A detection method, device, electronic device, and computer readable medium

Abstract

The present application discloses a detection method, device, electronic device, and computer-readable medium. The method includes: after obtaining a first event generated for the detection object, matching the first event with each final state condition in the final state condition set learned for the detection object; when a certain final state condition in the final state condition set is matched and hits the corresponding short-circuit value, the judgment result corresponding to the matched final state condition is directly used as the judgment result corresponding to each detection rule associated with the matched final state condition; the judgment result is used to characterize whether there is an abnormal situation in the detection object determined based on the first event, so that the purpose of determining the judgment results of multiple detection rules at the same time with the help of the matching result corresponding to a single final state condition can be achieved, so that the purpose of single-calculation batch judgment can be achieved with the help of these final state conditions, so that the resource consumption of threat intrusion detection processing can be effectively reduced.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a detection method, device, electronic device, and computer-readable medium. Background Art

[0002] With the development of the Internet, the application areas of information security technology are becoming more and more extensive.

[0003] For example, in some business scenarios, a detection rule set can be set in advance for a certain business, so that the detection rule set and actual events that occur under the business can be used to determine whether the business has risks, thereby improving the security of the business.

[0004] In fact, when the detection rule set for a certain business is more complex, each event detection process involved in the business has a large amount of computational complexity, and each event detection process requires the consumption of more resources. When the amount of event data involved in the business is relatively large, the existing detection method will consume a lot of computing resources and it is difficult to guarantee timeliness. Summary of the invention

[0005] In order to solve the above technical problems, the present application provides a detection method, device, electronic device, and computer-readable medium, which can effectively improve the detection efficiency of each event to ensure high real-time performance in application scenarios with large amounts of data.

[0006] In order to achieve the above objectives, the technical solutions provided by this application are as follows:

[0007] The present application provides a detection method, which comprises:

[0008] Acquire a first event generated for a detection object; the first event is used to detect whether there is a business abnormality in the detection object;

[0009] Acquire a final state condition set learned for the detection object, the final state condition set comprising: based on the number of hits of each short-circuit condition in the short-circuit condition set against the corresponding short-circuit value generated by the historical events for the detection object, select at least one short-circuit condition with a higher hit count from the short-circuit condition set; the short-circuit condition set comprises: at least one sub-condition obtained by parsing the detection rule set corresponding to the detection object and capable of independently and directly determining the final determination result of the detection rule; wherein the short-circuit value corresponding to the short-circuit condition hit indicates that the determination result of the detection rule corresponding to the short-circuit condition is the short-circuit value;

[0010] The first event is matched with each final state condition in the final state condition set. When a final state condition in the final state condition set is matched and hits the corresponding short-circuit value, the matching result corresponding to the matched final state condition is directly used as the judgment result corresponding to each detection rule associated with the matched final state condition. The judgment result is used to characterize whether there is an abnormal situation in the detection object determined based on the first event.

[0011] In a possible implementation manner, the method further includes:

[0012] Acquire historical events generated for the detection object, where the historical events are iteratively updated as the detection process progresses;

[0013] Parsing the detection rule set corresponding to the detection object to obtain a short-circuit condition set, wherein the short-circuit condition set includes: at least one sub-condition that can independently and directly determine the final determination result of the detection rule;

[0014] Matching the historical events with the short-circuit conditions in the short-circuit condition set corresponding to each detection rule, and counting the number of hits corresponding to the short-circuit conditions that match the hit short-circuit value;

[0015] For each detection rule in the detection rule set, the short-circuit condition with the largest number of hits corresponding to the detection rule is selected as the final state condition, and the final state condition set including at least one final state condition is generated. The final state condition set is dynamically updated as historical events are iteratively updated.

[0016] In a possible implementation manner, the parsing of the detection rule set corresponding to the detection object to obtain the short-circuit condition set includes:

[0017] Decomposing the detection rules in the detection rule set into Boolean operation expressions between sub-conditions by using regular expressions, extracting the short-circuit conditions based on the Boolean operation expressions to generate the short-circuit condition set; or,

[0018] The detection rule is decomposed and converted into a Boolean operation expression between sub-conditions by a short-circuit algorithm, and the short-circuit condition is extracted based on the Boolean operation expression to generate the short-circuit condition set.

[0019] In a possible implementation manner, the method further includes:

[0020] When none of the final state conditions in the final state condition set is matched to hit the corresponding short-circuit value, other short-circuit conditions except the final state condition set in the short-circuit condition set corresponding to the detection rule set are used to detect the first event to obtain a corresponding determination result.

[0021] In a possible implementation manner, the method further includes:

[0022] In the process of detecting the first event based on the other short-circuit conditions, if the final state condition is encountered, the detection result of the final state condition for the first event is reused.

[0023] In a possible implementation manner, obtaining a first event generated for the detection object includes:

[0024] Acquire a first system event generated for the target container, where the first system event includes any one or more of a file read / write event, a process execution event, and a network connection event;

[0025] The acquiring of a final state condition set learned for the detection object includes:

[0026] A final state condition set learned for the target container is obtained; the final state condition set includes: based on the hit count of each short-circuit condition in the short-circuit condition set by historical system events generated for the target container, at least one short-circuit condition with a higher hit count is selected from the short-circuit condition set; the short-circuit condition set includes: at least one sub-condition that is obtained by parsing the container intrusion detection rule set corresponding to the target container and can independently and directly determine the final determination result of the container intrusion detection rule; the container intrusion detection rule set includes multiple container intrusion detection rules, and the detection results corresponding to the container intrusion detection rules include risk or no risk; the container intrusion detection rules in the container intrusion detection rule set have the same detection sub-condition reuse.

[0027] In a possible implementation manner, obtaining a first system event generated for a target container includes:

[0028] The original system event generated for the target container is collected as a first system event through a security probe, where the first system event includes any one of a file read and write event, a process execution event, and a network connection event. The first system event is used to detect whether there is a security risk in the target container based on a terminal state condition set corresponding to the target container.

[0029] The present application also provides a detection device, comprising:

[0030] A first acquisition unit is used to acquire a first event generated for a detection object; the first event is used to detect whether there is a business abnormality in the detection object;

[0031] A second acquisition unit is used to acquire a final state condition set learned for the detection object, wherein the final state condition set includes: based on the number of hits of each short-circuit condition in the short-circuit condition set hitting the corresponding short-circuit value of the historical events generated for the detection object, selecting at least one short-circuit condition with a higher hit count from the short-circuit condition set; the short-circuit condition set includes: at least one sub-condition that can independently and directly determine the final judgment result of the detection rule obtained by parsing the detection rule set corresponding to the detection object; wherein the short-circuit value corresponding to the short-circuit condition hit indicates that the judgment result of the detection rule corresponding to the short-circuit condition is a short-circuit value;

[0032] A first matching unit is used to match the first event with each final state condition in the final state condition set. When a final state condition in the final state condition set is matched and hits the corresponding short-circuit value, the matching result corresponding to the matched final state condition is directly used as the judgment result corresponding to each detection rule associated with the matched final state condition. The judgment result is used to characterize whether there is an abnormal situation in the detection object determined based on the first event.

[0033] The present application also provides an electronic device, the device comprising: a processor and a memory;

[0034] The memory is used to store instructions or computer programs;

[0035] The processor is used to execute the instructions or computer programs in the memory so that the electronic device executes the detection method provided in the present application.

[0036] The present application also provides a computer-readable medium, in which instructions or computer programs are stored. When the instructions or computer programs are executed on a device, the device executes the detection method provided by the present application.

[0037] The present application provides a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program codes for executing the detection method provided by the present application.

[0038] Compared with the prior art, this application has at least the following advantages:

[0039] In the technical solution provided by the present application, for a detection object (for example, a container), a final state condition set can be learned in advance for the detection object, so that the final state condition set includes: based on the number of hits of each short-circuit condition in the short-circuit condition set that hits the corresponding short-circuit value based on the historical events generated for the detection object, at least one short-circuit condition with a higher hit count is selected from the short-circuit condition set; the short-circuit condition set includes: at least one sub-condition that is obtained by parsing the detection rule set corresponding to the detection object and can independently and directly determine the final judgment result of the detection rule; wherein the short-circuit value corresponding to the short-circuit condition hit represents that the judgment result of the detection rule corresponding to the short-circuit condition is a short-circuit value, so that the final state condition set can assist in improving the threat intrusion detection processing for the detection object, so that after obtaining the first event generated for the detection object (for example, system events such as file read and write events, process execution events, and network connection events), the first event is The component is matched with each final state condition in the final state condition set. When a final state condition in the final state condition set is matched and hits the corresponding short-circuit value, the judgment result corresponding to the matched final state condition is directly used as the judgment result corresponding to each detection rule associated with the matched final state condition. The judgment result is used to characterize whether there is an abnormal situation in the detection object determined based on the first event. In this way, the purpose of determining the judgment results of multiple detection rules at the same time with the help of the matching result corresponding to a single final state condition can be achieved, so that the purpose of single calculation batch judgment can be achieved with the help of these final state conditions, and then the adverse effects (for example, large resource consumption, etc.) caused by directly using all detection rules to calculate rawdata one by one can be effectively avoided. In this way, the resource consumption of threat intrusion detection processing can be effectively reduced, so as to effectively improve the detection efficiency of each event, so as to ensure high real-time performance in application scenarios with large amounts of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0041] Figure 1 A flow chart of a detection method provided in an embodiment of the present application;

[0042] Figure 2 A schematic diagram of the working principle of a rule accelerator provided in an embodiment of the present application;

[0043] Figure 3 A schematic diagram of the working principle of a pattern learner provided in an embodiment of the present application;

[0044] Figure 4 A schematic diagram of a threat intrusion detection process provided by an embodiment of the present application;

[0045] Figure 5 A schematic diagram of the structure of a detection device provided in an embodiment of the present application;

[0046] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to facilitate understanding of the technical solution provided by this application, some technical terms involved in this application are explained below.

[0048] Container is a kernel-lightweight virtualization technology at the operating system layer that can form an isolated operating system space for running certain services. It should be noted that for an application deployed on a terminal, the application can use at least one container to provide services.

[0049] Raw system events (rawdata) refer to system events collected by security probes, such as process execution events, file read and write events, network connection events, etc.

[0050] The threat intrusion detection rule refers to the intrusion detection rule configured in some threat intrusion detection products (for example, terminal security products, etc.), so that the threat intrusion detection rule can be used to discover abnormal attack behaviors.

[0051] A short-circuit condition refers to a sub-condition in a Boolean expression that can directly determine the final judgment result of the expression. For example, for the Boolean expression "Sub-condition 1 && Sub-condition 2", both Sub-condition 1 and Sub-condition 2 are short-circuit conditions, that is, as long as any sub-condition (for example, Sub-condition 1 or Sub-condition 2) hits the short-circuit value "FALSE", it can be determined directly that the overall judgment result of the Boolean expression is FALSE without relying on the result of another sub-condition. For ease of understanding, the following four cases are explained.

[0052] Case 1: For a Boolean operation expression expressed in the A&B mode, the short-circuit conditions of the Boolean operation expression are A and B, and the short-circuit value of the Boolean operation expression is FALSE. A represents one condition, B represents another condition, and & represents an AND operation.

[0053] Case 2: For a Boolean operation expression expressed in the A&B&C mode, the short-circuit conditions of the Boolean operation expression are A, B, and C, and the short-circuit value of the Boolean operation expression is FALSE. A represents one condition, B represents another condition, C represents another condition, and & represents an AND operation.

[0054] Case 3: For a Boolean operation expression expressed in the A||B||C pattern, the short-circuit conditions of the Boolean operation expression are A, B, and C, and the short-circuit value of the Boolean operation expression is True. A represents one condition, B represents another condition, C represents another condition, and || represents an OR operation.

[0055] Case 4: For a Boolean operation expression expressed in the A&(B||C) pattern, the short-circuit condition of the Boolean operation expression is A and (B||C), and the short-circuit value of the Boolean operation expression is FALSE. A represents one condition, B represents another condition, C represents another condition, & represents an AND operation, and || represents an OR operation.

[0056] Based on the above content about short-circuit conditions, it can be known that the short-circuit condition is a simplified rule calculation unit. Once the matching result of the short-circuit condition hits the short-circuit value corresponding to the short-circuit condition, the matching result of the entire rule including the short-circuit condition can be directly obtained. For example: for a Boolean operation expression expressed in the A&B&C mode, as long as there is a matching result of FALSE for one of the three short-circuit conditions A, B and C, the threat intrusion detection rule represented by the Boolean operation expression can be directly judged as FALSE.

[0057] It should be noted that for complex threat intrusion detection rules, the Boolean operation expression used to express the "complex threat intrusion detection rule" is also usually relatively complex. For example, there are multiple layers of bracket nesting in the Boolean operation expression (for example, a Boolean operation expression expressed in the (A||B)&C&(((D||E)&&(F||G)) pattern), and the short-circuit condition and short-circuit value corresponding to the Boolean operation expression can be determined by first using any existing or future operation expression parsing algorithm to decompose the problem of the "complex threat intrusion detection rule" and convert it into sub-problems of a single pattern; then, short-circuit condition analysis and processing are performed on each sub-problem obtained by the decomposition.

[0058] Based on the relevant contents of the technical terms above, the relevant contents of the technical solutions provided by this application will be introduced below.

[0059] According to research, in the scenario of container application, the container is usually a microservice instance, so that the container is usually only used to implement a certain service (for example, mysql service or nginx service, etc.), so that the container has the service singleness feature, and the container with service singleness feature has the following advantages: for the same container, the original system events collected by the security probe are relatively stable under normal circumstances (that is, there will not be a large number of inconsistencies in the timing of the previous and next events). For example, for a container used to provide mysql service, the container usually generates a large number of file read and write events and network connection events, and the attribute values ​​of these system events (for example: process name, command parameters, etc.) basically do not change much.

[0060] The study also found that for threat intrusion detection rules, there are only TRUE or FALSE (0 or 1) detection results. The "TRUE" detection result indicates that there is a risk, and the "FALSE" detection result indicates that there is no risk. In addition, because the probability of abnormal attack behavior is very small, the detection result given when using the threat intrusion detection rule to detect an original system event is usually FALSE (that is, no risk), so that the judgment results of some conditions involved in the threat intrusion detection rule (for example, short circuit conditions) are usually regular.

[0061] Based on the above two paragraphs, it can be known that in order to solve the technical problems shown in the background technology section, the present application provides a detection method, in which the event generated by an object (for example, a container) and some final state conditions learned in advance for the object (that is, some short-circuit conditions that are more likely to hit the short-circuit value) can be used to determine whether the object has an abnormal situation. Among them, because the matching time based on these final state conditions is much lower than the rule detection time based on the detection rule set, this can effectively improve the detection efficiency of each event to ensure high real-time performance in application scenarios with large amounts of data.

[0062] In addition, the present application does not limit the application scenario of the above detection method. For example, it can be implemented in any existing or future scenario that requires event detection processing based on detection rules (for example, container intrusion detection scenario, etc.). For ease of understanding, the following is an example.

[0063] As an example, when the detection method provided in the present application is applied to a container intrusion detection scenario, the method can specifically be: based on a detection rule set pre-set for a certain container, learn the final state condition set corresponding to the container, so that the final state condition set can represent the short-circuit conditions required for accelerated detection of the container, so that after obtaining the original system event generated by the container, the original system event is matched with each final state condition in the final state condition set, and when a final state condition in the final state condition set is matched and hits the corresponding short-circuit value, the judgment result corresponding to the matched final state condition is directly used as the judgment result corresponding to each detection rule associated with the matched final state condition, so that the purpose of determining the judgment results of multiple detection rules at the same time with the help of the matching result corresponding to a single final state condition can be achieved, so that the purpose of single-time batch judgment can be achieved with the help of these final state conditions, and then the detection efficiency for each event in the container can be effectively improved to ensure high real-time performance in application scenarios with large amounts of data.

[0064] In addition, the application does not limit the execution subject of the above detection method, for example, the detection method provided by the embodiment of the present application can be applied to a device with a data processing function such as a terminal device or a server. For example, the detection method provided by the embodiment of the present application can also be implemented by means of a data communication process between a terminal device and a server. Wherein, the terminal device can be a smart phone, a computer, a personal digital assistant (PDA) or a tablet computer, etc. The server can be a stand-alone server, a cluster server or a cloud server.

[0065] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0066] In order to better understand the technical solution provided by the present application, the detection method provided by the present application is described below with reference to some drawings. Figure 1 As shown, the detection method provided in the embodiment of the present application includes the following S1-S3. Figure 1 A flow chart of a detection method provided in an embodiment of the present application.

[0067] S1: Acquire a first event generated for a detection object; the first event is used to detect whether there is a business abnormality in the detection object.

[0068] Among them, the detection object refers to the object that needs to be processed by threat intrusion detection using pre-set threat intrusion detection rules (for example, the "detection rule set" below); and this application does not limit the detection object. For example, it can be any object (for example, a container, an application, etc.) that can provide a certain service (for example, MySQL service) to the user. It can be seen that in one possible implementation, when it is necessary to perform threat intrusion detection processing on an application deployed on a terminal, and the application uses at least one container to provide services, the detection object can refer to any one of these containers.

[0069] The first event refers to the original system event generated by the above-mentioned detection object (for example, it can be the original system event collected in real time from the detection object using a security probe), so that the first event can be used to detect whether there is any business abnormality in the detection object; and the present application does not limit the collection method of the system event, for example, it can be implemented with the help of a security probe.

[0070] In addition, the present application is not limited to the implementation method of S1 above. For ease of understanding, an explanation is given below with reference to examples.

[0071] As an example, in some application scenarios (for example, threat intrusion detection scenarios for container loads), the above "detection object" may be a container, and the above "first event" may refer to a system event generated by the container. Based on this, it can be seen that the above S1 may specifically be: obtaining a first system event generated for the target container, the first system event including any one or more of a file read and write event, a process execution event, and a network connection event, and the first system event is used to detect whether there is a business anomaly in the target container. Among them, the target container refers to an object that needs to be processed for threat intrusion detection using pre-set threat intrusion detection rules. The first system event refers to the original system event generated by the target container (for example, a process execution event, a file read and write event, a network connection event, etc.).

[0072] In addition, the present application does not limit the implementation method of the step "obtaining the first system event generated for the target container" in the above paragraph. For example, it can be specifically: collecting the original system event generated for the target container as the first system event through a security probe, so that the first system event includes any one of a file read and write event, a process execution event, and a network connection event, and the first system event is used to detect whether there is a security risk in the target container based on the final state condition set corresponding to the target container. It should be noted that the relevant content of the "final state condition set" can be found in the relevant content of S2 below.

[0073] Based on the relevant content of S1 above, it can be known that in some application scenarios (for example, threat intrusion detection scenarios for container loads), for a detection object (for example, a container), a security probe can be used to collect original system events generated by the detection object from the detection object, so that these original system events can be used to detect whether there are business abnormalities in the detection object.

[0074] S2: Obtain a final-state condition set learned for the detection object, the final-state condition set including: based on the number of hits of each short-circuit condition in the short-circuit condition set against the corresponding short-circuit value generated by historical events for the detection object, select at least one short-circuit condition with a higher hit count from the short-circuit condition set; the short-circuit condition set includes: at least one sub-condition that is obtained by parsing the detection rule set corresponding to the detection object and can independently and directly determine the final judgment result of the detection rule; wherein the short-circuit value corresponding to the short-circuit condition hit indicates that the judgment result of the detection rule corresponding to the short-circuit condition is a short-circuit value.

[0075] The final condition set refers to a set of short-circuit conditions that need to be referred to when accelerating the detection process for the above detection object, so that in the process of threat intrusion detection for the detection object, the final condition set can be used to assist in improving the threat intrusion detection efficiency for the detection object. For example, the final condition set can be Figure 2-4 The "final state condition set" shown.

[0076] In addition, for the above "final state condition set learned for the detection object", the final state condition set may include: based on the number of hits of each short-circuit condition in the short-circuit condition set with the corresponding short-circuit value generated by historical events for the detection object, at least one short-circuit condition with a higher hit count is selected from the short-circuit condition set.

[0077] The above "short-circuit condition set" is obtained by parsing the detection rule set corresponding to the above detection object, so that the "short-circuit condition set" can include: at least one sub-condition obtained by parsing the detection rule set corresponding to the detection object that can independently and directly determine the final judgment result of the detection rule, so that the "short-circuit condition set" can represent the detection rule set. Among them, the short-circuit value corresponding to the short-circuit condition hit represents that the judgment result of the detection rule corresponding to the short-circuit condition is a short-circuit value. For example, the short-circuit condition set can be Figure 2-4 The "Short Circuit Condition Set" shown.

[0078] The above “detection rule set corresponding to the detection object” refers to the threat intrusion detection rules required to be used when performing threat intrusion detection processing on the detection object, so that the “detection rule set corresponding to the detection object” includes the threat intrusion detection rules pre-set for the detection object.

[0079] In addition, the present application does not limit the determination process of the above “short-circuit condition set”, for example, it may include the following steps 11 and 12.

[0080] Step 11: Decompose each detection rule in the detection rule set to obtain a Boolean operation expression corresponding to each detection rule.

[0081] The nth detection rule refers to the nth threat intrusion detection rule recorded in the above detection rule set. n is a positive integer, n≤N, N is a positive integer, and N represents the number of detection rules in the detection rule set.

[0082] The Boolean operation expression corresponding to the nth detection rule is used to characterize the nth detection rule by means of Boolean operation, so that the "Boolean operation expression corresponding to the nth detection rule" can represent the semantic information carried by the nth detection rule. Wherein, n is a positive integer, n≤N.

[0083] In addition, the present application does not limit the determination process of the above "the Boolean operation expression corresponding to the nth detection rule". For example, it can be specifically: decomposing the nth detection rule into a Boolean operation expression between sub-conditions through a regular expression to obtain the Boolean operation expression corresponding to the nth detection rule. For another example, it can be specifically: parsing and decomposing the detection rule into a Boolean operation expression between sub-conditions through a short-circuit algorithm to obtain the Boolean operation expression corresponding to the nth detection rule.

[0084] Step 12: Extract the short-circuit conditions from the Boolean operation expressions corresponding to each detection rule to generate a short-circuit condition set.

[0085] In the present application, for the nth detection rule above, after converting the nth detection rule into a Boolean operation expression, short-circuit condition extraction processing can be performed on the Boolean operation expression to obtain at least one short-circuit condition corresponding to the nth detection rule and the short-circuit value corresponding to the nth detection rule, so that any one of these short-circuit conditions hitting the short-circuit value represents that the judgment result of the nth detection rule is a short-circuit value, so that these short-circuit conditions are helpful in assisting in determining the judgment result of the nth detection rule, so that the above short-circuit condition set can be generated based on at least one short-circuit condition corresponding to the nth detection rule, so that the short-circuit condition set includes at least one short-circuit condition corresponding to the nth detection rule, so that the short-circuit condition set records the short-circuit conditions corresponding to all detection rules in the above detection rule set.

[0086] Based on the relevant contents of steps 11 to 12 above, it can be known that for the above detection rule set, all detection rules in the detection rule set can be first converted into Boolean operation expressions; then the short-circuit conditions extracted from these Boolean operation expressions are used to generate the above short-circuit condition set, so that the short-circuit condition set is used to record the short-circuit conditions corresponding to these detection rules, so that the short-circuit condition set can represent the detection rule set and participate in the threat intrusion detection processing for any container.

[0087] In fact, since the above "detection rule set" usually does not change with time after being configured, this application does not limit the execution time of the above steps 11-12. For example, it can be specifically: after obtaining the detection rule set, execute the steps 11-12, and then construct and store the corresponding relationship between the rule identifier of each detection rule and the short-circuit condition and short-circuit value corresponding to each detection rule, so that the short-circuit condition and short-circuit value corresponding to the detection rule can be queried from the storage space with the help of the rule identifier of any detection rule. Among them, the rule identifier is used to uniquely identify a detection rule.

[0088] It should be noted that the present application does not limit the implementation method of "storing the correspondence between the rule identifier of each detection rule and the short-circuit condition and short-circuit value corresponding to each detection rule" in the above paragraph. For example, it can be specifically: first use the short-circuit condition and short-circuit value corresponding to the nth detection rule to construct the tuple (short-circuit condition corresponding to the nth detection rule, short-circuit value corresponding to the nth detection rule); then construct and store the correspondence between the rule identifier of the nth detection rule and the tuple. Where n is a positive integer, n≤N.

[0089] In fact, due to the different services provided by different containers, the usage of rules presented by different containers in the above detection rule set is different, so that the condition hit status presented by different containers in the short-circuit conditions corresponding to each detection rule is also different. Therefore, in order to better improve the threat intrusion detection effect, the final state condition corresponding to each detection rule can be automatically analyzed from the short-circuit conditions corresponding to each detection rule based on the original system events generated by each container, so that the final state condition can represent the short-circuit condition that is more likely to occur in the container under the detection rule and hits its short-circuit value. For ease of understanding, the following is an explanation in conjunction with the relevant content of the above "Final state condition set learned for the detection object".

[0090] As an example, in a possible implementation, when the above detection rule set includes N detection rules, the above "final state condition set learned for the detection object" may include the final state condition corresponding to the detection object under the first detection rule, the final state condition corresponding to the detection object under the second detection rule, ... (and so on), and the final state condition corresponding to the detection object under the Nth detection rule. Wherein N is a positive integer.

[0091] The above “final state condition corresponding to the detection object under the nth detection rule” (hereinafter referred to as “final state condition corresponding to the nth detection rule”) refers to the short-circuit condition required to be referred to under the nth detection rule when performing accelerated detection processing on the detection object, so that the “final state condition corresponding to the nth detection rule” can represent the short-circuit condition that is more likely to occur under the nth detection rule and hits its short-circuit value, so that when performing threat intrusion detection processing on the detection object later, the purpose of accelerated detection for the nth detection rule can be achieved with the help of the “final state condition corresponding to the nth detection rule”. Wherein, n is a positive integer, n≤N.

[0092] In addition, the present application does not limit the determination process of the above "final state condition corresponding to the nth detection rule". For example, it can be specifically as follows: based on the number of hits of the corresponding short-circuit value of each short-circuit condition in the short-circuit condition set for the historical events generated by the above detection object, a short-circuit condition with the highest number of hits is selected from all the short-circuit conditions corresponding to the nth detection rule, and determined as the "final state condition corresponding to the nth detection rule". The historical event refers to the original system event that was once generated by the detection object. Wherein, n is a positive integer, n≤N.

[0093] In fact, in order to better improve the real-time performance of the above “final state condition set for learning the detection object”, the present application also provides a determination process of the “final state condition set for learning the detection object”, which may specifically include the following steps 21 to 24.

[0094] Step 21: Obtain historical events generated for the detection object. The historical events are updated iteratively during the detection process.

[0095] In the present application, for a detection object, after obtaining the original system event generated by the detection object, not only can the detection object be detected whether there is a business abnormality based on the original system event, but the original system event can also be used to update the above "historical events generated for the detection object" so that the updated "historical events generated for the detection object" can include the original system event. In this way, the purpose of continuously iteratively updating the "historical events generated for the detection object" can be achieved as the detection object is updated, thereby effectively ensuring the real-time performance of the "historical events generated for the detection object", which is conducive to improving the real-time performance of the above "final state condition set learned for the detection object".

[0096] Step 22: parse the detection rule set corresponding to the detection object to obtain a short-circuit condition set, which includes: at least one sub-condition that can independently and directly determine the final judgment result of the detection rule.

[0097] It should be noted that, for the relevant contents of step 22, please refer to the relevant contents of the “short-circuit condition set” above, and for the sake of brevity, it will not be repeated here.

[0098] Step 23: Match the historical events with the short-circuit conditions in the short-circuit condition set corresponding to each detection rule, and count the number of hits corresponding to the short-circuit conditions that match the hit short-circuit value.

[0099] Step 24: For each detection rule in the detection rule set, select the short-circuit condition with the largest number of hits corresponding to the detection rule as the final state condition, and generate a final state condition set including at least one final state condition. The final state condition set is dynamically updated as historical events are iteratively updated.

[0100] It should be noted that the present application does not limit the implementation method of step 24. For example, when the above detection rule set includes N detection rules, and the nth detection rule corresponds to M short-circuit conditions, step 24 can specifically be: after obtaining the number of hits corresponding to the M short-circuit conditions, these short-circuit conditions are sorted from high to low according to the number of hits to obtain the sorting result, and the short-circuit condition with the highest ranking in the sorting result is determined as the final state condition corresponding to the above detection object under the nth detection rule, so that the final state condition set corresponding to the detection object can be generated based on the "final state condition corresponding to the detection object under the nth detection rule" in the subsequent process, so that the final state condition set includes the "final state condition corresponding to the detection object under the nth detection rule". Among them, because the "final state condition corresponding to the detection object under the nth detection rule" will be dynamically updated with the iterative update of historical events, the final state condition set corresponding to the detection object will also be dynamically updated with the iterative update of historical events. This is conducive to better improving the real-time performance of the final state condition set, thereby helping to speed up the threat intrusion detection processing for the detection object.

[0101] Based on the relevant contents of steps 21 to 24 above, it can be seen that in a possible implementation mode, Figure 3 As shown, for a detection object, after obtaining the original system event generated by the detection object, not only can the detection object be detected whether there is a business abnormality based on the original system event, but the short-circuit value hit situation presented by the original system event under the short-circuit conditions corresponding to each detection rule can also be used to update the final state condition set corresponding to the detection object, so that the updated final state condition set can better represent the short-circuit conditions that are more likely to occur in the detection object under these detection rules and hit its short-circuit value.

[0102] In fact, in some application scenarios, there may be multiple containers. Therefore, in order to better improve the detection effect for containers, after learning the final state condition set for a container, a correspondence between the container identifier of the container and the final state condition set corresponding to the container can be constructed and stored, so that the final state condition set corresponding to the container can be queried from the storage space based on the container identifier in the future. The container identifier is used to uniquely identify the container.

[0103] Based on the above content, it can be known that in a possible implementation mode, the above S2 can be specifically as follows: after obtaining the object identification of the above detection object, searching the preset storage space for the final state condition set corresponding to the object identification, and determining it as the final state condition set learned for the detection object. The object identification is used to uniquely identify the detection object. The preset storage space pre-stores the final state condition sets corresponding to different object identifications.

[0104] In addition, the present application does not limit the implementation method of S2 above. For example, in some application scenarios (for example, threat intrusion detection scenarios for container loads), when the above "detection object" is a target container and the above "detection rule set" is a container intrusion detection rule set, S2 can be specifically: obtaining a final state condition set for learning the target container; the final state condition set includes: based on the number of hits of each short-circuit condition in the short-circuit condition set by historical system events generated for the target container, selecting at least one short-circuit condition with a higher hit count from the short-circuit condition set; the short-circuit condition set includes: parsing the container intrusion detection rule set corresponding to the target container to obtain at least one sub-condition that can independently and directly determine the final judgment result of the container intrusion detection rule; the container intrusion detection rule set includes multiple container intrusion detection rules (for example, threat intrusion detection rules pre-set for the target container), and the detection results corresponding to the container intrusion detection rules include risk or no risk; the container intrusion detection rules in the container intrusion detection rule set have the same detection sub-condition reuse. Among them, please refer to the above for the relevant content of the target container. The container intrusion detection rule set refers to a set of threat intrusion detection rules that need to be referenced when performing threat intrusion detection processing on the target container; and the container intrusion detection rule set can be preset. The historical system event refers to the original system event that has been generated by the target container; and the relevant content of the "historical system event" is similar to the above "historical event".

[0105] It should be noted that the specific meaning of "the container intrusion detection rules in the container intrusion detection rule set have the same detection sub-conditions reused" in the previous paragraph is: if multiple container intrusion detection rules correspond to the same short-circuit condition, then after determining the matching result presented by an original system event under the short-circuit condition, the matching result can be directly used to determine the judgment results of these container intrusion detection rules without calculating the matching result multiple times, which can effectively save detection time.

[0106] Based on the relevant content of S2 above, it can be known that under a possible implementation mode, for a detection object, after obtaining the original system event generated by the detection object, the final state condition set learned for the detection object can be queried based on the object identification of the detection object, so that the detection acceleration purpose for the detection object can be achieved with the help of the final state condition set.

[0107] It should be noted that the present application does not limit the correlation between the execution time of S2 and the execution time of S1. For example, the former may be later than the latter. For another example, the latter may be later than the former. For another example, the two may be the same.

[0108] S3: Match the first event with each final state condition in the final state condition set. When a final state condition in the final state condition set is matched and hits the corresponding short-circuit value, the matching result corresponding to the matched final state condition is directly used as the judgment result corresponding to each detection rule associated with the matched final state condition. The judgment result is used to characterize whether there is an abnormal situation in the detection object determined based on the first event.

[0109] To facilitate understanding of S3 above, an example is provided below for explanation.

[0110] As an example, when the above final state condition set includes N final state conditions, the above S3 may specifically include the following steps 31 to 34.

[0111] Step 31: Match the first event above with the nth final state condition to obtain a matching result corresponding to the nth final state condition, where n is a positive integer, n≤N.

[0112] The nth final state condition refers to the short-circuit condition with the maximum number of hits that is pre-learned for the above detection object under the nth detection rule.

[0113] The above “matching result corresponding to the nth final state condition” is used to indicate whether the first event above satisfies the nth final state condition, so that the “matching result corresponding to the nth final state condition” can indicate whether the first event hits the short-circuit value corresponding to the nth final state condition under the nth final state condition.

[0114] Step 32: According to the matching result corresponding to the nth final state condition, determine whether the nth final state condition is matched and hits the corresponding short-circuit value. If so, execute the following step 33; if not, execute the following step 34.

[0115] Step 33: When it is determined that the nth final state condition is matched and hits the corresponding short-circuit value, the matching result corresponding to the nth final state condition is directly used as the determination result corresponding to each detection rule associated with the nth final state condition.

[0116] Among them, the detection rule associated with the nth final state condition refers to the detection rule in the above detection rule set, which takes the nth final state condition as the short-circuit condition, and takes the short-circuit value corresponding to the nth final state condition as the short-circuit value corresponding to the short-circuit condition. It can be seen that at least one short-circuit condition corresponding to the "detection rule associated with the nth final state condition" includes the nth final state condition, and the short-circuit value corresponding to the "detection rule associated with the nth final state condition" is the short-circuit value corresponding to the nth final state condition.

[0117] The judgment result corresponding to the i-th detection rule associated with the n-th final state condition is used to characterize whether the first event above complies with the i-th detection rule, so that the "judgment result corresponding to the i-th detection rule associated with the n-th final state condition" can be used to characterize whether there is an abnormality in the above detection object. Wherein, i is a positive integer, i≤I, I is a positive integer, and I represents the number of detection rules associated with the n-th final state condition.

[0118] Step 34: When it is determined that the nth final state condition above is not matched and hits the corresponding short-circuit value, the nth final state condition can be ignored.

[0119] Based on the relevant contents of steps 31 to 33 above, it can be known that for the original system event generated by any container (for example, the "detection object" above), after obtaining the matching result presented by the original system event under the nth final state condition corresponding to the container, if the matching result hits the short-circuit value corresponding to the nth final state condition, it can be determined that the judgment results of each threat intrusion detection rule having a corresponding relationship with the tuple (the nth final state condition, the short-circuit value corresponding to the nth final state condition) have been determined, so the short-circuit value corresponding to the nth final state condition can be directly used to determine the judgment results presented by the original system event under these threat intrusion detection rules. In this way, the purpose of quickly determining the judgment results presented by the original system event under some threat intrusion detection rules can be achieved with the help of the nth final state condition and its corresponding short-circuit value, so that single-calculation batch judgment (such as Figure 4 The purpose of "single calculation batch determination" shown in the figure is to improve the determination efficiency of these threat intrusion detection rules. Wherein, n is a positive integer, n≤N.

[0120] It should be noted that the present application does not limit the implementation method of the step "matching the first event with each final state condition in the final state condition set" in the above S3. For example, it can be achieved by traversal (for example, Figure 2 The traversal method shown in the figure is used for implementation.

[0121] It should also be noted that this application does not limit Figure 2 The traversal order of all the final state conditions shown in , for example, can be determined based on the number of short-circuit value hits corresponding to these final state conditions, so that the traversal timing of the final state conditions with a higher hit number is earlier than the traversal timing of the final state conditions with a lower hit number.

[0122] Based on the relevant contents of S1 to S3 above, it can be known that for the detection method provided in the present application, a final state condition set can be learned in advance for the detection object, so that the final state condition set includes: based on the number of hits of the corresponding short-circuit value of each short-circuit condition in the short-circuit condition set by the historical events generated for the detection object, at least one short-circuit condition with a higher hit count is selected from the short-circuit condition set; the short-circuit condition set includes: at least one sub-condition that is obtained by parsing the detection rule set corresponding to the detection object and can independently and directly determine the final judgment result of the detection rule; wherein, the short-circuit value corresponding to the short-circuit condition hit represents that the judgment result of the detection rule corresponding to the short-circuit condition is a short-circuit value, so that the final state condition set can assist in improving the threat intrusion detection processing for the detection object, so that after obtaining the first event generated for the detection object (for example, system events such as file read and write events, process execution events, and network connection events), the first event is generated. The component is matched with each final state condition in the final state condition set. When a final state condition in the final state condition set is matched and hits the corresponding short-circuit value, the judgment result corresponding to the matched final state condition is directly used as the judgment result corresponding to each detection rule associated with the matched final state condition. The judgment result is used to characterize whether there is an abnormal situation in the detection object determined based on the first event. In this way, the purpose of determining the judgment results of multiple detection rules at the same time with the help of the matching result corresponding to a single final state condition can be achieved, so that the purpose of single calculation batch judgment can be achieved with the help of these final state conditions, and then the adverse effects (for example, large resource consumption, etc.) caused by directly using all detection rules to calculate rawdata one by one can be effectively avoided. In this way, the resource consumption of threat intrusion detection processing can be effectively reduced, so as to effectively improve the detection efficiency of each event, so as to ensure high real-time performance in application scenarios with large amounts of data.

[0123] In fact, in order to better improve the threat intrusion detection effect, the present application also provides another possible implementation of the above detection method, in which, in addition to the above S1-S3, the detection method may also include the following step 41. The execution time of step 41 is later than the execution time of the above S3.

[0124] Step 41: When none of the final state conditions in the final state condition set above is matched to the corresponding short-circuit value, other short-circuit conditions except the final state condition set in the short-circuit condition set corresponding to the detection rule set are used to detect the first event above to obtain the corresponding judgment result.

[0125] In the present application, for all the final state conditions in the above final state condition set, after obtaining the matching results of the first event under all the final state conditions, if these matching results indicate that all the final state conditions have not been matched and hit their respective corresponding short-circuit values, it can be determined that the judgment results of the detection rules in the above detection rule set cannot be directly determined based on the matching results corresponding to these final state conditions. Therefore, the first event can continue to be matched with other short-circuit conditions in the above short-circuit condition set except these final state conditions, and the final judgment results of these detection rules can be determined based on the matching results corresponding to the other short-circuit conditions and the matching results corresponding to these final state conditions.

[0126] In fact, in order to better improve the detection efficiency, the present application also provides a possible implementation method for detection based on the other short-circuit conditions mentioned above, which can be specifically: in the process of detecting the first event based on the other short-circuit conditions mentioned above, if the final state condition is encountered, the detection result of the final state condition for the first event is reused. For ease of understanding, the following is explained with examples.

[0127] As an example, for a certain other short-circuit condition, when the other short-circuit condition is a complex condition composed of a first sub-condition and a second sub-condition, and the first sub-condition exists in the above "final condition set" but the second sub-condition does not exist, the detection process of the first event based on the other short-circuit condition can be specifically as follows: firstly match the second sub-condition with the first event to obtain the matching result corresponding to the second sub-condition; then use the matching result corresponding to the second sub-condition and the matching result corresponding to the first sub-condition that has been obtained to comprehensively determine the judgment result of the other short-circuit condition. Among them, the first sub-condition refers to the sub-condition that exists in the other short-circuit condition and also exists in the above "final condition set". The second sub-condition refers to the sub-condition that exists in the other short-circuit condition but does not exist in the above "final condition set".

[0128] Based on the relevant content of step 41 above, it can be seen that if Figure 2 As shown, for the first event above, after obtaining the matching results presented by the first event under all the final state conditions in the final state condition set above, if these matching results indicate that none of these final state conditions hit their respective corresponding short-circuit values, it is possible to directly return to the conventional calculation mode corresponding to the detection rule set above to obtain the determination results of all detection rules in the detection rule set. In addition, in this conventional calculation mode, if a certain final state condition is encountered, the matching result corresponding to the final state condition can be directly reused without repeated matching, which is conducive to improving the detection efficiency of the detection object.

[0129] Based on the above detection method, it can be seen that Figure 2As shown, the detection scheme provided by the present application involves two modes: an accelerated detection mode (that is, the detection mode shown in S1-S3 above) and a conventional calculation mode (that is, the detection mode shown in step 41 above), and in the detection scheme, the accelerated detection mode will be used preferentially for event detection. Based on this, it can be known that the detection scheme can be specifically as follows: for an original system event generated by a detection object, after the original system event is collected, the final state condition set learned for the detection object is first used to detect whether the original system event has a business abnormality, so as to implement the accelerated detection mode for the detection object, so that when it is determined that the final state condition set cannot be used to directly determine whether the original system event has a business abnormality (that is, all the final state conditions are hits corresponding to their respective short-circuit values), it can be returned to the conventional calculation mode as a bottom-up solution to ensure that it can be smoothly determined whether the original system event has a business abnormality, which is conducive to improving the detection efficiency while ensuring the detection effect.

[0130] Based on the above detection method, it can be seen that the detection method (for example, Figure 4 The detection process shown) includes at least one of the advantages shown below ①-③.

[0131] ① This application utilizes the characteristics of singleness and stability of container workload system events, and combines this characteristic with the strong judgment conditions and high reuse rate in threat intrusion rules. While keeping the system resource usage unchanged, it improves the computational efficiency of intrusion rules and effectively improves the performance of threat intrusion detection in container workloads.

[0132] ② This application decomposes the threat intrusion detection rules, extracts the "short-circuit conditions", and uses the system events in the container workload to iteratively train and learn the "short-circuit conditions", calculates the "final state conditions" of the threat rules that are adaptive to the current container, and forms an intrusion rule model suitable for the container.

[0133] ③ The threat detection processing process provided by this application for any container workload is directly calculated based on the adaptive "final state condition" model. Once the "short-circuit value" is hit, the judgment results of the intrusion rule set can be directly obtained in batches, which greatly improves the calculation efficiency of the threat intrusion rules.

[0134] Based on the detection method provided in the embodiment of the present application, the embodiment of the present application also provides a detection device. Figure 5 Explain and illustrate. Figure 5 This is a schematic diagram of the structure of a detection device provided in an embodiment of the present application. It should be noted that for the technical details of the detection device provided in an embodiment of the present application, please refer to the relevant content of the detection method above.

[0135] like Figure 5 As shown, the detection device 500 provided in the embodiment of the present application includes:

[0136] The first acquisition unit 501 is used to acquire a first event generated for a detection object; the first event is used to detect whether there is a business abnormality of the detection object;

[0137] The second acquisition unit 502 is used to acquire a final state condition set learned for the detection object, wherein the final state condition set includes: based on the number of hits of each short-circuit condition in the short-circuit condition set hitting the corresponding short-circuit value of the historical events generated for the detection object, selecting at least one short-circuit condition with a higher hit count from the short-circuit condition set; the short-circuit condition set includes: at least one sub-condition that can independently and directly determine the final determination result of the detection rule obtained by parsing the detection rule set corresponding to the detection object; wherein the short-circuit value corresponding to the short-circuit condition hit indicates that the determination result of the detection rule corresponding to the short-circuit condition is a short-circuit value;

[0138] The first matching unit 503 is used to match the first event with each final state condition in the final state condition set. When a final state condition in the final state condition set is matched and hits the corresponding short-circuit value, the matching result corresponding to the matched final state condition is directly used as the judgment result corresponding to each detection rule associated with the matched final state condition. The judgment result is used to characterize whether there is an abnormal situation in the detection object determined based on the first event.

[0139] In a possible implementation manner, the detection device 500 further includes:

[0140] A second acquisition unit, used to acquire historical events generated for the detection object, wherein the historical events are iteratively updated as the detection process progresses;

[0141] A condition parsing unit, configured to parse the detection rule set corresponding to the detection object to obtain a short-circuit condition set, wherein the short-circuit condition set includes: at least one sub-condition that can independently and directly determine a final determination result of the detection rule;

[0142] A second matching unit is used to match the historical events with the short-circuit conditions in the short-circuit condition set corresponding to each detection rule, and count the number of hits corresponding to the short-circuit conditions that match the short-circuit value;

[0143] The first generating unit is used to select, for each detection rule in the detection rule set, a short-circuit condition with the largest number of hits corresponding to the detection rule as a final state condition, and generate the final state condition set including at least one final state condition, wherein the final state condition set is dynamically updated as historical events are iteratively updated.

[0144] In one possible implementation, the conditional parsing unit is specifically used to: decompose the detection rules in the detection rule set into Boolean operation expressions between sub-conditions through regular expressions, and extract the short-circuit conditions based on the Boolean operation expressions to generate the short-circuit condition set; or, decompose the detection rules into Boolean operation expressions between sub-conditions through a short-circuit algorithm, and extract the short-circuit conditions based on the Boolean operation expressions to generate the short-circuit condition set.

[0145] In a possible implementation manner, the detection device 500 further includes:

[0146] An event detection unit is used to detect the first event and obtain a corresponding judgment result by using other short-circuit conditions except the final state condition set in the short-circuit condition set corresponding to the detection rule set when none of the final state conditions in the final state condition set is matched and hits the corresponding short-circuit value.

[0147] In a possible implementation manner, the detection device 500 further includes:

[0148] The result multiplexing unit is used to reuse the detection result of the final state condition for the first event if the final state condition is encountered during the detection of the first event based on the other short-circuit conditions.

[0149] In a possible implementation manner, the first acquisition unit 501 is specifically used to: acquire a first system event generated for a target container, where the first system event includes any one or more of a file read / write event, a process execution event, and a network connection event;

[0150] The second acquisition unit 502 is specifically used to: acquire a final state condition set learned for the target container; the final state condition set includes: based on the number of hits of each short-circuit condition in the short-circuit condition set by historical system events generated for the target container, selecting at least one short-circuit condition with a higher hit count from the short-circuit condition set; the short-circuit condition set includes: at least one sub-condition that is obtained by parsing the container intrusion detection rule set corresponding to the target container and can independently and directly determine the final judgment result of the container intrusion detection rule; the container intrusion detection rule set includes multiple container intrusion detection rules, and the detection results corresponding to the container intrusion detection rules include risk or no risk; the container intrusion detection rules in the container intrusion detection rule set have the same detection sub-condition reuse.

[0151] In a possible implementation manner, the first acquisition unit 501 is specifically used to: collect, through a security probe, an original system event generated for the target container as a first system event, where the first system event includes any one of a file read and write event, a process execution event, and a network connection event, and the first system event is used to detect whether there is a security risk currently in the target container based on a final state condition set corresponding to the target container.

[0152] Based on the relevant contents of the above-mentioned detection device 500, it can be known that for the detection device 500 provided in the embodiment of the present application, a final state condition set can be learned in advance for the detection object, so that the final state condition set includes: based on the number of hits of the corresponding short-circuit value of each short-circuit condition in the short-circuit condition set by the historical events generated for the detection object, at least one short-circuit condition with a higher hit count is selected from the short-circuit condition set; the short-circuit condition set includes: at least one sub-condition that can independently and directly determine the final judgment result of the detection rule obtained by parsing the detection rule set corresponding to the detection object; wherein the short-circuit value corresponding to the short-circuit condition hit represents that the judgment result of the detection rule corresponding to the short-circuit condition is a short-circuit value, so that the final state condition set can assist in improving the threat intrusion detection processing for the detection object, so that after obtaining the first event generated for the detection object (for example, file read and write events, process execution events, and system events such as network connection events), The first event is matched with each final state condition in the final state condition set. When a final state condition in the final state condition set is matched and hits the corresponding short-circuit value, the judgment result corresponding to the matched final state condition is directly used as the judgment result corresponding to each detection rule associated with the matched final state condition. The judgment result is used to characterize whether there is an abnormal situation in the detection object determined based on the first event. In this way, the purpose of determining the judgment results of multiple detection rules at the same time with the help of the matching result corresponding to a single final state condition can be achieved, so that the purpose of single calculation batch judgment can be achieved with the help of these final state conditions, and further, the adverse effects (for example, large resource consumption, etc.) caused by directly using all detection rules to calculate rawdata one by one can be effectively avoided. In this way, the resource consumption of threat intrusion detection processing can be effectively reduced, thereby effectively improving the detection efficiency of each event, so as to ensure high real-time performance in application scenarios with large amounts of data.

[0153] In addition, an embodiment of the present application also provides an electronic device, which includes a processor and a memory: the memory is used to store instructions or computer programs; the processor is used to execute the instructions or computer programs in the memory, so that the electronic device executes any implementation of the detection method provided in the embodiment of the present application.

[0154] See also Figure 6, which shows a schematic diagram of the structure of an electronic device 600 suitable for implementing the embodiment of the present disclosure. The terminal device in the embodiment of the present disclosure may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle terminals (such as vehicle navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0155] like Figure 6 As shown, the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 are also stored. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0156] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 6 The electronic device 600 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0157] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0158] The electronic device provided by the embodiment of the present disclosure and the method provided by the above embodiment belong to the same inventive concept, and the technical details not fully described in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0159] The embodiment of the present application also provides a computer-readable medium, in which instructions or computer programs are stored. When the instructions or computer programs are executed on a device, the device executes any implementation of the detection method provided in the embodiment of the present application.

[0160] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0161] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0162] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0163] The computer-readable medium carries one or more programs, and when the one or more programs are executed by the electronic device, the electronic device can execute the method.

[0164] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0165] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0166] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit / module does not, in some cases, constitute a limitation on the unit itself.

[0167] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0168] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0169] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.

[0170] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0171] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0172] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0173] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A detection method, characterized in that: The method comprises: Acquire a first event generated for a detection object; the first event is used to detect whether the detection object has a business abnormality; the first event includes a system event collected by a security probe; A final state condition set learned for the detection object is obtained, the final state condition set comprising: based on the number of hits of each short-circuit condition in the short-circuit condition set against the corresponding short-circuit value generated by the historical events for the detection object, at least one short-circuit condition with a higher hit count is selected from the short-circuit condition set; the short-circuit condition set comprises: at least one sub-condition that can independently and directly determine the final judgment result of the detection rule obtained by parsing the detection rule set corresponding to the detection object; wherein the short-circuit condition refers to a sub-condition in a Boolean operation expression that can directly determine the final judgment result of the expression, and the short-circuit value corresponding to the short-circuit condition hit indicates that the judgment result of the detection rule corresponding to the short-circuit condition is a short-circuit value; The first event is matched with each final state condition in the final state condition set. When a final state condition in the final state condition set is matched and hits the corresponding short-circuit value, the matching result corresponding to the matched final state condition is directly used as the judgment result corresponding to each detection rule associated with the matched final state condition. The judgment result is used to characterize whether there is an abnormal situation in the detection object determined based on the first event.

2. The method according to claim 1, characterized in that The method further comprises: Acquire historical events generated for the detection object, where the historical events are iteratively updated as the detection process progresses; Parsing the detection rule set corresponding to the detection object to obtain a short-circuit condition set, wherein the short-circuit condition set includes: at least one sub-condition that can independently and directly determine the final determination result of the detection rule; Matching the historical events with the short-circuit conditions in the short-circuit condition set corresponding to each detection rule, and counting the number of hits corresponding to the short-circuit conditions that match the hit short-circuit value; For each detection rule in the detection rule set, the short-circuit condition with the largest number of hits corresponding to the detection rule is selected as the final state condition, and the final state condition set including at least one final state condition is generated. The final state condition set is dynamically updated as historical events are iteratively updated.

3. The method according to claim 2, characterized in that The short-circuit condition set is obtained by parsing the detection rule set corresponding to the detection object, including: Decomposing the detection rules in the detection rule set into Boolean operation expressions between sub-conditions by using regular expressions, extracting the short-circuit conditions based on the Boolean operation expressions to generate the short-circuit condition set; or, The detection rule is decomposed and converted into a Boolean operation expression between sub-conditions by a short-circuit algorithm, and the short-circuit condition is extracted based on the Boolean operation expression to generate the short-circuit condition set.

4. The method according to claim 1, characterized in that: The method further comprises: When none of the final state conditions in the final state condition set is matched to hit the corresponding short-circuit value, other short-circuit conditions except the final state condition set in the short-circuit condition set corresponding to the detection rule set are used to detect the first event to obtain a corresponding determination result.

5. The method according to claim 4, characterized in that The method further comprises: In the process of detecting the first event based on the other short-circuit conditions, if the final state condition is encountered, the detection result of the final state condition for the first event is reused.

6. The method according to claim 1, characterized in that The obtaining of a first event generated for the detection object includes: Acquire a first system event generated for the target container, where the first system event includes any one or more of a file read / write event, a process execution event, and a network connection event; The acquiring of a final state condition set learned for the detection object includes: A final state condition set learned for the target container is obtained; the final state condition set includes: based on the hit count of each short-circuit condition in the short-circuit condition set by historical system events generated for the target container, at least one short-circuit condition with a higher hit count is selected from the short-circuit condition set; the short-circuit condition set includes: at least one sub-condition that is obtained by parsing the container intrusion detection rule set corresponding to the target container and can independently and directly determine the final determination result of the container intrusion detection rule; the container intrusion detection rule set includes multiple container intrusion detection rules, and the detection results corresponding to the container intrusion detection rules include risk or no risk; the container intrusion detection rules in the container intrusion detection rule set have the same detection sub-condition reuse.

7. The method according to claim 6, characterized in that The obtaining of a first system event generated for the target container includes: The original system event generated for the target container is collected as a first system event through a security probe, where the first system event includes any one of a file read and write event, a process execution event, and a network connection event. The first system event is used to detect whether there is a security risk in the target container based on a terminal state condition set corresponding to the target container.

8. A detection device, characterized in that: include: A first acquisition unit, used to acquire a first event generated for the detection object; The first event is used to detect whether there is a business abnormality in the detection object; The first event includes a system event collected by a security probe; A second acquisition unit is used to acquire a final state condition set learned for the detection object, wherein the final state condition set includes: based on the number of hits of each short-circuit condition in the short-circuit condition set hitting the corresponding short-circuit value of the historical events generated for the detection object, selecting at least one short-circuit condition with a higher hit count from the short-circuit condition set; the short-circuit condition set includes: at least one sub-condition that can independently and directly determine the final judgment result of the detection rule obtained by parsing the detection rule set corresponding to the detection object; wherein the short-circuit condition refers to a sub-condition in a Boolean operation expression that can directly determine the final judgment result of the expression, and the short-circuit value corresponding to the short-circuit condition hit indicates that the judgment result of the detection rule corresponding to the short-circuit condition is a short-circuit value; A first matching unit is used to match the first event with each final state condition in the final state condition set. When a final state condition in the final state condition set is matched and hits the corresponding short-circuit value, the matching result corresponding to the matched final state condition is directly used as the judgment result corresponding to each detection rule associated with the matched final state condition. The judgment result is used to characterize whether there is an abnormal situation in the detection object determined based on the first event.

9. An electronic device, characterized in that: The device comprises: a processor and a memory; The memory is used to store instructions or computer programs; The processor is used to execute the instructions or computer programs in the memory so that the electronic device executes the method according to any one of claims 1 to 7.

10. A computer-readable medium, characterized in that The computer-readable medium stores instructions or computer programs, and when the instructions or computer programs are executed on a device, the device is enabled to execute the method according to any one of claims 1 to 7.

Images