A detection method, apparatus and electronic device

Abstract

This disclosure presents a detection method, apparatus, and electronic device. It acquires threat logs collected when a target application is attacked, then generates feature vectors based on the threat logs and corresponding time information for each time window. These feature vectors are then input into a trained detection model, which combines them to output the attack behavior chain contained in the threat logs. Because it acquires threat logs and their corresponding time information, and generates attack behavior chains based on these information, this disclosure can predict attack behavior chains based on detected threat logs, thus achieving network threat prediction.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a detection method, apparatus and electronic device. Background Technology

[0002] In today's society, with the rapid development of the internet, cyber threats have become increasingly severe. Current technologies for addressing cyber threats typically detect individual threats. This method can only detect threats that are occurring or have already occurred; it cannot detect threats before they occur. Therefore, how to predict cyber threats is a pressing issue that needs to be addressed. Summary of the Invention

[0003] In view of this, the present disclosure provides a detection method, apparatus, and electronic device that can improve information security without affecting the user experience.

[0004] In a first aspect, embodiments of this disclosure provide a detection method, including:

[0005] Retrieve threat logs collected when a target application is under attack;

[0006] A feature vector is generated based on the threat logs corresponding to each time window and the time information corresponding to each time window.

[0007] The feature vectors are input into the trained detection model so that the detection model can combine them based on the feature vectors and output the attack behavior chain contained in the threat log.

[0008] According to a specific implementation of this disclosure, before generating the feature vector based on the threat log corresponding to each time window and the time information corresponding to each time window, the method further includes:

[0009] The collected threat logs are cleaned to filter logs generated by the target application and logs of the target application's behavior responses.

[0010] According to a specific implementation of this disclosure, a feature vector is generated based on the threat log corresponding to each time window and the time information corresponding to each time window, including:

[0011] Threat detection is performed based on the threat logs corresponding to each time window to obtain threat behavior data for each time window.

[0012] Feature vectors are generated based on the threat behavior data and time information corresponding to each time window.

[0013] According to a specific implementation of this disclosure, the detection model combines feature vectors to output an attack behavior chain contained in the threat log, including:

[0014] The detection model classifies multiple feature vectors to obtain feature vectors for multiple categories;

[0015] Within any category of feature vectors, the attack behavior chain is determined by the time sequence based on the time information contained in the feature vectors.

[0016] According to a specific implementation of an embodiment of this disclosure, the method further includes:

[0017] The probability of an attack behavior chain containing the feature vector is determined based on the feature vector and a pre-set database. The database stores the number of times the feature vector appears in a historical time period and the number of times an attack behavior chain containing the feature vector appears.

[0018] According to one specific implementation of the present disclosure, the detection model is obtained based on vectorized rules training;

[0019] Vectorized rules are determined by vectorizing multiple threat rules corresponding to each target application.

[0020] Secondly, embodiments of this disclosure provide a detection device, comprising:

[0021] The acquisition module is used to acquire threat logs to be detected.

[0022] The generation module is used to generate feature vectors based on threat information in threat logs and the corresponding time data of the threat information.

[0023] The detection module is used to input feature vectors into the trained detection model to obtain the category information of the detected threat logs.

[0024] According to a specific implementation of an embodiment of this disclosure, the apparatus further includes:

[0025] The cleaning module cleans the collected threat logs before generating feature vectors based on the threat logs corresponding to each time window and the time information corresponding to each time window. It filters the logs generated by the target application and the response logs of the target application's behavior.

[0026] According to a specific implementation of an embodiment of this disclosure, the generation module further includes:

[0027] The detection unit is used to perform threat detection based on the threat logs corresponding to each time window, and obtain threat behavior data corresponding to each time window.

[0028] The generation unit is used to generate feature vectors based on the threat behavior data and time information corresponding to each time window.

[0029] According to a specific implementation of an embodiment of this disclosure, the detection module includes:

[0030] The classification unit is used to detect the model to classify multiple feature vectors and obtain feature vectors of multiple categories.

[0031] The determination unit is used to determine the attack behavior chain from the feature vectors of any category based on the time information contained in the feature vectors according to the time sequence.

[0032] According to a specific implementation of an embodiment of this disclosure, the apparatus further includes:

[0033] The determination module is used to determine the probability of an attack behavior chain containing the feature vector based on the feature vector and a preset database. The database stores the number of times the feature vector appears in a historical time period and the number of times an attack behavior chain containing the feature vector appears.

[0034] According to one specific implementation of the present disclosure, the detection model is obtained based on vectorized rules training;

[0035] Vectorized rules are determined by vectorizing multiple threat rules corresponding to each target application.

[0036] Thirdly, embodiments of this disclosure provide an electronic device, which includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the method of any of the aforementioned implementation methods.

[0037] Fourthly, embodiments of this disclosure also provide an application program that is executed to implement the methods of any embodiment of this disclosure.

[0038] This disclosure provides a detection method, apparatus, device, and storage medium that acquires threat logs collected when a target application is attacked. Then, based on the threat logs corresponding to each time window and the corresponding time information, a feature vector is generated. This feature vector is then input into a trained detection model, which combines the feature vectors to output the attack behavior chain contained in the threat logs. Because it acquires threat logs and their corresponding time information, and generates the attack behavior chain based on these, it can predict the attack behavior chain based on the detected threat logs, thus achieving the prediction of network threats. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a schematic flowchart of the detection method according to Embodiment 1 of this disclosure;

[0041] Figure 2 This is a schematic flowchart of the detection method according to Embodiment 2 of this disclosure;

[0042] Figure 3 This is a schematic flowchart of the detection method according to Embodiment 3 of this disclosure;

[0043] Figure 4 This is a schematic flowchart of the detection method according to Embodiment 4 of this disclosure;

[0044] Figure 5 This is a schematic flowchart of the detection method according to Embodiment 5 of this disclosure;

[0045] Figure 6 This is a schematic flowchart of the detection device according to Embodiment 1 of this disclosure;

[0046] Figure 7 This is a schematic diagram of the structure of one embodiment of the electronic device disclosed herein. Detailed Implementation

[0047] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings. It should be understood that the described embodiments are merely some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0048] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0049] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0050] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0051] To address the aforementioned problems, this embodiment provides a detection method, apparatus, device, and storage medium.

[0052] Figure 1 This is a schematic flowchart of the detection method according to Embodiment 1 of this disclosure.

[0053] like Figure 1 As shown, the method in this embodiment may include:

[0054] S101, Obtain threat logs collected when the target application is attacked.

[0055] In some embodiments, the target application includes an application set on the terminal device.

[0056] Terminal devices can be various electronic devices, including but not limited to smartphones, tablets, laptops, desktop computers, wearable devices, augmented reality devices, virtual reality devices, etc.

[0057] In some embodiments, the target application may also be set up on a server.

[0058] Optionally, the server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. The terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc., but is not limited to these.

[0059] In some embodiments, the target application may include multiple applications. When an attack is detected on the terminal device or server configuring the application, threat logs of the application at the time of the attack can be obtained.

[0060] In some embodiments, obtaining threat logs may include methods for obtaining threat logs using a variety of related technologies, which will not be elaborated here.

[0061] S102, generate feature vectors based on the threat logs corresponding to each time window and the time information corresponding to each time window.

[0062] In some embodiments, after obtaining the threat log, the time information corresponding to the threat log can be obtained, and the time information can be determined as the time window corresponding to the threat log.

[0063] In some embodiments, the threat log may include time information, in which case the time information contained in the threat log can be directly determined as the time window corresponding to the threat log.

[0064] In some embodiments, the threat logs and their corresponding time information can be vectorized to obtain the feature vector corresponding to each threat log.

[0065] S103, input the feature vector into the trained detection model so that the detection model can combine the feature vectors and output the attack behavior chain contained in the threat log.

[0066] In some embodiments, before inputting the feature vectors into the trained detection model, the KNN model can be trained first to obtain the trained detection model.

[0067] In some embodiments, the KNN model described above can be trained based on training samples, and a trained detection model can be obtained after the training stopping condition is met.

[0068] In some embodiments, the training stopping condition includes the number of training iterations meeting a preset number or the loss function value corresponding to the model reaching a preset threshold.

[0069] In some embodiments, training samples can be constructed based on historical feature vectors and historical attack behavior chains.

[0070] In one embodiment, the detection model is trained based on vectorized rules;

[0071] Vectorized rules are determined by vectorizing multiple threat rules corresponding to each target application.

[0072] The detection method provided in this disclosure acquires threat logs collected when a target application is attacked. Then, it generates feature vectors based on the threat logs and time information corresponding to each time window. These feature vectors are then input into a trained detection model, which combines them to output the attack behavior chain contained in the threat logs. Because it acquires threat logs and their corresponding time information, and generates attack behavior chains based on these information, it can predict attack behavior chains based on the detected threat logs, thus achieving the prediction of network threats.

[0073] Figure 2 This is a schematic flowchart of the detection method according to Embodiment 2 of this disclosure.

[0074] like Figure 2 As shown, the detection method may include:

[0075] S201, Obtain threat logs collected when the target application is under attack;

[0076] S202, perform data cleaning on the collected threat logs, filtering logs generated by the target application and the target application's behavioral response logs.

[0077] In some embodiments, the threat logs can be cleaned based on cleaning rules in related technologies to obtain cleaned threat logs.

[0078] In some embodiments, the cleaned threat logs can also be categorized based on attacker IP, time, access route, etc. in the threat logs.

[0079] In some embodiments, threat rules can be categorized into different types based on different program dimensions and the correlation between threat rules, and then the threat rules can be matched with applications.

[0080] S203 generates feature vectors based on the threat logs corresponding to each time window and the time information corresponding to each time window.

[0081] S204. Input the feature vectors into the trained detection model so that the detection model can combine the feature vectors and output the attack behavior chain contained in the threat log.

[0082] The detection method provided in this disclosure acquires threat logs collected when a target application is attacked. Then, based on the threat logs corresponding to each time window, the threat logs are cleaned to remove logs generated by the target application and logs of the target application's behavior responses. Then, feature vectors are generated based on the cleaned threat logs, and then attack behavior chains are generated based on the feature vectors. Since the threat logs are cleaned, and feature vectors are generated based on the cleaned threat logs after cleaning, the generated feature vectors do not contain the interference of logs generated by the target application's behavior responses and logs of the target application. Furthermore, the attack behavior chains generated based on the feature vectors are more accurate.

[0083] Figure 3 This is a schematic flowchart of the detection method according to Embodiment 3 of this disclosure.

[0084] like Figure 3 As shown, the detection method may include:

[0085] S301, Obtain threat logs collected when the target application is under attack;

[0086] S302 performs threat detection based on the threat logs corresponding to each time window, and obtains threat behavior data corresponding to each time window.

[0087] In some embodiments, threat detection of threat logs may include detecting threat logs based on threat rules in related technologies to obtain threat behavior data.

[0088] S303 generates feature vectors based on the threat behavior data and time information corresponding to each time window.

[0089] In some embodiments, after obtaining threat behavior data, feature vectors can be generated based on the threat behavior data and the time information corresponding to the occurrence of the threat behavior data.

[0090] S304. Input the feature vectors into the trained detection model so that the detection model can combine the feature vectors and output the attack behavior chain contained in the threat log.

[0091] The detection method provided in this disclosure acquires threat logs collected when a target application is attacked, then detects the threat logs to obtain threat behavior data. Based on the threat behavior data and time information corresponding to each time window, a feature vector is generated. This feature vector is then input into a trained detection model, which combines the feature vectors to output the attack behavior chain contained in the threat log. Because it acquires threat logs and their corresponding time information, and generates the attack behavior chain based on these, it can predict the attack behavior chain based on the detected threat logs, thus achieving the prediction of network threats.

[0092] Figure 4 This is a schematic flowchart of the detection method according to Embodiment 4 of this disclosure.

[0093] like Figure 4 As shown, the detection method may include:

[0094] S401, Obtain threat logs collected when the target application is under attack;

[0095] S402, generate feature vectors based on the threat logs corresponding to each time window and the time information corresponding to each time window;

[0096] S403, the detection model classifies multiple feature vectors to obtain feature vectors of multiple categories.

[0097] In one embodiment, after obtaining the feature vectors, the feature vectors can be classified based on a detection model. Each category can contain multiple feature vectors.

[0098] S404: Within any category of feature vectors, the feature vectors are determined as attack behavior chains based on the time information contained in the feature vectors according to the time sequence.

[0099] In one embodiment, multiple feature vectors of the same category can be grouped into one or more attack behavior chains based on the time corresponding to the feature vectors.

[0100] For example, b, c, and d are multiple feature vectors belonging to the same category. Sorting b, c, and d chronologically, we get b, c, d. The resulting attack behavior chain can then be bc, bd, cd, and bcd.

[0101] The detection method provided in this disclosure acquires threat logs collected when a target application is attacked, then detects the threat logs to obtain threat behavior data. Based on the threat behavior data corresponding to each time window and the time information corresponding to each time window, feature vectors are generated. These feature vectors are then classified. Among multiple feature vectors of the same category, one or more attack behavior chains can be formed based on the time information contained in the feature vectors. Forming one or more attack behavior chains based on time information can generate a large number of attack behavior chains, avoiding the problem of undetected attack behavior chains.

[0102] Figure 5 This is a schematic flowchart of the detection method according to Embodiment 5 of this disclosure.

[0103] like Figure 5 As shown, the detection method may include:

[0104] S501, acquire threat logs collected when the target application is under attack;

[0105] S502 generates feature vectors based on the threat logs corresponding to each time window and the time information corresponding to each time window;

[0106] S503, input the feature vector into the trained detection model so that the detection model can combine based on the feature vector and output the attack behavior chain contained in the threat log;

[0107] S504, based on the feature vector and a preset database, determine the probability of an attack behavior chain containing the feature vector appearing. The database stores the number of times the feature vector appears in a historical time period and the number of times an attack behavior chain containing the feature vector appears.

[0108] In some embodiments, when an attack behavior chain is detected, the attack behavior chain and the number of times the attack behavior chain occurs can be stored in a database.

[0109] In some embodiments, the database may also record feature vectors and attack behavior chains containing the aforementioned feature vectors.

[0110] In some embodiments, after determining the feature vector, the probability of each of the multiple attack behavior chains appearing after the feature vector appears can be determined based on the ratio of the number of times the determined feature vector has appeared in history to the number of times multiple attack behavior chains containing the feature vector appearing in the database.

[0111] The detection method provided in this embodiment acquires threat logs collected when a target application is attacked. Then, it generates feature vectors based on the threat logs and time information corresponding to each time window. These feature vectors are then input into a trained detection model, which combines them to output the attack behavior chains contained in the threat logs. Because it acquires threat logs and their corresponding time information, generates attack behavior chains based on these logs, and determines the probability of each attack behavior chain based on historically occurring feature vectors and the frequency of occurrences of attack behavior chains containing these feature vectors, it predicts the probability of each type of attack behavior chain, thus making the prediction of multiple attack behavior chains more accurate.

[0112] Figure 6 This is a schematic diagram of the detection device according to Embodiment Six of this disclosure.

[0113] like Figure 6 As shown, the detection device may include:

[0114] The acquisition module 610 is used to acquire threat logs to be detected;

[0115] The generation module 620 is used to generate feature vectors based on threat information in the threat log and the time data corresponding to the threat information.

[0116] The detection module 630 is used to input the feature vector into the trained detection model to obtain the category information of the detected threat logs.

[0117] This disclosure provides a detection method and apparatus that acquires threat logs collected when a target application is attacked. Then, based on the threat logs corresponding to each time window and the corresponding time information, a feature vector is generated. This feature vector is then input into a trained detection model, which combines the feature vectors to output the attack behavior chain contained in the threat logs. Because it acquires threat logs and their corresponding time information, and generates the attack behavior chain based on these information, it can predict the attack behavior chain based on the detected threat logs, thus achieving the prediction of network threats.

[0118] According to a specific implementation of an embodiment of this disclosure, the apparatus further includes:

[0119] The cleaning module cleans the collected threat logs before generating feature vectors based on the threat logs corresponding to each time window and the time information corresponding to each time window. It filters the logs generated by the target application and the response logs of the target application's behavior.

[0120] The detection device provided in this embodiment acquires threat logs collected when a target application is attacked. Then, based on the threat logs corresponding to each time window, the threat logs are cleaned to remove logs generated by the target application and logs of the target application's behavior responses. Then, feature vectors are generated based on the cleaned threat logs, and then attack behavior chains are generated based on the feature vectors. Since the threat logs are cleaned, and feature vectors are generated based on the cleaned threat logs after cleaning, the generated feature vectors do not contain the interference of logs generated by the target application's behavior responses and logs of the target application. Furthermore, the attack behavior chains generated based on the feature vectors are more accurate.

[0121] According to a specific implementation of an embodiment of this disclosure, the generation module further includes:

[0122] The detection unit is used to perform threat detection based on the threat logs corresponding to each time window, and obtain threat behavior data corresponding to each time window.

[0123] The generation unit is used to generate feature vectors based on the threat behavior data and time information corresponding to each time window.

[0124] The detection device provided in this disclosure acquires threat logs collected when a target application is attacked, then detects the threat logs to obtain threat behavior data. Based on the threat behavior data corresponding to each time window and the corresponding time information, it generates feature vectors. These feature vectors are then input into a trained detection model, which combines the feature vectors to output the attack behavior chain contained in the threat logs. Because it acquires threat logs and their corresponding time information, and generates attack behavior chains based on these information, it can predict attack behavior chains based on the detected threat logs, thus achieving the prediction of network threats.

[0125] According to a specific implementation of an embodiment of this disclosure, the detection module includes:

[0126] The classification unit is used to detect the model to classify multiple feature vectors and obtain feature vectors of multiple categories.

[0127] The determination unit is used to determine the attack behavior chain from the feature vectors of any category based on the time information contained in the feature vectors according to the time sequence.

[0128] The detection device provided in this embodiment acquires threat logs collected when a target application is attacked, then detects the threat logs to obtain threat behavior data. Based on the threat behavior data corresponding to each time window and the time information corresponding to each time window, feature vectors are generated. These feature vectors are then classified. Among multiple feature vectors of the same category, one or more attack behavior chains can be formed based on the time information contained in the feature vectors. Forming one or more attack behavior chains based on time information can generate a large number of attack behavior chains, avoiding the problem of undetected attack behavior chains.

[0129] According to a specific implementation of an embodiment of this disclosure, the apparatus further includes:

[0130] The determination module is used to determine the probability of an attack behavior chain containing the feature vector based on the feature vector and a preset database. The database stores the number of times the feature vector appears in a historical time period and the number of times an attack behavior chain containing the feature vector appears.

[0131] According to one specific implementation of the present disclosure, the detection model is obtained based on vectorized rules training;

[0132] Vectorization rules are determined by vectorizing multiple threat rules corresponding to each target application.

[0133] The detection apparatus and method provided in this disclosure acquire threat logs collected when a target application is attacked. Then, based on the threat logs corresponding to each time window and the time information corresponding to each time window, a feature vector is generated. This feature vector is then input into a trained detection model, allowing the model to combine the feature vectors and output the attack behavior chain contained in the threat logs. Since the method acquires threat logs and their corresponding time information, generates attack behavior chains based on these logs and time information, and determines the probability of each attack behavior chain based on historically occurring feature vectors and the frequency of occurrences of attack behavior chains containing these feature vectors, the prediction of the probability of each attack behavior chain is more accurate.

[0134] Figure 7 This is a schematic diagram of the structure of an embodiment of the electronic device disclosed herein, which can realize the present disclosure. Figure 1-5 The process of the illustrated embodiment is as follows: Figure 7As shown, the above-mentioned electronic device may include: a housing 71, a processor 72, a memory 73, a circuit board 74, and a power supply circuit 75, wherein the circuit board 74 is disposed inside the space enclosed by the housing 71, and the processor 72 and the memory 73 are disposed on the circuit board 74; the power supply circuit 75 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 73 is used to store executable program code; the processor 72 runs a program corresponding to the executable program code by reading the executable program code stored in the memory 73, for executing the detection method of any of the foregoing embodiments.

[0135] For details on the specific execution process of the above steps by processor 72, and the steps further executed by processor 72 through running executable program code, please refer to this disclosure. Figure 1-5 The description of the illustrated embodiments will not be repeated here.

[0136] This electronic device exists in various forms, including but not limited to:

[0137] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily aim to provide voice and data communication. These terminals include: smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones, etc.

[0138] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, possessing computing and processing capabilities, and generally also have mobile internet access features. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0139] (3) Portable entertainment devices: These devices can display and play multimedia content. This category includes: audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0140] (7) Server: A device that provides computing services. The components of a server include a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0141] (5) Other electronic devices with data interaction functions.

[0142] Fifthly, embodiments of this disclosure also provide an application that is executed to implement the methods provided in any embodiment of this disclosure.

[0143] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0144] The various embodiments in this specification are described in a related manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0145] In particular, the device embodiment is basically similar to the method embodiment, so the description is relatively simple. For relevant details, please refer to the description of the method embodiment.

[0146] For ease of description, the above apparatus is described by dividing it into various functional units / modules. Of course, in implementing this disclosure, the functions of each unit / module can be implemented in one or more software and / or hardware.

[0147] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0148] The above are merely specific embodiments of this disclosure, but the scope of protection of this disclosure is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this disclosure should be included within the scope of protection of this disclosure. Therefore, the scope of protection of this disclosure should be determined by the scope of the claims.

Claims

1. A method of detection, characterized in that, The method comprises the following steps: obtaining threat logs collected when a target application is attacked; obtaining time information corresponding to the threat logs, and determining the time information corresponding to the threat logs or time information contained in the threat logs as a time window corresponding to the threat logs; performing data cleaning on the collected threat logs, and filtering logs generated by the target application and target application behavior recovery logs; generating a feature sub-vector based on the threat logs corresponding to each time window and the time information corresponding to each time window; constructing a training sample based on a historical feature sub-vector and a historical attack behavior chain; training a KNN model based on the training sample to obtain a trained detection model; inputting the feature sub-vector into the trained detection model to enable the detection model to combine based on the feature sub-vector and output an attack behavior chain contained in the threat logs; the detection model combines based on the feature sub-vector to output the attack behavior chain contained in the threat logs, which comprises: the detection model classifies a plurality of feature sub-vectors to obtain a plurality of categories of feature sub-vectors; arranging and combining a plurality of feature sub-vectors in the same category of feature sub-vectors in chronological order to obtain a plurality of attack behavior chains.

2. The detection method according to claim 1, characterized in that, The method comprises the following steps: performing threat detection based on the threat logs corresponding to each time window to obtain threat behavior data corresponding to each time window; generating a feature sub-vector based on the threat behavior data corresponding to each time window and the time information corresponding to each time window.

3. The method of claim 1, wherein The detection model combines based on the feature sub-vector to output the attack behavior chain contained in the threat logs, which further comprises: determining the feature sub-vector as an attack behavior chain based on the time information contained in the feature sub-vector in any category of feature sub-vectors in chronological order.

4. The method of claim 1, wherein The method further comprises the following steps: determining the probability of occurrence of an attack behavior chain containing the feature sub-vector based on the feature sub-vector and a preset database, wherein the database stores the number of occurrences of the feature sub-vector and the number of occurrences of an attack behavior chain containing the feature sub-vector in a historical time period.

5. The method of claim 1, wherein, The detection model is trained based on a vectorization rule; The vectorization rule is determined based on a plurality of threat rule vectors corresponding to each target application.

6. A detection device, characterized in that The method comprises the following steps: an acquisition module configured to acquire threat logs to be detected; a generation module configured to generate a feature vector based on threat information in the threat logs and time data corresponding to the threat information; a detection module configured to input the feature vector into a trained detection model to obtain category information of the detected threat logs; a cleaning module configured to perform data cleaning on the collected threat logs before generating a feature sub-vector based on the threat logs corresponding to each time window and the time information corresponding to each time window, and filter logs generated by the target application and target application behavior recovery logs. The detection module comprises: a classification unit configured to detect classification of a plurality of feature vectors by a model to obtain a plurality of categories of feature vectors; A determination unit is configured to determine, in any category of feature vectors, the feature vectors as attack behavior chains in a time sequence based on time information contained in the feature vectors.

7. The detection device of claim 6, wherein, The device further comprises: A division module is configured to divide the threat information into a training set and a validation set; the training set is used to determine an optimal K parameter of the KNN model, and the validation set is used to judge the model accuracy; A determination module is configured to determine an optimal K value by using a cross-validation method with the highest accuracy as a target, and obtain a trained KNN algorithm model by determining a key parameter K value in the KNN model.

8. An electronic device, comprising: The electronic device comprises a shell, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is arranged inside a space surrounded by the shell, the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to each circuit or device of the electronic device; the memory is used to store executable program codes; the processor runs programs corresponding to the executable program codes by reading the executable program codes stored in the memory, and is used to execute the method in any one of the preceding claims 1 to 5.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores one or more programs, which can be executed by one or more processors to implement the method in any one of the preceding claims 1 to 5.

Images