior features stored in the process nodes in the abnormal process tree library to obtain the matched abnormal process nodes. Among them, the process data is the operation data related to the process.

[0063] In one embodiment, process data is stored in the process nodes of the target process tree and the process nodes in the abnormal process tree library. It is understood that for each process node in the target process tree, the computer device can compare the process data in the process node with the process data of each process node in the abnormal process tree library, and use the process nodes in the target process tree with consistent data as abnormal process nodes.

[0064] In one embodiment, the process data includes a process command. In one embodiment, in addition to the process command, the process data also includes a command parameter corresponding to the process command. The process command is a computer instruction in a process. The command parameter is an operating parameter corresponding to the process command. For example, if the process command is https (Hypertext Transfer Protocol Secure), the command parameter corresponding to https can be a specific IP (Internet Protocol) address.

[0065] Step 206: Perform preliminary anomaly detection on the target process tree based on the connectivity between abnormal process nodes.

[0066] Among them, connectivity refers to the existence of directly connected edges between process nodes. It can be understood that if there is a directly connected edge between two process nodes, the two process nodes are considered to be connected. Preliminary anomaly detection refers to the preliminary anomaly detection of the target process tree. It can be understood that the preliminary detection of the target process tree anomaly only indicates that the target process tree has the possibility of anomaly, and cannot ultimately determine whether the target process tree is ultimately abnormal.

[0067] Specifically, the computer device may determine the connectivity between abnormal process nodes, and perform preliminary anomaly detection on the target process tree based on the connectivity between the abnormal process nodes.

[0068] In one embodiment, if there are connected abnormal process nodes in the target process tree, it is preliminarily determined that the target process tree is abnormal.

[0069] Step 208, when the target process tree is initially detected to be abnormal, the process behavior characteristics corresponding to the abnormal process node are mapped to obtain the attack stage corresponding to the abnormal process node.

[0070] Among them, the attack stage refers to the stage of the process corresponding to the abnormal process node during the attack process. The attack stage may include at least one of the information detection type stage, the persistence type stage and the execution type stage. The information detection type stage refers to the stage of the attack process that includes the information detection type behavior. The persistence type stage refers to the stage of the attack process that includes the persistence type behavior. The execution type stage refers to the stage of the attack process that includes the execution type behavior.

[0071] In one embodiment, the information detection type behavior may include at least one of obtaining port information and vulnerability information of the attack object, etc. The persistence type behavior may include at least one of adding object operations and modifying object permissions, etc. The execution type behavior may include at least one of downloading files, compiling and decompressing, etc.

[0072] Specifically, when an abnormality is initially detected in the target process tree, for each abnormal process node in the target process tree, the computer device can determine the process behavior characteristics corresponding to the abnormal process node, and map the process behavior characteristics corresponding to the abnormal process node to obtain the attack stage corresponding to the abnormal process node.

[0073] In one embodiment, mapping the process behavior characteristics corresponding to the abnormal process node to obtain the attack stage corresponding to the abnormal process node includes: determining a mapping relationship between a preset process behavior characteristic and an attack stage; for each abnormal process node, based on the mapping relationship, determining the attack stage mapped to the process behavior characteristic corresponding to the abnormal process node to obtain the attack stage corresponding to the abnormal process node. In this embodiment, by determining the attack stage mapped to the process behavior characteristic corresponding to the abnormal process node through the mapping relationship between the preset process behavior characteristic and the attack stage, the acquisition accuracy of the attack stage corresponding to the abnormal process node can be improved.

[0074] In one embodiment, Figure 4 The mapping table shown in the figure records the mapping relationship between the preset process behavior characteristics and the attack stage. Based on the mapping relationship recorded in the mapping table, the computer device can determine the attack stage mapped to the process behavior characteristics corresponding to the abnormal process node, and obtain the attack stage corresponding to the abnormal process node.

[0075] Step 210, according to the attack stages respectively corresponding to the abnormal process nodes in the target process tree, an advanced abnormality detection is performed on the target process tree to obtain an abnormality detection result for the target process tree.

[0076] Specifically, the target process tree is constructed based on the generation relationship between multiple processes running on the computer device. The computer device can perform advanced anomaly detection on the target process tree according to the attack stages corresponding to each abnormal process node in the target process tree, and obtain an anomaly detection result for the target process tree. If the anomaly detection result for the target process tree indicates that the target process tree is abnormal, it is determined that there is a process that attacks the computer device among the multiple processes running on the computer device. If the anomaly detection result for the target process tree indicates that the target process tree is normal, it is determined that there is no process that attacks the computer device among the multiple processes running on the computer device.

[0077] In one embodiment, if there is a stage of a preset type in the attack stages respectively corresponding to the abnormal process nodes in the target process tree, the target process tree is determined to be abnormal. If there is no stage of a preset type in the attack stages respectively corresponding to the abnormal process nodes in the target process tree, the target process tree is determined to be normal.

[0078] In the above abnormal process detection method, a target process tree constructed based on a generative relationship between multiple processes is obtained; the target process tree includes at least one process node; there is a generative relationship between two process nodes on the same side in the target process tree, and each process node in the target process tree is matched with a process node in a pre-constructed abnormal process tree library. Since each process node in the abnormal process tree library is abnormal, the abnormal process node in the target process tree can be determined more accurately. Then, the target process tree is preliminarily detected for abnormality based on the connectivity between the abnormal process nodes, and whether the target process tree is abnormal can be preliminarily detected more accurately. In the case of preliminary detection of the abnormality of the target process tree, the process behavior characteristics corresponding to the abnormal process node are mapped to obtain the attack stage corresponding to the abnormal process node. Since there is a generative relationship between two process nodes on the same side in the target process tree, the target process tree is subjected to advanced abnormality detection through the attack stages corresponding to each abnormal process node in the target process tree. In this way, the information of the attack process corresponding to each abnormal process node in the target process tree is comprehensively considered, and the abnormal detection result for the target process tree can be accurately obtained, thereby improving the detection accuracy of the abnormal process.

[0079] In one embodiment, according to the attack stages respectively corresponding to the abnormal process nodes in the target process tree, advanced anomaly detection is performed on the target process tree to obtain an anomaly detection result for the target process tree, including: if there is at least one execution type stage in the attack stages respectively corresponding to the abnormal process nodes in the target process tree, the target process tree is determined to be abnormal.

[0080] Specifically, the attack phase may include at least one of an information detection type phase, a persistence type phase, and an execution type phase. If there is at least one execution type phase in the attack phases corresponding to each abnormal process node in the target process tree, the computer device may determine that the target process tree is abnormal. Conversely, it can be understood that if there are information detection type phases and persistence type phases, but no execution type phases, in the attack phases corresponding to each abnormal process node in the target process tree, the computer device may determine that the target process tree is normal.

[0081] It can be understood that the attack process is a chain. The complete attack chain will contain networking behaviors for obtaining resources. After obtaining resources, the execution type of behavior will be initiated. If the target process tree is initially detected as abnormal, and the attack process corresponding to the target process tree includes suspicious behaviors before and after networking, it means that the probability of the target process tree being abnormal is very high, and the target process tree can be advanced to determine that it is abnormal. It can be understood that suspicious behaviors can include at least one of the above-mentioned information detection type behaviors, persistence type behaviors, and execution type behaviors.

[0082] In the above embodiment, by judging whether there is an execution type stage in the attack stage corresponding to each abnormal process node in the target process tree, whether the target process tree is abnormal can be determined, and the detection accuracy of the abnormal process can be further improved.

[0083] In one embodiment, the target process tree includes at least one process chain; each process chain includes at least one process node; the method also includes: generating corresponding single-point alarm information for each abnormal process node in the target process tree; after advanced detection of the abnormality of the target process tree, for each process chain in the target process tree, concatenating the single-point alarm information corresponding to each abnormal process node on the process chain to obtain the alarm information corresponding to the process chain; merging the alarm information corresponding to each process chain in the target process tree to obtain the target alarm information and output it.

[0084] Among them, the single point alarm information is the alarm information generated for a single abnormal process node. It can be understood that one abnormal process node corresponds to one single point alarm information. The target alarm information is the alarm information generated for the target process tree. It can be understood that one target process tree corresponds to one target alarm information.

[0085] Specifically, after each process node in the target process tree is matched with the process node in the abnormal process tree library, and the matched abnormal process nodes are obtained, the computer device can generate corresponding single-point alarm information for each abnormal process node in the target process tree. After the target process tree is detected to be abnormal, for each process chain in the target process tree, if there is at least one abnormal process node on the process chain, the computer device can connect the single-point alarm information corresponding to each abnormal process node on the process chain in series to obtain the alarm information corresponding to the process chain. Furthermore, the computer device can merge the alarm information corresponding to each process chain in the target process tree, obtain the target alarm information for the target process tree and output it. It can be understood that the single-point alarm information corresponding to each abnormal process node will not be directly output and displayed to the user, and what is finally output and displayed to the user is the target alarm information generated by synthesizing the single-point alarm information corresponding to each abnormal process node.

[0086] Traditional single-point monitoring alarm information display, such as Figure 5 As shown in the figure, each row represents an alarm message obtained by detecting an abnormal process. The traditional single-point monitoring alarm information display will display these four alarm messages to the user separately, and there is no correlation between the alarm messages. The alarm information display of this application is as follows: Figure 6As shown, the present application can connect and merge the single-point alarm information corresponding to each abnormal process node in the same process tree, and output the merged target alarm information. It can be understood that for each abnormal process tree, the present application finally displays only one merged alarm information with context information to the user.

[0087] In the above embodiment, the single-point alarm information corresponding to each abnormal process node on the process chain is connected in series to obtain the alarm information corresponding to the process chain, and the alarm information corresponding to each process chain in the target process tree is merged to obtain the target alarm information and output it. Compared with the traditional single-point detection method of outputting an alarm message for each abnormal process, the present application constructs a process tree, merges the single-point alarm information corresponding to each abnormal process node in the same process tree, and outputs the merged target alarm information, which can reduce the output amount of alarm information. In addition, compared with the traditional single-point detection method of outputting an alarm message for each abnormal process, the scattered detection result data lacks connection with each other, and the present application connects the single-point alarm information corresponding to each abnormal process node on the process chain in series, integrates the scattered detection result data, and improves the richness of the context information of the alarm information.

[0088] In one embodiment, the method also includes the step of constructing an abnormal process tree library; the step of constructing the abnormal process tree library includes: obtaining at least one historical alarm information; the historical alarm information is the alarm information obtained by performing abnormal detection on each process node in at least one historical process tree; for each historical alarm information, determining the process node targeted by the historical alarm information, obtaining the alarm process node corresponding to the historical alarm information, and extracting the process subtree with the alarm process node as the new root node from the process tree where the alarm process node is located, to obtain the process subtree corresponding to the historical alarm information; constructing the abnormal process tree library according to the process subtrees corresponding to each historical alarm information.

[0089] Among them, the historical process tree is a process tree constructed based on the generation relationship between multiple historical processes. It can be understood that multiple historical processes refer to the processes recorded in the process log before the abnormal process detection. The alarm process node refers to the process node in the historical process tree that causes the generation of historical alarm information. The process subtree is a subtree cut from the historical process tree with the alarm process node as the root node.

[0090] Specifically, the computer device can obtain multiple historical processes from the processes recorded in the process log before the abnormal process detection, and construct a historical process tree based on the generation relationship between the multiple historical processes. The computer device can perform abnormal detection on each process node in the historical process tree to obtain historical alarm information for the abnormal process node. For each historical alarm information, the computer device can determine the process node targeted by the historical alarm information, obtain the alarm process node corresponding to the historical alarm information, and extract the process subtree with the alarm process node as the new root node from the process tree where the alarm process node is located, and obtain the process subtree corresponding to the historical alarm information. Furthermore, the computer device can construct an abnormal process tree library based on the process subtrees corresponding to each historical alarm information.

[0091] In one embodiment, the computer device may extract features from the process data corresponding to the process nodes in each process subtree to obtain process behavior features, and store the process behavior features in a database in a tree structure to obtain an abnormal process tree library. It can be understood that each process node in the abnormal process tree library stores the process behavior features corresponding to the process.

[0092] In one embodiment, the computer device can store the process data corresponding to the process nodes in each process subtree in a database in a tree structure to obtain an abnormal process tree library. It can be understood that each process node in the abnormal process tree library stores the process data corresponding to the process.

[0093] In the above embodiment, a process subtree with the alarm process node as a new root node is extracted from the process tree where the alarm process node is located to obtain a process subtree corresponding to the historical alarm information. Since the process corresponding to the alarm process node is abnormal, the possibility that each process node in the process subtree corresponding to the historical alarm information is abnormal is also very high. Therefore, an abnormal process tree library is constructed according to the process subtrees corresponding to each historical alarm information. This can improve the accuracy of abnormal process nodes in the abnormal process tree library, so that when each process node in the target process tree is subsequently matched with the process nodes in the abnormal process tree library, the accuracy of the matched abnormal process nodes can be improved.

[0094] In one embodiment, a preliminary abnormality detection is performed on a target process tree based on the connectivity between abnormal process nodes, including: determining connected abnormal process nodes from matched abnormal process nodes to obtain target abnormal process nodes; if the number of target abnormal process nodes is greater than a preset number threshold, the target process tree is preliminarily determined to be abnormal.

[0095] The target abnormal process node is an abnormal process node that is connected to the matched abnormal process nodes. It can be understood that if there are multiple groups of target abnormal process nodes in the target process tree, a path can be formed between the target abnormal process nodes of each group.

[0096] Specifically, the computer device may determine the connected abnormal process nodes from the matched abnormal process nodes to obtain the target abnormal process node. For each group of target abnormal process nodes in the target process tree, the computer device may compare the number of the target abnormal process nodes in the group with a preset number threshold. If the number of any group of target abnormal process nodes is greater than the preset number threshold, the target process tree is preliminarily determined to be abnormal.

[0097] In one embodiment, Figure 7 As shown, there are 7 connected abnormal process nodes, namely, process node a, process node b, process node c, process node d, process node e, process node f and process node g. If the preset number threshold is 4, and the number of these 7 connected abnormal process nodes is greater than 4, the computer device can preliminarily determine that the target process tree to which these 7 connected abnormal process nodes belong is abnormal.

[0098] In the above embodiment, since the connected abnormal process nodes can represent the generation relationship between the processes corresponding to each process node, the number of connected target abnormal process nodes can represent the abnormality degree of the corresponding process tree to a certain extent. Therefore, by judging the number of connected target abnormal process nodes to preliminarily determine whether the target process tree is abnormal, the accuracy of preliminary detection of abnormalities in the target process tree can be improved.

[0099] In one embodiment, connected abnormal process nodes are determined from matched abnormal process nodes to obtain a target abnormal process node, including: determining connected abnormal process nodes from matched abnormal process nodes to obtain multiple candidate abnormal process nodes; determining abnormal process nodes with the same process behavior characteristics from the multiple candidate abnormal process nodes; and deduplicating abnormal process nodes with the same process behavior characteristics to obtain a target abnormal process node.

[0100] The candidate abnormal process nodes are abnormal process nodes that are connected and before deduplication from the matched abnormal process nodes. It can be understood that the candidate abnormal process nodes may include abnormal process nodes with the same process behavior characteristics.

[0101] Specifically, the computer device may determine connected abnormal process nodes from the matched abnormal process nodes to obtain multiple candidate abnormal process nodes. The computer device may determine the process features corresponding to each candidate abnormal process node, and determine abnormal process nodes with the same process behavior features from the multiple candidate abnormal process nodes. Furthermore, the computer device may remove duplicates from the abnormal process nodes with the same process behavior features to obtain the target abnormal process node.

[0102] In one embodiment, the computer device may deduplicate abnormal process nodes with the same process behavior characteristics, and may treat each abnormal process node with the same process behavior characteristics as one abnormal process node. When performing quantity statistics, the number of each abnormal process node with the same process behavior characteristics is recorded as 1, and the number is no longer added.

[0103] In the above embodiment, since the abnormal information represented by multiple abnormal process nodes with the same process behavior characteristics is the same, there is no cumulative effect on the improvement of the accuracy of preliminary abnormal detection of the target process tree. Therefore, by deduplicating the abnormal process nodes with the same process behavior characteristics, the target abnormal process nodes are obtained, and then the number of connected target abnormal process nodes is judged to preliminarily determine whether the target process tree is abnormal, which can further improve the accuracy of preliminary abnormal detection of the target process tree.

[0104] In one embodiment, each process node in the target process tree is matched with a process node in a pre-built abnormal process tree library to obtain a matched abnormal process node, including: for each process node in the target process tree, the process behavior feature corresponding to the process node is compared with the process behavior feature corresponding to each process node in the abnormal process tree library, and the process node with the consistent feature comparison in the target process tree is taken as the abnormal process node.

[0105] Specifically, the computer device may determine the process behavior features corresponding to each process node in the abnormal process tree library. Also, for each process node in the target process tree, the computer device may determine the process behavior features corresponding to the process node, compare the process behavior features corresponding to the process node with the process behavior features corresponding to each process node in the abnormal process tree library, and use the process nodes in the target process tree with the same features as the abnormal process nodes.

[0106] In one embodiment, the process nodes of the target process tree and the process nodes in the abnormal process tree library store corresponding process behavior features. It can be understood that the process behavior features are extracted based on the process data corresponding to the corresponding process nodes. For each process node in the target process tree, the computer device can compare the process behavior features in the process node with the process behavior features in each process node in the abnormal process tree library, and use the process nodes in the target process tree with the same features as the abnormal process nodes.

[0107] In one embodiment, process data is stored in the process nodes of the target process tree and the process nodes in the abnormal process tree library. It is understood that the computer device can perform feature extraction on the process data stored in the process nodes in the abnormal process tree library to obtain the process behavior features corresponding to each process node in the abnormal process tree library. And, for each process node in the target process tree, the computer device can perform feature extraction on the process data stored in the process nodes of the target process tree to obtain the process behavior features corresponding to the process nodes in the target process tree, and compare the process behavior features corresponding to the process nodes with the process behavior features corresponding to each process node in the abnormal process tree library, and use the process nodes in the target process tree with consistent features as abnormal process nodes.

[0108] In the above embodiment, since the process behavior characteristics can more accurately characterize the abnormal information corresponding to the corresponding process node, the accuracy of judging the abnormal process node can be further improved by comparing the process behavior characteristics corresponding to the process node with the process behavior characteristics corresponding to each process node in the abnormal process tree library.

[0109] In one embodiment, a process node of a target process tree stores process behavior features; the stored process behavior features are extracted based on process commands corresponding to the process node; the method also includes a step of constructing a target process tree, and the step of constructing the target process tree includes: obtaining an initial process tree constructed based on a generation relationship between multiple processes; the initial process tree includes at least one process node storing a process command; there is a generation relationship between two process nodes on the same edge in the initial process tree; homogenizing the process commands with different forms but the same functions stored in the process nodes in the initial process tree so that the process commands with the same function have the same form to obtain a homogenized process tree; extracting features of the process commands in the process nodes of the homogenized process tree to obtain process behavior features, and constructing the target process tree based on the process behavior features.

[0110] The initial process tree is a process tree constructed based on the generation relationship between multiple processes before the process commands in the process nodes are homogenized. The process commands of different forms refer to the different description forms of the process commands. It can be understood that the process data mentioned above includes process commands.

[0111] For example, the two process commands, passwd and pwd, have different forms, but they have the same function, that is, passwd and pwd both represent passwords. The two process commands, adduser and useradd, have different forms, but they have the same function, that is, adduser and useradd both represent adding new users. The two process commands, http and https, have different forms, but they have the same function, that is, http, https, ftp, and tcp all represent transmission protocols.

[0112] Specifically, the computer device can obtain an initial process tree constructed based on the generation relationship between multiple processes, and perform homogenization conversion on each process command with different forms but the same function stored in each process node in the initial process tree. That is, any process command is selected from each process command with different forms but the same function, and each process command with different forms but the same function is replaced with the selected process command, so that each process command with the same function has the same form, and a homogenized process tree is obtained. Furthermore, the computer device can extract features of the process commands in the process nodes of the homogenized process tree to obtain process behavior features, and construct a target process tree based on the process behavior features. It can be understood that the process nodes of the target process tree store the process behavior features corresponding to each process node.

[0113] In the above embodiment, by homogenizing the process commands with different forms but the same functions stored in the process nodes in the initial process tree so that the process commands with the same function have the same form, a homogenized process tree is obtained, and feature extraction is performed on the process commands in the process nodes of the homogenized process tree, so that more accurate process behavior features can be obtained, and the accuracy of process behavior feature extraction is improved, so that abnormal process nodes can be more accurately identified from the target process tree subsequently, thereby improving the accuracy of abnormal process node identification.

[0114] In one embodiment, the process nodes of the target process tree also store command parameters corresponding to the process commands; the stored process behavior features are extracted based on the process commands corresponding to the process nodes and the command parameters corresponding to the process commands; feature extraction is performed on the process commands in the process nodes of the homogenized process tree to obtain process behavior features, and the target process tree is constructed based on the process behavior features, including: feature extraction on the command parameters of the process nodes in the homogenized process tree to obtain command parameter features; feature extraction is performed on the process commands and command parameter features in the process nodes to obtain process behavior features, and the target process tree is constructed based on the process behavior features.

[0115] The command parameter feature is a feature obtained by extracting the command parameter. It can be understood that the process data mentioned above includes the process command and the command parameter corresponding to the process command.

[0116] Specifically, the computer device may perform feature extraction on the command parameters of the process nodes in the homogenized process tree to obtain command parameter features. It is understood that after feature extraction on the command parameters of the process nodes in the homogenized process tree, the process nodes of the process tree include process commands and command parameter features. Furthermore, the computer device may perform feature extraction on the process commands and command parameter features in the process nodes to obtain process behavior features, and construct a target process tree based on the process behavior features. It is understood that the process nodes of the target process tree store process behavior features corresponding to each process node.

[0117] For example, the process command is https, and the command parameter corresponding to https is a specific IP address. If the command parameter corresponding to process node A is IP 1, and the command parameter corresponding to process node B is IP 2, the computer device can extract features of command parameter IP 1 and command parameter IP 2 respectively to obtain the same command parameter feature, for example. Extract features of command parameter IP 1 and command parameter IP 2 to obtain the same command parameter feature PARAM (parameter).

[0118] In one embodiment, Figure 8 As shown, the process command is https, and the command parameter corresponding to https is a specific IP address, that is Figure 8 As shown in the figure, the feature extraction of command parameters can be divided into seven levels. The first level extracts the feature of the command parameter as the symbol "IP", the second level extracts the feature of the command parameter as the symbol "URL", and the third level extracts the feature of the command parameter as the symbol "PARAM". Since the feature extracted by the third level can well represent that the specific IP address is a variable parameter, the computer device can use the feature extracted by the third level for the command parameter as the command parameter feature.

[0119] In the above embodiment, since the change of command parameters does not affect the entire attack process, the command parameter features are extracted from the command parameters of the process nodes in the homogenized process tree to obtain the command parameter features, and the process commands and command parameter features in the process nodes are extracted to obtain the process behavior features. In this way, more accurate process behavior features can be obtained, and the accuracy of process behavior feature extraction is improved, so that abnormal process nodes can be more accurately identified from the target process tree in the future, thereby improving the accuracy of abnormal process node identification.

[0120] In one embodiment, the method further includes: when the anomaly detection result indicates that the target process tree is abnormal, but the target process tree is not really abnormal, determining the process node in the abnormal process tree library that causes the false alarm of the target process tree abnormality, and deleting the process node that causes the false alarm to update the abnormal process tree library.

[0121] In one embodiment, when the abnormality detection result indicates that the target process tree is abnormal, but the target process tree is not really abnormal, the computer device can determine the process node in the abnormal process tree library that causes the target process tree to be abnormal, and directly delete the process node that causes the false alarm to update the abnormal process tree library. It can be understood that in this embodiment, the process node that causes the false alarm is deleted, and the process tree where the process node that causes the false alarm is located is still retained in the abnormal process tree library.

[0122] In one embodiment, when the abnormality detection result indicates that the target process tree is abnormal, but the target process tree is not really abnormal, the computer device can determine the process node in the abnormal process tree library that causes the target process tree abnormality to be falsely reported, determine the process tree where the process node that causes the false report is located, and delete the process tree where the process node that causes the false report is located, so as to update the abnormal process tree library. It can be understood that in this embodiment, the process tree where the process node that causes the false report is located is deleted, that is, the process tree where the process node that causes the false report is located is deleted from the abnormal process tree library.

[0123] In the above embodiment, by deleting the process node that causes the false alarm to update the abnormal process tree bank, the accuracy of the data stored in the abnormal process tree bank can be improved, thereby improving the accuracy of subsequent abnormal process detection.

[0124] In one embodiment, obtaining a target process tree constructed based on a generation relationship between multiple processes includes: obtaining a target process tree of a host; the target process tree is constructed based on the generation relationship between multiple processes running on the host; the method also includes: if an abnormality detection result for the target process tree indicates that the target process tree is abnormal, determining that there is a process that attacks the host among the multiple processes.

[0125] Specifically, the computer device mentioned above includes a host, and multiple processes can be run on the host. The host can construct a target process tree according to the generation relationship between multiple processes running locally. The host can match each process node in the target process tree with the process node in the pre-built abnormal process tree library, obtain the matched abnormal process node, and perform preliminary abnormal detection on the target process tree based on the connectivity between the abnormal process nodes. In the case of preliminary detection of the abnormality of the target process tree, the host can map the process behavior characteristics corresponding to the abnormal process node to obtain the attack stage corresponding to the abnormal process node. Furthermore, the host can perform advanced abnormal detection on the target process tree according to the attack stage corresponding to each abnormal process node in the target process tree, and obtain the abnormal detection result for the target process tree. It can be understood that if the abnormal detection result for the target process tree indicates that the target process tree is abnormal, it is determined that there is a process that attacks the host among the multiple processes running on the host. If the abnormal detection result for the target process tree indicates that the target process tree is normal, it is determined that there is no process that attacks the host among the multiple processes running on the host.

[0126] In one embodiment, the host may be a cloud host deployed on a cloud, or may be other hosts deployed in a non-cloud environment.

[0127] In the above embodiment, by detecting the target process tree constructed according to the generation relationship between multiple processes running on the host, and based on the abnormality detection results of the target process tree, determining whether there is a process attacking the host among the multiple processes running on the host, the accuracy of abnormal process detection can be improved.

[0128] In one embodiment, Fig. 9As shown, the computer device includes a subtree extraction unit, an abnormality detection unit and an operation unit. The computer device can obtain at least one historical alarm information from the historical process log through the subtree extraction unit; for each historical alarm information, determine the process node targeted by the historical alarm information, obtain the alarm process node corresponding to the historical alarm information (it can be understood that each alarm process node has a unique process node identifier), and extract the process subtree with the alarm process node as the new root node from the process tree where the alarm process node is located, and obtain the process subtree corresponding to the historical alarm information; according to the process subtrees corresponding to each historical alarm information, an abnormal process tree library is constructed. Furthermore, the computer device can obtain multiple processes from the real-time process log through the abnormality detection unit, and obtain a target process tree based on multiple processes. For each process node in the target process tree, the process node is compared with each process node in the abnormal process tree library, and the process nodes that are matched in the target process tree are used as the detected abnormal process nodes. The computer device can perform preliminary abnormality detection on the target process tree based on the connectivity between the abnormal process nodes. In the case of preliminary detection of abnormality in the target process tree, the process behavior characteristics corresponding to the abnormal process node are mapped to obtain the attack stage corresponding to the abnormal process node; according to the attack stage corresponding to each abnormal process node in the target process tree, the target process tree is subjected to advanced abnormal detection to obtain the abnormal detection result for the target process tree. Corresponding single-point alarm information is generated for each abnormal process node in the target process tree; after advanced detection of abnormality in the target process tree, for each process chain in the target process tree, the single-point alarm information corresponding to each abnormal process node on the process chain is connected in series to obtain the alarm information corresponding to the process chain; the alarm information corresponding to each process chain in the target process tree is merged to obtain the target alarm information and output it. In the case that the abnormal detection result indicates that the target process tree is abnormal, but the target process tree is not really abnormal, the computer device can reject the false alarm through the operation unit, and determine the process node in the abnormal process tree library that causes the false alarm of the target process tree abnormality, and delete the process node that causes the false alarm to update the abnormal process tree library. In addition, the operation unit can also delete the process node that causes the false alarm in the abnormal process tree library through manual intervention.

[0129] like Fig.10 As shown, in one embodiment, an abnormal process detection method is provided, which can be applied to a computer device, which can be a terminal or a server, and can be executed by the terminal or the server itself alone, or can be implemented through the interaction between the terminal and the server. The method can be applied to the scenario of attack detection against a cloud host, wherein a cloud host refers to a host deployed in a cloud environment. It can be understood that the method can also be applied to the scenario of attack detection against a computer device in a non-cloud environment, which is not limited in this embodiment. The method specifically includes the following steps:

[0130] Step 1002, obtaining an initial process tree constructed based on a generation relationship between multiple processes; the initial process tree includes at least one process node storing a process command and command parameters corresponding to the process command; there is a generation relationship between two process nodes on the same edge in the initial process tree.

[0131] It can be understood that when the abnormal process detection method is applied to a scenario of attack detection against a cloud host, multiple processes may be running on the cloud host, and the cloud host may construct an initial process tree based on the generation relationship between the multiple processes.

[0132] Step 1004, homogenize the process commands with different forms but the same functions stored in the process nodes in the initial process tree so that the process commands with the same functions have the same form, thereby obtaining a homogenized process tree.

[0133] Step 1006: extract features of command parameters of process nodes in the homogenized process tree to obtain command parameter features.

[0134] Step 1008, extracting process commands and command parameter features in the process nodes to obtain process behavior features, and constructing a target process tree based on the process behavior features; the process nodes of the target process tree store the process behavior features.

[0135] It can be understood that when the abnormal process detection method is applied to a scenario of attack detection on a cloud host, the constructed target process tree is the target process tree constructed for the cloud host.

[0136] Step 1010, obtaining a target process tree constructed based on a generation relationship between multiple processes; the target process tree includes at least one process node; there is a generation relationship between two process nodes on the same edge in the target process tree; the target process tree includes at least one process chain; each process chain includes at least one process node.

[0137] Step 1012, for each process node in the target process tree, the process behavior characteristics corresponding to the process node are compared with the process behavior characteristics corresponding to each process node in the abnormal process tree library, and the process nodes with consistent characteristics in the target process tree are regarded as abnormal process nodes.

[0138] Step 1014: determine connected abnormal process nodes from the matched abnormal process nodes to obtain a plurality of candidate abnormal process nodes.

[0139] Step 1016: determine abnormal process nodes with the same process behavior characteristics from multiple candidate abnormal process nodes.

[0140] Step 1018, deduplicate abnormal process nodes with the same process behavior characteristics to obtain target abnormal process nodes.

[0141] Step 1020: If the number of target abnormal process nodes is greater than a preset number threshold, it is preliminarily determined that the target process tree is abnormal.

[0142] Step 1022, when the target process tree is initially detected to be abnormal, a mapping relationship between a preset process behavior feature and an attack stage is determined.

[0143] Step 1024: for each abnormal process node, based on the mapping relationship, determine the attack stage mapped to the process behavior feature corresponding to the abnormal process node, and obtain the attack stage corresponding to the abnormal process node.

[0144] Step 1026: If there is at least one execution-type stage in the attack stages corresponding to the abnormal process nodes in the target process tree, the target process tree is determined to be abnormal.

[0145] It can be understood that when the abnormal process detection method is applied to the scenario of attack detection on a cloud host, if the target process tree of the cloud host is abnormal, it can be determined that there is a process attacking the cloud host among the multiple processes running on the cloud host. Then, steps 1028 to 1032 can be executed to generate target alarm information for the attacked cloud host.

[0146] Step 1028, generating corresponding single point alarm information for each abnormal process node in the target process tree.

[0147] Step 1030, after the target process tree is advanced detected to be abnormal, for each process chain in the target process tree, the single point alarm information corresponding to each abnormal process node on the process chain is connected in series to obtain the alarm information corresponding to the process chain.

[0148] Step 1032, merging the alarm information corresponding to each process chain in the target process tree, obtaining target alarm information and outputting it.

[0149] It can be understood that outputting the target alarm information can provide an alert for situations where the cloud host is attacked by a process, thereby avoiding situations where the cloud host is attacked without knowing it, thereby improving the security of the cloud host.

[0150] It should be noted that the abnormal process detection method of the above embodiment is not limited to attack detection scenarios against cloud hosts, but can also be applied to detect abnormal processes in other scenarios, because computer devices in general environments (i.e., non-cloud environments) may also be attacked by processes. For example, ordinary computer terminals may also be attacked by hackers using processes. Therefore, the abnormal process detection method of the present application can also be applied to attack detection scenarios against computer devices in general environments. There is no limitation on this.

[0151] In order to more clearly understand how the abnormal process detection method in the embodiment of the present application is applied in the scenario of attack detection against the cloud host, the following specific description is now made. Specifically, the cloud host can obtain an initial process tree constructed based on the generation relationship between multiple processes running locally; the initial process tree includes at least one process node storing a process command and command parameters corresponding to the process command; there is a generation relationship between two process nodes on the same edge in the initial process tree. The process commands with different forms but the same functions stored in each process node in the initial process tree are homogenized so that each process command with the same function has the same form, and a homogenized process tree is obtained. The command parameters of the process nodes in the homogenized process tree are feature extracted to obtain command parameter features. The process command and command parameter features in the process node are feature extracted to obtain process behavior features, and a target process tree is constructed based on the process behavior features; the process nodes of the target process tree store process behavior features.

[0152] The cloud host can obtain a target process tree constructed based on a generation relationship between multiple processes; the target process tree includes at least one process node; there is a generation relationship between two process nodes on the same edge in the target process tree; the target process tree includes at least one process chain; each process chain includes at least one process node. For each process node in the target process tree, the process behavior characteristics corresponding to the process node are compared with the process behavior characteristics corresponding to each process node in the abnormal process tree library, and the process nodes with consistent characteristics in the target process tree are used as abnormal process nodes. From the matched abnormal process nodes, connected abnormal process nodes are determined to obtain multiple candidate abnormal process nodes. From the multiple candidate abnormal process nodes, abnormal process nodes with the same process behavior characteristics are determined. Abnormal process nodes with the same process behavior characteristics are deduplicated to obtain target abnormal process nodes. If the number of target abnormal process nodes is greater than the preset number threshold, it is preliminarily determined that the target process tree is abnormal.

[0153] In the case of preliminary detection of abnormalities in the target process tree, the cloud host can determine the mapping relationship between the preset process behavior characteristics and the attack stage. For each abnormal process node, based on the mapping relationship, determine the attack stage mapped to the process behavior characteristics corresponding to the abnormal process node, and obtain the attack stage corresponding to the abnormal process node. If there is at least one stage of the execution type in the attack stages corresponding to the abnormal process nodes in the target process tree, the target process tree is determined to be abnormal. It can be understood that if the target process tree is detected to be abnormal, it is determined that there is a process that attacks the cloud host among the multiple processes running on the cloud host. If the target process tree is detected to be normal, it is determined that there is no process that attacks the cloud host among the multiple processes running on the cloud host.

[0154] The cloud host can generate corresponding single-point alarm information for each abnormal process node in the target process tree. After the target process tree is detected to be abnormal, for each process chain in the target process tree, the single-point alarm information corresponding to each abnormal process node on the process chain is connected in series to obtain the alarm information corresponding to the process chain. The alarm information corresponding to each process chain in the target process tree is merged to obtain the target alarm information and output it. Through the abnormal process detection method of the present application, the abnormal process detection accuracy of the cloud host deployed in the cloud environment can be improved.

[0155] The present application also provides an application scenario, that is, the abnormal process detection method in the present application can be applied to attack detection scenarios for computer devices deployed in non-cloud environments. It can be understood that there are a lot of important data stored on computer devices, and it is necessary to perform abnormal detection on the processes received by the computer devices and intervene in the detected abnormal processes to prevent the occurrence of security risk events such as virus propagation, vulnerability exploitation and data leakage, thereby ensuring the security of data on computer devices. Through the abnormal process detection method of the present application, the accuracy of abnormal process detection for computer devices deployed in non-cloud environments can be improved.

[0156] It should be understood that, although each step in the flow chart of the above-mentioned embodiments is shown in order, these steps are not necessarily performed in order. Unless there is a clear explanation in this article, the execution of these steps does not have strict order restrictions, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the above-mentioned embodiments may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily performed in order, but can be performed in turn or alternately with at least a portion of other steps or sub-steps or stages of other steps.

[0157] In one embodiment, Fig.11As shown, an abnormal process detection device 1100 is provided. The device can adopt a software module or a hardware module, or a combination of the two to form a part of a computer device. The device specifically includes:

[0158] An acquisition module 1102 is used to acquire a target process tree constructed based on a generation relationship between multiple processes; the target process tree includes at least one process node; there is a generation relationship between two process nodes on the same edge in the target process tree;

[0159] The matching module 1104 is used to match each process node in the target process tree with the process nodes in the pre-built abnormal process tree library to obtain matched abnormal process nodes;

[0160] A detection module 1106, configured to perform preliminary anomaly detection on the target process tree based on the connectivity between the abnormal process nodes;

[0161] A mapping module 1108 is used to map the process behavior characteristics corresponding to the abnormal process node when the target process tree is initially detected to be abnormal, and obtain the attack stage corresponding to the abnormal process node;

[0162] The detection module 1106 is also used to perform advanced anomaly detection on the target process tree according to the attack stages corresponding to the abnormal process nodes in the target process tree, and obtain an anomaly detection result for the target process tree.

[0163] In one embodiment, the mapping module 1108 is also used to determine the mapping relationship between the preset process behavior characteristics and the attack stage; for each abnormal process node, based on the mapping relationship, the attack stage mapped to the process behavior characteristics corresponding to the abnormal process node is determined to obtain the attack stage corresponding to the abnormal process node.

[0164] In one embodiment, the detection module 1106 is further configured to determine that the target process tree is abnormal if there is at least one execution-type stage in the attack stages corresponding to the abnormal process nodes in the target process tree.

[0165] In one embodiment, the target process tree includes at least one process chain; each process chain includes at least one process node; the device further includes:

[0166] The merging module is used to generate corresponding single-point alarm information for each abnormal process node in the target process tree; after the advanced detection of the abnormality of the target process tree, for each process chain in the target process tree, the single-point alarm information corresponding to each abnormal process node on the process chain is connected in series to obtain the alarm information corresponding to the process chain; the alarm information corresponding to each process chain in the target process tree is merged to obtain the target alarm information and output it.

[0167] In one embodiment, the apparatus further comprises:

[0168] The first construction module is used to obtain at least one historical alarm information; the historical alarm information is the alarm information obtained by performing anomaly detection on each process node in at least one historical process tree; for each historical alarm information, the process node targeted by the historical alarm information is determined, and the alarm process node corresponding to the historical alarm information is obtained, and from the process tree where the alarm process node is located, a process subtree with the alarm process node as a new root node is extracted to obtain the process subtree corresponding to the historical alarm information; according to the process subtrees corresponding to each historical alarm information, an abnormal process tree library is constructed.

[0169] In one embodiment, the detection module 1106 is also used to determine the connected abnormal process nodes from the matched abnormal process nodes to obtain the target abnormal process nodes; if the number of the target abnormal process nodes is greater than a preset number threshold, it is preliminarily determined that the target process tree is abnormal.

[0170] In one embodiment, the detection module 1106 is also used to determine the connected abnormal process nodes from the matched abnormal process nodes to obtain multiple candidate abnormal process nodes; determine the abnormal process nodes with the same process behavior characteristics from the multiple candidate abnormal process nodes; and deduplicate the abnormal process nodes with the same process behavior characteristics to obtain the target abnormal process node.

[0171] In one embodiment, the matching module 1104 is also used to compare the process behavior characteristics corresponding to each process node in the target process tree with the process behavior characteristics corresponding to each process node in the abnormal process tree library, and to use the process nodes in the target process tree with consistent characteristics as abnormal process nodes.

[0172] In one embodiment, a process node of the target process tree stores a process behavior feature; the stored process behavior feature is extracted based on a process command corresponding to the process node; the device further includes:

[0173] The second construction module is used to obtain an initial process tree constructed based on a generation relationship between multiple processes; the initial process tree includes at least one process node storing a process command; there is a generation relationship between two process nodes on the same edge in the initial process tree; the process commands with different forms but the same functions stored in the process nodes in the initial process tree are homogenized so that the process commands with the same function have the same form to obtain a homogenized process tree; the process commands in the process nodes of the homogenized process tree are feature extracted to obtain process behavior features, and a target process tree is constructed based on the process behavior features.

[0174] In one embodiment, the process node of the target process tree also stores command parameters corresponding to the process command; the stored process behavior features are extracted based on the process command corresponding to the process node and the command parameters corresponding to the process command; the second construction module is also used to extract features of the command parameters of the process nodes in the homogenized process tree to obtain command parameter features; extract features of the process commands and command parameter features in the process nodes to obtain process behavior features, and construct the target process tree based on the process behavior features.

[0175] In one embodiment, the apparatus further comprises:

[0176] The update module is used to determine the process node in the abnormal process tree library that causes the false alarm of the target process tree abnormality when the abnormal detection result indicates that the target process tree is abnormal, but the target process tree is not really abnormal, and delete the process node that causes the false alarm to update the abnormal process tree library.

[0177] In one embodiment, the acquisition module 1102 is also used to obtain the target process tree of the host; the target process tree is constructed based on the generation relationship between multiple processes running on the host; the detection module 1106 is also used to determine whether there is a process that attacks the host among the multiple processes if the abnormality detection result for the target process tree indicates that the target process tree is abnormal.

[0178] The above abnormal process detection device obtains a target process tree constructed based on a generative relationship between multiple processes; the target process tree includes at least one process node; there is a generative relationship between two process nodes on the same side in the target process tree, and each process node in the target process tree is matched with a process node in a pre-constructed abnormal process tree library. Since each process node in the abnormal process tree library is abnormal, the abnormal process node in the target process tree can be determined more accurately. Then, the target process tree is preliminarily detected for abnormality based on the connectivity between the abnormal process nodes, and whether the target process tree is abnormal can be preliminarily detected more accurately. In the case of preliminary detection of the abnormality of the target process tree, the process behavior characteristics corresponding to the abnormal process node are mapped to obtain the attack stage corresponding to the abnormal process node. Since there is a generative relationship between two process nodes on the same side in the target process tree, the target process tree is advancedly detected for abnormality through the attack stages corresponding to each abnormal process node in the target process tree. In this way, the information of the attack process corresponding to each abnormal process node in the target process tree is comprehensively considered, and the abnormal detection result for the target process tree can be accurately obtained, thereby improving the detection accuracy of the abnormal process.

[0179] Each module in the abnormal process detection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0180] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig.12 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an abnormal process detection method is implemented.

[0181] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Fig.13As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, an abnormal process detection method is implemented. The display unit of the computer device is used to form a visually visible image, and can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse, etc.

[0182] Those skilled in the art will understand that Fig.12 and Fig.13 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0183] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0184] In one embodiment, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0185] In one embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0186] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0187] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0188] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0189] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for detecting abnormal processes, characterized in that: The method comprises: Obtain at least one historical alarm information; the historical alarm information is alarm information obtained by performing anomaly detection on each process node in at least one historical process tree; For each piece of historical alarm information, determine the process node targeted by the historical alarm information, obtain the alarm process node corresponding to the historical alarm information, and extract a process subtree with the alarm process node as a new root node from the process tree where the alarm process node is located, to obtain the process subtree corresponding to the historical alarm information; Constructing an abnormal process tree library according to the process subtrees corresponding to each of the historical alarm information; Obtain a target process tree constructed based on a generation relationship between multiple processes; the target process tree includes at least one process node; and there is a generation relationship between two process nodes on the same edge in the target process tree; For each process node in the target process tree, the process behavior feature corresponding to the process node is compared with the process behavior feature corresponding to each process node in the abnormal process tree library, and the process nodes with the same feature comparison in the target process tree are taken as abnormal process nodes; the abnormal process tree library is a database composed of abnormal process trees; Performing preliminary anomaly detection on the target process tree based on the connectivity between the abnormal process nodes; In the case of preliminary detection of the target process tree being abnormal, mapping the process behavior characteristics corresponding to the abnormal process node to obtain the attack stage corresponding to the abnormal process node; the attack stage refers to the stage of the process corresponding to the abnormal process node during the attack process; If there is at least one execution-type stage in the attack stages respectively corresponding to the abnormal process nodes in the target process tree, the target process tree is determined to be abnormal.

2. The method according to claim 1, characterized in that The mapping of the process behavior feature corresponding to the abnormal process node to obtain the attack stage corresponding to the abnormal process node includes: Determine the mapping relationship between the preset process behavior characteristics and the attack stages; For each abnormal process node, based on the mapping relationship, an attack stage mapped to the process behavior feature corresponding to the abnormal process node is determined to obtain the attack stage corresponding to the abnormal process node.

3. The method according to claim 1, characterized in that The target process tree includes at least one process chain; each process chain includes at least one process node; the method further includes: Generate corresponding single point alarm information for each abnormal process node in the target process tree; After the target process tree is detected to be abnormal, for each process chain in the target process tree, single point alarm information corresponding to each abnormal process node on the process chain is connected in series to obtain alarm information corresponding to the process chain; The alarm information corresponding to each process chain in the target process tree is merged to obtain the target alarm information and output it.

4. The method according to claim 1, characterized in that: The preliminary abnormality detection of the target process tree based on the connectivity between the abnormal process nodes includes: Determine the connected abnormal process nodes from the matched abnormal process nodes to obtain the target abnormal process node; If the number of the target abnormal process nodes is greater than a preset number threshold, the target process tree is preliminarily determined to be abnormal.

5. The method according to claim 4, characterized in that The step of determining connected abnormal process nodes from the matched abnormal process nodes to obtain a target abnormal process node includes: Determine connected abnormal process nodes from the matched abnormal process nodes to obtain multiple candidate abnormal process nodes; Determining abnormal process nodes having the same process behavior characteristics from the multiple candidate abnormal process nodes; Abnormal process nodes with the same process behavior characteristics are deduplicated to obtain target abnormal process nodes.

6. The method according to claim 1, characterized in that The process node of the target process tree stores process behavior characteristics; The stored process behavior features are extracted based on the process commands corresponding to the process nodes; the method further includes a target process tree construction step, the target process tree construction step including: Acquire an initial process tree constructed based on a generation relationship between multiple processes; the initial process tree includes at least one process node storing the process command; there is a generation relationship between two process nodes on the same edge of the initial process tree; Performing homogeneous conversion on the process commands having different forms but the same function stored in the process nodes in the initial process tree, so that the process commands having the same function have the same form, thereby obtaining a homogenized process tree; Feature extraction is performed on process commands in process nodes of the homogenized process tree to obtain process behavior features, and a target process tree is constructed based on the process behavior features.

7. The method according to claim 6, characterized in that The process node of the target process tree also stores a command parameter corresponding to the process command; the stored process behavior feature is extracted based on the process command corresponding to the process node and the command parameter corresponding to the process command; the feature extraction of the process command in the process node of the homogenized process tree to obtain the process behavior feature, and the target process tree is constructed based on the process behavior feature, including: Extracting features of command parameters of process nodes in the homogenized process tree to obtain command parameter features; Feature extraction is performed on the process command and the command parameter features in the process node to obtain process behavior features, and a target process tree is constructed based on the process behavior features.

8. The method according to claim 1, characterized in that The method further comprises: When the abnormality detection result indicates that the target process tree is abnormal, but the target process tree is not really abnormal, the process node in the abnormal process tree library that causes the target process tree to be falsely reported as abnormal is determined, and the process node that causes the false report is deleted to update the abnormal process tree library.

9. The method according to any one of claims 1 to 8, characterized in that The step of obtaining a target process tree constructed based on a generation relationship between multiple processes includes: Obtaining a target process tree of a host; the target process tree is constructed according to a generation relationship between multiple processes running on the host; The method further comprises: If the abnormality detection result for the target process tree indicates that the target process tree is abnormal, it is determined that there is a process that attacks the host among the multiple processes.

10. An abnormal process detection device, characterized in that: The device comprises: The first construction module is used to obtain at least one historical alarm information; the historical alarm information is alarm information obtained by performing abnormal detection on each process node in at least one historical process tree; for each historical alarm information, determine the process node targeted by the historical alarm information, obtain the alarm process node corresponding to the historical alarm information, and extract the process subtree with the alarm process node as the new root node from the process tree where the alarm process node is located, to obtain the process subtree corresponding to the historical alarm information; construct an abnormal process tree library according to the process subtrees corresponding to each of the historical alarm information; An acquisition module, used for acquiring a target process tree constructed based on a generation relationship between multiple processes; the target process tree includes at least one process node; there is a generation relationship between two process nodes on the same edge in the target process tree; a matching module, for comparing, for each process node in the target process tree, the process behavior features corresponding to the process node with the process behavior features corresponding to each process node in the abnormal process tree library, and taking the process nodes in the target process tree with consistent features as abnormal process nodes; the abnormal process tree library is a database consisting of abnormal process trees; A detection module, configured to perform preliminary anomaly detection on the target process tree based on the connectivity between the abnormal process nodes; A mapping module is used to map the process behavior characteristics corresponding to the abnormal process node when the target process tree is initially detected to be abnormal, so as to obtain the attack stage corresponding to the abnormal process node; the attack stage refers to the stage of the process corresponding to the abnormal process node during the attack process; The detection module is also used to determine that the target process tree is abnormal if there is at least one execution type stage in the attack stages respectively corresponding to the abnormal process nodes in the target process tree.

11. The device according to claim 10, characterized in that The mapping module is also used to determine the mapping relationship between the preset process behavior characteristics and the attack stage; for each abnormal process node, based on the mapping relationship, determine the attack stage mapped to the process behavior characteristics corresponding to the abnormal process node, and obtain the attack stage corresponding to the abnormal process node.

12. The device according to claim 10, characterized in that The target process tree includes at least one process chain; each process chain includes at least one process node; the device also includes: A merging module is used to generate corresponding single-point alarm information for each abnormal process node in the target process tree; after the advanced detection of the abnormality of the target process tree, for each process chain in the target process tree, the single-point alarm information corresponding to each abnormal process node on the process chain is connected in series to obtain the alarm information corresponding to the process chain; the alarm information corresponding to each process chain in the target process tree is merged to obtain the target alarm information and output it.

13. The device according to claim 10, characterized in that The detection module is also used to determine the connected abnormal process nodes from the matched abnormal process nodes to obtain the target abnormal process nodes; if the number of the target abnormal process nodes is greater than a preset number threshold, the target process tree is preliminarily determined to be abnormal.

14. The device according to claim 13, characterized in that The detection module is also used to determine connected abnormal process nodes from the matched abnormal process nodes to obtain multiple candidate abnormal process nodes; determine abnormal process nodes with the same process behavior characteristics from the multiple candidate abnormal process nodes; and deduplicate the abnormal process nodes with the same process behavior characteristics to obtain target abnormal process nodes.

15. The device according to claim 10, characterized in that The process node of the target process tree stores process behavior characteristics; The stored process behavior features are extracted based on the process commands corresponding to the process nodes; the device also includes: A second construction module is used to obtain an initial process tree constructed based on a generation relationship between multiple processes; The initial process tree includes at least one process node storing the process command; a generative relationship exists between two process nodes on the same edge in the initial process tree; homogenization is performed on process commands with different forms but the same functions stored in the process nodes in the initial process tree so that the process commands with the same functions have the same form, thereby obtaining a homogenized process tree; feature extraction is performed on the process commands in the process nodes of the homogenized process tree to obtain process behavior features, and a target process tree is constructed based on the process behavior features.

16. The device according to claim 15, characterized in that The process node of the target process tree also stores command parameters corresponding to the process command; the stored process behavior features are extracted based on the process command corresponding to the process node and the command parameters corresponding to the process command; the second construction module is also used to extract features of the command parameters of the process nodes in the homogenized process tree to obtain command parameter features; Feature extraction is performed on the process command and the command parameter features in the process node to obtain process behavior features, and a target process tree is constructed based on the process behavior features.

17. The device according to claim 10, characterized in that The device also includes: An updating module is used to determine the process node in the abnormal process tree library that causes a false alarm of the target process tree abnormality when the abnormal detection result indicates that the target process tree is abnormal, but the target process tree is not really abnormal, and delete the process node that causes the false alarm to update the abnormal process tree library.

18. The device according to any one of claims 10 to 17, characterized in that The acquisition module is also used to obtain the target process tree of the host; the target process tree is constructed according to the generation relationship between multiple processes running on the host; the detection module is also used to determine whether there is a process attacking the host among the multiple processes if the abnormality detection result of the target process tree indicates that the target process tree is abnormal.

19. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

20. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

21. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images